A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.
A flaw was found in grub2 in versions prior to 2.06. Setparamprefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face source, related to "type confusion."
A flaw was found in Intel graphics hardware (GPU) where a local attacker with the ability to issue commands to the GPU which could inadvertently lead to memory corruption and possibly privilege escalation.
The attacker could use the GPU blitter to perform privilege MMIO operations not limited to the address space required to function correctly. This would expose the blitter to access kernel memory with a specially crafted request to the blitter.
Affected hardware:
- Ivy Bridge(Gen 7) and later, - Cherry Trail (Gen8) and newer mobile, desktop and embedded processors. - Intel Xeon E3-1200 v4 and later product families.
A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
A use after free issue was found in the way Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice(), device holds a reference to a VM object, latter this reference is transferred to caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to use-after-free issue latter.
A user/process could use this flaw to crash the guest VM resulting in DoS issue OR potentially gain privileged access to a system.
Upstream patch: --------------- -> https://git.kernel.org/linus/cfa39381173d5f969daf43582c95ad679189cbc9
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
A use after free issue was found in the way Linux kernel's KVM hypervisor emulates a preemption timer for L2 guest when nested(=1) virtualization is enabled. This high resolution timer(hrtimer) runs when L2 guest is active. After VM exit, in syncvmcs12() timer object is stopped. The use-after-free occurs if the timer object is free'd before calling syncvmcs12() routine.
A guest user/process could use this flaw to crash the host kernel resulting in DoS OR potentially gain privileged access to a system.
It affects only Intel processors and only when nested virtualization is enabled.
Upstream patch: --------------- -> https://git.kernel.org/linus/ecec76885bcfe3294685dc363fd1273df0d5d65f
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a potentially exploitable crash.
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
A possible memory corruption due to a type confusion was found in the Linux kernel in the skclonelock() function in the net/core/sock.c. A possibility of local escalation of privileges cannot be fully ruled out for a local unprivileged attacker.
References:
https://source.android.com/security/bulletin/2018-12-01.html#kernel-components
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d538fa60bad4f7b23193c89e843797a1cf71ef3
A vulnerability was found in Artifex Ghostscript before 9.26. The restorepagedevice function in psi/zdevice2.c allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
References: https://bugs.ghostscript.com/showbug.cgi?id=700153 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patch: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3005fcb9bb160af199e761e03bc70a9f249a987e
A vulnerability was found in Artifex Ghostscript before 9.26. A type confusion in setcolorspace in psi/zicc.c allows remote attackers to bypass intended access restrictions.
References: https://bugs.ghostscript.com/showbug.cgi?id=700169 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=67d760ab775dae4efe803b5944b0439aa3c0b04a http://git.ghostscript.com/?p=ghostpdl.git;h=548bb434e81dadcc9f71adf891a3ef5bea8e2b4e
A vulnerability was found in Artifex Ghostscript before 9.26. A JBIG2Decode type confusion in psi/zfjbig2.c allows remote attackers to bypass intended access restrictions.
References: https://bugs.ghostscript.com/showbug.cgi?id=700168 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ef252e7dc214bcbd9a2539216aab9202848602bb http://git.ghostscript.com/?p=ghostpdl.git;h=606a22e77e7f081781e99e44644cd0119f559e03
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened.
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write.
Note: 64-bit builds are not vulnerable to this issue.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12393
By rewriting the Host request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12395
Last updated 25 August 2025
A security flaw was found in the Linux kernel in the adjustscalarminmaxvals() function in kernel/bpf/verifier.c. A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because this function mishandles 32-bit right shifts. A local unprivileged user cannot leverage this flaw, but as a privileged user ("root") this can lead to a system panic and a denial of service or other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1686
https://seclists.org/oss-sec/2018/q4/69
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b799207e1e1816b09e7a5920fbb2d5fcf6edd681
A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash.
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
It was discovered that the JNDI comment of OpenJDK did not properly enforce the restriction controlled by the com.sun.jndi.ldap.object.trustURLCodebase system property. In certain cases, a Java LDAP client could unexpectedly load and execute code form an LDAP server.
It was discovered that the Hotspot component of OpenJDK did not perform access checks correctly in certain cases when performing field link resolution. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.
Last updated 25 August 2025
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered.
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-23/#CVE-2018-12385