oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 3	²	³ 2	⁴	⁵ 1	⁶ 1
⁷ 3	⁸ 5	⁹ 4	¹⁰ 2	¹¹ 2	¹²	¹³
¹⁴ 6	¹⁵ 5	¹⁶ 7	¹⁷ 2	¹⁸ 2	¹⁹	²⁰ 1
²¹ 6	²² 2	²³ 4	²⁴	²⁵ 5	²⁶ 1	²⁷
²⁸	²⁹	³⁰ 1	³¹ 6

Messages by day:

May 1 (3 messages)

Re: CVE-XXX (quasselclient/quasselcore version 0.12.4): Heap Remote Code Execution and Null Pointer DDOS (nongiach nongiach <nongiach@...il.com>)
CVE-2016-6811: Apache Hadoop Privilege escalation vulnerability (Akira Ajisaka <aajisaka@...che.org>)
CVE-2018-1000199: ptrace() incorrect error handling leads to corruption and DoS (Andy Lutomirski <luto@...nel.org>)

May 3 (2 messages)

Singularity's Linux kernel vulnerability claim ("Priedhorsky, Reid" <reidpr@...l.gov>)
Re: Singularity's Linux kernel vulnerability claim (gremlin@...mlin.ru)

May 5 (1 message)

[ANNOUNCE] CVE-2018-1313: Apache Derby externally-controlled input vulnerability (Bryan Pendleton <bpendleton.derby@...il.com>)

May 6 (1 message)

GNU Wget Cookie Injection [CVE-2018-0494] (Harry Sintonen <sintonen@....fi>)

May 7 (3 messages)

WebKitGTK+ Security Advisory WSA-2018-0004 (Michael Catanzaro <mcatanzaro@...lia.com>)
CVE-2018-1089 389-ds-base: unauthenticated ns-slapd crash via large filter value in ldapsearch (Cedric Buissart <cbuissar@...hat.com>)
Re: CVE-2018-1089 389-ds-base: unauthenticated ns-slapd crash via large filter value in ldapsearch (Cedric Buissart <cbuissar@...hat.com>)

May 8 (5 messages)

Xen Security Advisory 260 (CVE-2018-8897) - x86: mishandling of debug exceptions (Xen.org security team <security@....org>)
Xen Security Advisory 261 - x86 vHPET interrupt injection errors (Xen.org security team <security@....org>)
Xen Security Advisory 262 - qemu may drive Xen into unbounded loop (Xen.org security team <security@....org>)
CVE-2018-8897: #DB exceptions that are deferred by MOV SS or POP SS may cause unexpected behavior (Andy Lutomirski <luto@...nel.org>)
CVE-2018-1087: KVM incorrectly handles #DB exceptions while deferred by MOV SS/POP SS (Andy Lutomirski <luto@...nel.org>)

May 9 (4 messages)

CVE-2018-1118 linux kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (Wade Mealing <wmealing@...hat.com>)
PowerDNS Security Advisory 2018-02 (Remi Gacogne <remi.gacogne@...erdns.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2018-1000155: Denial of Service, Improper Authentication and Authorization, and Covert Channel in the OpenFlow 1.0+… (Kashyap Thimmaraju <kashyap.thimmaraju@…)

May 10 (2 messages)

CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Vladis Dronov <vdronov@...hat.com>)
erc20 contract KoreaShow bug (Qinghao Tang <luodalongde@...il.com>)

May 11 (2 messages)

Xen Security Advisory 262 (CVE-2018-10981) - qemu may drive Xen into unbounded loop (Xen.org security team <security@....org>)
Xen Security Advisory 261 (CVE-2018-10982) - x86 vHPET interrupt injection errors (Xen.org security team <security@....org>)

May 14 (6 messages)

PGP/MIME and S/MIME mail clients vulnerabilities (Yves-Alexis Perez <corsac@...ian.org>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Jakub Wilk <jwilk@...lk.net>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Christian Brabandt <cb@...bit.org>)
Re: [ANNOUNCE] CVE-2018-1313: Apache Derby externally-controlled input vulnerability (Tomas Hoger <thoger@...hat.com>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE-2018-1000200 (Linux): Bad memory access on oom kill of large mlocked process (David Rientjes <rientjes@...gle.com>)

May 15 (5 messages)

