oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 3	² 3	³	⁴	⁵ 1
⁶ 4	⁷	⁸ 6	⁹ 14	¹⁰ 3	¹¹	¹²
¹³ 1	¹⁴ 14	¹⁵ 5	¹⁶ 2	¹⁷ 10	¹⁸	¹⁹
²⁰ 4	²¹ 7	²² 6	²³ 16	²⁴ 2	²⁵ 3	²⁶ 4
²⁷ 5	²⁸ 11	²⁹ 8	³⁰ 1	³¹ 2

Messages by day:

August 1 (3 messages)

Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Django security releases issued: 1.11.15 and 2.0.8 (Tim Graham <timograham@...il.com>)
[SBA-ADV-20180425-01] CVE-2015-5243 rediscovered: phpWhois before 5.1.0 PHP Code Injection (SBA Research Advisory <advisory@...-research.org>)

August 2 (3 messages)

Stored XSS vulnerabilities in Tiki <= 18.1 (chbi@...i.eu)
Re: Stored XSS vulnerabilities in Tiki <= 18.1 (chbi@...i.eu)
Linux kernel: CVE-2017-18344: arbitrary-read vulnerability in the timer subsystem (Andrey Konovalov <andreyknvl@...il.com>)

August 5 (1 message)

Heap-based buffer overflow in zutils zcat (Ben Hutchings <ben@...adent.org.uk>)

August 6 (4 messages)

Requesting CVE number for Qt Creator / Botan issue (Thiago Macieira <thiago@...ieira.org>)
CVE-2017-12614 XSS Vulnerability in Airflow < 1.9 (Ash Berlin-Taylor <ash@...che.org>)
Re: Requesting CVE number for Qt Creator / Botan issue (Henri Salo <henri@...v.fi>)
CVE-2018-6556: lxc-user-nic allows for open() of arbitrary paths (Stéphane Graber <stgraber@...ntu.com>)

August 8 (6 messages)

WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0006 (Michael Catanzaro <mcatanzaro@...lia.com>)
CVE-2018-11769: Apache CouchDB Remote Code Execution (affects versions 1.x and ≤2.1.2) (Joan Touzet <wohali@...che.org>)
Unauthenticated EAPOL-Key decryption in wpa_supplicant (Jouni Malinen <j@...fi>)
Re: Unauthenticated EAPOL-Key decryption in wpa_supplicant (Jens Timmerman <jens.timmerman@...il.com>)
Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Matthew Garrett <mjg59@...gle.com>)
Re: Unauthenticated EAPOL-Key decryption in wpa_supplicant (Jouni Malinen <jkmalinen@...il.com>)

August 9 (14 messages)

CVE-2018-5740: A flaw in the "deny-answer-aliases" feature can cause an INSIST assertion failure in named (Michael McNally <mcnally@....org>)
Knot Resolver 2.4.1 security release (Petr Špaček <petr.spacek@....cz>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Stiepan <stie@....swiss>)
RE: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) ("Reinis Rozitis" <r@...e.lv>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: CVE-2017-18344: arbitrary-read vulnerability in the timer subsystem (Andrey Konovalov <andreyknvl@...il.com>)
Re: Re: Linux kernel: CVE-2017-18344: arbitrary-read vulnerability in the timer subsystem (Simon McVittie <smcv@...ian.org>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Stiepan <stie@....swiss>)
cobbler CVE-2018-10931: CobblerXMLRPCInterface exports internal only functions over XMLRPC (Cedric Buissart <cbuissar@...hat.com>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) ("David T." <davidmthomsen@...il.com>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Solar Designer <solar@...nwall.com>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Matthew Garrett <mjg59@...gle.com>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Kurt H Maier <khm@...ops.net>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Solar Designer <solar@...nwall.com>)

August 10 (3 messages)

Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Stiepan <stie@...tonmail.ch>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Dave Horsfall <dave@...sfall.org>)
Re: Linux TCP implementation vulnerable to Denial of Service (CVE 2018-5390) (Amos Jeffries <squid3@...enet.co.nz>)

August 13 (1 message)

CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication (Sean Owen <srowen@...che.org>)

August 14 (14 messages)

