oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 1	³ 1	⁴ 9	⁵ 5	⁶ 4	⁷	⁸ 3
⁹ 4	¹⁰ 7	¹¹ 1	¹² 9	¹³ 4	¹⁴	¹⁵
¹⁶ 3	¹⁷ 1	¹⁸ 2	¹⁹ 5	²⁰ 3	²¹	²²
²³ 3	²⁴ 3	²⁵ 8	²⁶ 1	²⁷ 1	²⁸	²⁹
³⁰ 3

Messages by day:

April 2 (1 message)

[CVE-2018-1295]: Possible Execution of Arbitrary Code Within Deserialization Endpoints of Apache Ignite (Denis Magda <dmagda@...che.org>)

April 3 (1 message)

Announce: OpenSSH 7.7 released (Damien Miller <djm@...nbsd.org>)

April 4 (9 messages)

CVE-2018-1002150: koji: Dist Repo call missing authorization check allowing filesystem manipulation (Patrick Uiterwijk <puiterwijk@...hat.com>)
Linux Kernel Defence Map (Alexander Popov <alex.popov@...ux.com>)
WebKitGTK+ Security Advisory WSA-2018-0003 (Michael Catanzaro <mcatanzaro@...lia.com>)
Re: [webkit-security] WebKitGTK+ Security Advisory WSA-2018-0003 (Michael Catanzaro <mcatanzaro@...lia.com>)
Re: Linux Kernel Defence Map (Kees Cook <keescook@...omium.org>)
[SECURITY] CVE-2018-1284: Hive UDF series UDFXPathXXXX allow users to pass carefully crafted XML to access arbitrary files (Daniel Dai <daijy@...che.org>)
[SECURITY] CVE-2018-1282 JDBC driver is susceptible to SQL injection attack if the input parameters are not properly cleaned (Daniel Dai <daijy@...che.org>)
[SECURITY] CVE-2018-1315 'COPY FROM FTP' statement in HPL/SQL can write to arbitrary location if the FTP server is compromised (Daniel Dai <daijy@...che.org>)
Re: Re: Linux Kernel Defence Map (Kurt Seifried <kseifried@...hat.com>)

April 5 (5 messages)

Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Linux Kernel Defence Map (Alexander Popov <alex.popov@...ux.com>)
Re: Linux Kernel Defence Map (Kees Cook <keescook@...omium.org>)
Re: Linux Kernel Defence Map (Alexander Popov <alex.popov@...ux.com>)
Re: Linux Kernel Defence Map (Kees Cook <keescook@...omium.org>)

April 6 (4 messages)

Privsec vuln in beep / Code execution in GNU patch (Hanno Böck <hanno@...eck.de>)
Re: Privsec vuln in beep / Code execution in GNU patch (Sebastian Krahmer <half.linked.list@...il.com>)
Re: Privsec vuln in beep / Code execution in GNU patch (Jakub Wilk <jwilk@...lk.net>)
Re: Linux Kernel Defence Map (Alexander Popov <alex.popov@...ux.com>)

April 8 (3 messages)

beep infoleak (Hanno Böck <hanno@...eck.de>)
CVE-2018-2767: MySQL & MariaDB: Return of the BACKRONYM vulnerability (public disclosure) (Pali Rohár <pali.rohar@...il.com>)
[SECURITY] CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request parameter ("Uwe Schindler" <uschindler@...che.org>)

April 9 (4 messages)

Re: beep infoleak (Kash Pande <kash@...pleback.net>)
pcs: disclosure of CVE-2018-1079 and CVE-2018-1086 (Cedric Buissart <cbuissar@...hat.com>)
Re: Terminal Control Chars (Ian Zimmerman <itz@...y.loosely.org>)
Re: Re: Terminal Control Chars (Not Real <theborland1@...il.com>)

April 10 (7 messages)

Re: Terminal Control Chars (Gordo Lowrey <gordo@...eval.com>)
CVE-2017-13220 / Android A-63527053: Linux kernel: Possible out-of-bound access in Bluetooth subsystem (Vladis Dronov <vdronov@...hat.com>)
Re: Re: Terminal Control Chars (Jakub Wilk <jwilk@...lk.net>)
CVE-2018-1097 Foreman: oVirt credentials exposed by host power API (Tomer Brisker <tbrisker@...hat.com>)
Re: Terminal Control Chars (Christian Brabandt <cb@...bit.org>)
Change to ASF httpd vulnerability XML format (Mark Cox <mjc@...che.org>)
Re: Terminal Control Chars (Jakub Wilk <jwilk@...lk.net>)

April 11 (1 message)

Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)

April 12 (9 messages)

Arbitrary file download vulnerability in Drupal module avatar_uploader v7.x-1.0-beta8 ("Larry W. Cashdollar" <larry0@...com>)
CVE-2018-1084 corosync: Integer overflow in exec/totemcrypto.c:authenticate_nss_2_3() function (Raphael Sanchez Prudencio <rasanche@...hat.com>)
Re: Terminal Control Chars (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2018-1000168: nghttp2: Denial of service due to NULL pointer dereference. (Tatsuhiro Tsujikawa <tatsuhiro.t@...il.com>)
Re: Terminal Control Chars (Ian Zimmerman <itz@...y.loosely.org>)
Re: Re: Terminal Control Chars (Russ Allbery <eagle@...ie.org>)
Re: Re: Terminal Control Chars ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Re: Terminal Control Chars (Russ Allbery <eagle@...ie.org>)
Re: Re: Terminal Control Chars (Simon McVittie <smcv@...ian.org>)

