It was discovered that the JNDI comment of OpenJDK did not properly enforce the restriction controlled by the com.sun.jndi.ldap.object.trustURLCodebase system property. In certain cases, a Java LDAP client could unexpectedly load and execute code form an LDAP server.

A flaw was found in Intel graphics hardware (GPU) where a local attacker with the ability to issue commands to the GPU which could inadvertently lead to memory corruption and possibly privilege escalation.

The attacker could use the GPU blitter to perform privilege MMIO operations not limited to the address space required to function correctly. This would expose the blitter to access kernel memory with a specially crafted request to the blitter.

Affected hardware:

- Ivy Bridge(Gen 7) and later, - Cherry Trail (Gen8) and newer mobile, desktop and embedded processors. - Intel Xeon E3-1200 v4 and later product families.

ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.

References:

http://mailman.alsa-project.org/pipermail/alsa-devel/2018-February/132026.html

https://marc.info/?l=alsa-devel&m=151859118611846&w=2

An upstream fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d15d662e89fc667b90cd294b0eb45694e33144da

Last updated 25 August 2025

A flaw was found in dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted. D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

References: https://github.com/flatpak/flatpak/releases/tag/0.8.9 https://github.com/flatpak/flatpak/releases/tag/0.10.3

Patch: https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6

A flaw was found in Qemu. A lack of restriction for the amount of data read by QEMU Monitor socket can lead to denial of service by exhaustion of memory resources.

References:

https://www.redhat.com/archives/libvir-list/2017-December/msg00749.html

A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcpcollapseofoqueue() and tcppruneofoqueue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses.

A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithms by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system.

External References:

https://access.redhat.com/articles/3553061

https://www.kb.cert.org/vuls/id/641765

A fix is a merge commit in the Linux kernel tree:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f

consisting of the following commits:

7969e5c40dfd04799d4341f1b7cd266b6e47f227 385114dec8a49b5e5945e77ba7de6356106713f4 fa0f527358bd900ef92f925878ed6bfbd51305cc

A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed.

An unprivileged KVM guest user could use this flaw to crash the guest and/or potentially escalate their privileges in the guest.

Upstream patch: --------------- -> https://git.kernel.org/linus/32d43cd391bacb5f0814c2624399a5dad3501d09

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2018/05/08/5

A flaw was found in the Linux kernels with commit b6a2fea39318 ("mm: variable length argument support", from July 19, 2007) but without commit da029c11e6b1 ("exec:Limit arg stack to at most 75% of STKLIM", from July 7, 2017). An integer overflow in the Linux kernel's createelftables() function. A local attacker can exploit this vulnerability via a SUID-root binary and obtain full root privileges.

Referenced commits: b6a2fea39318 ("mm: variable length argument support", from July 19, 2007) https://github.com/torvalds/linux/commit/b6a2fea39318e43fee84fa7b0b90d68bed92d2ba

da029c11e6b1 ("exec: Limit arg stack to at most 75% of STKLIM", from July 7, 2017) https://github.com/torvalds/linux/commit/da029c11e6b12f321f36dac8771e833b65cec962

Additional references: https://www.qualys.com/2018/09/25/cve-2018-14634/mutagen-astronomy-integer-overflow-linux-createelftables-cve-2018-14634.txt

GnuPG before version 2.2.8 does not properly sanitize original filenames of signed or encrypted messages allowing for the insertion of line feeds and other control characters. An attacker could exploit this by injecting such characters to craft status messages and fake the validity of signatures.

External Reference:

https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html

Upstream Issue:

https://dev.gnupg.org/T4012

Upstream Patches:

https://dev.gnupg.org/rG2326851c60793653069494379b16d84e4c10a0ac https://dev.gnupg.org/rG210e402acd3e284b32db1901e43bf1470e659e49 https://dev.gnupg.org/rG13f135c7a252cc46cff96e75968d92b6dc8dce1b

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIGHAVEHWBREAKPOINT) support. While modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.

GNU patch does not properly sanitize patch files allowing for malicious patches to pass arbitrary shell commands to ed. An attacker could exploit this by tricking a user into applying malicious patches with the patch command.

A use-after-free flaw was found in the MySQL client library (libmysqlclient.so). A malicious MySQL server could cause an application using the MySQL client library to crash.

Upstream bugs:

https://bugs.mysql.com/bug.php?id=70429 https://bugs.mysql.com/bug.php?id=63363

Upstream patch:

https://github.com/mysql/mysql-server/commit/4797ea0b772d5f4c5889bc552424132806f46e93

A flaw was found in kernel versions before 4.14.8. The timercreate syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigevnotify field, which leads to out-of-bounds access in the showtimer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIGPOSIXTIMERS and CONFIGCHECKPOINTRESTORE).

References:

http://seclists.org/oss-sec/2018/q3/76

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cef31d9af908243421258f1df35a4a644604efbe

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.

Last updated 25 August 2025

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

An out-of-bounds read in cmstypes.c in TypeMLURead function was found, leading to heap memory leak triggered by crafted ICC profile.

Upstream patch:

https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2

CVE request:

http://seclists.org/oss-sec/2016/q3/288

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products.

A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlNextChar.

References:

https://bugzilla.gnome.org/showbug.cgi?id=759671

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=a7a94612aa3b16779e2c74e1fa353b5d9786c602

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened.

Last updated 25 August 2025

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process.

An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter.

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system.