oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 7	² 5	³ 1	⁴ 1	⁵
⁶ 2	⁷ 3	⁸ 1	⁹ 2	¹⁰	¹¹	¹²
¹³	¹⁴ 4	¹⁵ 6	¹⁶ 4	¹⁷ 4	¹⁸	¹⁹ 2
²⁰ 1	²¹ 9	²² 2	²³ 15	²⁴ 3	²⁵ 1	²⁶
²⁷ 4	²⁸	²⁹	³⁰ 5

Messages by day:

April 1 (7 messages)

Re: pam-krb5 security advisory (4.9 and earlier) (Jason Bishop <jason.bishop@...il.com>)
CVE-2020-1954: Apache CXF JMX Integration is vulnerable to a MITM attack (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2019-11254: Kubernetes: denial of service vulnerability from malicious YAML payloads (CJ Cullen <cjcullen@...gle.com>)
CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (Daniel Ruggeri <druggeri@...che.org>)
CVE-2020-1934: mod_proxy_ftp use of uninitialized value (Daniel Ruggeri <druggeri@...che.org>)
[CVE-2020-1958]: Apache Druid LDAP injection vulnerability (Jonathan Wei <jonwei@...che.org>)
Deficient engineering processes (Jeffrey Walton <noloader@...il.com>)

April 2 (5 messages)

Re: Deficient engineering processes (Michael Orlitzky <michael@...itzky.com>)
Re: Deficient engineering processes (Russ Allbery <eagle@...ie.org>)
Re: Deficient engineering processes (Seth Arnold <seth.arnold@...onical.com>)
Re: Deficient engineering processes (Ulisses Albuquerque <ulisses.montenegro@...il.com>)
Re: Deficient engineering processes (Reed Black <reed@...afeword.org>)

April 3 (1 message)

Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 4 (1 message)

Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (Daniel Ruggeri <druggeri@...che.org>)

April 6 (2 messages)

CVE-2020-11102 QEMU: tulip: OOB access in tulip_copy_tx_buffers (P J P <ppandit@...hat.com>)
CVE-2020-8834: Linux kernel Power8 conflicting use of HSTATE_HOST_R1 vulnerability (Steve Beattie <steve.beattie@...onical.com>)

April 7 (3 messages)

CVE-2020-1760 ceph: header-splitting in RGW GetObject has a possible XSS (Hardik Vyas <hvyas@...hat.com>)
CVE-2020-1759 ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions (Hardik Vyas <hvyas@...hat.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

April 8 (1 message)

Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack (Brian May <brian@...uxpenguins.xyz>)

April 9 (2 messages)

libssh - CVE-2020-1730 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: [CVE-2019-16782] Possible Information Leak / Session Hijack Vulnerability in Rack (Stuart D Gathman <stuart@...hman.org>)

April 14 (4 messages)

Xen Security Advisory 313 v3 (CVE-2020-11740,CVE-2020-11741) - multiple xenoprof issues (Xen.org security team <security@....org>)
Xen Security Advisory 314 v3 (CVE-2020-11739) - Missing memory barriers in read-write unlock paths (Xen.org security team <security@....org>)
Xen Security Advisory 316 v3 (CVE-2020-11743) - Bad error path in GNTTABOP_map_grant (Xen.org security team <security@....org>)
Xen Security Advisory 318 v3 (CVE-2020-11742) - Bad continuation handling in GNTTABOP_copy (Xen.org security team <security@....org>)

April 15 (6 messages)

CVE-2020-11669: Linux kernel 4.10 to 5.1: powerpc: guest can cause DoS on POWER9 KVM hosts (Andrew Donnellan <ajd@...ux.ibm.com>)
Re: CVE-2020-11669: Linux kernel 4.10 to 5.1: powerpc: guest can cause DoS on POWER9 KVM hosts (Michal Suchánek <msuchanek@...e.de>)
CVE-2020-2771, CVE-2020-2851, CVE-2020-2944 - Multiple vulnerabilities in Oracle Solaris (Marco Ivaldi <marco.ivaldi@...iaservice.net>)
CVE-2020-10942 Kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (P J P <ppandit@...hat.com>)
CVE-2020-5260: Git: malicious URLs may cause Git to present stored credentials to the wrong server (Solar Designer <solar@...nwall.com>)
Re: CVE-2020-5260: Git: malicious URLs may cause Git to present stored credentials to the wrong server (Taylor Blau <ttaylorr@...hub.com>)

April 16 (4 messages)

CVE-2020-1964: Apache Heron (incubating) information disclosure vulnerability (Josh Fischer <josh@...hfischer.io>)
Re: CVE-2020-11669: Linux kernel 4.10 to 5.1: powerpc: guest can cause DoS on POWER9 KVM hosts (Paul Mackerras <paulus@...abs.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0004 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

April 17 (4 messages)

CVE-2020-10708 kernel: race condition in kernel/audit.c may allow low privilege users trigger kernel panic ("陈伟宸(田各)" <splendidsky.cwc@...baba-inc.com…)
Re: CVE-2020-10708 kernel: race condition in kernel/audit.c may allow low privilege users trigger kernel panic (Greg KH <greg@...ah.com>)
回复：CVE-2020-10708 kernel: race condition in kernel/audit.c may allow low privilege users trigger kernel panic ("陈伟宸(田各)" <splendidsky.cwc@...bab…)
Re: CVE-2020-10708 kernel: race condition in kernel/audit.c may allow low privilege users trigger kernel panic (Steve Grubb <sgrubb@...hat.com>)