April 13 (4 messages)

Re: Re: Terminal Control Chars ("David A. Wheeler" <dwheeler@...eeler.com>)
Updated distros statistics (Kristian Fiskerstrand <k_f@...too.org>)
Re: Updated distros statistics (Seth Arnold <seth.arnold@...onical.com>)
Re: Terminal Control Chars (Jakub Wilk <jwilk@...lk.net>)

April 16 (3 messages)

Re: Re: Terminal Control Chars (Jakub Wilk <jwilk@...lk.net>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2018-0737 OpenSSL: RSA key generation follows several non constant time code paths (Billy Brumley <bbrumley@...il.com>)

April 17 (1 message)

Re: CVE-2018-0737 OpenSSL: RSA key generation follows several non constant time code paths (Huzaifa Sidhpurwala <huzaifas@...hat.com>)

April 18 (2 messages)

CVE-2018-1088 glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled (Siddharth Sharma <siddharth@...hat.com>)
CVE-2018-1172 Squid Proxy Cache Denial of Service vulnerability (Amos Jeffries <squid3@...enet.co.nz>)

April 19 (5 messages)

[SECURITY] CVE-2018-1289: Apache Fineract SQL Injection Vulnerability by orderBy and sortOrder parameters (Ed Cable <edcable@...os.org>)
[SECURITY] CVE-2018-1290: Apache Fineract SQL Injection Vulnerability - Single quotation escape caused by two continuous SQL param… (Ed Cable <edcable@...os.org>)
[SECURITY] CVE-2018-1291: Apache Fineract SQL Injection Vulnerability - Order by injection via Order Param (Ed Cable <edcable@...os.org>)
[SECURITY] CVE-2018-1292: Apache Fineract SQL Injection Vulnerability - Injection via reportName parameter (Ed Cable <edcable@...os.org>)
CVE-2018-10194 Ghostscript 9.18 stack-based buffer overflow (Vítor Silva <vitorhg20080@...il.com>)

April 20 (3 messages)

Re: CVE-2018-0737 OpenSSL: RSA key generation follows several non constant time code paths (Billy Brumley <bbrumley@...il.com>)
Re: a number of CVEs for issues in the filesystem's code in the Linux kernel (Vladis Dronov <vdronov@...hat.com>)
[OSSA-2018-001] Raw underlying encrypted volume access (CVE-2017-18191) (Tristan Cacqueray <tdecacqu@...hat.com>)

April 23 (3 messages)

Authorization bypass in PHPLiteAdmin since 1.9.5 (Karsten König <mail@...enig.net>)
CVE-2018-1110: Knot Resolver <= 2.2.0 Improper Input Validation (Petr Špaček <petr.spacek@....cz>)
Multiple local root vulnerabilities involving PackageKit CVE-2018-1106 (Matthias Gerstner <mgerstner@...e.de>)

April 24 (3 messages)

ktexteditor / Kate local privilege escalation (Matthias Gerstner <mgerstner@...e.de>)
Re: CVE-2018-0737 OpenSSL: RSA key generation follows several non constant time code paths (Billy Brumley <bbrumley@...il.com>)
CVE-2018-1000200 (Linux): Bad memory access on oom kill of large mlocked process (David Rientjes <rientjes@...gle.com>)

April 25 (8 messages)

Re: CVE-2018-0737 OpenSSL: RSA key generation follows several non constant time code paths (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: ktexteditor / Kate local privilege escalation (CVE-2018-10361) (Matthias Gerstner <mgerstner@...e.de>)
Re: Authorization bypass in PHPLiteAdmin since 1.9.5 (Karsten König <mail@...enig.net>)
Xen Security Advisory 258 - Information leak via crafted user-supplied CDROM (Xen.org security team <security@....org>)
Xen Security Advisory 259 - x86: PV guest may crash Xen with XPTI (Xen.org security team <security@....org>)
[CVE-2018-1338] DoS (Infinite Loop) Vulnerability in Apache Tika’s BPGParser (Tim Allison <tallison@...che.org>)
[CVE-2018-1339] DoS (Infinite Loop) Vulnerability in Apache Tika’s ChmParser (Tim Allison <tallison@...che.org>)
[CVE-2018-1335] Command Injection Vulnerability in Apache Tika’s tika-server module (Tim Allison <tallison@...che.org>)

April 26 (1 message)

[ANNOUNCE] CVE-2017-15691: Apache UIMA XML external entity expansion (XXE) attack exposure (Marshall Schor <schor@...che.org>)

April 27 (1 message)

CVE-XXX (quasselclient/quasselcore version 0.12.4): Heap Remote Code Execution and Null Pointer DDOS (nongiach nongiach <nongiach@...il.com>)

April 30 (3 messages)

Xen Security Advisory 258 (CVE-2018-10472) - Information leak via crafted user-supplied CDROM (Xen.org security team <security@....org>)
Xen Security Advisory 259 (CVE-2018-10471) - x86: PV guest may crash Xen with XPTI (Xen.org security team <security@....org>)
Re: Re: Linux Kernel Defence Map (Alexander Popov <alex.popov@...ux.com>)

81 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.