python-sqlalchemy: SQL Injection when the group_by parameter can be controlled

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

dovecot: Buffer overflow in indexer-worker process results in privilege escalation

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.

KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.

ImageMagick: Memory leak in the WriteDIBImage function in coders/dib.c

In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.

ImageMagick: Memory leak in the WritePDFImage function in coders/pdf.c

In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.

ImageMagick: Memory leak in the ReadSIXELImage function in coders/sixel.c

In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.

ImageMagick: Memory leak in the WritePSDChannel function in coders/psd.c

In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.

kernel: eBPF: Spectre v1 mitigation bypass

kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.

Kernel: KVM: leak of uninitialized stack contents to guest

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer

The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.

imagemagick: memory leak in function DecodeImage in coders/pcd.c

In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.

python-sqlalchemy: SQL Injection when the order_by parameter can be controlled

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

QEMU: slirp: heap buffer overflow in tcp_emu()

In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

python-gnupg: improper input validation in gnupg.GPG.encrypt() and gnupg.GPG.decrypt()

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

golang: crypto/elliptic implementations of P-521 and P-384 elliptic curves allow for denial of service

Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems.

webkitgtk: processing maliciously crafted web content lead to URI spoofing

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge.

libtiff: memory leak in TIFFFdOpen function in tif_unix.c when using pal2rgb

The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.