oss-security mailing list - 2018/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 7	³ 3	⁴ 4	⁵ 1	⁶ 4	⁷	⁸
⁹	¹⁰ 4	¹¹ 8	¹² 3	¹³ 2	¹⁴	¹⁵
¹⁶ 1	¹⁷ 2	¹⁸ 8	¹⁹ 2	²⁰ 6	²¹	²² 1
²³ 1	²⁴ 1	²⁵ 2	²⁶ 5	²⁷	²⁸ 1	²⁹ 1
³⁰ 1	³¹ 3

Messages by day:

July 2 (7 messages)

Re: Apache CXF 3.2.6 and 3.1.16 are released (David Karlsen <davidkarlsen@...il.com>)
accountsservice: insufficient path check in user_change_icon_file_authorized_cb() (Matthias Gerstner <mgerstner@...e.de>)
cinnamon: possible symlink attack in cinnamon-settings-users.py (Matthias Gerstner <mgerstner@...e.de>)
Re: accountsservice: insufficient path check in user_change_icon_file_authorized_cb() (Jakub Wilk <jwilk@...lk.net>)
Re: cinnamon: possible symlink attack in cinnamon-settings-users.py (Matthias Gerstner <mgerstner@...e.de>)
Re: accountsservice: insufficient path check in user_change_icon_file_authorized_cb() (Matthias Gerstner <mgerstner@...e.de>)
Re: accountsservice: insufficient path check in user_change_icon_file_authorized_cb() (Simon McVittie <smcv@...ian.org>)

July 3 (3 messages)

Re: accountsservice: insufficient path check in user_change_icon_file_authorized_cb() (Matthias Gerstner <mgerstner@...e.de>)
coverity scan of qmail -- 53 potential defects (with false positives) (Georgi Guninski <guninski@...inski.com>)
Re: CVE-2018-1000204: Linux kernel 3.18 to 4.16 infoleak due to incorrect handling of SG_IO ioctl (Alexander Potapenko <glider@...gle.com>)

July 4 (4 messages)

Apache CXF Fediz 1.4.4 is released (Colm O hEigeartaigh <coheigea@...che.org>)
[SECURITY] CVE-2018-8026: XXE vulnerability due to Apache Solr configset upload (exchange rate provider config / enum fi… ("Uwe Schindler" <uschindler@...che.org>)
Statistics for distros lists updated for Q2 (Kristian Fiskerstrand <k_f@...too.org>)
Re: [SECURITY] CVE-2018-8026: XXE vulnerability due to Apache Solr configset upload (exchange rate provider config / enum fi… (will martin <wmartinusa@...il.com>)

July 5 (1 message)

BIND Operational Notification: Extremely large zone transfers can result in corrupted journal files or server process termina… (Michael McNally <mcnally@....org>)

July 6 (4 messages)

mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (<zrlw@...a.com>)
Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (Greg KH <greg@...ah.com>)
Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (Solar Designer <solar@...nwall.com>)
Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (<zrlw@...a.com>)

July 10 (4 messages)

[OSSN-0084] Data retained after deletion of a ScaleIO volume (Luke Hinds <lhinds@...hat.com>)
[Annoucement] CVE-2018-1337 Plaintext Password Disclosure in Secured Channel (Emmanuel Lecharny <elecharny@...che.org>)
Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (Greg KH <greg@...ah.com>)
CVE-2018-1331: Apache Storm remote code execution vulnerability (Bobby Evans <bobby@...che.org>)

July 11 (8 messages)

[SECURITY ADVISORY] curl SMTP send heap buffer overflow (Daniel Stenberg <daniel@...x.se>)
polkit: CVE-2018-1116: polkitd trusting client-supplied UID allows spoofed authentication dialogs (Matthias Gerstner <mgerstner@...e.de>)
Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (<zrlw@...a.com>)
Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (<zrlw@...a.com>)
Re: Re: mmap vulnerability in motion eye video4linux driver for Sony Vaio PictureBook (Greg KH <greg@...ah.com>)
CVE-2018-8007: Apache CouchDB administrative privilege escalation (Dave Cottlehuber <dch@...che.org>)
CVE-2018-10895: Remote code execution due to CSRF in qutebrowser (Florian Bruhin <me@...-compiler.org>)
CVE-2018-5739: ISC Kea 1.4.0 failure to release memory may exhaust system resources (Michael McNally <mcnally@....org>)

July 12 (3 messages)

CVE-2018-1334 Apache Spark local privilege escalation vulnerability (Sean Owen <srowen@...che.org>)
CVE-2018-8024 Apache Spark XSS vulnerability in UI (Sean Owen <srowen@...che.org>)
Re: Libc Realpath Buffer Underflow CVE-2018-1000001 expolit source code for SuSE 12 SP2 (halfdog <me@...fdog.net>)

July 13 (2 messages)

