oss-security mailing list - 2018/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 6	² 2	³ 1	⁴
⁵ 2	⁶ 4	⁷ 7	⁸ 7	⁹ 1	¹⁰	¹¹ 1
¹²	¹³	¹⁴ 3	¹⁵ 3	¹⁶ 4	¹⁷ 4	¹⁸ 1
¹⁹ 5	²⁰ 5	²¹	²² 4	²³ 1	²⁴ 9	²⁵ 3
²⁶ 3	²⁷ 4	²⁸ 1	²⁹ 1	³⁰ 2	³¹

Messages by day:

March 1 (6 messages)

Apache Xerces-C Security Advisory for versions < 3.2.1 [CVE-2017-12627] ("Cantor, Scott" <cantor.2@....edu>)
Dovecot Security Advisory: CVE-2017-14461 rfc822_parse_domain Information Leak Vulnerability (Aki Tuomi <aki.tuomi@...n-xchange.com>)
Dovecot Security Advisory: CVE-2017-15130 TLS SNI config lookups are inefficient and can be used for DoS (Aki Tuomi <aki.tuomi@...n-xchange.com>)
Xen Security Advisory 252 (CVE-2018-7540) - DoS via non-preemptable L3/L4 pagetable freeing (Xen.org security team <security@....org>)
Xen Security Advisory 256 (CVE-2018-7542) - x86 PVH guest without LAPIC may DoS the host (Xen.org security team <security@....org>)
Xen Security Advisory 255 (CVE-2018-7541) - grant table v2 -> v1 transition may crash Xen (Xen.org security team <security@....org>)

March 2 (2 messages)

memcached UDP amplification attacks (Hanno Böck <hanno@...eck.de>)
Re: memcached UDP amplification attacks (Kurt Seifried <kseifried@...hat.com>)

March 3 (1 message)

Re: memcached UDP amplification attacks (Kurt Seifried <kseifried@...hat.com>)

March 5 (2 messages)

Linux kernel: CVE-2018-1065 - netfilter rule insertion may panic system. (Wade Mealing <wmealing@...hat.com>)
Terminal Control Chars (up201407890@...nos.dcc.fc.up.pt)

March 6 (4 messages)

CVE-2018-1066 : kernel - CIFS - Null pointer dereference in ntlmv2 response client crash. (Wade Mealing <wmealing@...hat.com>)
Remote DoS flaw in 389-ds-base (Dhiru Kholia <dkholia@...hat.com>)
Re: Terminal Control Chars (Jesse Hertz <jesse_hertz@...le.com>)
Django security releases issued: 2.0.3, 1.11.11, and 1.8.19 (Tim Graham <timograham@...il.com>)

March 7 (7 messages)

Authentication bypass mainwp-child < 3.4.5 (Slavco Mihajloski <slavco.mihajloski@...il.com>)
util-linux: CVE-2018-7738: code execution in bash-completion for umount (Salvatore Bonaccorso <carnil@...ian.org>)
Re: memcached UDP amplification attacks (Tomas Hoger <thoger@...hat.com>)
Portus, missing certificate validation on proxified https traffic (Raphael Geissert <atomo64@...il.com>)
And Harbor? (was: Portus, missing certificate validation on proxified https traffic) (Raphael Geissert <atomo64@...il.com>)
Re: memcached UDP amplification attacks (Kurt Seifried <kseifrie@...hat.com>)
Re: memcached UDP amplification attacks ("Seaman, Chad" <cseaman@...mai.com>)

March 8 (7 messages)

Memcached remote DoS in older versions (dormando <dormando@...ia.net>)
Re: memcached UDP amplification attacks (Patrick Forsberg <fors@...t.sunet.se>)
Re: memcached UDP amplification attacks ("Seaman, Chad" <cseaman@...mai.com>)
CVE-2018-7550 Qemu: i386: multiboot OOB access while loading kernel image (P J P <ppandit@...hat.com>)
CVE-2018-7290: Stored XSS vulnerability in Tiki <= 18 (chbi@...i.eu)
Vulnerabilities and default credentials in Ilias e-learning software / German gov hack (Hanno Böck <hanno@...eck.de>)
Re: Memcached remote DoS in older versions (dormando <dormando@...ia.net>)

March 9 (1 message)

CVE-2018-7858 Qemu: cirrus: OOB access when updating vga display (P J P <ppandit@...hat.com>)

March 11 (1 message)

Re: Portus, missing certificate validation on proxified https traffic (Raphael Geissert <atomo64@...il.com>)

March 14 (3 messages)

[SECURITY ADVISORY] curl: FTP path trickery leads to NIL byte out of bounds write (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: LDAP NULL pointer dereference (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: RTSP RTP buffer over-read (Daniel Stenberg <daniel@...x.se>)

March 15 (3 messages)

[CVE-2018-5233] Grav CMS admin plugin Reflected Cross Site Scripting (XSS) vulnerability (Sydream Labs <labs@...dream.com>)
CVE request: maliciously crafted notebook files in Jupyter (Thomas Kluyver <thomas@...yver.me.uk>)
[SECURITY] CVE-2018-1319 Apache Allura HTTP response splitting (Dave Brondsema <brondsem@...che.org>)

March 16 (4 messages)

CVE-2018-1068: Linux kernel: netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Vladis Dronov <vdronov@...hat.com>)
[CVE-2018-1324] Apache Commons Compress denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)
Fwd: Firefox 52.7.2 (Fwd: Linux ARM ESR-52 builds need additional patch!) (Julien Cristau <jcristau@...illa.com>)
libvorbis/libtremor OOB write (Daniel Veditz <dveditz@...illa.com>)

