oss-security mailing list - 2019/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 2	² 3	³
⁴	⁵ 2	⁶ 5	⁷ 2	⁸ 1	⁹ 1	¹⁰
¹¹ 2	¹² 7	¹³ 10	¹⁴	¹⁵ 1	¹⁶	¹⁷
¹⁸ 3	¹⁹ 2	²⁰	²¹ 3	²² 2	²³ 1	²⁴
²⁵	²⁶	²⁷	²⁸ 1

Messages by day:

February 1 (2 messages)

Re: [CVE-2018-20242] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki (Juan Pablo Santos Rodríguez <juanpablo.santos@...il.com>)
Re: CVE-2018-1340: Apache Guacamole: Secure flag missing from session cookie (Salvatore Bonaccorso <carnil@...ian.org>)

February 2 (3 messages)

Re: CVE-2018-1340: Apache Guacamole: Secure flag missing from session cookie (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2018-1340: Apache Guacamole: Secure flag missing from session cookie (Mike Jumper <mjumper@...che.org>)
Linux kernel: BPF spectre v1 mitigation bypass (CVE-2019-7308, fixed in 4.19.19 and 4.20.6) (Jann Horn <jannhorn@...glemail.com>)

February 5 (2 messages)

CVE-2019-3814: Suitable client certificate can be used to login as other user (Aki Tuomi <aki.tuomi@...n-xchange.com>)
Notes on fuzzing ImageMagick and GraphicsMagick (Alex Gaynor <alex.gaynor@...il.com>)

February 6 (5 messages)

[SECURITY ADVISORY] curl: NTLM type-2 out-of-bounds buffer read (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: NTLMv2 type-3 header stack buffer overflow (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: SMTP end-of-response out-of-bounds read (Daniel Stenberg <daniel@...x.se>)
Re: Notes on fuzzing ImageMagick and GraphicsMagick (Hanno Böck <hanno@...eck.de>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

February 7 (2 messages)

Re: Linux Kernel: Missing access_ok() checks in IOCTL function (gpu/drm/i915 Driver) (Ben Hutchings <ben.hutchings@...ethink.co.uk>)
Re: Linux Kernel: Missing access_ok() checks in IOCTL function (gpu/drm/i915 Driver) (Timothy Michaud <tmm08a@....edu>)

February 8 (1 message)

CVE-2019-7628: Pagure version 5.2 leaks API keys by e-mail (Randy Barlow <randy@...ctronsweatshop.com>)

February 9 (1 message)

WebKitGTK+ and WPE WebKit Security Advisory WSA-2019-0001 (Michael Catanzaro <mcatanzaro@...lia.com>)

February 11 (2 messages)

CVE-2019-6975 -- Django fixed memory exhaustion in utils.numberformat.format(). (Carlton Gibson <carlton.gibson@...il.com>)
CVE-2019-5736: runc container breakout (all versions) (Aleksa Sarai <cyphar@...har.com>)

February 12 (7 messages)

Re: CVE-2019-5736: runc container breakout (all versions) (Florian Weimer <fweimer@...hat.com>)
Re: CVE-2019-5736: runc container breakout (all versions) (Aleksa Sarai <asarai@...e.de>)
Re: CVE-2019-5736: runc container breakout (all versions) (Steve Grubb <sgrubb@...hat.com>)
Re: CVE-2019-5736: runc container breakout (all versions) (Aleksa Sarai <cyphar@...har.com>)
Re: CVE-2019-5736: runc container breakout (all versions) (Solar Designer <solar@...nwall.com>)
Two more LXC breakouts (both privileged), apparmor issue? ("Alexander E. Patrakov" <patrakov@...il.com>)
CVE-2017-3164: Apache Solr: SSRF issue (Tomas Fernandez Lobbe <tflobbe@...che.org>)

February 13 (10 messages)

Re: CVE-2019-5736: runc container breakout (all versions) (Aleksa Sarai <asarai@...e.de>)
Re: CVE-2019-5736: runc container breakout (all versions) (Aleksa Sarai <asarai@...e.de>)
CVE-2019-5736: runc container breakout exploit code (Aleksa Sarai <cyphar@...har.com>)
Re: CVE-2019-5736: runc container breakout exploit code (Aleksa Sarai <cyphar@...har.com>)
Re: CVE-2019-5736: runc container breakout exploit code (Aleksa Sarai <cyphar@...har.com>)
[CVE-2018-11783] Apache Traffic Server vulnerability with sslheader plugin (Bryan Call <bcall@...che.org>)
Re: CVE-2019-5736: runc container breakout exploit code (EJ Campbell <ejc3@...izonmedia.com>)
Re: CVE-2019-5736: runc container breakout exploit code (EJ Campbell <ejc3@...izonmedia.com>)
Re: CVE-2019-5736: runc container breakout (all versions) (Loganaden Velvindron <loganaden@...il.com>)
Railroader: static analysis tool for Ruby on Rails (OSS fork of Brakeman) ("David A. Wheeler" <dwheeler@...eeler.com>)

February 15 (1 message)

MatrixSSL stack buffer overflow (Tavis Ormandy <taviso@...gle.com>)

February 18 (3 messages)

CVE-2019-3812 - qemu - Out-of-bounds read in hw/i2c/i2c-ddc.c allows for memory disclosure (Wade Mealing <wmealing@...hat.com>)
Linux kernel: three KVM bugs (CVE-2019-6974, CVE-2019-7221, CVE-2019-7222) (Jann Horn <jannhorn@...glemail.com>)
CVE-2019-6454: systemd (PID1) crash with specially crafted D-Bus message (Chris Coulson <chris.coulson@...onical.com>)

February 19 (2 messages)

Re: CVE-2019-6454: systemd (PID1) crash with specially crafted D-Bus message (Simon McVittie <smcv@...ian.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

February 21 (3 messages)

CVE-2019-8934 QEMU: ppc64: sPAPR emulator leaks the host hardware identity (P J P <ppandit@...hat.com>)
Kernel local root in SCTP / CVE-2019-8956 (Marcus Meissner <meissner@...e.de>)
CVE-2018-1002161 - Koji - SQL injection in multiple remote calls (Patrick Uiterwijk <puiterwijk@...hat.com>)

February 22 (2 messages)

Multiple BIND CVEs disclosed (CVE-2018-5744, CVE-2018-5745, CVE-2019-6465) (Michael McNally <mcnally@....org>)
Xen Security Advisory 283 v2 - Withdrawn Xen Security Advisory number (Xen.org security team <security@....org>)

February 23 (1 message)

Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

February 28 (1 message)

ikiwiki: CVE-2019-9187: Server-side request forgery (Simon McVittie <smcv@...ian.org>)

48 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.