oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 6	³ 4	⁴ 6	⁵ 7	⁶ 3	⁷	⁸ 1
⁹ 8	¹⁰ 4	¹¹ 9	¹² 2	¹³ 3	¹⁴	¹⁵
¹⁶ 3	¹⁷ 1	¹⁸ 3	¹⁹ 3	²⁰ 2	²¹	²²
²³ 2	²⁴ 1	²⁵	²⁶	²⁷	²⁸	²⁹ 1
³⁰ 1	³¹

Messages by day:

December 2 (6 messages)

Django 2.2.8 and 2.1.15: CVE-2019-19118: Privilege escalation in the Django admin. (Carlton Gibson <carlton.gibson@...il.com>)
virtual consoles (Tavis Ormandy <taviso@...il.com>)
Re: virtual consoles (Solar Designer <solar@...nwall.com>)
Re: virtual consoles (Tavis Ormandy <taviso@...il.com>)
Re: virtual consoles (Leonid Isaev <leonid.isaev@...x.com>)
Re: virtual consoles (Leonid Isaev <leonid.isaev@...x.com>)

December 3 (4 messages)

Re: virtual consoles (Georgi Guninski <gguninski@...il.com>)
Re: virtual consoles (Simon McVittie <smcv@...ian.org>)
Re: virtual consoles (Tavis Ormandy <taviso@...il.com>)
Linux kernel: multiple vulnerabilities in the USB subsystem x3 (Andrey Konovalov <andreyknvl@...il.com>)

December 4 (6 messages)

CVE-2019-17554: Olingo: XML External Entity resolution attack (mibo <mibo@...che.org>)
CVE-2019-17555: Olingo: DoS via Retry-After header vulnerability (mibo <mibo@...che.org>)
CVE-2019-17556: Olingo: Deserialization vulnerability (mibo <mibo@...che.org>)
[CVE-2019-19331] Knot Resolver 4.3.0 security release (Vladimír Čunát <vladimir.cunat@....cz>)
Authentication vulnerabilities in OpenBSD (Qualys Security Advisory <qsa@...lys.com>)
Re: Authentication vulnerabilities in OpenBSD (Solar Designer <solar@...nwall.com>)

December 5 (7 messages)

[CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. ("William J. Tolley" <william@...akpointingbad.com>)
Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (Noel Kuntze <noel.kuntze+oss-security@...rmi.consulting>)
Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (Colm MacCárthaigh <colm@...costs.net>)
Re: Authentication vulnerabilities in OpenBSD (Georgi Guninski <gguninski@...il.com>)
Re: Authentication vulnerabilities in OpenBSD (Renaud Allard <renaud@...ard.it>)
Re: Authentication vulnerabilities in OpenBSD (Arrigo Triulzi <arrigo@...hemistowl.org>)
Xen Security Advisory 306 v3 (CVE-2019-19579) - Device quarantine for alternate pci assignment methods (Xen.org security team <security@....org>)

December 6 (3 messages)

CVE-2019-5544 openslp 1.2.1, 2.0.0 heap overflow vulnerability (VMware Security Response Center <security@...are.com>)
Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (ValdikSS <iam@...dikss.org.ru>)
Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (ValdikSS <iam@...dikss.org.ru>)

December 8 (1 message)

Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (Noel Kuntze <noel.kuntze+oss-security@...rmi.consulting>)

December 9 (8 messages)

Shell wildcards considered dangerous? (Georgi Guninski <gguninski@...il.com>)
Re: Shell wildcards considered dangerous? (Noel Kuntze <noel.kuntze+oss-security@...rmi.consulting>)
Re: Shell wildcards considered dangerous? (Heiko Schlittermann <hs@...littermann.de>)
Re: Shell wildcards considered dangerous? (Leonid Isaev <leonid.isaev@...x.com>)
Re: Shell wildcards considered dangerous? (Noel Kuntze <noel.kuntze+oss-security@...rmi.consulting>)
Re: Shell wildcards considered dangerous? (Leonid Isaev <leonid.isaev@...x.com>)
Re: Shell wildcards considered dangerous? (Noel Kuntze <noel.kuntze+oss-security@...rmi.consulting>)
Re: Shell wildcards considered dangerous? (Leonid Isaev <leonid.isaev@...x.com>)

December 10 (4 messages)

