oss-security mailing list - 2020/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 2
²	³ 1	⁴ 3	⁵ 1	⁶ 3	⁷	⁸
⁹ 1	¹⁰ 1	¹¹ 1	¹² 4	¹³ 2	¹⁴ 1	¹⁵
¹⁶	¹⁷	¹⁸ 5	¹⁹ 1	²⁰	²¹	²²
²³ 3	²⁴	²⁵ 2	²⁶ 1	²⁷	²⁸	²⁹
³⁰ 3	³¹ 3

Messages by day:

March 1 (2 messages)

Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) ("Alexander E. Patrakov" <patrakov@...il.com>)
Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) (Florian Weimer <fweimer@...hat.com>)

March 3 (1 message)

CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Benjamin Gilbert <benjamin.gilbert@...eos.com>)

March 4 (3 messages)

Django: CVE-2020-9402: Potential SQL injection via tolerance parameter in GIS functions and aggregates on Oracle (Mariusz Felisiak <felisiak.mariusz@...il.com>)
Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Igor Seletskiy <i@...udlinux.com>)
Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (John Haxby <john.haxby@...cle.com>)

March 5 (1 message)

CVE-2019-20382 QEMU: vnc: memory leakage upon disconnect (P J P <ppandit@...hat.com>)

March 6 (3 messages)

BIND Operational Notification: An error in handling TCP client quota limits can exhaust TCP connections in BIND 9.16.0 (ISC Security Officer <security-officer@…)
[CVE-2020-1943] Apache OFBiz XSS Vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
CVE-2020-10174: timeshift: arbitrary local code execution due to unsafe usage of temporary directory in /tmp/timeshift (Matthias Gerstner <mgerstner@...e.de>)

March 9 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

March 10 (1 message)

Xen Security Advisory 315 v1 (CVE-2020-0551) - Load Value Injection (LVI) speculative side channel (Xen.org security team <security@....org>)

March 11 (1 message)

[CVE-2020-1947] Apache ShardingSphere(incubator) deserialization vulnerability (Chen QingYang <chenqingyang@...che.org>)

March 12 (4 messages)

[OSSA-2020-002] Manila: Unprivileged users can retrieve, use and manipulate share networks (CVE-2020-9543) (Goutham Pacha Ravi <gouthampravi@...il.com>)
roccat-tools: unsafe multi user scenario involving group-writeable /var/lib/roccat directory (Matthias Gerstner <mgerstner@...e.de>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0003 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Bluez <5.53 DoS/privilege escalation (Matthew Garrett <mjg59@...gle.com>)

March 13 (2 messages)

[CVE-2020-1953] Uncontrolled class instantiation when loading YAML files in Apache Commons Configuration (Oliver Heger <oheger@...che.org>)
Re: Bluez <5.53 DoS/privilege escalation (Marc Deslauriers <marc.deslauriers@...onical.com>)

March 14 (1 message)

[CVE-2019-10091] Apache Geode SSL endpoint verification vulnerability (Anthony Baker <abaker@...che.org>)

March 18 (5 messages)

Insecure implementation of OpenResty ngx.req.set_uri + memory content leak in nginx. (Vladimir Dubrovin <vlad@...urityvulns.ru>)
Re: Insecure implementation of OpenResty ngx.req.set_uri + memory content leak in nginx. (Vladimir Dubrovin <vlad@...urityvulns.ru>)
[CVE-2020-1950] Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser (Tim Allison <tallison@...che.org>)
[CVE-2020-1951] Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser (Tim Allison <tallison@...che.org>)
U-Boot verified boot improper signature verification ("Janushkevich, Dmitry" <dmitry.janushkevich@...ecure.com>)

March 19 (1 message)

[CVE-2020-5267] Possible XSS vulnerability in ActionView (Aaron Patterson <tenderlove@...y-lang.org>)

March 23 (3 messages)

Serendipity XSS via update notification (minor, exploitable by s9y developers) (Hanno Böck <hanno@...eck.de>)
[CVE-2020-1957] Apache Shiro 1.5.2 released (Brian Demers <bdemers@...che.org>)
CVE-2020-8551, CVE-2020-8552: Kubernetes: Denial of service (Tim Allclair <tallclair@...gle.com>)

March 25 (2 messages)

CVE-2020-1949: Apache Sling CMS Reflected XSS Vulnerability (Daniel Klco <dklco@...che.org>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

March 26 (1 message)

Stealing Videos from VLC-iOS (IDOR) (Dhiraj Mishra <mishra.dhiraj95@...il.com>)

March 30 (3 messages)

[CVE-2019-17560] "Apache NetBeans" autoupdate cert validation (Matthias Bläsing <mblaesing@...pel-helix.eu>)
[CVE-2019-17561] "Apache NetBeans" autoupdate system does not fully validate code signatures. (Matthias Bläsing <mblaesing@...pel-helix.eu>)
CVE-2020-8835: Linux kernel bpf incorrect verifier vulnerability (Steve Beattie <steve@...w.org>)

March 31 (3 messages)

pam-krb5 security advisory (4.9 and earlier) (Russ Allbery <eagle@...ie.org>)
Re: pam-krb5 security advisory (4.9 and earlier) (Russ Allbery <eagle@...ie.org>)
Re: pam-krb5 security advisory (4.9 and earlier) (Russ Allbery <eagle@...ie.org>)

38 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.