oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 3	² 4	³	⁴
⁵ 6	⁶ 6	⁷ 2	⁸ 1	⁹ 1	¹⁰	¹¹ 1
¹² 5	¹³ 1	¹⁴	¹⁵ 8	¹⁶	¹⁷	¹⁸
¹⁹ 1	²⁰ 2	²¹ 1	²² 17	²³ 5	²⁴	²⁵
²⁶ 1	²⁷ 1	²⁸ 9	²⁹ 5	³⁰	³¹

Messages by day:

August 1 (3 messages)

[CVE-2019-0193] Apache Solr, Remote Code Execution via DataImportHandler (David Smiley <dsmiley@...che.org>)
CVE-2019-14378 QEMU: slirp: heap buffer overflow during packet reassembly (P J P <ppandit@...hat.com>)
Django security releases issued: Multiple CVEs (Carlton Gibson <carlton.gibson@...il.com>)

August 2 (4 messages)

Re: CVE-2019-10207: linux kernel: bluetooth: hci_uart: 0x0 address execution as nonprivileged user (Vladis Dronov <vdronov@...hat.com>)
[CVE-2019-10088] OOM from a crafted Zip File in Apache Tika's RecursiveParserWrapper (Tim Allison <tallison@...che.org>)
[CVE-2019-10093] Denial of Service in Apache Tika's 2003ml and 2006ml Parsers (Tim Allison <tallison@...che.org>)
[CVE-2019-10094] StackOverflow from Crafted Package/Compressed Files in Apache Tika's RecursiveParserWrapper (Tim Allison <tallison@...che.org>)

August 5 (6 messages)

New Tool - Phishing Simulation (jeny raval <jenyraval@...il.com>)
Current CVE policy on missing-hardening bugs (Florian Weimer <fweimer@...hat.com>)
Re: New Tool - Phishing Simulation (zugtprgfwprz@...rnkuller.de)
Security issues in various deepin D-Bus services and tools (Matthias Gerstner <mgerstner@...e.de>)
Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249 (Joel Smith <joelsmith@...hat.com>)
CVE request: musl libc 1.1.23 and earlier x87 float stack imbalance (Rich Felker <dalias@...c.org>)

August 6 (6 messages)

Re: [musl] CVE request: musl libc 1.1.23 and earlier x87 float stack imbalance (Rich Felker <dalias@...c.org>)
Re: CVE request: musl libc 1.1.23 and earlier x87 float stack imbalance (Moritz Muehlenhoff <jmm@...til.org>)
clamav: denial of service through "better zip bomb" (Hanno Böck <hanno@...eck.de>)
Re: [musl] CVE request: musl libc 1.1.23 and earlier x87 float stack imbalance (Rich Felker <dalias@...c.org>)
[ANNOUNCE] CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port (Tim Allclair <tallclair@...gle.com>)
[OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433) (Jeremy Stanley <fungi@...goth.org>)

August 7 (2 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
wpa_supplicant/hostapd: SAE/EAP-pwd side-channel attack update (Jouni Malinen <j@...fi>)

August 8 (1 message)

CVE update - fixed in Apache Ranger 2.0.0 (Velmurugan Periasamy <vel@...che.org>)

August 9 (1 message)

[ANNOUNCE] Security release of kube-state-metrics v1.7.2 (Frederic Branczyk <fbranczy@...hat.com>)

August 11 (1 message)

Nokogiri security update v1.10.4 (Mike Dalessio <mike.dalessio@...il.com>)

August 12 (5 messages)

Re: linux-distros membership application - Microsoft (Sasha Levin <sashal@...nel.org>)
gnu/linux rediscovers macro malware (Georgi Guninski <gguninski@...il.com>)
Re: linux-distros membership application - Microsoft (Solar Designer <solar@...nwall.com>)
ghostscript CVE-2019-10216: -dSAFER escape via .buildfont1 (Cedric Buissart <cbuissar@...hat.com>)
Re: ghostscript CVE-2019-10216: -dSAFER escape via .buildfont1 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)

August 13 (1 message)

Re: ghostscript CVE-2019-10216: -dSAFER escape via .buildfont1 (Cedric Buissart <cbuissar@...hat.com>)

August 15 (8 messages)

