oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2017/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 2	² 1	³
⁴ 3	⁵ 5	⁶ 4	⁷ 10	⁸ 5	⁹ 1	¹⁰ 7
¹¹ 4	¹² 7	¹³ 2	¹⁴ 1	¹⁵ 5	¹⁶ 1	¹⁷ 11
¹⁸ 8	¹⁹ 6	²⁰ 1	²¹ 2	²² 1	²³ 2	²⁴ 1
²⁵ 1	²⁶	²⁷ 1	²⁸	²⁹ 1	³⁰	³¹

Messages by day:

December 1 (2 messages)

[ANN] Apache Struts 2.5.14.1 GA with Security Fixes Release (Lukasz Lenart <lukaszlenart@...che.org>)
Re: Re: Security risk of server side text editing ... (Scott Court <z5t1@...1.com>)

December 2 (1 message)

Re: libtiff: Heap-based buffer overflow bug in pal2rgb(pal2rgb.c) (Salvatore Bonaccorso <carnil@...ian.org>)

December 4 (3 messages)

ZKTime Web Software 2.0.1.12280 CVE-2017-17057 Cross Site Scripting (Himanshu Mehta <mehta.himanshu21@...il.com>)
CVE-2017-1000407 Kernel: KVM: DoS via write flood to I/O port 0x80 (P J P <ppandit@...hat.com>)
CVE-2017-16930 - Claymore's Dual Ethereum Miner unauth stack buffer overflow in remote management interface ("oststrom \(public\)" <pub@...strom.com>)

December 5 (5 messages)

CVE-2017-8824 linux: use-after-free in DCCP code (Mohamed Ghannam <simo.ghannam@...il.com>)
CVE-2017-17381 Qemu: virtio: divide by zero exception while updating rings (P J P <ppandit@...hat.com>)
Jenkins stored cross-site scripting vulnerability (Daniel Beck <ml@...kweb.net>)
[OSSA 2017-005.1] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239) ERRATA (Tristan Cacqueray <tdecacqu@...hat.com>)
[OSSA-2017-006] Nova FilterScheduler doubles resource allocations during rebuild with new image (CVE-2017-17051) (Jeremy Stanley <fungi@...goth.org>)

December 6 (4 messages)

Xen Security Advisory 238 (CVE-2017-15591) - DMOP map/unmap missing argument checks (Xen.org security team <security@....org>)
Jenkins EC2 Plugin 1.37 and earlier arbitrary shell command execution (Daniel Beck <ml@...kweb.net>)
Info Leak in the Linux Kernel via Bluetooth (Armis Security <security@...is.com>)
Re: Info Leak in the Linux Kernel via Bluetooth (Adam Maris <amaris@...hat.com>)

December 7 (10 messages)

Recommendations GnuPG-2 replacement (halfdog <me@...fdog.net>)
CVE Request -- Arbitrary command execution in mercurial repo with a git submodule (feer james <pnigos70@...il.com>)
signed integer overflow in common_timer_get on linux 4.15.0-rc1 (at zhou <zhouat2017@...il.com>)
Re: Recommendations GnuPG-2 replacement (oss-security@...chelkaktus.net)
Re: signed integer overflow in common_timer_get on linux 4.15.0-rc1 (Greg KH <greg@...ah.com>)
Re: Recommendations GnuPG-2 replacement (Jeremy Stanley <fungi@...goth.org>)
Re: Recommendations GnuPG-2 replacement (Solar Designer <solar@...nwall.com>)
Re: Recommendations GnuPG-2 replacement (Peter Bex <peter@...e-magic.net>)
Re: Recommendations GnuPG-2 replacement (Blibbet <blibbet@...il.com>)
Re: Recommendations GnuPG-2 replacement (Solar Designer <solar@...nwall.com>)

December 8 (5 messages)

