oss-security mailing list - 2020/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	² 2
³ 1	⁴ 3	⁵ 5	⁶ 5	⁷	⁸	⁹
¹⁰ 1	¹¹ 2	¹² 3	¹³	¹⁴ 6	¹⁵	¹⁶
¹⁷	¹⁸	¹⁹ 2	²⁰	²¹	²²	²³ 1
²⁴ 6	²⁵ 7	²⁶ 1	²⁷ 2	²⁸	²⁹

Messages by day:

February 2 (2 messages)

Re: Linux kernel: user-triggerable read-after-free crash or 1-bit infoleak oracle in open(2) (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: user-triggerable read-after-free crash or 1-bit infoleak oracle in open(2) (Al Viro <viro@...iv.linux.org.uk>)

February 3 (1 message)

Django 3.0.3, 2.2.10 and 1.11.28: CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)`` (Carlton Gibson <carlton.gibson@...il.com>)

February 4 (3 messages)

CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr… (Matthias Gerstner <mgerstner@...e.de>)
Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr… (Solar Designer <solar@...nwall.com>)
Re: CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of … (Matthias Gerstner <mgerstner@...e.de>)

February 5 (5 messages)

CVE-2020-1712 systemd: use-after-free when asynchronous polkit queries are performed (Riccardo Schirone <rschiron@...hat.com>)
Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled (William Bowling <will@...wling.info>)
CVE-2019-18901: mariadb: possible symlink attack for the mysql user in the SUSE specific mysql-systemd-helper script (Matthias Gerstner <mgerstner@...e.de>)
Re: CVE-2019-18901: mariadb: possible symlink attack for the mysql user in the SUSE specific mysql-systemd-helper script ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled ("Todd C. Miller" <Todd.Miller@...o.ws>)

February 6 (5 messages)

Re: CVE-2019-18901: mariadb: possible symlink attack for the mysql user in the SUSE specific mysql-systemd-helper script (Matthias Gerstner <mgerstner@...e.de>)
CVE-2020-8608 QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (P J P <ppandit@...hat.com>)
GNU screen "out of bounds access when setting w_xtermosc after OSC 49" (Solar Designer <solar@...nwall.com>)
[SECURITY] CVE-2019-12426 information disclosure vulnerability in Apache OFBiz (Jacopo Cappellato <jacopoc@...che.org>)
Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" (Amadeusz Sławiński <amade@...blr.net>)

February 10 (1 message)

CVE-2020-1942: Apache NiFi 0.0.1 to 1.11.0 information disclosure in logs (Andy LoPresto <alopresto@...che.org>)

February 11 (2 messages)

Potential regression and/or incomplete fix for CVE-2017-12762 (Ibrahim el-sayed <i.elsayed92@...il.com>)
Re: Potential regression and/or incomplete fix for CVE-2017-12762 (Brad Spengler <spender@...ecurity.net>)

February 12 (3 messages)

CVE-2020-7046: Dovecot: Truncated UTF-8 can be used to DoS submission-login and lmtp processes (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE-2020-7957: Dovecot: Specially crafted mail can crash snippet generation (Aki Tuomi <aki.tuomi@...ecot.fi>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

February 14 (6 messages)

Announce: OpenSSH 8.2 released (Damien Miller <djm@...nbsd.org>)
CVE for program distributing vulnerable components ? (security minded <osssecur1tym1nded@...il.com>)
Re: CVE for program distributing vulnerable components ? (Simon McVittie <smcv@...ian.org>)
Re: Potential regression and/or incomplete fix for CVE-2017-12762 (Ibrahim el-sayed <i.elsayed92@...il.com>)
Re: CVE for program distributing vulnerable components ? (Francis Perron <francisp@...gle.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

February 19 (2 messages)

Wordpress themegrill-demo-importer: database reset/auth bypass, incomplete fix due to CSRF (Hanno Böck <hanno@...eck.de>)
[OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543) (Jeremy Stanley <fungi@...goth.org>)

February 23 (1 message)

[CVE-2020-1937] Apache Kylin SQL injection vulnerability (George Ni <nic@...che.org>)

February 24 (6 messages)

Re: Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" (Cedric Buissart <cbuissar@...hat.com>)
mailman 2.x: XSS via file attachments in list archives (Hanno Böck <hanno@...eck.de>)
Re: mailman 2.x: XSS via file attachments in list archives (Jim Popovitch <jim@...qc.com>)
Local information disclosure in OpenSMTPD (CVE-2020-8793) (Qualys Security Advisory <qsa@...lys.com>)
LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) (Qualys Security Advisory <qsa@...lys.com>)
Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) ("Alexander E. Patrakov" <patrakov@...il.com>)

February 25 (7 messages)

Re: Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" (Cedric Buissart <cbuissar@...hat.com>)
Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) (Qualys Security Advisory <qsa@...lys.com>)
CVE-2020-2732: Nested VMX vulnerability (Boris Ostrovsky <boris.ostrovsky@...cle.com>)
Re: CVE-2020-2732: Nested VMX vulnerability (P J P <ppandit@...hat.com>)
Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2020-9391: Ignoring the top byte of addresses in brk causes heap corruption (AArch64) (Florian Weimer <fweimer@...hat.com>)
Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" (Amadeusz Sławiński <amade@...blr.net>)

February 26 (1 message)

Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) (Qualys Security Advisory <qsa@...lys.com>)

February 27 (2 messages)

Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) (Jonathan Brossard <endrazine@...il.com>)
Re: Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) (Jouni Malinen <jkmalinen@...il.com>)

47 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.