oss-security mailing list - 2019/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 4	² 2	³ 1	⁴ 1	⁵ 1	⁶ 4	⁷ 3
⁸ 6	⁹ 4	¹⁰ 2	¹¹ 15	¹² 7	¹³	¹⁴ 3
¹⁵ 3	¹⁶	¹⁷ 2	¹⁸	¹⁹ 2	²⁰	²¹ 2
²² 13	²³ 3	²⁴ 4	²⁵ 7	²⁶ 8	²⁷ 2	²⁸
²⁹ 3	³⁰ 2	³¹ 3

Messages by day:

July 1 (4 messages)

Re: linux-distros membership application - Microsoft (Simon Lees <sflees@...e.de>)
pari/gp arbitrary file write (Georgi Guninski <gguninski@...il.com>)
Django: CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (Mariusz Felisiak <felisiak.mariusz@...il.com>)
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz (Adrien Nader <adrien@...k.org>)

July 2 (2 messages)

Re: linux-distros membership application - Microsoft (Michael Ellerman <mpe@...erman.id.au>)
CVE-2019-13164 Qemu: qemu-bridge-helper ACL bypassed with long interface names (P J P <ppandit@...hat.com>)

July 3 (1 message)

CVE-2019-10183 virt-install: unattended option leaks password via command line argument (P J P <ppandit@...hat.com>)

July 4 (1 message)

deepin-clone: various symlink attacks (Matthias Gerstner <mgerstner@...e.de>)

July 5 (1 message)

CVE-2019-13122: Patchwork: XSS via Message-ID (Daniel Axtens <dja@...ens.net>)

July 6 (4 messages)

Re: linux-distros membership application - Microsoft (Georgi Guninski <gguninski@...il.com>)
Re: linux-distros membership application - Microsoft (Solar Designer <solar@...nwall.com>)
Re: linux-distros membership application - Microsoft (Solar Designer <solar@...nwall.com>)
Re: linux-distros membership application - Microsoft (Sasha Levin <sashal@...nel.org>)

July 7 (3 messages)

Re: linux-distros membership application - Microsoft (Moritz Muehlenhoff <jmm@...til.org>)
Re: linux-distros membership application - Microsoft (Georgi Guninski <gguninski@...il.com>)
Re: linux-distros membership application - Microsoft (Solar Designer <solar@...nwall.com>)

July 8 (6 messages)

Re: [CVE-2019-0231] MINA SSLFilter security Issue (Doran Moppert <dmoppert@...hat.com>)
Re: linux-distros membership application - Microsoft ("Stuart D. Gathman" <stuart@...hman.org>)
CVE-2019-13313, CVE-2019-13314: password disclosure via command line arguments (P J P <ppandit@...hat.com>)
Re: linux-distros membership application - Microsoft (Solar Designer <solar@...nwall.com>)
Re: linux-distros membership application - Microsoft ("David A. Wheeler" <dwheeler@...eeler.com>)
CVE-2019-13132: zeromq/libzmq: denial of service via stack overflow with arbitrary data (Luca Boccassi <bluca@...ian.org>)

July 9 (4 messages)

Xen Security Advisory 300 v1 - Linux: No grant table and foreign mapping limits (Xen.org security team <security@....org>)
Data exfiltration with FPM servers (HHVM and rarely PHP) (Hanno Böck <hanno@...eck.de>)
Privileged File Access from Desktop Applications (Malte Kraus <malte.kraus@...e.com>)
Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)

July 10 (2 messages)

Contributing Back (Joe McManus <joe.mcmanus@...onical.com>)
Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)

July 11 (15 messages)

CVE-2018-17196: Potential to bypass transaction/idempotent ACL checks in Apache Kafka (Jason Gustafson <jason@...fluent.io>)
Re: Privileged File Access from Desktop Applications (Malte Kraus <malte.kraus@...e.com>)
Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Privileged File Access from Desktop Applications (Matthias Gerstner <mgerstner@...e.de>)
Re: Privileged File Access from Desktop Applications (Malte Kraus <malte.kraus@...e.com>)
Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)
Re: Privileged File Access from Desktop Applications (Simon McVittie <smcv@...ian.org>)
Re: Privileged File Access from Desktop Applications (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Privileged File Access from Desktop Applications (John Haxby <john.haxby@...cle.com>)
Re: Privileged File Access from Desktop Applications (Simon McVittie <smcv@...ian.org>)
Re: Privileged File Access from Desktop Applications (Simon McVittie <smcv@...ian.org>)
Re: Privileged File Access from Desktop Applications (Martin Steigerwald <martin@...htvoll.de>)
Re: Privileged File Access from Desktop Applications (Steffen Nurpmeso <steffen@...oden.eu>)
Re: linux-distros membership application - Microsoft (Kristian Fiskerstrand <k_f@...too.org>)

July 12 (7 messages)

Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)
[CVE-2019-0234] Reflected Cross-site Scripting (XSS) Vulnerabiulity in Apache Roller (Dave <snoopdave@...il.com>)
Re: linux-distros membership application - Microsoft (Sasha Levin <sashal@...nel.org>)
Re: Privileged File Access from Desktop Applications (Jordan Glover <Golden_Miller83@...tonmail.ch>)
Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)
Re: Privileged File Access from Desktop Applications ("Perry E. Metzger" <perry@...rmont.com>)
Re: Privileged File Access from Desktop Applications (Steffen Nurpmeso <steffen@...oden.eu>)

July 14 (3 messages)

Knot Resolver 4.1.0 security release (Vladimír Čunát <vladimir.cunat@....cz>)
Re: Contributing Back (Solar Designer <solar@...nwall.com>)
Fwd: [ANNOUNCE] libICE 1.0.10 (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 15 (3 messages)

