oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 4	²	³ 1
⁴ 1	⁵ 4	⁶ 2	⁷ 4	⁸ 2	⁹ 1	¹⁰ 2
¹¹ 1	¹² 4	¹³ 12	¹⁴ 5	¹⁵ 10	¹⁶ 1	¹⁷ 1
¹⁸ 2	¹⁹ 4	²⁰ 1	²¹ 9	²² 5	²³ 1	²⁴
²⁵ 5	²⁶ 6	²⁷ 12	²⁸ 1	²⁹ 2	³⁰ 1

Messages by day:

June 1 (4 messages)

Re: CVE request: rufus ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: Re: CVE request: rufus (Henri Salo <henri@...v.fi>)
[CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 (Denis Magda <dmagda@...che.org>)
Re: Re: CVE request: rufus (Lionel Debroux <lionel_debroux@...oo.fr>)

June 3 (1 message)

CVE-2018-10058 and CVE-2018-10057 - cgminer <=4.10.0 and bfgminer <=5.5.0 remote management api post-auth buffer overflo… ("oststrom \(public\)" <pub@...strom.com…)

June 4 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

June 5 (4 messages)

[CVE-2018-1332] Apache Storm user impersonation vulnerability ("P. Taylor Goetz" <ptgoetz@...che.org>)
[CVE-2018-8008] Apache Storm arbitrary file write vulnerability ("P. Taylor Goetz" <ptgoetz@...che.org>)
RE: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 ("Rai, Harendra" <Harendra.Rai@....com>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

June 6 (2 messages)

Re: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 (Tomas Hoger <thoger@...hat.com>)
Re: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 (Denis Magda <dmagda@...che.org>)

June 7 (4 messages)

CVE-2018-11806 Qemu: slirp: heap buffer overflow while reassembling fragmented datagrams (P J P <ppandit@...hat.com>)
Secunia Research: Linux Kernel USB over IP Multiple Denial of Service Vulnerabilities ("Secunia Research" <vuln@...unia.com>)
Re: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114 (Andrey Gura <agura@...che.org>)
Perl: CVE-2018-12015: Archive::Tar: directory traversal vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)

June 8 (2 messages)

CVE-2018-1000204: Linux kernel 3.18 to 4.16 infoleak due to incorrect handling of SG_IO ioctl (Alexander Potapenko <glider@...gle.com>)
CVE-2018-12020 in GnuPG (Yves-Alexis Perez <corsac@...ian.org>)

June 9 (1 message)

Re: CVE-2018-12020 in GnuPG (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)

June 10 (2 messages)

Re : Re: CVE-2018-12020 in GnuPG (Stiepan <stie@....swiss>)
Re: Re : Re: CVE-2018-12020 in GnuPG (Yves-Alexis Perez <corsac@...ian.org>)

June 11 (1 message)

Buffer Overflow in pppd EAP-TLS implementation (Luciano Bello <luciano@...ian.org>)

June 12 (4 messages)

Are `su user' and/or `sudo -u user sh' considered dangerous? (Georgi Guninski <guninski@...inski.com>)
Re: Are `su user' and/or `sudo -u user sh' considered dangerous? (Jakub Wilk <jwilk@...lk.net>)
Re: Are `su user' and/or `sudo -u user sh' considered dangerous? (Jordan Glover <Golden_Miller83@...tonmail.ch>)
Re: Are `su user' and/or `sudo -u user sh' considered dangerous? ("Todd C. Miller" <Todd.Miller@...o.ws>)

June 13 (12 messages)

