oss-security mailing list
Recent messages:
- 2026/01/16 #1:
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2026/01/15 #7:
Re: Fwd: [FD] zlib v1.3.1.2 Global Buffer Overflow in
TGZfname() of zlib untgz Utility via Unbounded strcpy() on User-S… (Alan Coopersmith <alan.coopersmith@...c…)
- 2026/01/15 #6:
CVE-2025-68675: Apache Airflow: proxy credentials for various
providers might leak in task logs (Ephraim Anierobi <ephraimanierobi@...che.org>)
- 2026/01/15 #5:
CVE-2025-68438: Apache Airflow: Secrets in rendered templates
could contain parts of sensitive values when truncated (Ephraim Anierobi <ephraimanierobi@...che…)
- 2026/01/15 #4:
Re: Go 1.25.6 and Go 1.24.12 are released
with 6 CVE fixes (Steffen Nurpmeso <steffen@...oden.eu>)
- 2026/01/15 #3:
Go 1.25.6 and Go 1.24.12 are released with 6 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/15 #2:
Re: The Curious Case of Stack Pivot Detection (Adam Zabrocki <pi3@....com.pl>)
- 2026/01/15 #1:
[CVE-2026-22797] OpenStack keystonemiddleware: Privilege Escalation
via Identity Headers in External OAuth2 Tokens (CVE-2026… (Jeremy Stanley <fungi@...goth.org>)
- 2026/01/14 #3:
Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
- 2026/01/14 #2:
Re: NodeJS Security Releases (CVE-2025-55131,
CVE-2025-55130, CVE-2025-59465, and others) (Jan Schaumann <jschauma@...meister.org>)
- 2026/01/14 #1:
Re: NodeJS Security Releases (CVE-2025-55131,
CVE-2025-55130, CVE-2025-59465, and others) (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/13 #5:
CVE-2025-66169: Apache Camel: Cypher injection vulnerability in
Camel-Neo4j component (Andrea Cosentino <acosentino@...che.org>)
- 2026/01/13 #4:
Re: Null Pointer Dereference in HarfBuzz (Vincent Lefevre <vincent@...c17.net>)
- 2026/01/13 #3:
Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
- 2026/01/13 #2:
NodeJS Security Releases (CVE-2025-55131, CVE-2025-55130,
CVE-2025-59465, and others) (Jan Schaumann <jschauma@...meister.org>)
- 2026/01/13 #1:
Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
- 2026/01/12 #7:
libpng 1.6.54: two heap buffer over-read vulnerabilities fixed:
CVE-2026-22695, CVE-2026-22801 (Cosmin Truta <ctruta@...il.com>)
- 2026/01/12 #6:
Re: CVE-2025-68493: Apache Struts: XXE vulnerability
in outdated XWork component (Loganaden Velvindron <loganaden@...il.com>)
- 2026/01/12 #5:
Re: Null Pointer Dereference in HarfBuzz (Vincent Lefevre <vincent@...c17.net>)
- 2026/01/12 #4:
Re: Null Pointer Dereference in HarfBuzz (Greg KH <greg@...ah.com>)
- 2026/01/12 #3:
Re: Null Pointer Dereference in HarfBuzz (Jan Engelhardt <ej@...i.de>)
- 2026/01/12 #2:
Re: CVE-2025-68493: Apache Struts: XXE vulnerability
in outdated XWork component (Hanno Böck <hanno@...eck.de>)
- 2026/01/12 #1:
Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
- 2026/01/11 #2:
CVE-2025-68493: Apache Struts: XXE vulnerability in outdated XWork component (Lukasz Lenart <lukaszlenart@...che.org>)
- 2026/01/11 #1:
Null Pointer Dereference in HarfBuzz (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/10 #1:
The Curious Case of Stack Pivot Detection (Ali Polatel <alip@...sys.org>)
- 2026/01/09 #2:
Net-SNMP snmptrapd vulnerability [CVE-2025-68615] (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/09 #1:
InputPlumber: Lack of D-Bus Authorization and Input Verification
allows UI Input Injection and Denial-of-Service (CVE-202… (Matthias Gerstner <mgerstner@...e.de>)
- 2026/01/08 #7:
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
- 2026/01/08 #6:
Re: Systemd vsock sshd (Solar Designer <solar@...nwall.com>)
- 2026/01/08 #5:
Fwd: libtasn1-4.21.0 released [stable] - fixes