April 19 (2 messages)

re2c: heap overflow in Scanner::fill (scanner.cc) (Agostino Sarubbo <ago@...too.org>)
Re: re2c: heap overflow in Scanner::fill (scanner.cc) (Henri Salo <henri@...v.fi>)

April 20 (1 message)

CVE-2020-11008: Git: Malicious URLs can still cause Git to send a stored credential to the wrong server (Taylor Blau <ttaylorr@...hub.com>)

April 21 (9 messages)

Re: re2c: heap overflow in Scanner::fill (scanner.cc) (Henri Salo <henri@...v.fi>)
CVE-2020-10690 kernel: use-after-free in cdev_put() when a PTP device is removed while it's chardev is open (Rohit Keshri <rkeshri@...hat.com>)
Pacman package manager - taking untrusted input ("jellicent@...tonmail.com" <jellicent@...tonmail.com>)
Re: Pacman package manager - taking untrusted input (Santiago Torres <torresariass@...il.com>)
Re: Pacman package manager - taking untrusted input (Amin Vakil <info@...nvakil.com>)
Re: Pacman package manager - taking untrusted input ("jellicent@...tonmail.com" <jellicent@...tonmail.com>)
Re: Pacman package manager - taking untrusted input (Simon McVittie <smcv@...ian.org>)
Re: Pacman package manager - taking untrusted input (Jelle van der Waa <jelle@...aa.nl>)
Re: Pacman package manager - taking untrusted input (Morten Linderud <foxboron@...hlinux.org>)

April 22 (2 messages)

Re: Pacman package manager - taking untrusted input (Eli Schwartz <eschwartz@...hlinux.org>)
[CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain (Mark J Cox <mark@...nssl.org>)

April 23 (15 messages)

[ADVISORY] SQUID-2019:12 Multiple issues in ESI Response processing (Amos Jeffries <squid3@...enet.co.nz>)
[ADVISORY] SQUID-2020:4 Multiple issues in HTTP Digest authentication (Amos Jeffries <squid3@...enet.co.nz>)
spoofing of local email sender via a homoglyph attack (PromiseLabs Pentest Research <pentest@...miselabs.net>)
Exuberant Ctags and x2vpn format string vulnerabilities (Jasper Lievisse Adriaanse <j@...per.la>)
Re: spoofing of local email sender via a homoglyph attack (Solar Designer <solar@...nwall.com>)
Re: spoofing of local email sender via a homoglyph attack (PromiseLabs Pentest Research <pentest@...miselabs.net>)
Re: mailman 2.x: XSS via file attachments in list archives (Stefan Cornelius <scorneli@...hat.com>)
Re: spoofing of local email sender via a homoglyph attack (Solar Designer <solar@...nwall.com>)
Re: spoofing of local email sender via a homoglyph attack (Claus Assmann <ml+oss@...tp.org>)
Re: spoofing of local email sender via a homoglyph attack (PromiseLabs Pentest Research <pentest@...miselabs.net>)
Re: spoofing of local email sender via a homoglyph attack ("Stuart D. Gathman" <stuart@...hman.org>)
Re: spoofing of local email sender via a homoglyph attack (Wietse Venema <wietse@...cupine.org>)
Re: spoofing of local email sender via a homoglyph attack (Solar Designer <solar@...nwall.com>)
Re: spoofing of local email sender via a homoglyph attack (Jeremy Stanley <fungi@...goth.org>)
Re: spoofing of local email sender via a homoglyph attack (John Haxby <john.haxby@...cle.com>)

April 24 (3 messages)

[CVE-2020-9489] Denial of Service (DOS) Vulnerabilities in Some of Apache Tika's Parsers (Tim Allison <tallison@...che.org>)
CVE-2020-11869 qemu: integer overflow in ati_2d_blt() in hw/display/ati-2d.c could lead to DoS (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: mailman 2.x: XSS via file attachments in list archives (Salvatore Bonaccorso <carnil@...ian.org>)

April 25 (1 message)

[CVE-2020-9488] Improper validation of certificate with host mismatch in Apache Log4j SMTP appender (Matt Sicker <mattsicker@...che.org>)

April 27 (4 messages)

[CVE-2020-1952] Apache IoTDB (incubating) Remote Code execution vulnerability ("Dawei Liu" <liudw@...che.org>)
re2c: infinite loop (Agostino Sarubbo <ago@...too.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
[CVE-2020-9482] Apache NiFi Registry user log out issue (Nathan Gough <thenatog@...che.org>)

April 30 (5 messages)

Check your pre/post install scripts in rpm/deb/... packages for security issues (Johannes Segitz <jsegitz@...e.de>)
[CVE-2019-12425] Apache OFBiz Host Header Injection (Jacques Le Roux <jacques.le.roux@...7arts.com>)
Re: Check your pre/post install scripts in rpm/deb/... packages for security issues (Michael Orlitzky <michael@...itzky.com>)
[CVE-2019-0235 ] Apache OFBiz multiple CSRF vulnerabilities (Jacques Le Roux <jacques.le.roux@...7arts.com>)
Linux kernel SELinux/netlink missing access check (Paul Moore <paul@...l-moore.com>)

82 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.