ISC has announced CVE-2018-5738, a defect in some versions of BIND (ISC Security Officer <security-officer@....org>)
[SECURITY] CVE-2017-15695 Apache Geode remote code execution vulnerability (Anthony Baker <abaker@...otal.io>)
Re : Re: Re : Re: CVE-2018-12020 in GnuPG (Stiepan <stie@....swiss>)
Re: Are `su user' and/or `sudo -u user sh' considered dangerous? (Georgi Guninski <guninski@...inski.com>)
Re: Re : Re: Re : Re: CVE-2018-12020 in GnuPG (Stephen Farrell <stephen.farrell@...tcd.ie>)
Re: Are `su user' and/or `sudo -u user sh' considered dangerous? (Georgi Guninski <guninski@...inski.com>)
Intel FP security issue (Loganaden Velvindron <loganaden@...il.com>)
Third Party Code Signing Vulnerability in Squirrel & Sparkle (Lets Secure <is3curi5@...il.com>)
Re: Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2018-12020, CVE-2018-12019 in GnuPG, Enigmails, GPGTools, python-gnupg (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)
Re: Intel FP security issue (Loganaden Velvindron <loganaden@...il.com>)
Xen Security Advisory 267 (CVE-2018-3665) - Speculative register leakage from lazy FPU context switching (Xen.org security team <security@....org>)

June 14 (5 messages)

WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0005 (Michael Catanzaro <mcatanzaro@...lia.com>)
Re: Are `su user' and/or `sudo -u user sh' considered dangerous? (Jakub Wilk <jwilk@...lk.net>)
CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)
Re: CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) ("Jason A. Donenfeld" <Jason@...c4.com>)

June 15 (10 messages)

Re: Are `su user' and/or `sudo -u user sh' considered dangerous? (Georgi Guninski <guninski@...inski.com>)
Re: Re: Intel FP security issue (Marcus Meissner <meissner@...e.de>)
Re: Re: Intel FP security issue ("Liguori, Anthony" <aliguori@...zon.com>)
Re: Intel FP security issue (Solar Designer <solar@...nwall.com>)
CVE-2018-3665 Lazy FPU Context Switching Information Leak (Anthony Liguori <aliguori@...zon.com>)
Re: Intel FP security issue (Anthony Liguori <anthony@...emonkey.ws>)
Re: CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)
Re: CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2018-3665 Lazy FPU Context Switching Information Leak (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2018-3665 Lazy FPU Context Switching Information Leak (Anthony Liguori <aliguori@...zon.com>)

June 16 (1 message)

Re: CVE-2018-12356 Breaking signature verification in pass (Simple Password Store) (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)

June 17 (1 message)

Fun with DBM-type databases... (Lionel Debroux <lionel_debroux@...oo.fr>)

June 18 (2 messages)

cantata: cantata-mounter D-Bus service local privilege escalation and other security issues (Matthias Gerstner <mgerstner@...e.de>)
[SECURITY] [CVE-2018-8030] Apache Qpid Broker-J Denial of Service Vulnerability when AMQP 0-8...0-91 messages exceed maximum siz… (Alex Rudyy <orudyy@...che.org>)

June 19 (4 messages)

Re: cantata: cantata-mounter D-Bus service local privilege escalation and other security issues (Matthias Gerstner <mgerstner@...e.de>)
[CVE-2018-3760] Path Traversal in Sprockets (Rafael Mendonça França <rafaelmfranca@...il.com>)
CVE-2018-12558: DOS in perl module Email::Address (Pali Rohár <pali.rohar@...il.com>)
Intel hyper-threading security issues (Loganaden Velvindron <loganaden@...il.com>)

June 20 (1 message)

CVE-2018-10841 glusterfs: access trusted peer group via remote-host command (Siddharth Sharma <siddharth@...hat.com>)

June 21 (9 messages)

Re: Intel hyper-threading security issues (Georgi Guninski <guninski@...inski.com>)
Re: Intel hyper-threading security issues (Stuart Henderson <stu@...cehopper.org>)
Re: Intel hyper-threading security issues (Lukas Odzioba <lukas.odzioba@...il.com>)
Re: Intel hyper-threading security issues (Lukas Odzioba <lukas.odzioba@...il.com>)
Re: Intel hyper-threading security issues (Sven Schwedas <sven.schwedas@....at>)
Re: Intel hyper-threading security issues (Georgi Guninski <guninski@...inski.com>)
Re: Intel hyper-threading security issues (Solar Designer <solar@...nwall.com>)
Re: Intel hyper-threading security issues (Lukas Odzioba <lukas.odzioba@...il.com>)
Re: Intel hyper-threading security issues (Gordon Tetlow <gordon@...lows.org>)

June 22 (5 messages)