CVE-2025-13151 (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/08 #4:
CVE-2025-62235: Apache NimBLE: Incorrect handling of SMP Security
Request could lead to undesirable pairing (Szymon Janc <janc@...che.org>)
- 2026/01/08 #3:
CVE-2025-53477: Apache NimBLE: NULL Pointer Dereference in NimBLE
host HCI layer (Szymon Janc <janc@...che.org>)
- 2026/01/08 #2:
CVE-2025-53470: Apache NimBLE: Out-of-Bounds Write Vulnerability
in NimBLE HCI H4 driver (Szymon Janc <janc@...che.org>)
- 2026/01/08 #1:
CVE-2025-52435: Apache NimBLE: Invalid error handling in pause
encryption procedure in NimBLE controller (Szymon Janc <janc@...che.org>)
- 2026/01/07 #9:
Foomuuri: Lack of Client Authorization and Input Verification allow
Control over Firewall Configuration (CVE-2025-67603, … (Matthias Gerstner <mgerstner@...e.de>)
- 2026/01/07 #8:
TLP: Polkit Authentication Bypass in Profiles Daemon in Version
1.9.0 (CVE-2025-67859) (Matthias Gerstner <mgerstner@...e.de>)
- 2026/01/07 #7:
[ADVISORY] curl CVE-2025-15224: libssh key passphrase bypass without
agent set (Daniel Stenberg <daniel@...x.se>)
- 2026/01/07 #6:
[ADVISORY] curl CVE-2025-15079: libssh global knownhost override (Daniel Stenberg <daniel@...x.se>)
- 2026/01/07 #5:
[ADVISORY] curl CVE-2025-14819: OpenSSL partial chain store policy
bypass (Daniel Stenberg <daniel@...x.se>)
- 2026/01/07 #4:
[ADVISORY] curl CVE-2025-14524: bearer token leak on cross-protocol
redirect (Daniel Stenberg <daniel@...x.se>)
- 2026/01/07 #3:
[ADVISORY] curl CVE-2025-14017: broken TLS options for threaded
LDAPS (Daniel Stenberg <daniel@...x.se>)
- 2026/01/07 #2:
[ADVISORY] curl CVE-2025-13034: No QUIC certificate pinning with
GnuTLS (Daniel Stenberg <daniel@...x.se>)
- 2026/01/07 #1:
wget2-2.2.1 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/06 #5:
Fwd: [FD] zlib v1.3.1.2 Global Buffer Overflow in
TGZfname() of zlib untgz Utility via Unbounded strcpy() on User-Suppl… (Alan Coopersmith <alan.coopersmith@...c…)
- 2026/01/06 #4:
Re: [External] : Buffer overflow in /bin/su from UNIX
v4 (Casper Dik <casper.dik@...cle.com>)
- 2026/01/06 #3:
Re: Re: Best practices for signature verifcation (Taavi Eomäe <taavi@...e.ee>)
- 2026/01/06 #2:
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2026/01/06 #1:
Re: Buffer overflow in /bin/su from UNIX v4 (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2026/01/05 #14:
Multiple vulnerabilities in aiohttp (Sam Bull <9m199i@...bull.org>)
- 2026/01/05 #13:
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/01/05 #12:
Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/01/05 #11:
Re: CVE-2025-68280: Apache SIS: XML External Entity
(XXE) vulnerability (Sebastian Pipping <sebastian@...ping.org>)
- 2026/01/05 #10:
Buffer overflow in /bin/su from UNIX v4 (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/01/05 #9:
Re: Re: Best practices for signature verifcation (Morten Linderud <morten@...derud.pw>)
- 2026/01/05 #8:
Re: Best practices for signature verifcation (Clemens Lang <cllang@...hat.com>)
- 2026/01/05 #7:
CVE-2025-68280: Apache SIS: XML External Entity (XXE)
vulnerability (Martin Desruisseaux <desruisseaux@...che.org>)
- 2026/01/05 #6:
Re: Re: Best practices for signature verifcation (Jeffrey Walton <noloader@...il.com>)
- 2026/01/05 #5:
Re: Re: Best practices for signature verifcation (Valtteri Vuorikoski <vuori@...com.org>)
- 2026/01/05 #4:
GnuPG ticket T7900 (was: Many vulnerabilities in GnuPG) (Werner Koch <wk@...pg.org>)
- 2026/01/05 #3:
Re: Many vulnerabilities in GnuPG (Stephan Verbücheln <stephan@...buecheln.ch>)
- 2026/01/05 #2:
