A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
ABRT might allow attackers to obtain sensitive information from crash reports.
A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader.
Last updated 25 August 2025
A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution.
A flaw was found in Apache Thrift versions 0.9.3 to 0.12.0. A server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
References:
https://seclists.org/oss-sec/2019/q4/29
A flaw was found in Apache Thrift up to and including 0.12.0. A server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed by THRIFT-4024 in version 0.11.0, depending on the installed version it affects only certain language bindings.
References:
https://seclists.org/oss-sec/2019/q4/28
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
Last updated 11 July 2025
A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server.
Only 1.0.1 releases of OpenSSL are affected including 1.0.1f (and 1.0.2 betas)
The following upstream commit introduced TLS/DTLS heatbeat support and also this issue:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504
A deserialization flaw was discovered in the jackson-databind that could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaws CVE-2017-7525 and CVE-2017-17485 by blacklisting more classes that could be used maliciously.
Withdrawn Advisory This advisory has been withdrawn because the vulnerability only affects the Qpid Proton C library and not org.apache.qpid:proton-j. This link has been maintained to preserve external references.
Original Description
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
It was discovered that the JNDI comment of OpenJDK did not properly enforce the restriction controlled by the com.sun.jndi.ldap.object.trustURLCodebase system property. In certain cases, a Java LDAP client could unexpectedly load and execute code form an LDAP server.
It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in sndrawmidiinputparams() and sndrawmidioutputstatus() which are part of sndrawmidiioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.
Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
An inappropriate implementation flaw was found in the JavaScript component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1029576
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient data validation flaw was found in the streams component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1031895
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An use after free flaw was found in the audio component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1042254
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An inappropriate implementation flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1024256
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the downloads component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1029375
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An uninitialized use flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1032090
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An use after free flaw was found in the speech component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1043603
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html
An insufficient policy enforcement flaw was found in the storage component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1035399
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An out of bounds memory access flaw was found in the streams component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1045874
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1051017
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html
An use after free flaw was found in the WebAudio component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1048473
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html
A type confusion flaw was found in the JavaScript component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1031909
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An integer overflow flaw was found in the JavaScript component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1034394
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html