Re: Recommendations GnuPG-2 replacement (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)
Re: signed integer overflow in common_timer_get on linux 4.15.0-rc1 (Dan Carpenter <dan.carpenter@...cle.com>)
Re: signed integer overflow in common_timer_get on linux 4.15.0-rc1 (Greg KH <greg@...ah.com>)
Re: Re: Recommendations GnuPG-2 replacement (ludo@....org (Ludovic Courtès))
Re: Re: Recommendations GnuPG-2 replacement (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)

December 9 (1 message)

Re: Re: signed integer overflow in common_timer_get on linux 4.15.0-rc1 (Daniel Micay <danielmicay@...il.com>)

December 10 (7 messages)

Re: Recommendations GnuPG-2 replacement (Phil Pennock <oss-security-phil@...dhuis.org>)
Re: Re: Recommendations GnuPG-2 replacement (Jeffrey Walton <noloader@...il.com>)
Re: Re: Recommendations GnuPG-2 replacement (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)
[CVE-2017-15708] Apache Synapse Remote Code Execution Vulnerability (Isuru Udana <isudana@...che.org>)
Re: CVE Request -- Arbitrary command execution in mercurial repo with a git submodule (Salvatore Bonaccorso <carnil@...ian.org>)
GraphicsMagick 1.3.27 is available (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Re: Recommendations GnuPG-2 replacement (Phil Pennock <oss-security-phil@...dhuis.org>)

December 11 (4 messages)

PowerDNS Security Advisory 2017-08 (Remi Gacogne <remi.gacogne@...erdns.com>)
Re: PowerDNS Security Advisory 2017-08 (Remi Gacogne <remi.gacogne@...erdns.com>)
Jenkins Script Security Plugin 1.36 and earlier arbitrary file read vulnerability (Daniel Beck <ml@...kweb.net>)
Qualys Security Advisory - Buffer overflow in glibc's ld.so (Qualys Security Advisory <qsa@...lys.com>)

December 12 (7 messages)

[ANN] [APACHE STRUTS] Security Bulletin S2-055: impact increased to High (related to CVE-2017-7525 - JSON Jackson libra… (Lukasz Lenart <lukaszlenart@...che.org>)
Xen Security Advisory 249 - broken x86 shadow mode refcount overflow check (Xen.org security team <security@....org>)
Xen Security Advisory 250 - improper x86 shadow mode refcount error handling (Xen.org security team <security@....org>)
Xen Security Advisory 248 - x86 PV guests may gain access to internally used pages (Xen.org security team <security@....org>)
Xen Security Advisory 251 - improper bug check in x86 log-dirty handling (Xen.org security team <security@....org>)
ROBOT attack (WolfSSL, Bouncy Castle, Erlang) (Hanno Böck <hanno@...eck.de>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem (Andrey Konovalov <andreyknvl@...il.com>)

December 13 (2 messages)

[SECURITY] CVE-2017-5663: Apache Fineract SQL Injection Vulnerability (Nazeer Shaik <nazeer1100126@...che.org>)
Bugs in iscsiuio (Qualys Security Advisory <qsa@...lys.com>)

December 14 (1 message)

Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)

December 15 (5 messages)

CVE-2017-17670: vlc: type conversion vulnerability (Hans Jerry Illikainen <hji@...topia.com>)
Re: CVE-2017-17670: vlc: type conversion vulnerability (Stiepan <stie@....swiss>)
Re: Recommendations GnuPG-2 replacement (halfdog <me@...fdog.net>)
Re: Recommendations GnuPG-2 replacement (halfdog <me@...fdog.net>)
Re: CVE-2017-17670: vlc: type conversion vulnerability (Hans Jerry Illikainen <hji@...topia.com>)

December 16 (1 message)

CVE-2017-17712 net/ipv4/raw.c: raw_sendmsg() race condition (Mohamed Ghannam <simo.ghannam@...il.com>)

December 17 (11 messages)