CVE-2019-10140 - linux kernel - system panic in overlayfs directory creation. (Wade Mealing <wmealing@...hat.com>)
CVE-2019-10081: mod_http2, memory corruption on early pushes (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-10082: mod_http2, read-after-free in h2 connection shutdown (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-10092: Limited cross-site scripting in mod_proxy (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-10097: mod_remoteip stack buffer overflow and NULL pointer dereference (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-10098: mod_rewrite configurations vulnerable to open redirect (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workers (Daniel Ruggeri <druggeri@...che.org>)
Re: [ANNOUNCE] Security release of kube-state-metrics v1.7.2 (Sam Fowler <sfowler@...hat.com>)

August 19 (1 message)

[CVE-2019-15150] CSRF in MediaWiki extension OAuth2 Client 0.3 (Justin Bull <me@...tinbull.ca>)

August 20 (2 messages)

[ANNOUNCE] Security release of Kubernetes v1.15.3, v1.14.6, v1.13.10 - CVE-2019-9512 and CVE-2019-9514 ("Hausler, Micah" <mhausler@...zon.com>)
Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Andrey Konovalov <andreyknvl@...il.com>)

August 21 (1 message)

RE: CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack ("Vogl, Todd" <ToddVogl@...iantenergy.com>)

August 22 (17 messages)

Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Eric Biggers <ebiggers@...nel.org>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (John Haxby <john.haxby@...cle.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Marcus Meissner <meissner@...e.de>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (John Haxby <john.haxby@...cle.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Andrey Konovalov <andreyknvl@...il.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Greg KH <greg@...ah.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Brad Spengler <spender@...ecurity.net>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 ("Perry E. Metzger" <perry@...rmont.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Jeremy Stanley <fungi@...goth.org>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (John Haxby <john.haxby@...cle.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Kurt H Maier <khm@...ops.net>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Eddie Chapman <eddie@...k.net>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 ("Perry E. Metzger" <perry@...rmont.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Eddie Chapman <eddie@...k.net>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Greg KH <greg@...ah.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Mathias Payer <mathias.payer@...elwelt.net>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 ("Stuart D. Gathman" <stuart@...hman.org>)

August 23 (5 messages)

Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 ("Perry E. Metzger" <perry@...rmont.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Eddie Chapman <eddie@...k.net>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Greg KH <greg@...ah.com>)
[CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry (David Tomaschik <davidtomaschik@...gle.com>)

August 26 (1 message)

CVE-2019-15525: Missing TLS/SSL certificate validation in pw3270 (Carlos Eduardo <carlosecg@...il.com>)

August 27 (1 message)

[CVE-2019-12402] Apache Commons Compress denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)

August 28 (9 messages)

Linux kernel: three heap overflow in the marvell wifi driver (huangwen <huangwenabc@...il.com>)
ghostscript: CVE-2019-14811, CVE-2019-14812, CVE-2019-14813 and CVE-2019-14817 (.forceput exposed) (Cedric Buissart <cbuissar@...hat.com>)
Critical Dovecot and Pigeonhole vulnerability (Aki Tuomi <aki.tuomi@...ecot.fi>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Critical Dovecot and Pigeonhole vulnerability (Hanno Böck <hanno@...eck.de>)
Re: Critical Dovecot and Pigeonhole vulnerability (Hanno Böck <hanno@...eck.de>)
Re: Critical Dovecot and Pigeonhole vulnerability (aki.tuomi@...ecot.fi)
Re: Critical Dovecot and Pigeonhole vulnerability (Larry Rosenman <ler@...eBSD.org>)
CVE-2019-10222: ceph: unauthenticated clients can crash RGW (Alexandros Toptsoglou <atoptsoglou@...e.com>)

August 29 (5 messages)

Three vulnerabilities in Kea DHCP disclosed by ISC, 28 August 2019 (Michael McNally <mcnally@....org>)
[OSSA-2019-004] Ageing time of 0 disables linuxbridge MAC learning (CVE-2019-15753) (Jeremy Stanley <fungi@...goth.org>)
Irssi 1.2.2:CVE-2019-15717 (Ailin Nemui <ailin.nemui@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2019-0004 (Adrian Perez de Castro <aperez@...lia.com>)
Re: Irssi 1.2.2:CVE-2019-15717 (Santiago Torres <torresariass@...il.com>)

80 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.