oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 1	²	³ 3	⁴ 3	⁵ 5	⁶ 8	⁷ 1
⁸ 1	⁹ 8	¹⁰ 4	¹¹ 5	¹² 7	¹³	¹⁴ 2
¹⁵ 3	¹⁶ 7	¹⁷ 3	¹⁸ 12	¹⁹ 8	²⁰ 2	²¹
²² 6	²³ 2	²⁴ 6	²⁵ 6	²⁶ 8	²⁷ 2	²⁸
²⁹ 6	³⁰	³¹ 3

Messages by day:

January 1 (1 message)

Apache OpenOffice 4.1.4 - fixes CVE-2017-3157 CVE-2017-9806 CVE-2017-12607 CVE-2017-12608 (Andrea Pescetti <pescetti@...che.org>)

January 3 (3 messages)

[CVE-2013-4317] Apache CloudStack information disclosure vulnerability (Rafael Weingärtner <rafael@...che.org>)
Xen Security Advisory 254 - Information leak via side effects of speculative execution (Xen.org security team <security@....org>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)

January 4 (3 messages)

Xen Security Advisory 253 - x86: memory leak with MSR emulation (Xen.org security team <security@....org>)
"[SECURITY] CVE-2017-15714 Apache OFBiz BIRT code vulnerability" (Taher Alkhateeb <slidingfilaments@...il.com>)
CVE-2017-18018: GNU chown and chgrp (coreutils) privilege escalation via recursive dereferences (Michael Orlitzky <michael@...itzky.com>)

January 5 (5 messages)

CVE-2017-15129: Linux kernel: net: double-free and memory corruption in get_net_ns_by_id() (Vladis Dronov <vdronov@...hat.com>)
[ANNOUNCE] Apache Sentry 1.7.1 released (Colm O hEigeartaigh <coheigea@...che.org>)
Re: [Xen-devel] Xen Security Advisory 254 - Information leak via side effects of speculative execution (Doug Goldstein <cardoe@...doe.com>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)
CVE-2017-18021: predictably random password generation in third-party pass-compatible software, "QtPass" ("Jason A. Donenfeld" <Jason@...c4.com>)

January 6 (8 messages)

Re: Path traversal flaws in awstats 7.6 and earlier. (Hanno Böck <hanno@...eck.de>)
Irssi 1.0.6: CVE-2018-5206, CVE-2018-5205, CVE-2018-5208, CVE-2018-5207 (Ailin Nemui <ailin.nemui@...il.com>)
Xen Security Advisory 253 (CVE-2018-5244) - x86: memory leak with MSR emulation (Xen.org security team <security@....org>)
Xen Security Advisory 248 (CVE-2017-17566) - x86 PV guests may gain access to internally used pages (Xen.org security team <security@....org>)
Xen Security Advisory 249 (CVE-2017-17563) - broken x86 shadow mode refcount overflow check (Xen.org security team <security@....org>)
Xen Security Advisory 251 (CVE-2017-17565) - improper bug check in x86 log-dirty handling (Xen.org security team <security@....org>)
Xen Security Advisory 250 (CVE-2017-17564) - improper x86 shadow mode refcount error handling (Xen.org security team <security@....org>)
Re: Path traversal flaws in awstats 7.6 and earlier. (John Lightsey <jd@...nel.net>)

January 7 (1 message)

Re: Path traversal flaws in awstats 7.6 and earlier. (Stefan Pietsch <s.pietsch@...ecurity.de>)

January 8 (1 message)

CVE-2012-3353: Apache Sling Content Loading Vulnerability (Bertrand Delacretaz <bdelacretaz@...che.org>)

January 9 (8 messages)

Own on install. How grave it is? (Georgi Guninski <guninski@...inski.com>)
Re: Own on install. How grave it is? (Kurt Seifried <kseifried@...hat.com>)
Re: Own on install. How grave it is? (Michal Hrušecký <michal.hrusecky@....cz>)
Re: Own on install. How grave it is? (Simon McVittie <smcv@...ian.org>)
Re: Own on install. How grave it is? (Kurt Seifried <kseifried@...hat.com>)
[SECURITY] CVE-2017-9795 Apache Geode OQL method invocation vulnerability (Anthony Baker <abaker@...che.org>)
[SECURITY] CVE-2017-12622 Apache Geode gfsh authorization vulnerability (Anthony Baker <abaker@...che.org>)
[SECURITY] CVE-2017-9796 Apache Geode OQL bind parameter vulnerability (Anthony Baker <abaker@...che.org>)

January 10 (4 messages)

CVE-2017-18016 - Paritytech Parity Ethereum built-in Dapp Browser <= v1.6.10 webproxy token reuse same-origin policy by… ("oststrom \(public\)" <pub@...strom.com…)
CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API (Radu Cotescu <radu@...che.org>)
WebKitGTK+ Security Advisory WSA-2018-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
JSONRPC vulnerability in Electrum 2.6 to 3.0.4 (Thomas Voegtlin <thomasv@...ctrum.org>)