Re: Recommendations GnuPG-2 replacement (halfdog <me@...fdog.net>)
Re: The Internet Bug Bounty: Data Processing (hackerone.com) (Qhdwns123 <qhdwns123@...tonmail.com>)
Sonatype Nexus Repository Manager 2.x weak password encryption (Raphael Geissert <atomo64@...il.com>)
Portus, missing LDAP server authentication (Raphael Geissert <atomo64@...il.com>)
Re: Sonatype Nexus Repository Manager 2.x weak password encryption (Stefano Brivio <sbrivio@...hat.com>)
Re: Sonatype Nexus Repository Manager 2.x weak password encryption (Brian Fox <brianf@...atype.com>)
Re: Sonatype Nexus Repository Manager 2.x weak password encryption (Raphael Geissert <atomo64@...il.com>)
Re: Portus, missing LDAP server authentication (Kiall Mac Innes <kiall@...innes.ie>)
Gitlab, LDAP integration vulnerable to MITM attack (Raphael Geissert <atomo64@...il.com>)
Net::LDAP ruby gem, missing certificate validation (Raphael Geissert <atomo64@...il.com>)
Re: [security] Re: Sonatype Nexus Repository Manager 2.x weak password encryption (Brian Fox <brianf@...atype.com>)

December 18 (8 messages)

Re: Portus, missing LDAP server authentication (Marcus Meissner <meissner@...e.de>)
[SECURITY] CVE-2017-12630 Apache Drill XSS vulnerability (Arina Ielchiieva <arina@...che.org>)
overly broad IPC details sharing on Linux Kernel? (Marcus Meissner <meissner@...e.de>)
Re: Recommendations GnuPG-2 replacement (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE-2017-15700 - Apache Sling Authentication Service vulnerability (Antonio Sanso <asanso@...be.com>)
Re: Recommendations GnuPG-2 replacement (halfdog <me@...fdog.net>)
Re: Recommendations GnuPG-2 replacement (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Recommendations GnuPG-2 replacement (Leonid Isaev <leonid.isaev@...a.colorado.edu>)

December 19 (6 messages)

Re: Recommendations GnuPG-2 replacement (halfdog <me@...fdog.net>)
CVE-2017-17741 kernel: kvm: stack-based out-of-bounds read via vmcall instruction (P J P <ppandit@...hat.com>)
Re: Recommendations GnuPG-2 replacement (Leonid Isaev <leonid.isaev@...a.colorado.edu>)
CVE-2017-15124 Qemu: memory exhaustion through framebuffer update request message in VNC server (P J P <ppandit@...hat.com>)
GIMP parser bugs (FLIMP and more) (Hanno Böck <hanno@...eck.de>)
WebKitGTK+ Security Advisory WSA-2017-0010 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

December 20 (1 message)

Re: GIMP parser bugs (FLIMP and more) (Salvatore Bonaccorso <carnil@...ian.org>)

December 21 (2 messages)

[GitLab, Inc.] Update: Gitlab, LDAP integration vulnerable to MITM attack ("Kwang (GitLab Support)" <security@...lab.com>)
Linux >=4.9: eBPF memory corruption bugs (Jann Horn <jannh@...gle.com>)

December 22 (1 message)

Re: Recommendations GnuPG-2 replacement (Solar Designer <solar@...nwall.com>)

December 23 (2 messages)

Re: Recommendations GnuPG-2 replacement (Dhiru Kholia <dhiru.kholia@...il.com>)
Re: Linux >=4.9: eBPF memory corruption bugs (Salvatore Bonaccorso <carnil@...ian.org>)

December 24 (1 message)

Re: Linux >=4.9: eBPF memory corruption bugs (Salvatore Bonaccorso <carnil@...ian.org>)

December 25 (1 message)

Gain Access to SSH Group via ssh-agent and OpenSSL (halfdog <me@...fdog.net>)

December 27 (1 message)

Path traversal flaws in awstats 7.6 and earlier. (John Lightsey <jd@...nel.net>)

December 29 (1 message)

Re: Path traversal flaws in awstats 7.6 and earlier. (John Lightsey <jd@...nel.net>)

93 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.