Re: Intel hyper-threading security issues (Michael Ellerman <mpe@...erman.id.au>)
Re: CVE-2018-1000204: Linux kernel 3.18 to 4.16 infoleak due to incorrect handling of SG_IO ioctl (Vladis Dronov <vdronov@...hat.com>)
CVE-2018-8025 on Apache HBase (Josh Elser <elserj@...che.org>)
Re: Intel hyper-threading security issues (Solar Designer <solar@...nwall.com>)
Re: Intel hyper-threading security issues (Seth Arnold <seth.arnold@...onical.com>)

June 23 (1 message)

Re: Intel hyper-threading security issues (Peter Kjellström <cap@....liu.se>)

June 25 (5 messages)

Re: Intel hyper-threading security issues (Georgi Guninski <guninski@...inski.com>)
Libc Realpath Buffer Underflow CVE-2018-1000001 expolit source code for SuSE 12 SP2 (<zrlw@...a.com>)
Re: Libc Realpath Buffer Underflow CVE-2018-1000001 expolit source code for SuSE 12 SP2 (Marcus Meissner <meissner@...e.de>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

June 26 (6 messages)

CVE-2018-8016 on Apache Cassandra (Nate McCall <zznate@...che.org>)
[ CVE-2018-1306 ] Apache Portals Pluto information disclosure vulnerability ("Martin Scott Nicklous" <Scott.Nicklous@...ibm.com>)
Re: CVE-2018-1000204: Linux kernel 3.18 to 4.16 infoleak due to incorrect handling of SG_IO ioctl (Alexander Potapenko <glider@...gle.com>)
CVE-2018-10857 and CVE-2018-10859: git-annex private data exposure (Joey Hess <id@...yh.name>)
Re: CVE-2018-1000204: Linux kernel 3.18 to 4.16 infoleak due to incorrect handling of SG_IO ioctl (Vladis Dronov <vdronov@...hat.com>)
CVE-2018-1273 fixed in Metron 0.5.0 (James Sirota <jsirota@...che.org>)

June 27 (12 messages)

CVE for PyYAML RCE-factory API (Alex Gaynor <alex.gaynor@...il.com>)
Re: CVE for PyYAML RCE-factory API (Seth Arnold <seth.arnold@...onical.com>)
rclone data exflitration / unauthorized API use (oss-security-list@...tactdaniel.net)
Re: rclone data exflitration / unauthorized API use (Solar Designer <solar@...nwall.com>)
squirrelmail XSS issues in bug tracker since 2016 (Hanno Böck <hanno@...eck.de>)
Re: squirrelmail XSS issues in bug tracker since 2016 (Hanno Böck <hanno@...eck.de>)
KVM L1 guest escape - CVE-2018-12904 (Marcus Meissner <meissner@...e.de>)
Re: squirrelmail XSS issues in bug tracker since 2016 (Hanno Böck <hanno@...eck.de>)
Re: CVE for PyYAML RCE-factory API (Alex Gaynor <alex.gaynor@...il.com>)
Xen Security Advisory 264 (CVE-2018-12891) - preemption checks bypassed in x86 PV MM handling (Xen.org security team <security@....org>)
Xen Security Advisory 265 (CVE-2018-12893) - x86: #DB exception safety check can be triggered by a guest (Xen.org security team <security@....org>)
Xen Security Advisory 266 (CVE-2018-12892) - libxl fails to honour readonly flag on HVM emulated SCSI disks (Xen.org security team <security@....org>)

June 28 (1 message)

Apache CXF 3.2.6 and 3.1.16 are released (Colm O hEigeartaigh <coheigea@...che.org>)

June 29 (2 messages)

[CVE-2018-8036] DoS (OOM) Vulnerability in Apache PDFBox's AFMParser (Andreas Lehmkuehler <lehmi@...che.org>)
[CVE-2018-8036] DoS (OOM) Vulnerability in Apache PDFBox's AFMParser (Andreas Lehmkuehler <lehmi@...che.org>)

June 30 (1 message)

BUG_ON() on mips linux kernels 4.17.2 and earlier (old but alive) (Georgi Guninski <guninski@...inski.com>)

104 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.