Re: PGP/MIME and S/MIME mail clients vulnerabilities (Brian May <brian@...uxpenguins.xyz>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Yves-Alexis Perez <corsac@...ian.org>)
Re: [ANNOUNCE] CVE-2018-1313: Apache Derby externally-controlled input vulnerability (Bryan Pendleton <bpendleton.derby@...il.com>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Leo Gaspard <oss-security@....gaspard.ninja>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)

May 16 (7 messages)

[SECURITY AVISORY] curl: FTP shutdown response buffer overflow (Daniel Stenberg <daniel@...x.se>)
[SECURITY AVISORY] curl: RTSP bad headers buffer over-read (Daniel Stenberg <daniel@...x.se>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Yves-Alexis Perez <corsac@...ian.org>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Brian May <bam@...ian.org>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Brian May <bam@...ian.org>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Matthew Fernandez <matthew.fernandez@...il.com>)
[SECURITY] CVE-2018-8014 Insecure defaults for CORS filter (Mark Thomas <markt@...che.org>)

May 17 (2 messages)

Qualys Security Advisory - Procps-ng Audit Report (Qualys Security Advisory <qsa@...lys.com>)
Apache ORC 1.5.0 and 1.4.4 Released ("Owen O'Malley" <owen.omalley@...il.com>)

May 18 (2 messages)

[opendaylight-security-note]: SDNInterfaceapp SQL injection (Luke Hinds <lhinds@...hat.com>)
ISC has disclosed two vulnerabilities in BIND 9.12 (CVE-2018-5736, CVE-2018-5737) (ISC Security Officer <security-officer@....org>)

May 20 (1 message)

Reptile: a LKM rootkit written for evil purposes (nullbyte <seclist45@...il.com>)

May 21 (6 messages)

[CVE-2018-10094] Dolibarr SQL Injection vulnerability (Sysdream Labs <labs@...dream.com>)
[CVE-2018-10092] Dolibarr admin panel authenticated Remote Code Execution (RCE) vulnerability (Sysdream Labs <labs@...dream.com>)
Dolibarr XSS Injection vulnerability (Sysdream Labs <labs@...dream.com>)
[SECURITY] CVE-2018-8010: XXE vulnerability due to Apache Solr configset upload ("Uwe Schindler" <uschindler@...che.org>)
Re: [ANNOUNCE] CVE-2018-1313: Apache Derby externally-controlled input vulnerability (Tomas Hoger <thoger@...hat.com>)
[CVE-2018-8012] Apache ZooKeeper Quorum Peer mutual authentication (Patrick Hunt <phunt@...che.org>)

May 22 (2 messages)

[ANNOUNCE] CVE Announcement for Apache NiFi 1.0.0 - 1.5.0 (Andy LoPresto <alopresto@...che.org>)
Re: PGP/MIME and S/MIME mail clients vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)

May 23 (4 messages)

[CVE-2018-8013] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
Re: Qualys Security Advisory - Procps-ng Audit Report (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Andrey Konovalov <andreyknvl@...il.com>)
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Kurt Seifried <kseifried@...hat.com>)

May 25 (5 messages)

Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Andrey Konovalov <andreyknvl@...il.com>)
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Evgenii Shatokhin <eshatokhin@...tuozzo.com>)
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Andrey Konovalov <andreyknvl@...il.com>)
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit (Andrey Konovalov <andreyknvl@...il.com>)

May 26 (1 message)

Re: [ANNOUNCE] CVE-2018-1313: Apache Derby externally-controlled input vulnerability (Bryan Pendleton <bpendleton.derby@...il.com>)

May 30 (1 message)

MachForm Multiple Vulnerabilities CVE-2018-6409/CVE-2018-6410/CVE-2018-6411 (Amine Taouirsa <taouirsa@...il.com>)

May 31 (6 messages)

CVE request: rufus ("Stefan Kanthak" <stefan.kanthak@...go.de>)
[CVE-2018-10847] prosody: insufficient stream header validation (Matthew Wild <mwild1@...il.com>)
Re: CVE request: rufus (Pete Batard <pete@...o.ie>)
Re: CVE request: rufus ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: CVE request: rufus (Solar Designer <solar@...nwall.com>)
Re: CVE request: rufus (Pete Batard <pete@...o.ie>)

71 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.