January 11 (5 messages)

transmission: rpc session-id mechanism design flaw results in RCE (Tavis Ormandy <taviso@...gle.com>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)
util-linux mount/unmount ASLR bypass via environment variable (halfdog <me@...fdog.net>)
OpenSSH sftp remote code execution in chroot mode in VERY RARE cases (halfdog <me@...fdog.net>)
Libc Realpath Buffer Underflow CVE-2018-1000001 (halfdog <me@...fdog.net>)

January 12 (7 messages)

Re: transmission: rpc session-id mechanism design flaw results in RCE (Tavis Ormandy <taviso@...gle.com>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)
DBD::mysql and SSL/TLS (Daniël van Eeden <daniel.vaneeden@...king.com>)
On reading, thinking, copying (halfdog <me@...fdog.net>)
Re: Libc Realpath Buffer Underflow CVE-2018-1000001 (Jakub Wilk <jwilk@...lk.net>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)

January 14 (2 messages)

Re: [CVE-2017-15708] Apache Synapse Remote Code Execution Vulnerability (Isuru Udana <isudana@...che.org>)
Re: DBD::mysql and SSL/TLS (Michiel Beijen <michiel.beijen@...il.com>)

January 15 (3 messages)

Re: transmission: rpc session-id mechanism design flaw results in RCE (Marcus Meissner <meissner@...e.de>)
CVE-2018-5683 Qemu: Out-of-bounds read in vga_draw_text routine (P J P <ppandit@...hat.com>)
CVE-2017-18030 Qemu: Out-of-bounds access in cirrus_invalidate_region routine (P J P <ppandit@...hat.com>)

January 16 (7 messages)

sound driver Conditional competition (luo <a4651386@....com>)
opendaylight-advisory: Multiple "expired" flows consume the memory resource of CONFIG DS (Luke Hinds <lhinds@...hat.com>)
Re: sound driver Conditional competition (Marcus Meissner <meissner@...e.de>)
Re: sound driver Conditional competition (Kurt Seifried <kseifried@...hat.com>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)
ISC has announced CVE-2017-3144, a defect in ISC DHCP (Michael McNally <mcnally@....org>)
New vulnerability in ISC BIND announced (CVE-2017-3145) (ISC Security Officer <security-officer@....org>)

January 17 (3 messages)

CVE-2017-16933: Icinga2 root privilege escalation via init script and systemd service (Michael Orlitzky <michael@...itzky.com>)
MySQL sha256_password authentication plugin DoS issues (Tomas Hoger <thoger@...hat.com>)
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)

January 18 (12 messages)

How to deal with reporters who don't want their bugs fixed? (Florian Weimer <fweimer@...hat.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Kurt Seifried <kseifried@...hat.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Gynvael Coldwind <gynvael@...dwind.pl>)
Re: How to deal with reporters who don't want their bugs fixed? (ludo@....org (Ludovic Courtès))
Xen Security Advisory 254 (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) - Information leak via side effects of speculativ… (Xen.org security team <security@....org…)
Re: How to deal with reporters who don't want their bugs fixed? (Matthias Fetzer <admin@...l.cat>)
Re: How to deal with reporters who don't want their bugs fixed? (Yves-Alexis Perez <corsac@...ian.org>)
Re: How to deal with reporters who don't want their bugs fixed? (Rich Felker <dalias@...c.org>)
Re: How to deal with reporters who don't want their bugs fixed? (Solar Designer <solar@...nwall.com>)
Re: How to deal with reporters who don't want their bugs fixed? ("Luedtke, Nicholas (Cyber Security)" <nicholas.luedtke@....com>)
Re: How to deal with reporters who don't want their bugs fixed? (Solar Designer <solar@...nwall.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Michael Orlitzky <michael@...itzky.com>)

January 19 (8 messages)

CVE-2017-18043 Qemu: integer overflow in ROUND_UP macro could result in DoS (P J P <ppandit@...hat.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Nicholas Luedtke <nicholas.luedtke@....com>)
CVE-2017-15105 Unbound: NSEC processing vulnerability (DNSSEC) (Ralph Dolmans <ralph@...etlabs.nl>)
Re: How to deal with reporters who don't want their bugs fixed? (i@...udlinux.com)
Re: How to deal with reporters who don't want their bugs fixed? (Greg KH <greg@...ah.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Igor Seletskiy <i@...udlinux.com>)
CVE-2017-15713: Apache Hadoop MapReduce job history server vulnerability (Jason Lowe <jlowe@...che.org>)
CVE-2018-1049: systemd: automount: access to automounted volumes can lock up (Vladis Dronov <vdronov@...hat.com>)

