oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 5	³ 1	⁴ 2	⁵	⁶ 8	⁷ 2	⁸ 1
⁹ 2	¹⁰ 4	¹¹ 8	¹² 6	¹³ 6	¹⁴	¹⁵
¹⁶ 2	¹⁷ 5	¹⁸	¹⁹	²⁰ 6	²¹ 1	²²
²³	²⁴ 2	²⁵ 3	²⁶	²⁷ 3	²⁸ 4	²⁹
³⁰

Messages by day:

September 2 (5 messages)

MITRE response time (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: MITRE response time ("(RS) Tyler Schroder" <redorhcs@...coded.com>)
Re: MITRE response time (Johannes Segitz <jsegitz@...e.de>)
Re: MITRE response time (Florian Weimer <fweimer@...hat.com>)
Re: MITRE response time (Heiko Schlittermann <hs@...marc.schlittermann.de>)

September 3 (1 message)

CVE-2019-15718: Missing access controls on systemd-resolved's D-Bus interface (Chris Coulson <chris.coulson@...onical.com>)

September 4 (2 messages)

CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Heiko Schlittermann <hs@...littermann.de>)

September 6 (8 messages)

Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Heiko Schlittermann <hs@...marc.schlittermann.de>)
CVE-2019-15890 QEMU: Slirp: use-after-free during packet reassembly (P J P <ppandit@...hat.com>)
Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges ("Sebastian Nielsen" <sebastian@...be.eu>)
CVE-2019-12405: Apache Traffic Control LDAP-based authentication vulnerability (Rawlin Peters <rawlin@...che.org>)
Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (akuster <akuster@...sta.com>)

September 7 (2 messages)

Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (Phil Pennock <pdp@...m.org>)

September 8 (1 message)

Re: Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges. (Sylvain Beucler <beuc@...c.net>)

September 9 (2 messages)

Re: Sv: [exim] CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges (Phil Pennock <pdp@...m.org>)
Telegram privacy fails again. (Dhiraj Mishra <mishra.dhiraj95@...il.com>)

September 10 (4 messages)

[SECURITY] CVE-2019-12401: XML Bomb in Apache Solr versions prior to 5.0 (Tomas Fernandez Lobbe <tflobbe@...che.org>)
Re: Telegram privacy fails again. (Ilya Matveychikov <matvejchikov@...il.com>)
CVE-2019-15030: Linux kernel: powerpc: data leak with FP/VMX triggerable by unavailable exception in transaction (Michael Neuling <mikey@...ling.org>)
CVE-2019-15031: Linux kernel: powerpc: data leak with FP/VMX triggerable by interrupt in transaction (Michael Neuling <mikey@...ling.org>)

September 11 (8 messages)

[CVE-2018-17200] Apache OFBiz unauthenticated remote code execution vulnerability in HttpEngine (Jacopo Cappellato <jacopoc@...che.org>)
[CVE-2019-0189] Apache OFBiz remote code execution and arbitrary file delete via Java deserialization (Jacopo Cappellato <jacopoc@...che.org>)
[CVE-2019-10073] Apache OFBiz XSS vulnerability in the "ecommerce" component (Jacopo Cappellato <jacopoc@...che.org>)
[CVE-2019-10074] Apache OFBiz RCE (template injection) (Jacopo Cappellato <jacopoc@...che.org>)
[SECURITY ADVISORY] curl: FTP-KRB double-free (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: TFTP small blocksize heap buffer overflow (Daniel Stenberg <daniel@...x.se>)
hostapd/wpa_supplicant: AP mode PMF disconnection protection bypass (Jouni Malinen <j@...fi>)
OpenDMARC signature bypass with multiple From addresses (Hanno Böck <hanno@...eck.de>)

September 12 (6 messages)

pam_p11 0.3.1 released (Frank Morgner <frankmorgner@...il.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Telegram privacy fails again. (Solar Designer <solar@...nwall.com>)
Re: Telegram privacy fails again. (Ben Tasker <ben@...tasker.co.uk>)
3 CVEs in dino (Randy Barlow <randy@...ctronsweatshop.com>)
Re: hostapd/wpa_supplicant: AP mode PMF disconnection protection bypass (Salvatore Bonaccorso <carnil@...ian.org>)

September 13 (6 messages)

CVE-2019-14822 ibus: missing authorization flaw (Riccardo Schirone <rschiron@...hat.com>)
Re: Telegram privacy fails again. (notspam@...st)
Re: Telegram privacy fails again. (Stuart Henderson <stu@...cehopper.org>)
[CVE-2019-0195] Apache Tapestry vulnerability disclosure ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)
CVE-2019-0207: Apache Tapestry 5.4.2 Path Traversal vulnerability ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)
CVE-2019-10071: Apache Tapestry vulnerability disclosure ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)

September 16 (2 messages)

Re: Telegram privacy fails again. (Jiri 'Ghormoon' Novak <ghormoon@...il.com>)
Re: Telegram privacy fails again. (notspam@...st)

September 17 (5 messages)

CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow (cradminzhang(张博) <cradminzhang@...cent.com>)
Re: OpenDMARC signature bypass with multiple From addresses (Salvatore Bonaccorso <carnil@...ian.org>)
OpenDMARC buffer overflows (Hanno Böck <hanno@...eck.de>)
Re: OpenDMARC buffer overflows (Alyssa Ross <hi@...ssa.is>)
Re: OpenDMARC buffer overflows (Thomas Ward <teward@...mas-ward.net>)

September 20 (6 messages)

CVE-2019-14821 Kernel: KVM: OOB memory access via mmio ring buffer (P J P <ppandit@...hat.com>)
[CVE-2019-10087] Apache JSPWiki Cross-site scripting vulnerability in Page Revision History (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
[CVE-2019-10089] Apache JSPWiki Cross-site scripting vulnerability on WYSIWYG editor (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
[CVE-2019-10090] Apache JSPWiki Cross-site scripting vulnerability on plain editor (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
[CVE-2019-12404] Apache JSPWiki Cross-site scripting vulnerability on InfoContent.jsp (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
[CVE-2019-12407] Apache JSPWiki Cross-site scripting vulnerability related to the remember parameter (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)

September 21 (1 message)

OSS platform security (Rich Persaud <persaur@...il.com>)

September 24 (2 messages)

Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow (peterpi(皮罡) <peterpi@...cent.com>)
CVE-2019-16714: info leak in RDS rds6_inc_info_copy (butt3rflyh4ck <butterflyhuangxx@...il.com>)

September 25 (3 messages)

CVE-2019-16714: Linux kernel net/rds: info leak vulnerability in rds6_inc_info_copy (butt3rflyh4ck <butterflyhuangxx@...il.com>)
[SBA-ADV-20190911-01] CVE-2019-16524: Easy FancyBox Wordpress Plugin 1.8.17 or below Stored Cross-site Scripting (XSS) (SBA Research Advisory <advisory@...-res…)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

September 27 (3 messages)

Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Tyler Hicks <tyhicks@...onical.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Andrey Konovalov <andreyknvl@...il.com>)
Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 (Tyler Hicks <tyhicks@...onical.com>)

September 28 (4 messages)

Exim CVE-2019-16928 RCE using a heap-based buffer overflow (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: Exim CVE-2019-16928 RCE using a heap-based buffer overflow (Dominic Taylor <dom@...blepoint.com>)
Re: Exim CVE-2019-16928 RCE using a heap-based buffer overflow (Heiko Schlittermann <hs@...littermann.de>)
Re: Exim CVE-2019-16928 RCE using a heap-based buffer overflow (Heiko Schlittermann <hs@...marc.schlittermann.de>)

71 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.