oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2018/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 3	² 3	³ 3	⁴ 2	⁵ 6	⁶ 3	⁷ 1
⁸ 4	⁹ 12	¹⁰ 13	¹¹ 4	¹²	¹³	¹⁴ 1
¹⁵	¹⁶ 6	¹⁷ 10	¹⁸ 5	¹⁹	²⁰ 3	²¹ 1
²² 4	²³ 11	²⁴ 4	²⁵ 1	²⁶	²⁷ 1	²⁸ 3
²⁹ 5	³⁰ 2	³¹ 9

Messages by day:

October 1 (3 messages)

Django security release issued: 2.1.2 (Carlton Gibson <carlton.gibson@...il.com>)
Re: Django security release issued: 2.1.2 (Solar Designer <solar@...nwall.com>)
Re: Django security release issued: 2.1.2 (Alex Gaynor <alex.gaynor@...il.com>)

October 2 (3 messages)

Re: CVE Request - Information Exposure Vulnerability in WordPress Mobile Pack Wordpress Plugin v2.1.2 (and certain versions of v2.1… (Henri Salo <henri@...v.fi>)
arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor (Will Deacon <will.deacon@....com>)
Re: arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor (Henri Salo <henri@...v.fi>)

October 3 (3 messages)

Re: arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor (Florian Weimer <fw@...eb.enyo.de>)
Re: arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor (Marcus Meissner <meissner@...e.de>)
Re: arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor (Seth Arnold <seth.arnold@...onical.com>)

October 4 (2 messages)

CVE-2018-14656: Linux kernel: arbitrary kernel memory dump into the dmesg log (Vladis Dronov <vdronov@...hat.com>)
[NOTICE] CVE-2017-5658: Derived information disclosure by Apache Pony Mail (Daniel Gruno <humbedooh@...che.org>)

October 5 (6 messages)

CVE update - fixed in Apache Ranger 1.2.0 (Velmurugan Periasamy <vel@...che.org>)
[SECURITY] CVE-2011-3600 Apache OFBiz XML-RPC XXE Vulnerability (Taher Alkhateeb <slidingfilaments@...il.com>)
[SECURITY] CVE-2018-8033 Apache OFBiz XXE Vulnerability in HttpEngine (Taher Alkhateeb <slidingfilaments@...il.com>)
[CVE-2018-11797] DoS vulnerability in Apache PDFBox parser (Andreas Lehmkuehler <lehmi@...che.org>)
CVE-2018-17977: CentOS ipsec remote denial of service vulnerability (luo <a4651386@....com>)
Re: CVE-2018-17977: CentOS ipsec remote denial of service vulnerability (Solar Designer <solar@...nwall.com>)

October 6 (3 messages)

Re: CVE-2018-17977: CentOS ipsec remote denial of service vulnerability (luo <a4651386@....com>)
[UPDATE][CVE-2018-11797] DoS vulnerability in Apache PDFBox parser (Andreas Lehmkuehler <lehmi@...che.org>)
CVE-2018-17456 Git RCE via .gitmodules (joernchen <joernchen@...noelit.de>)

October 7 (1 message)

Re: arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor (Salvatore Bonaccorso <carnil@...ian.org>)

October 8 (4 messages)

Qemu: integer overflow issues (P J P <ppandit@...hat.com>)
Re: CVE-2018-17977: CentOS ipsec remote denial of service vulnerability (luo <a4651386@....com>)
CVE-2018-17407: Tex-Live buffer overflow in handling of Type 1 fonts (Nick Roessler <nicholas.e.roessler@...il.com>)
net-snmp 5.7.3 unauthenticated remote Denial of Service (exploit available) (Magnus Klaaborg Stubman <magnus@...bman.eu>)

October 9 (12 messages)

