oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	² 1
³ 2	⁴ 6	⁵ 5	⁶ 5	⁷ 1	⁸	⁹ 2
¹⁰ 3	¹¹ 3	¹² 2	¹³ 3	¹⁴	¹⁵ 1	¹⁶ 1
¹⁷ 5	¹⁸ 4	¹⁹ 11	²⁰ 4	²¹ 1	²² 1	²³
²⁴ 2	²⁵ 6	²⁶ 3	²⁷ 2	²⁸ 1	²⁹ 1	³⁰

Messages by day:

September 1 (2 messages)

Re: Travis CI MITM RCE (zugtprgfwprz@...rnkuller.de)
Re: Travis CI MITM RCE (zugtprgfwprz@...rnkuller.de)

September 2 (1 message)

CVE-2018-10853 kernel: kvm: guest userspace to guest kernel write (P J P <ppandit@...hat.com>)

September 3 (2 messages)

Re: Linux kernel: CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto subsystem. (Wade Mealing <wmealing@...hat.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Marcus Meissner <meissner@...e.de>)

September 4 (6 messages)

glusterfs: multiple flaws (Siddharth Sharma <siddharth@...hat.com>)
CVE-2018-6554 and CVE-2018-6555: Linux kernel: irda memory leak and use after free (Tyler Hicks <tyhicks@...onical.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Brandon Perry <bperry.volatile@...il.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)

September 5 (5 messages)

[SECURITY ADVISORY] curl: NTLM password overflow via integer overflow (Daniel Stenberg <daniel@...x.se>)
Re: CVE-2018-6554 and CVE-2018-6555: Linux kernel: irda memory leak and use after free (Vladis Dronov <vdronov@...hat.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? ("Perry E. Metzger" <perry@...rmont.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Stuart Gathman <stuart@...hman.org>)

September 6 (5 messages)

Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? ("Perry E. Metzger" <perry@...rmont.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Leonid Isaev <leonid.isaev@...a.colorado.edu>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Marcus Meissner <meissner@...e.de>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Jakub Wilk <jwilk@...lk.net>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Leonid Isaev <leonid.isaev@...a.colorado.edu>)

September 7 (1 message)

perl Crypt::JWT vulnerability (Jeremy Choi <jechoi@...hat.com>)

September 9 (2 messages)

Re: Ghostscript 9.24 issues (Tavis Ormandy <taviso@...gle.com>)
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? (Tavis Ormandy <taviso@...gle.com>)

September 10 (3 messages)

[ANNOUNCE] CVE-2018-11775: ActiveMQ Client - Missing TLS Hostname Verification (Christopher Shannon <christopher.l.shannon@...il.com>)
Re: [ANNOUNCE] CVE-2018-11775: ActiveMQ Client - Missing TLS Hostname Verification (Christopher Shannon <christopher.l.shannon@...il.com>)
Re: [ANNOUNCE] CVE-2018-11775: ActiveMQ Client - Missing TLS Hostname Verification (Solar Designer <solar@...nwall.com>)

September 11 (3 messages)

Re: Re: Ghostscript 9.24 issues (Marcus Meissner <meissner@...e.de>)
Blind SQL injection and multiple reflected XSS vulnerabilities in Wordpress Plugin Arigato Autoresponder and Newsletter v… ("Larry W. Cashdollar" <larry0@...com>)
tdesktop leaks user IP address (Dhiraj Mishra <mishra.dhiraj95@...il.com>)

September 12 (2 messages)

[SECURITY] New security advisory CVE-2018-8041 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
Re: tdesktop leaks user IP address (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

September 13 (3 messages)

Cleartext passwords external services in Squash TM's web interface (Guillaume Quéré <guillaume@...re.eu>)
OpenSC release 0.19.0 (Frank Morgner <frankmorgner@...il.com>)
CVE-2018-1330: Libprocess might crash when decoding malformed HTTP requests or malformed JSON payload. (Alex R <alexr@...che.org>)

September 15 (1 message)

haskell-tls: Inconsistencies in answers to RSA errors (possiby Bleichenbacher/ROBOT attack) (Hanno Böck <hanno@...eck.de>)

September 16 (1 message)

[SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 ("Kevin A. McGrail" <kmcgrail@...che.org>)

September 17 (5 messages)

Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 (Reindl Harald <h.reindl@...lounge.net>)
Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 ("Kevin A. McGrail" <kmcgrail@...che.org>)
Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 (Reindl Harald <h.reindl@...lounge.net>)
[SBA-ADV-20180420-01] CVE-2018-13982: Smarty 3.1.32 or below Trusted-Directory Bypass via Path Traversal (SBA Research Advisory <advisory@...-research.org>)
Re: Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 (Leo Famulari <leo@...ulari.name>)