Re: Contributing Back (Joe McManus <joe.mcmanus@...onical.com>)
Re: Contributing Back (Anthony Liguori <anthony@...emonkey.ws>)
Re: Contributing Back (Solar Designer <solar@...nwall.com>)

July 17 (2 messages)

CVE-2019-10198: Authorization bypass in Foreman tasks plugin (Tomer Brisker <tbrisker@...hat.com>)
Multiple vulnerabilities in Jenkins (Wadeck Follonier <wfollonier@...udbees.com>)

July 19 (2 messages)

Xen Security Advisory 300 v2 - Linux: No grant table and foreign mapping limits (Xen.org security team <security@....org>)
stack buffer overflow in fbdev (Tavis Ormandy <taviso@...il.com>)

July 21 (2 messages)

Two unauthenticated SQL injection vulnerabilities in Onionbuzz WordPress plugin (Eugene Kolo <eugene@...enekolo.com>)
Re: stack buffer overflow in fbdev (Linus Torvalds <torvalds@...ux-foundation.org>)

July 22 (13 messages)

Re: stack buffer overflow in fbdev (Linus Torvalds <torvalds@...ux-foundation.org>)
Re: stack buffer overflow in fbdev (Daniel Vetter <daniel@...ll.ch>)
CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Mikhail Klementev <root@...pstack.io>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Stuart Henderson <stu@...cehopper.org>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Mikhail Klementev <root@...pstack.io>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Solar Designer <solar@...nwall.com>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Eric Blake <eblake@...hat.com>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Amos Jeffries <squid3@...enet.co.nz>)
Re: stack buffer overflow in fbdev (Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Ian Zimmerman <itz@...y.loosely.org>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Heiko Schlittermann <hs@...littermann.de>)

July 23 (3 messages)

Re: Two unauthenticated SQL injection vulnerabilities in Onionbuzz WordPress plugin (Eugene Kolo <eugene@...enekolo.com>)
Re: stack buffer overflow in fbdev (Daniel Vetter <daniel@...ll.ch>)
Re: stack buffer overflow in fbdev (Linus Torvalds <torvalds@...ux-foundation.org>)

July 24 (4 messages)

Security release pre-announcement messages (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
[CVE-2019-0202] Apache Storm Logviewer file system access vulnerability (Stig Rohde Døssing <srdo@...che.org>)
[CVE-2018-1320] Apache Storm vulnerable Thrift version (Stig Rohde Døssing <srdo@...che.org>)
[CVE-2018-11779] Apache Storm UI Java deserialization vulnerability (Stig Rohde Døssing <srdo@...che.org>)

July 25 (7 messages)

CVE-2019-10207: linux kernel: bluetooth: hci_uart: 0x0 address execution as nonprivileged user (Vladis Dronov <vdronov@...hat.com>)
Re: CVE-2019-10207: linux kernel: bluetooth: hci_uart: 0x0 address execution as nonprivileged user (Andrey Konovalov <andreyknvl@...il.com>)
Re: CVE-2019-10207: linux kernel: bluetooth: hci_uart: 0x0 address execution as nonprivileged user (Vladis Dronov <vdronov@...hat.com>)
Re: CVE-2019-10207: linux kernel: bluetooth: hci_uart: 0x0 address execution as nonprivileged user (Brad Spengler <spender@...ecurity.net>)
Statistics for distros lists updated for 2019Q2 (Kristian Fiskerstrand <k_f@...too.org>)
Re: Statistics for distros lists updated for 2019Q2 (Solar Designer <solar@...nwall.com>)
Re: Statistics for distros lists updated for 2019Q2 (Kristian Fiskerstrand <k_f@...too.org>)

July 26 (8 messages)

Re: Security release pre-announcement messages (Stiepan <stie@...tonmail.ch>)
Re: Security release pre-announcement messages (Greg KH <greg@...ah.com>)
Re: Security release pre-announcement messages (Greg KH <greg@...ah.com>)
Re: Statistics for distros lists updated for 2019Q2 (Solar Designer <solar@...nwall.com>)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead (Solar Designer <solar@...nwall.com>)
Re: Statistics for distros lists updated for 2019Q2 (Kristian Fiskerstrand <k_f@...too.org>)
Re: Statistics for distros lists updated for 2019Q2 (Solar Designer <solar@...nwall.com>)
Re: Security release pre-announcement messages (Stiepan <stie@...tonmail.ch>)

July 27 (2 messages)

RCE through open PHP-FPM ports (Hanno Böck <hanno@...eck.de>)
Re: Statistics for distros lists updated for 2019Q2 (Kristian Fiskerstrand <k_f@...too.org>)

July 29 (3 messages)

[CVE-2018-11772] Apache VCL SQL injection attack in privilege management (Josh Thompson <jfthomps@...che.org>)
[CVE-2018-11773] Apache VCL improper form validation in block allocation management (Josh Thompson <jfthomps@...che.org>)
[CVE-2018-11774] Apache VCL SQL injection attack in VM management (Josh Thompson <jfthomps@...che.org>)

July 30 (2 messages)

CVE-2019-13648: Linux kernel: powerpc: kernel crash in TM handling triggerable by any local user (Michael Neuling <mikey@...ling.org>)
PowerDNS Security Advisory 2019-06: Denial of service via crafted zone records (Peter van Dijk <peter.van.dijk@...erdns.com>)

July 31 (3 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 (Cedric Buissart <cbuissar@...hat.com>)
[CVE-2018-11782, CVE-2019-0203] Apache Subversion svnserve vulnerabilities (Julian Foad <julianfoad@...che.org>)

107 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.