Fastbin double free in MP4v2 2.0.0 (Ruikai Liu <lrk700@...il.com>)
CVE-2018-13405: Linux kernel: fs/inode.c:inode_init_owner() function mishandled a file creation in setgid directories (Vladis Dronov <vdronov@...hat.com>)

July 16 (1 message)

Integer underflow/overflow in MP4v2 2.0.0 (Ruikai Liu <lrk700@...il.com>)

July 17 (2 messages)

Type confusion in MP4v2 2.0.0 (Ruikai Liu <lrk700@...il.com>)
[CVE-2018-1000211] Public apps can't revoke OAuth access & refresh tokens in Doorkeeper (Justin Bull <me@...tinbull.ca>)

July 18 (8 messages)

CVE-2018-1333: Apache HTTP Server HTTP/2 DoS (Mark Cox <mjc@...che.org>)
CVE-2018-8011: Apache HTTP Server mod_md DoS (Mark Cox <mjc@...che.org>)
Out-of-bounds memory access in MP4v2 2.0.0 (Ruikai Liu <lrk700@...il.com>)
CVE-2018-14055: privilege escalation in ZNC (Alexey Sokolov <alexey+znc@...kolov.org>)
CVE-2018-14056: path traversal in ZNC (Alexey Sokolov <alexey+znc@...kolov.org>)
CVE-2018-8042: Passwords for Hadoop credential stores are visible in Ambari Agent standard out in Apache Ambari (Robert Levas <rlevas@...che.org>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)

July 19 (2 messages)

[CVE-2018-1273] Apache Ignite impacted by security vulnerability in Spring Data Commons (Denis Magda <dmagda@...che.org>)
[CVE-2018-8018] Possible Execution of Arbitrary Code via Apache Ignite GridClientJdkMarshaller (Denis Magda <dmagda@...che.org>)

July 20 (6 messages)

CVE request: Wesnoth arbitrary code execution/sandbox escape (Iris Morelle <shadowm2006@...il.com>)
Re: CVE request: Wesnoth arbitrary code execution/sandbox escape (Emilio Pozuelo Monfort <pochu27@...il.com>)
CVE-2018-10900: NetworkManager-vpnc-1.2.4 local privilege escalation (Lubomir Rintel <lkundrak@...sk>)
Re: accountsservice: insufficient path check in user_change_icon_file_authorized_cb() (Jakub Wilk <jwilk@...lk.net>)
[CVE] CVE-2018-11756 PHP Runtime for Apache OpenWhisk (Rodric Rabbah <rabbah@...che.org>)
[CVE] CVE-2018-11757 Docker Skeleton Runtime for Apache OpenWhisk (Rodric Rabbah <rabbah@...che.org>)

July 22 (1 message)

Re: CVE request: Wesnoth arbitrary code execution/sandbox escape (Iris Morelle <shadowm2006@...il.com>)

July 23 (1 message)

CVE-2018-8031 Apache TomEE Webapp XSS (Jonathan Gallimore <jgallimore@...che.org>)

July 24 (1 message)

[CVE-2018-10906] libfuse: restriction bypass of the "allow_other" option when SELinux is active (Nikolaus Rath <nikolaus@...h.org>)

July 25 (2 messages)

Xen Security Advisory 274 - Linux: Uninitialized state in PV syscall return path (Xen.org security team <security@....org>)
[OSSA-2018-002] GET /v3/OS-FEDERATION/projects leaks project information (CVE-2018-14432) (Matthew Thode <prometheanfire@...too.org>)

July 26 (5 messages)

Fw: New cabextract 1.7 and libmspack 0.7 release (Hanno Böck <hanno@...eck.de>)
Squirrelmail XSS security fix (Hanno Böck <hanno@...eck.de>)
CVE-2017-12610: Authenticated Kafka clients may impersonate other users (Rajini Sivaram <rsivaram@...che.org>)
CVE-2018-1288: Authenticated Kafka clients may interfere with data replication (Rajini Sivaram <rajinisivaram@...il.com>)
Re: Pointer misuse unziping files with busybox (Salvatore Bonaccorso <carnil@...ian.org>)

July 28 (1 message)

Re: Fw: New cabextract 1.7 and libmspack 0.7 release (Salvatore Bonaccorso <carnil@...ian.org>)

July 29 (1 message)

Re: Pointer misuse unziping files with busybox (Justin Ferguson <justin@...c.co>)

July 30 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

July 31 (3 messages)

[SECURITY] New security advisory CVE-2018-8027 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
Xen Security Advisory 274 v2 (CVE-2018-14678) - Linux: Uninitialized state in x86 PV failsafe callback path (Xen.org security team <security@....org>)
blueman before version 2.0.6 is not enforcing authorization for polkit action org.blueman.network.setup (Matthias Gerstner <mgerstner@...e.de>)

71 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.