September 18 (4 messages)

CVE-2018-14641: Linux kernel: a security flaw in the ip_frag_reasm() (Vladis Dronov <vdronov@...hat.com>)
[SECURITY] New security advisory for CVE-2018-11786 released for Apache Karaf (Jean-Baptiste Onofré <jb@...thrax.net>)
[SECURITY] New security advisory for CVE-2018-11787 released for Apache Karaf (Jean-Baptiste Onofré <jb@...thrax.net>)
Linux kernel: potential local priviledge escalation bug in vmacache code (Davidlohr Bueso <dave@...olabs.net>)

September 19 (11 messages)

Re: Linux kernel: potential local priviledge escalation bug in vmacache code (Vladis Dronov <vdronov@...hat.com>)
Re: Linux kernel: potential local priviledge escalation bug in vmacache code (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux kernel: potential local priviledge escalation bug in vmacache code (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2018-11761] Apache Tika DoS XML Entity Expansion Vulnerability (Tim Allison <tallison@...che.org>)
[CVE-2018-11762] Zip Slip Vulnerability in Apache Tika's tika-app (Tim Allison <tallison@...che.org>)
[CVE-2018-8017] Apache Tika Denial of Service Vulnerability -- Potential Infinite Loop in IptcAnpaParser (Tim Allison <tallison@...che.org>)
CVE-2018-12642: Incorrect Access Control of tickets in Froxlor <= 0.9.39.5 (chbi@...i.eu)
tdesktop 1.3.14: index out of range (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
Re: tdesktop 1.3.14: index out of range ("Stuart D. Gathman" <stuart@...hman.org>)
Re: tdesktop 1.3.14: index out of range (Solar Designer <solar@...nwall.com>)
ISC has issued new patch releases of BIND (Michael McNally <mcnally@....org>)

September 20 (4 messages)

X41 D-Sec GmbH Security Advisory X41-2018-008: Multiple Vulnerabilities in HylaFAX (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
X41 D-Sec GmbH Security Advisory X41-2018-007: Multiple Vulnerabilities in mgetty (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
Re: ISC has issued new patch releases of BIND (Solar Designer <solar@...nwall.com>)
CVE-2018-5740 BIND (named vuln) and bad OVAL dict file maintenance (scrumpyjack@...ilet.to)

September 21 (1 message)

CVE-2018-8023: A remote attacker can exploit a vulnerability in the JWT implementation to gain unauthenticated access to Mesos Execut… (Alex R <alexr@...che.org>)

September 22 (1 message)

Re: CVE-2018-8023: A remote attacker can exploit a vulnerability in the JWT implementation to gain unauthenticated acce… (Ariel Zelivansky <ariel.zelivans@...il.…)

September 24 (2 messages)

Re: CVE-2018-8023: A remote attacker can exploit a vulnerability in the JWT implementation to gain unauthenticated access t… (Terry Chia <terrycwk1994@...il.com>)
CVE-2018-14633: Linux kernel: security flaw in iscsi target code (Vladis Dronov <vdronov@...hat.com>)

September 25 (6 messages)

bounties (Justin Ferguson <justin@...c.co>)
Re: bounties (Solar Designer <solar@...nwall.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Integer overflow in Linux's create_elf_tables() (CVE-2018-14634) (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2018-8023: A remote attacker can exploit a vulnerability in the JWT implementation to gain unauthenticated acce… (Ariel Zelivansky <ariel.zelivans@...il.…)
Re: bounties (Jeremy Stanley <fungi@...goth.org>)

September 26 (3 messages)

Re: bounties (Justin Ferguson <jnferguson@...il.com>)
Re: bounties (Solar Designer <solar@...nwall.com>)
Apache Ignite: CVE-2018-8018, CVE-2018-1273, CVE-2018-1274: Notification on available mitigation (Alexander Gerus <agerus@...dgain.com>)

September 27 (2 messages)

Telegram uses SOCKS5 to share user/creds (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
Using quilt on untrusted RPM spec files (Matthias Gerstner <mgerstner@...e.de>)

September 28 (1 message)

Re: Using quilt on untrusted RPM spec files (Randy Barlow <randy@...ctronsweatshop.com>)

September 29 (1 message)

WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007 (Michael Catanzaro <mcatanzaro@...lia.com>)

78 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.