Re: net-snmp 5.7.3 unauthenticated remote Denial of Service (exploit available) (Alexander Bergmann <abergmann@...e.com>)
Re: net-snmp 5.7.3 unauthenticated remote Denial of Service (exploit available) (Salvatore Bonaccorso <carnil@...ian.org>)
Linux kernel: "Meltdown leaks with Global kernel mapping" (Solar Designer <solar@...nwall.com>)
ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Tavis Ormandy <taviso@...gle.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Leonid Isaev <leonid.isaev@...a.colorado.edu>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Tavis Ormandy <taviso@...gle.com>)
[CVE-2018-11796] Apache Tika Denial of Service via XML Entity Expansion Vulnerability (Tim Allison <tallison@...che.org>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Hanno Böck <hanno@...eck.de>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) ("Perry E. Metzger" <perry@...rmont.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Tavis Ormandy <taviso@...gle.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Alex Gaynor <alex.gaynor@...il.com>)

October 10 (13 messages)

Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Doran Moppert <dmoppert@...hat.com>)
Re: net-snmp 5.7.3 unauthenticated remote Denial of Service (exploit available) (Magnus Klaaborg Stubman <magnus@...bman.eu>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Eddie Chapman <eddie@...k.net>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Hanno Böck <hanno@...eck.de>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Hanno Böck <hanno@...eck.de>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Eddie Chapman <eddie@...k.net>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Ian Zimmerman <itz@...y.loosely.org>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Brandon Perry <bperry.volatile@...il.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Leo Famulari <leo@...ulari.name>)
ghostscript: saved execution stacks can leak operator arrays (CVE-2018-18073) (Tavis Ormandy <taviso@...gle.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) ("Perry E. Metzger" <perry@...rmont.com>)

October 11 (4 messages)

Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Emilio Pozuelo Monfort <pochu27@...il.com>)
jQuery-File-Upload <= v9.22.0 unauthenticated arbitrary file upload vulnerability ("Larry W. Cashdollar" <larry0@...com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Tavis Ormandy <taviso@...gle.com>)
Re: Linux kernel: "Meltdown leaks with Global kernel mapping" (Dave Hansen <dave.hansen@...ux.intel.com>)

October 14 (1 message)

Re: jQuery-File-Upload <= v9.22.0 unauthenticated arbitrary file upload vulnerability ("Larry W. Cashdollar" <larry0@...com>)

October 16 (6 messages)

CVE-2018-10933: libssh: authentication bypass in server code (Marcus Meissner <meissner@...e.de>)
ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Tavis Ormandy <taviso@...gle.com>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 ("Perry E. Metzger" <perry@...rmont.com>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Tavis Ormandy <taviso@...gle.com>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Hanno Böck <hanno@...eck.de>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 ("Perry E. Metzger" <perry@...rmont.com>)

October 17 (10 messages)

Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Rich Felker <dalias@...c.org>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Rich Felker <dalias@...c.org>)
CVE-2018-18438 Qemu: Integer overflow in ccid_card_vscard_read() allows memory corruption (P J P <ppandit@...hat.com>)
CVE-2018-12617 Qemu: qemu-guest-agent: Integer overflow in qmp_guest_file_read may lead to crash (P J P <ppandit@...hat.com>)
Re: CVE-2018-10933: libssh: authentication bypass in server code (Minh Tuan Luong <not.soledad@...il.com>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) ("Perry E. Metzger" <perry@...rmont.com>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) (Rich Felker <dalias@...c.org>)
Linux kernel: BPF verifier bug leads to out-of-bounds access (CVE-2018-18445; 4.14.9-4.14.74; 4.15-4.18.12) (Jann Horn <jannh@...gle.com>)
Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Tavis Ormandy <taviso@...gle.com>)

October 18 (5 messages)

Re: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Jordan Glover <Golden_Miller83@...tonmail.ch>)
Re: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Tavis Ormandy <taviso@...gle.com>)
Re: Using quilt on untrusted RPM spec files (Jakub Wilk <jwilk@...lk.net>)
Re: Travis CI MITM RCE (Jakub Wilk <jwilk@...lk.net>)
Re: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Jordan Glover <Golden_Miller83@...tonmail.ch>)

October 20 (3 messages)

Re: Travis CI MITM RCE (zugtprgfwprz@...rnkuller.de)
Attempting to patch ghostscript-9.25 (Ken Moffat <zarniwhoop@...world.com>)
Re: Attempting to patch ghostscript-9.25 (Jordan Glover <Golden_Miller83@...tonmail.ch>)

October 21 (1 message)

Re: Attempting to patch ghostscript-9.25 (Ken Moffat <zarniwhoop@...world.com>)

October 22 (4 messages)