January 20 (2 messages)

Re: How to deal with reporters who don't want their bugs fixed? (Tavis Ormandy <taviso@...gle.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Florian Weimer <fweimer@...hat.com>)

January 22 (6 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: How to deal with reporters who don't want their bugs fixed? (r.hering@....de)
SQUID-2018:1 Denial of Service issue in ESI Response processing (Amos Jeffries <squid3@...enet.co.nz>)
SQUID-2018:2 Denial of Service issue in HTTP Message processing (Amos Jeffries <squid3@...enet.co.nz>)
Re: How to deal with reporters who don't want their bugs fixed? (Mikhail Utin <mikhailutin@...mail.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Ian Zimmerman <itz@...y.loosely.org>)

January 23 (2 messages)

Re: Re: How to deal with reporters who don't want their bugs fixed? (Tristan Henning <tristan@...tomcrypto.com>)
[ANNOUNCE] CVE fixes in Apache NiFi 1.5.0 (Andy LoPresto <alopresto@...che.org>)

January 24 (6 messages)

Re: How to deal with reporters who don't want their bugs fixed? ("Mike O'Connor" <mjo@...o.mi.org>)
CVE-2018-1000018: ovirt-engine-setup: root password disclosed in provisioning logs (Doran Moppert <dmoppert@...hat.com>)
[SECURITY ADVISORY] curl: HTTP/2 trailer out-of-bounds read (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: HTTP authentication leak in redirects (Daniel Stenberg <daniel@...x.se>)
CVE-2017-15718: Apache Hadoop YARN NodeManager vulnerability (Akira Ajisaka <aajisaka@...che.org>)
WebKitGTK+ Security Advisory WSA-2018-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

January 25 (6 messages)

Re: Jenkins EC2 Plugin 1.37 and earlier arbitrary shell command execution (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2017-15132: dovecot: auth client leaks memory if SASL authentication is aborted. (Aki Tuomi <aki.tuomi@...n-xchange.com>)
Re: Jenkins Script Security Plugin 1.36 and earlier arbitrary file read vulnerability (Daniel Beck <ml@...kweb.net>)
[ANNOUNCE] CVE advisory for Apache NiFi 1.0.0 - 1.3.0 (Andy LoPresto <alopresto@...che.org>)

January 26 (8 messages)

Re: How to deal with reporters who don't want their bugs fixed? (Stiepan <stie@....swiss>)
Re: How to deal with reporters who don't want their bugs fixed? (Solar Designer <solar@...nwall.com>)
Deserialization Vulnerability in VMware Xenon (CVE-2017-4947) (VMware Security Response Center <security@...are.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Mikhail Utin <mikhailutin@...mail.com>)
CVE-2018-1294: Apache Commons Email vulnerability information disclosure (Jochen Wiedmann <jochen.wiedmann@...il.com>)
Re: How to deal with reporters who don't want their bugs fixed? (Solar Designer <solar@...nwall.com>)
CVE-2017-12626 – Denial of Service Vulnerabilities in Apache POI < 3.17 (Tim Allison <tallison@...che.org>)
Re: How to deal with reporters who don't want their bugs fixed? (Solar Designer <solar@...nwall.com>)

January 27 (2 messages)

Re: How to deal with reporters who don't want their bugs fixed? (halfdog <me@...fdog.net>)
Re: How to deal with reporters who don't want their bugs fixed? (Stiepan <stie@....swiss>)

January 29 (6 messages)

Re: SQUID-2018:1 Denial of Service issue in ESI Response processing (Amos Jeffries <squid3@...enet.co.nz>)
Re: SQUID-2018:2 Denial of Service issue in HTTP Message processing (Amos Jeffries <squid3@...enet.co.nz>)
CVE-2018-18078: systemd-tmpfiles root privilege escalation with fs.protected_hardlinks=0 (Michael Orlitzky <michael@...itzky.com>)
Re: CVE-2017-18078: systemd-tmpfiles root privilege escalation with fs.protected_hardlinks=0 (Michael Orlitzky <michael@...itzky.com>)
Re: CVE-2017-18078: systemd-tmpfiles root privilege escalation with fs.protected_hardlinks=0 (Florian Weimer <fweimer@...hat.com>)
Re: CVE-2017-18078: systemd-tmpfiles root privilege escalation with fs.protected_hardlinks=0 (Michael Orlitzky <michael@...itzky.com>)

January 31 (3 messages)

Re: CVE-2017-15132: dovecot: auth client leaks memory if SASL authentication is aborted. (Aki Tuomi <aki.tuomi@...n-xchange.com>)
Re: Re: CVE-2017-16845 Qemu: ps2: information leakage via post_load routine (P J P <ppandit@...hat.com>)
report a vulnerability in sfcb software. (XinleiHe <hxl1999@...h.net>)

122 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.