CVE-2019-18960: Firecracker v0.18.0 and v0.19.0 vsock buffer overflow (<sandreim@...zon.com>)
Re: CVE-2019-5544 openslp 1.2.1, 2.0.0 heap overflow vulnerability (Riccardo Schirone <rschiron@...hat.com>)
CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) (P J P <ppandit@...hat.com>)
Re: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) (Tyler Hicks <tyhicks@...onical.com>)

December 11 (9 messages)

Re: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) (P J P <ppandit@...hat.com>)
Re: CVE-2019-5544 openslp 1.2.1, 2.0.0 heap overflow vulnerability (VMware Security Response Center <security@...are.com>)
Xen Security Advisory 307 v3 (CVE-2019-19581,CVE-2019-19582) - find_next_bit() issues (Xen.org security team <security@....org>)
Xen Security Advisory 309 v3 (CVE-2019-19578) - Linear pagetable use / entry miscounts (Xen.org security team <security@....org>)
Xen Security Advisory 310 v3 (CVE-2019-19580) - Further issues with restartable PV type change operations (Xen.org security team <security@....org>)
Xen Security Advisory 311 v4 (CVE-2019-19577) - Bugs in dynamic height handling for AMD IOMMU pagetables (Xen.org security team <security@....org>)
Xen Security Advisory 308 v3 (CVE-2019-19583) - VMX: VMentry failure with debug exceptions and blocked states (Xen.org security team <security@....org>)
[OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687) (Gage Hugo <gagehugo@...il.com>)
Local Privilege Escalation in OpenBSD's dynamic loader (CVE-2019-19726) (Qualys Security Advisory <qsa@...lys.com>)

December 12 (2 messages)

Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805 ("Kevin A. McGrail" <kmcgrail@...che.org>)
Apache SpamAssassin v3.4.3 released with fix for CVE-2019-12420 ("Kevin A. McGrail" <kmcgrail@...che.org>)

December 13 (3 messages)

Multiple vulnerabilities fixed in Git (Johannes Schindelin <Johannes.Schindelin@....de>)
CVE-2019-19722: Critical vulnerability in Dovecot (Aki Tuomi <aki.tuomi@...ecot.fi>)
Re: CVE-2019-19722: Critical vulnerability in Dovecot (Aki Tuomi <aki.tuomi@...n-xchange.com>)

December 16 (3 messages)

CVE-2019-19332 Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (P J P <ppandit@...hat.com>)
[CVE-2019-12414] Apache Incubator Superset medata data leak vulnerability (daniel gaspar <danielvazgaspar@...il.com>)
[CVE-2019-12413] Apache Incubator Superset meta data leak vulnerability (daniel gaspar <danielvazgaspar@...il.com>)

December 17 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

December 18 (3 messages)

Django: CVE-2019-19844: Potential account hijack via password reset form (Mariusz Felisiak <felisiak.mariusz@...il.com>)
[CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack (Aaron Patterson <aaron.patterson@...il.com>)
Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack ("Alexander E. Patrakov" <patrakov@...il.com>)

December 19 (3 messages)

CVE requests: three vulnerabilities in ImageMagick (GalyCannon <galycannon@...il.com>)
[CVE-2019-17571] Apache Log4j 1.2 deserialization of untrusted data in SocketServer (Matt Sicker <mattsicker@...che.org>)
Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack ("Stuart D. Gathman" <stuart@...hman.org>)

December 20 (2 messages)

Re: CVE requests: three vulnerabilities in ImageMagick (Mohammad Tausif Siddiqui <msiddiqu@...hat.com>)
VNC vulnerabilities. TigerVNC security update (Pavel Cheremushkin <Pavel.Cheremushkin@...persky.com>)

December 23 (2 messages)

Arbitrary file upload vulnerability in upload-image-with-ajax v1.0 ("Larry W. Cashdollar" <larry0@...com>)
Re: Arbitrary file upload vulnerability in upload-image-with-ajax v1.0 ("Larry W. Cashdollar" <larry0@...com>)

December 24 (1 message)

CVE-2019-19947: Linux kernel can: kvaser_usb: kvaser_usb_leaf: some info-leaks vulnerabilities (butt3rflyh4ck <butterflyhuangxx@...il.com>)

December 29 (1 message)

OpenSC 0.20.0 released (Frank Morgner <frankmorgner@...il.com>)

December 30 (1 message)

[CVE-2019-17558] Apache Solr RCE through VelocityResponseWriter (Erik Hatcher <erik.hatcher@...il.com>)

70 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.