oss-security mailing list - 2020/01

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹	²	³	⁴	⁵
⁶	⁷	⁸ 2	⁹	¹⁰ 1	¹¹	¹² 1
¹³	¹⁴ 4	¹⁵ 2	¹⁶ 4	¹⁷ 4	¹⁸	¹⁹
²⁰ 6	²¹ 2	²² 3	²³ 3	²⁴ 2	²⁵	²⁶
²⁷ 4	²⁸ 4	²⁹ 1	³⁰ 6	³¹ 3

Messages by day:

January 8 (2 messages)

[SECURITY ADVISORY] curl: SMB access smuggling via FILE URL on Windows (CVE-2019-15601) (Daniel Stenberg <daniel@...x.se>)
[SECURITY] CVE-2020-1925: Possible SSRF in AsyncResponseWrapperImpl (mibo <mibo@...che.org>)

January 10 (1 message)

linux-distros membership adjustment/vouching (Kees Cook <kees@...ntu.com>)

January 12 (1 message)

Re: linux-distros membership adjustment/vouching (Solar Designer <solar@...nwall.com>)

January 14 (4 messages)

CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint (Randall Hauch <rhauch@...che.org>)
[CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI (Ash Berlin-Taylor <ash@...che.org>)
Xen Security Advisory 312 v1 - arm: a CPU may speculate past the ERET instruction (Xen.org security team <security@....org>)
Re: linux-distros membership adjustment/vouching (Jorge Lucangeli Obes <jorgelo@...gle.com>)

January 15 (2 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
[CVE-2020-1929] Apache Beam MongoDB IO connector disables certificate trust verification (Ismaël Mejía <iemejia@...che.org>)

January 16 (4 messages)

[CVE-2019-17570] xmlrpc-common untrusted deserialization (<cert.cc@...nge.com>)
CVE-2020-7039 QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (P J P <ppandit@...hat.com>)
[CVE-2019-12423] Apache CXF OpenId Connect JWK Keys service returns private/secret credentials if configured with a jwk… (Colm O hEigeartaigh <coheigea@...che.or…)
[CVE-2019-17573] Apache CXF Reflected XSS in the services listing page (Colm O hEigeartaigh <coheigea@...che.org>)

January 17 (4 messages)

Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume (Jeffrey Walton <noloader@...il.com>)
CVE-2020-7211 QEMU: Slirp: potential directory traversal using relative paths via tftp server on Windows host (P J P <ppandit@...hat.com>)
Re: Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume (Sven Schwedas <sven.schwedas@....at>)
Re: Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume (John Haxby <john.haxby@...cle.com>)

January 20 (6 messages)

Re: Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume (Peter Kjellström <cap@....liu.se>)
CVE-2020-2656, CVE-2020-2696 - Multiple vulnerabilities in Oracle Solaris (Marco Ivaldi <marco.ivaldi@...iaservice.net>)
CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock (Matthias Gerstner <mgerstner@...e.de>)
CVE-2020-5202: apt-cacher-ng: a local unprivileged user can impersonate the apt-cacher-ng daemon, possible credentials le… (Matthias Gerstner <mgerstner@...e.de>)
CVE-2019-18899: apt-cacher-ng: openSUSE packaging for apt-cacher-ng runs the daemon as root instead of as an unprivileged… (Matthias Gerstner <mgerstner@...e.de>)
CVE-2019-18932: sarg: insecure usage of /tmp/sarg allows privilege escalation / DoS attack vector (Matthias Gerstner <mgerstner@...e.de>)

January 21 (2 messages)

CVE-2019-20384: Portage insecure temporary location (Michael Orlitzky <michael@...itzky.com>)
Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock (Nick Boyce <nick.boyce@...il.com>)

January 22 (3 messages)

Plone security hotfix 20200121 (Maurits van Rees <maurits@...rees.org>)
Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lo… (Matthias Gerstner <matthias.gerstner@su…)
Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lo… (Matthias Gerstner <matthias.gerstner@su…)

January 23 (3 messages)

Re: CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock (Nick Boyce <nick.boyce@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE-2020-1711 QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server (P J P <ppandit@...hat.com>)

January 24 (2 messages)

Re: Plone security hotfix 20200121 (Maurits van Rees <maurits@...rees.org>)
RE: [CVE-2019-17570] xmlrpc-common untrusted deserialization (<cert.cc@...nge.com>)

January 27 (4 messages)

Re: CVE-2019-18932: sarg: insecure usage of /tmp/sarg allows privilege escalation / DoS attack vector (Matthias Gerstner <mgerstner@...e.de>)
[CVE-2020-1933] Apache NiFi Information Disclosure (Nathan Gough <thenatog@...che.org>)
[CVE-2020-1933] Apache NiFi XSS Attack (Nathan Gough <thenatog@...che.org>)
[CVE-2020-1932] Apache Incubator Superset user data leak vulnerability (daniel gaspar <danielvazgaspar@...il.com>)

January 28 (4 messages)

CVE-2020-1940: Apache Jackrabbit Oak sensitive information disclosure vulnerability (Angela Schreiber <anchela@...be.com>)
Linux kernel: user-triggerable read-after-free crash or 1-bit infoleak oracle in open(2) (Solar Designer <solar@...nwall.com>)
LPE and RCE in OpenSMTPD (CVE-2020-7247) (Qualys Security Advisory <qsa@...lys.com>)
Re: Linux kernel: user-triggerable read-after-free crash or 1-bit infoleak oracle in open(2) (Solar Designer <solar@...nwall.com>)

January 29 (1 message)

Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

January 30 (6 messages)

New Qt vulnerabilities (Thiago Macieira <thiago.macieira@...el.com>)
[CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands w… ("Kevin A. McGrail" <kmcgrail@...che.org…)
[CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands ("Kevin A. McGrail" <kmcgrail@...che.org>)
CVE-2019-3016: information leak within a KVM guest (John Haxby <john.haxby@...cle.com>)
Linux kernel: arm64/KVM debug registers vulnerability (Catalin Marinas <catalin.marinas@....com>)
CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled ("Todd C. Miller" <Todd.Miller@...o.ws>)

January 31 (3 messages)

Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled ("Todd C. Miller" <Todd.Miller@...o.ws>)
CVE-2020-1700 ceph: connection leak in the RGW Beast front-end permits a DoS against the RGW server (Hardik Vyas <hvyas@...hat.com>)
multiple NULL pointer dereference vulnerabilities in newlib (Dimitrios Glynos <dimitris@...sus-labs.com>)

52 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.