Buffer overflow in cabextract/libmspack (Fwd: New cabextract 1.8 and libmspack 0.8 release) (Hanno Böck <hanno@...eck.de>)
Re: Using quilt on untrusted RPM spec files (Jakub Wilk <jwilk@...lk.net>)
GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Andrew Sandoval <ASandoval@...root.com>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Florian Weimer <fweimer@...hat.com>)

October 23 (11 messages)

Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Mikhail Klementev <jollheef@...eup.net>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Ramon de C Valle <rcvalle@...e.com>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Yann Droneaud <ydroneaud@...eya.com>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Matthew Fernandez <matthew.fernandez@...il.com>)
GLib (2.20.0+): GVariant, GDBus and GMarkup out of bounds reads, DoS and unbounded recursion (Philip Withnall <philip@...nocode.co.uk>)
Re: Using quilt on untrusted RPM spec files ("Stuart D. Gathman" <stuart@...hman.org>)
Re: Using quilt on untrusted RPM spec files ("Stuart D. Gathman" <stuart@...hman.org>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Solar Designer <solar@...nwall.com>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Florian Weimer <fweimer@...hat.com>)
Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Jeff Law <law@...hat.com>)
Re: Buffer overflow in cabextract/libmspack (Fwd: New cabextract 1.8 and libmspack 0.8 release) (Salvatore Bonaccorso <carnil@...ian.org>)

October 24 (4 messages)

Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions (Jordan Glover <Golden_Miller83@...tonmail.ch>)
CVE-2018-11804: Apache Spark build/mvn runs zinc, and can expose information from build machines (Sean Owen <srowen@...che.org>)
Fwd: CVE-2018-11785 and CVE-2018-11792, was "[ANNOUNCE] Apache Impala 3.0.1 release" (Jim Apple <jbapple@...udera.com>)
Xen Security Advisory 278 v1 - x86: Nested VT-x usable even when disabled (Xen.org security team <security@....org>)

October 25 (1 message)

X.Org security advisory: October 25, 2018 (Matthieu Herrb <matthieu@...rb.eu>)

October 27 (1 message)

Re: Travis CI MITM RCE (Jakub Wilk <jwilk@...lk.net>)

October 28 (3 messages)

Squid Proxy multiple vulnerabilities (Amos Jeffries <squid3@...enet.co.nz>)
Re: Squid Proxy multiple vulnerabilities (Amos Jeffries <squid3@...enet.co.nz>)
Re: Squid Proxy multiple vulnerabilities (Hanno Böck <hanno@...eck.de>)

October 29 (5 messages)

Re: Squid Proxy multiple vulnerabilities (Amos Jeffries <squid3@...enet.co.nz>)
Re: Squid Proxy multiple vulnerabilities (面和毅 <ka-omo@...s.com>)
Script sandbox bypass in multiple Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Re: Travis CI MITM RCE (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Linux kernel: TLB flush happens too late on mremap (CVE-2018-18281; fixed in 4.9.135, 4.14.78, 4.18.16, 4.19) (Jann Horn <jannh@...gle.com>)

October 30 (2 messages)

[CVE-2018-16468] Loofah XSS Vulnerability (Mike Dalessio <mike.dalessio@...il.com>)
Re: Linux kernel: CVE-2017-18344: arbitrary-read vulnerability in the timer subsystem (Andrey Konovalov <andreyknvl@...il.com>)

October 31 (9 messages)

[SECURITY ADVISORY] curl - SASL password overflow via integer overflow (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl - use-after-free in handle close (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl - warning message out-of-buffer read (Daniel Stenberg <daniel@...x.se>)
Re: Squid Proxy multiple vulnerabilities (Karol Babioch <kbabioch@...e.de>)
glusterfs: multiple flaws (Siddharth Sharma <siddharth@...hat.com>)
Linux 4.19.0-rc3 Bluetooth out-of-bounds-read and use-after-free (Solar Designer <solar@...nwall.com>)
Re: Re: Travis CI MITM RCE (Jakub Wilk <jwilk@...lk.net>)
CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal (Mark Thomas <markt@...che.org>)
Re: Linux 4.19.0-rc3 Bluetooth out-of-bounds-read and use-after-free (Greg KH <greg@...ah.com>)

120 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.