oss-security mailing list - 2019/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	² 1	³ 2
⁴ 1	⁵ 9	⁶ 3	⁷ 3	⁸	⁹	¹⁰ 1
¹¹ 1	¹²	¹³ 5	¹⁴	¹⁵ 1	¹⁶ 1	¹⁷ 1
¹⁸ 4	¹⁹ 1	²⁰	²¹ 1	²² 1	²³ 1	²⁴
²⁵ 2	²⁶ 2	²⁷ 3	²⁸ 2	²⁹	³⁰	³¹

Messages by day:

March 1 (3 messages)

Squirrelmail XSS Fixes (Hanno Böck <hanno@...eck.de>)
Re: Squirrelmail XSS Fixes (Hanno Böck <hanno@...eck.de>)
[SECURITY] CVE-2019-0200: Apache Qpid Broker-J Denial of Service due to malformed AMQP 0-8 to 0-10 commands (Alex Rudyy <orudyy@...che.org>)

March 2 (1 message)

[SECURITY] CVE-2019-0187: Apache JMeter Missing client auth for RMI connection when distributed test is used (Philippe Mouawad <pmouawad@...che.org>)

March 3 (2 messages)

Open Redirect in Tiny Tiny RSS (tt-rss) (Hanno Böck <hanno@...eck.de>)
Re: Open Redirect in Tiny Tiny RSS (tt-rss) (Mark Steward <marksteward@...il.com>)

March 4 (1 message)

CVE-2018-11793: Mesos components might crash when parsing deeply nested JSON structures. (Alex R <alexr@...che.org>)

March 5 (9 messages)

Xen Security Advisory 284 v2 - grant table transfer issues on large hosts (Xen.org security team <security@....org>)
Xen Security Advisory 285 v2 - race with pass-through device hotplug (Xen.org security team <security@....org>)
Xen Security Advisory 291 v2 - x86/PV: page type reference counting issue with failed IOMMU update (Xen.org security team <security@....org>)
Xen Security Advisory 287 v2 - x86: steal_page violates page_struct access discipline (Xen.org security team <security@....org>)
Xen Security Advisory 292 v2 - x86: insufficient TLB flushing when using PCID (Xen.org security team <security@....org>)
Xen Security Advisory 288 v2 - x86: Inconsistent PV IOMMU discipline (Xen.org security team <security@....org>)
Xen Security Advisory 290 v2 - missing preemption in x86 PV page table unvalidation (Xen.org security team <security@....org>)
Xen Security Advisory 293 v3 - x86: PV kernel context switch corruption (Xen.org security team <security@....org>)
Xen Security Advisory 294 v2 - x86 shadow: Insufficient TLB flushing when using PCID (Xen.org security team <security@....org>)

March 6 (3 messages)

Linux kernel: OOB R/W in SNMP NAT module (CVE-2019-9162); virtual address 0 mappable (CVE-2019-9213) (Jann Horn <jannhorn@...glemail.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Transient execution attacks leveraging port contention (Mathias Payer <mathias.payer@...elwelt.net>)

March 7 (3 messages)

CVE-2019-0192 Deserialization of untrusted data via jmx.serviceUrl in Apache Solr (Tomas Fernandez Lobbe <tflobbe@...che.org>)
[CVE-2018-11789] Apache Incubator Heron file access vulnerability (Neng Lu <freeneng@...il.com>)
[SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf (Jean-Baptiste Onofré <jb@...thrax.net>)

March 10 (1 message)

Re: Linux kernel: OOB R/W in SNMP NAT module (CVE-2019-9162); virtual address 0 mappable (CVE-2019-9213) (Solar Designer <solar@...nwall.com>)

March 11 (1 message)

CVE-2018-11767: Apache Hadoop KMS ACL regression (Akira Ajisaka <aajisaka@...che.org>)

March 13 (5 messages)

Stack/Heap Clashing on Linux >=4.13 when loader directly invoked (Ali Saidi <asaidi@...il.com>)
Re: [SECURITY] CVE-2018-1320 Apache Thrift SASL negotiation vulnerability (update) ("James E. King III" <jking@...che.org>)
[CVE-2019-5420] Possible Remote Code Execution Exploit in Rails Development Mode (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2019-5419] Denial of Service Vulnerability in Action View (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2019-5418] File Content Disclosure in Action View (Aaron Patterson <tenderlove@...y-lang.org>)

March 15 (1 message)

libseccomp: incorrect generation of syscall argument filters (Paul Moore <paul@...l-moore.com>)

March 16 (1 message)

Fwd: [ANNOUNCE] libXdmcp 1.1.3 [fix for CVE-2017-2625] (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 17 (1 message)

CVE-2019-9573 / CVE-2019-9574: WordPress plugin hrm missing server side authorization checks (Henri Salo <henri@...v.fi>)

March 18 (4 messages)

CVE-2019-9824 QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables (P J P <ppandit@...hat.com>)
[OSSA-2019-001] Unsupported dport option prevents applying security groups in OpenStack Neutron (CVE-2019-9735) (Jeremy Stanley <fungi@...goth.org>)
[SECURITY ADVISORIES] libssh2 (Daniel Stenberg <daniel@...x.se>)
PowerDNS Security Advisory 2019-03 (Erik Winkels <erik.winkels@...n-xchange.com>)

March 19 (1 message)

Re: [SECURITY ADVISORIES] libssh2 (Riccardo Schirone <rschiron@...hat.com>)

March 21 (1 message)

ghostscript: 2 -dSAFER bypass: CVE-2019-3835 & CVE-2019-3838 (Cedric Buissart <cbuissar@...hat.com>)

March 22 (1 message)

[CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View (Aaron Patterson <tenderlove@...y-lang.org>)

March 23 (1 message)

CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible. (Alex R <alexr@...che.org>)

March 25 (2 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

March 26 (2 messages)

[CVE-2019-0224] Apache JSPWiki Cross-site scripting vulnerability (Juan Pablo Santos Rodríguez <juanpablo.santos@...il.com>)
[CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information discl… (Juan Pablo Santos Rodríguez <juanpablo…)

March 27 (3 messages)

CVE-2018-20815 QEMU: device_tree: heap buffer overflow while loading device tree blob (P J P <ppandit@...hat.com>)
[ANNOUNCE] CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown (Dejan Bosanac <dejan@...httale.net>)
[CVE-2019-0212] Apache HBase REST Server incorrect user authorization (Josh Elser <elserj@...che.org>)

March 28 (2 messages)

CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files (Aki Tuomi <aki.tuomi@...ecot.fi>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

49 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.