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2026/01/05 #1:
CVE-2025-66518: Apache Kyuubi: Unauthorized directory access due
to missing path normalization (Akira Ajisaka <aajisaka@...che.org>)
- 2026/01/03 #5:
Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/01/03 #4:
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/01/03 #3:
Re: Systemd vsock sshd (Carlos Rodriguez-Fernandez <carlosrodrifernandez@...il.com>)
- 2026/01/03 #2:
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
- 2026/01/03 #1:
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/01/02 #3:
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2026/01/02 #2:
Re: Best practices for signature verifcation (Soatok Dreamseeker <soatok.dhole@...il.com>)
- 2026/01/02 #1:
Re: Systemd vsock sshd (wish42offcl98@...teo.org)
- 2026/01/01 #6:
Re: Best practices for signature verifcation (Clemens Lang <cllang@...hat.com>)
- 2026/01/01 #5:
Re: Re: Best practices for signature verifcation (Ali Polatel <alip@...sys.org>)
- 2026/01/01 #4:
Re: Best practices for signature verifcation (Simon Josefsson <simon@...efsson.org>)
- 2026/01/01 #3:
Re: Systemd vsock sshd (Pat Gunn <pgunn01@...il.com>)
- 2026/01/01 #2:
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/01/01 #1:
Re: Re: Best practices for signature verifcation (Collin Funk <collin.funk1@...il.com>)
- 2025/12/31 #12:
Re: Best practices for signature verifcation (Steffen Nurpmeso <steffen@...oden.eu>)
- 2025/12/31 #11:
CVE-2025-48769: Apache NuttX RTOS: fs/vfs/fs_rename: use after
free (Tomasz Cedro <cederom@...che.org>)
- 2025/12/31 #10:
CVE-2025-48768: Apache NuttX RTOS: fs/inode: fs_inoderemove root
inode removal (Tomasz Cedro <cederom@...che.org>)
- 2025/12/31 #9:
Re: Best practices for signature verifcation (Simon Josefsson <simon@...efsson.org>)
- 2025/12/31 #8:
Re: safe use of cleartext signatures? (Werner Koch <wk@...pg.org>)
- 2025/12/31 #7:
Re: Many vulnerabilities in GnuPG (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2025/12/31 #6:
Re: Many vulnerabilities in GnuPG (Jeffrey Walton <noloader@...il.com>)
- 2025/12/31 #5:
Re: Many vulnerabilities in GnuPG (Jacob Bachmeyer <jcb62281@...il.com>)
- 2025/12/31 #4:
Re: Re: Best practices for signature verifcation (Eli Schwartz <eschwartz@...too.org>)
- 2025/12/31 #3:
Re: Re: Best practices for signature verifcation (Eli Schwartz <eschwartz@...too.org>)
- 2025/12/31 #2:
Re: Best practices for signature verifcation (Ali Polatel <alip@...sys.org>)
- 2025/12/31 #1:
Re: Many vulnerabilities in GnuPG (Collin Funk <collin.funk1@...il.com>)
- 2025/12/30 #16:
Re: Many vulnerabilities in GnuPG (Henrik Ahlgren <pablo@...stieto.com>)
- 2025/12/30 #15:
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
- 2025/12/30 #14:
Re: Many vulnerabilities in GnuPG (Sam James <sam@...too.org>)
- 2025/12/30 #13:
Re: Systemd vsock sshd (Demi Marie Obenour <demiobenour@...il.com>)
- 2025/12/30 #12:
Re: safe use of cleartext signatures? (Demi Marie Obenour <demiobenour@...il.com>)
- 2025/12/30 #11:
Re: Many vulnerabilities in GnuPG (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2025/12/30 #10:
Re: Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
- 2025/12/30 #9:
Re: Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
- 2025/12/30 #8:
Re: Many vulnerabilities in GnuPG (Jacob Bachmeyer <jcb62281@...il.com>)
- 2025/12/30 #7:
Re: safe use of cleartext signatures? (Werner Koch <wk@...pg.org>)
- 2025/12/30 #6:
Re: safe use of cleartext signatures? (was: Many
vulnerabilities in GnuPG) (Jacob Bachmeyer <jcb62281@...il.com>)
31944 messages
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
