libwebp: use of uninitialized value in ReadSymbol()

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

libwebp: out-of-bounds read in ShiftBytes()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

libwebp: out-of-bounds read in WebPMuxCreateInternal()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

libwebp: heap-based buffer overflow in PutLE16()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().

libwebp: out-of-bounds read in ApplyFilter()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

libwebp: out-of-bounds read in WebPMuxCreateInternal

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

rust: weak synchronization in the Arc::get_mut method

In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

Invariant failure when explaining a find with a UUID

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy.

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.

nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.

An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.