March 17 (4 messages)

[cve-request@...re.org: Re: [scr479280] sqlite3 - all; fix is in source control but not yet released] (Seth Arnold <seth.arnold@...onical.com>)
Squirrelmail directory traversal vulnerability allows exfiltrating files from server (Hanno Böck <hanno@...eck.de>)
Re: Squirrelmail directory traversal vulnerability allows exfiltrating files from server (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: maliciously crafted notebook files in Jupyter (Salvatore Bonaccorso <carnil@...ian.org>)

March 18 (1 message)

Re: CVE request: maliciously crafted notebook files in Jupyter (Thomas Kluyver <takowl@...il.com>)

March 19 (5 messages)

Re: CVE request: maliciously crafted notebook files in Jupyter (Fernando Perez <Fernando.Perez@...keley.edu>)
[SECURITY] CVE-2018-1321: Remote code execution by administrators with report and template entitlements (Francesco Chicchiriccò <ilgrosso@...che.org>)
[SECURITY] CVE-2018-1322: Information disclosure via FIQL and ORDER BY sorting (Francesco Chicchiriccò <ilgrosso@...che.org>)
Re: CVE request: maliciously crafted notebook files in Jupyter (Ricter Zheng <ricterzheng@...il.com>)
[CVE-2018-8048] Loofah XSS Vulnerability (Mike Dalessio <mike.dalessio@...il.com>)

March 20 (5 messages)

Sanitize <= 4.6.2 HTML injection and XSS (Ryan Grove <ryan@...ko.com>)
Re: CVE request: maliciously crafted notebook files in Jupyter (Gordo Lowrey <gordo@...eval.com>)
Re: Sanitize <= 4.6.2 HTML injection and XSS (Ryan Grove <ryan@...ko.com>)
ES2018-05 Kamailio heap overflow (Sandro Gauci <sandro@...blesecurity.com>)
OpenSSL: bug in modular exponentiation (Guido Vranken <guidovranken@...il.com>)

March 22 (4 messages)

Re: OpenSSL: bug in modular exponentiation (zugtprgfwprz@...rnkuller.de)
Re: OpenSSL: bug in modular exponentiation (Guido Vranken <guidovranken@...il.com>)
Denial of service and other vulnerabilities in Icinga 2.x before version 2.8.2 (CVE-2018-6532, CVE-2018-6534, CVE-2018-65… (Michael Hanselmann <public@...smi.ch>)
[CVE-2018-3741] XSS vulnerability in rails-html-sanitizer (Rafael Mendonça França <rafaelmfranca@...il.com>)

March 23 (1 message)

CVE-2018-1000140 - rsyslog librelp X.509 parsing issue (Kurt Seifried <kseifried@...hat.com>)

March 24 (9 messages)

Re: [SECURITY] CVE-2018-1321: Remote code execution by administrators with report and template entitlements (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE-2018-1301: Possible out of bound access after failure in reading the HTTP request (Daniel Ruggeri <druggeri@...che.org>)
CVE-2018-1303: Possible out of bound read in mod_cache_socache (Daniel Ruggeri <druggeri@...che.org>)
CVE-2018-1283: Tampering of mod_session data for CGI applications (Daniel Ruggeri <druggeri@...che.org>)
CVE-2018-1302: Possible write of after free on HTTP/2 stream shutdown (Daniel Ruggeri <druggeri@...che.org>)
CVE-2017-15715: <FilesMatch> bypass with a trailing newline in the file name (Daniel Ruggeri <druggeri@...che.org>)
CVE-2018-1312: Weak Digest auth nonce generation in mod_auth_digest (Daniel Ruggeri <druggeri@...che.org>)
CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (Daniel Ruggeri <druggeri@...che.org>)
Stack buffer overflow in WolfSSL before 3.13.0 (Hanno Böck <hanno@...eck.de>)

March 25 (3 messages)

Re: CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (Marius Bakke <mbakke@...tmail.com>)
Re: CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (Yann Ylavic <ylavic@...che.org>)
Re: LibVNCServer rfbserver.c: rfbProcessClientNormalMessage() case rfbClientCutText doesn't sanitize msg.cct.length (Solar Designer <solar@...nwall.com>)

March 26 (3 messages)

Re: Stack buffer overflow in WolfSSL before 3.13.0 (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (Yann Ylavic <ylavic@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

March 27 (4 messages)

Re: CVE-2017-15710: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (Yann Ylavic <ylavic.dev@...il.com>)
[ANN] A crafted XML request can be used to perform a DoS attack when using the Struts REST plugin (Lukasz Lenart <lukaszlenart@...che.org>)
Linux kernel: syzkaller dashboard (Andrey Konovalov <andreyknvl@...il.com>)
CVE-2018-1091: Linux kernel: a KVM guest kernel crash during core dump on POWER9 host (Vladis Dronov <vdronov@...hat.com>)

March 28 (1 message)

Foreman 1.9+ SQL injection in dashboard page (Tomer Brisker <tbrisker@...hat.com>)

March 29 (1 message)

a number of CVEs for issues in the filesystem's code in the Linux kernel (Vladis Dronov <vdronov@...hat.com>)

March 30 (2 messages)

Fwd: [scr485440] 5 Samsung CVEs (flanker017 <flankerhqd017@...il.com>)
Re: Fwd: [scr485440] 5 Samsung CVEs (Solar Designer <solar@...nwall.com>)

84 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.