CVE-2018-14424: Use-after-free in GDM (Chris Coulson <chris.coulson@...onical.com>)
X41 D-Sec GmbH Security Advisory X41-2018-001: Multiple Vulnerabilities in Yubico Piv (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
X41 D-Sec GmbH Security Advisory X41-2018-002: Multiple Vulnerabilities in OpenSC (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
X41 D-Sec GmbH Security Advisory X41-2018-003: Multiple Vulnerabilities in pam_pkcs11 (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
X41 D-Sec GmbH Security Advisory X41-2018-004: Multiple Vulnerabilities in Yubico libykneomgr (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
X41 D-Sec GmbH Security Advisory X41-2018-005: Multiple Vulnerabilities in Apple smartcardservices (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
CVE-2018-14722: btrfsmaintenance: Code execution (Marcus Meissner <meissner@...e.de>)
Xen Security Advisory 273 v1 (CVE-2018-3620,CVE-2018-3646) - L1 Terminal Fault speculative side channel (Xen.org security team <security@....org>)
Xen Security Advisory 268 v2 - Use of v2 grant tables may cause crash on ARM (Xen.org security team <security@....org>)
Xen Security Advisory 269 v2 - x86: Incorrect MSR_DEBUGCTL handling lets guests enable BTS (Xen.org security team <security@....org>)
Xen Security Advisory 270 v2 - Linux netback driver OOB access in hash handling (Xen.org security team <security@....org>)
Xen Security Advisory 271 v2 (CVE-2018-14007) - XAPI HTTP directory traversal (Xen.org security team <security@....org>)
Xen Security Advisory 272 v2 - oxenstored does not apply quota-maxentity (Xen.org security team <security@....org>)
CVE-2018-5391: Linux kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) (Vladis Dronov <vdronov@...hat.com>)

August 15 (5 messages)

Re: CVE-2018-5391: Linux kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) ("David T." <davidmthomsen@...il.com>)
Re: CVE-2018-5391: Linux kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) (Marcus Meissner <meissner@...e.de>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Xen Security Advisory 274 v3 (CVE-2018-14678) - Linux: Uninitialized state in x86 PV failsafe callback path (Xen.org security team <security@....org>)
OpenSSH Username Enumeration (Qualys Security Advisory <qsa@...lys.com>)

August 16 (2 messages)

Re: OpenSSH Username Enumeration (Matthew Daley <mattd@...fuzz.com>)
[CVE-2018-11771] Apache Commons Compress 1.7 to 1.17 denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)

August 17 (10 messages)

spice CVE-2018-10873: post-auth crash or potential heap corruption when demarshalling (Doran Moppert <dmoppert@...hat.com>)
Re: spice CVE-2018-10873: post-auth crash or potential heap corruption when demarshalling (Florian Weimer <fweimer@...hat.com>)
Re: spice CVE-2018-10873: post-auth crash or potential heap corruption when demarshalling (Frediano Ziglio <fziglio@...hat.com>)
Re: spice CVE-2018-10873: post-auth crash or potential heap corruption when demarshalling (Jeffrey Walton <noloader@...il.com>)
Rule for releasing fixes for embargoed bugs (Dominique Martinet <asmadeus@...ewreck.org>)
Re: Rule for releasing fixes for embargoed bugs (Marcus Meissner <meissner@...e.de>)
Re: Rule for releasing fixes for embargoed bugs (Dominique Martinet <asmadeus@...ewreck.org>)
Re: OpenSSH Username Enumeration (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Rule for releasing fixes for embargoed bugs (Amos Jeffries <squid3@...enet.co.nz>)
Re: OpenSSH Username Enumeration (Dariusz Tytko <dariusz.tytko@...uritum.pl>)

August 20 (4 messages)

Xen Security Advisory 269 v3 (CVE-2018-15468) - x86: Incorrect MSR_DEBUGCTL handling lets guests enable BTS (Xen.org security team <security@....org>)
Xen Security Advisory 268 v3 (CVE-2018-15469) - Use of v2 grant tables may cause crash on ARM (Xen.org security team <security@....org>)
Xen Security Advisory 272 v3 (CVE-2018-15470) - oxenstored does not apply quota-maxentity (Xen.org security team <security@....org>)
Xen Security Advisory 270 v3 (CVE-2018-15471) - Linux netback driver OOB access in hash handling (Xen.org security team <security@....org>)

August 21 (7 messages)

CVE-2018-10902 - linux kernel - double free in midi subsystem (Wade Mealing <wmealing@...hat.com>)
More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Alex Gaynor <alex.gaynor@...il.com>)
X.Org security advisory: August 21, 2018 (Matthieu Herrb <matthieu@...rb.eu>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)

August 22 (6 messages)

[ANN] CVE-2018-11776 Apache Struts 2.3 to 2.3.34 and 2.5 to 2.5.16 (Yasser Zamani <yasserzamani@...che.org>)
Re: Heap-based buffer overflow in zutils zcat (Ben Hutchings <ben@...adent.org.uk>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (AmitB <me@...tbl.com>)
CVE-2018-11758: Apache Cayenne XXE Vulnerability in CayenneModeler GUI tool (Andrus Adamchik <aadamchik@...che.org>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Fwd: X.Org security advisory: August 22, 2018 (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 23 (16 messages)

Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Florian Weimer <fweimer@...hat.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Leonardo Taccari <iamleot@...il.com>)
Re: Heap-based buffer overflow in zutils zcat (Antonio Diaz Diaz <antonio@....org>)
Re: OpenSSH Username Enumeration (Dariusz Tytko <dariusz.tytko@...uritum.pl>)
Re: OpenSSH Username Enumeration (Solar Designer <solar@...nwall.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Mateusz Lenik <mlen@...n.pl>)
Re: OpenSSH Username Enumeration (Qualys Security Advisory <qsa@...lys.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Leonardo Taccari <iamleot@...il.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Leonardo Taccari <iamleot@...il.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
[SECURITY] CVE-2018-8028: Bypass ALTER TABLE EXCHANGE PARTITIONS authorization for Hive (Sergio Peña <spena82@...il.com>)

August 24 (2 messages)

About OpenSSH "user enumeration" / CVE-2018-15473 (Damien Miller <djm@...drot.org>)
Re: About OpenSSH "user enumeration" / CVE-2018-15473 (Solar Designer <solar@...nwall.com>)

August 25 (3 messages)

Re: Re: About OpenSSH "user enumeration" / CVE-2018-15473 (Damien Miller <djm@...drot.org>)
Re: About OpenSSH "user enumeration" / CVE-2018-15473 (Solar Designer <solar@...nwall.com>)
Travis CI MITM RCE (Jakub Wilk <jwilk@...lk.net>)

August 26 (4 messages)

Re: Travis CI MITM RCE (Phil Pennock <oss-security-phil@...dhuis.org>)
Re: About OpenSSH "user enumeration" / CVE-2018-15473 (Damien Miller <djm@...drot.org>)
Re: About OpenSSH "user enumeration" / CVE-2018-15473 (Solar Designer <solar@...nwall.com>)
Re: Travis CI MITM RCE (Jeremy Stanley <fungi@...goth.org>)

August 27 (5 messages)

CVE-2018-10938: Linux kernel: net: infinite loop in net/ipv4/cipso_ipv4.c:cipso_v4_optptr() allows a remote DoS (Vladis Dronov <vdronov@...hat.com>)
Another OpenSSH "user enumeration" (Qualys Security Advisory <qsa@...lys.com>)
Another "user enumeration" in Dropbear (sjw@....ch)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? ("Perry E. Metzger" <perry@...rmont.com>)

August 28 (11 messages)

Linux kernel: CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto subsystem. (Wade Mealing <wmealing@...hat.com>)
Re: Another OpenSSH "user enumeration" (Marcus Meissner <meissner@...e.de>)
Linux kernel: FS_IOC_FSSETXATTR will lead to EXT4-fs shut down (zhrzhang(张洪睿) <zhrzhang@...cent.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Marcus Meissner <meissner@...e.de>)
Re: Linux kernel: FS_IOC_FSSETXATTR will lead to EXT4-fs shut down (Xiami <pengyu.tao@...li.com>)
CVE-2018-15746 Qemu: seccomp: blacklist is not applied to all threads (P J P <ppandit@...hat.com>)
Re: Linux kernel: CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto subsystem. (Greg KH <greg@...ah.com>)
Re: CVE-2018-10938: Linux kernel: net: infinite loop in net/ipv4/cipso_ipv4.c:cipso_v4_optptr() allows a remote DoS (Greg KH <greg@...ah.com>)
Re: Linux kernel: CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto subsystem. (Florian Weimer <fweimer@...hat.com>)
Re: Linux kernel: CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto subsystem. (Greg KH <greg@...ah.com>)
Re: Travis CI MITM RCE (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

August 29 (8 messages)

[ANNOUNCE] Apache Traffic Server vulnerability with an invalid TLS handshake - CVE-2018-8022 (Bryan Call <bcall@...che.org>)
[ANNOUNCE] Apache Traffic Server vulnerability with header variable access in the ESI plugin - CVE-2018-8040 (Bryan Call <bcall@...che.org>)
[ANNOUNCE] Apache Traffic Server vulnerability with method ACLs - CVE-2018-1318 (Bryan Call <bcall@...che.org>)
[ANNOUNCE] Apache Traffic Server vulnerability with multi-range requests - CVE-2018-8005 (Bryan Call <bcall@...che.org>)
[ANNOUNCE] Apache Traffic Server vulnerability with multiple HTTP smuggling and cache poisoning attacks - CVE-2018-8004 (Bryan Call <bcall@...che.org>)
Re: [ANNOUNCE] Apache Traffic Server vulnerability with header variable access in the ESI plugin - CVE-2018-8040 (Bryan Call <bcall@...che.org>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)

August 30 (1 message)

Re: Travis CI MITM RCE (zugtprgfwprz@...rnkuller.de)

August 31 (2 messages)

Re: Travis CI MITM RCE (vines@...eup.net)
Re: Travis CI MITM RCE (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

135 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.