oss-security mailing list - 2020/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	² 3	³
⁴ 2	⁵ 1	⁶ 6	⁷ 3	⁸ 4	⁹	¹⁰ 1
¹¹ 1	¹² 3	¹³ 2	¹⁴ 11	¹⁵ 3	¹⁶	¹⁷
¹⁸ 2	¹⁹ 9	²⁰ 5	²¹ 1	²² 6	²³	²⁴
²⁵	²⁶	²⁷ 5	²⁸ 2	²⁹	³⁰	³¹

Messages by day:

May 2 (3 messages)

[CVE-2019-17557] Enduser UI XSS (Francesco Chicchiriccò <ilgrosso@...che.org>)
[CVE-2020-1959] Apache Syncope: Multiple Remote Code Execution Vulnerabilities (Francesco Chicchiriccò <ilgrosso@...che.org>)
[CVE-2020-1961] Apache Syncope: Server-Side Template Injection on mail templates (Francesco Chicchiriccò <ilgrosso@...che.org>)

May 4 (2 messages)

CVE-2020-10717 QEMU: virtiofsd: guest may open maximum file descriptor to cause DoS (P J P <ppandit@...hat.com>)
[CVE-2020-12114] Linux kernel denial of service by corrupting mountpoint reference counter (Piotr Krysiuk <piotras@...il.com>)

May 5 (1 message)

Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Solar Designer <solar@...nwall.com>)

May 6 (6 messages)

CVE-2020-10732 kernel: uninitialized kernel data leak in userspace coredumps (Wade Mealing <wmealing@...hat.com>)
Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Igor Seletskiy <i@...udlinux.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
[OSSA-2020-003] Keystone: Keystone does not check signature TTL of the EC2 credential auth method (CVE PENDING) (Gage Hugo <gagehugo@...il.com>)
[OSSA-2020-004] Keystone: Keystone credential endpoints allow owner modification and are not protected from a scoped context (CV… (Gage Hugo <gagehugo@...il.com>)
[OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING) (Gage Hugo <gagehugo@...il.com>)

May 7 (3 messages)

Re: [OSSA-2020-003] Keystone: Keystone does not check signature TTL of the EC2 credential auth method (CVE PENDING) (Gage Hugo <gagehugo@...il.com>)
Re: [OSSA-2020-004] Keystone: Keystone credential endpoints allow owner modification and are not protected from a scoped context… (Gage Hugo <gagehugo@...il.com>)
Re: [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING) (Gage Hugo <gagehugo@...il.com>)

May 8 (4 messages)

Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Benjamin Gilbert <benjamin.gilbert@...eos.com>)
Linux kernel: two buffer overflow in the marvell wifi driver (qing xu <m1s5p6688@...il.com>)
Incentives for pre-release reporting (Florian Weimer <fweimer@...hat.com>)
Re: Incentives for pre-release reporting (Henri Salo <henri@...v.fi>)

May 10 (1 message)

[CVE-2018-1285] XXE vulnerability in Apache log4net (Matt Sicker <mattsicker@...che.org>)

May 11 (1 message)

oddjob: mkhomedir: CVE-2020-10737: race condition when copying skeleton tree (Matthias Gerstner <mgerstner@...e.de>)

May 12 (3 messages)

[CVE-2020-1939] Apache NuttX optional/example ftpd program NULL pointer bug (Brennan Ashton <btashton@...che.org>)
CVE-2020-10711 Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category (P J P <ppandit@...hat.com>)
Re: CVE-2020-10711 Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category (P J P <ppandit@...hat.com>)

May 13 (2 messages)

[CVE-2020-1945] Apache Ant insecure temporary file vulnerability (Stefan Bodewig <bodewig@...che.org>)
[CVE-2020-1960] Apache Flink JMX information disclosure vulnerability (Chesnay Schepler <chesnay@...che.org>)

May 14 (11 messages)

[CVE-2020-1941] XSS in ActiveMQ WebConsole (Jean-Baptiste Onofre <jb@...thrax.net>)
Hypermail XSS via attachment (Hanno Böck <hanno@...eck.de>)
XSS in BigBlueButton < 2.2.6 (Hanno Böck <hanno@...eck.de>)
Re: re2c: infinite loop (Agostino Sarubbo <ago@...too.org>)
[SECURITY][CVE-2019-17572] Apache RocketMQ directory traversal vulnerability (ShannonDing <dinglei@...che.org>)
CVE-2019-17562 buffer overflow in baremetal plugin. (Daan Hoogland <dahn@...che.org>)
[SECURITY] New security advisory CVE-2020-11971 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
[SECURITY] New security advisory CVE-2020-11972 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
[SECURITY] New security advisory CVE-2020-11973 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
Re: [SECURITY] New security advisory CVE-2020-11972 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
Python Beaker - Deserialization of Untrasted Data which can lead to Arbitrary code execution (Matheus Bratfisch <matheusbrat@...il.com>)

May 15 (3 messages)

Re: [test case][kunit] CVE-2020-10711 Kernel netLabel (P J P <ppandit@...hat.com>)
[test case][kunit] CVE-2020-10711 Kernel netLabel ("Singh, Balbir" <sblbir@...zon.com>)
Re: [test case][kunit] CVE-2020-10711 Kernel netLabel ("Singh, Balbir" <sblbir@...zon.com>)

May 18 (2 messages)

Multiple vulnerabilities in Dovecot IMAP server (Aki Tuomi <aki.tuomi@...ecot.fi>)
DPDK security advisory for multiple vhost related issues (Ferruh Yigit <ferruh.yigit@...el.com>)

May 19 (9 messages)

CVE-2020-10736 ceph: authorization bypass in monitor and manager daemons (Hardik Vyas <hvyas@...hat.com>)
[CVE-2020-12667] Knot Resolver 5.1.1 NXNSAttack mitigation (Petr Špaček <petr.spacek@....cz>)
PowerDNS Recursor 4.3.1, 4.2.2. and 4.1.16 released fixing multiple vulnerabilities (Otto Moerbeek <otto.moerbeek@...n-xchange.com>)
Two vulnerabilities disclosed in BIND (CVE-2020-8616 and CVE-2020-8617) (ISC Security Officer <security-officer@....org>)
Unbound - CVE-2020-12662, CVE-2020-12663 (Ralph Dolmans <ralph@...etlabs.nl>)
CVE-2020-12888 Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (P J P <ppandit@...hat.com>)
[CVE-2020-1955] Apache CouchDB Remote Privilege Escalation (Jan Lehnardt <jan@...che.org>)
Remote Code Execution in qmail (CVE-2005-1513) (Qualys Security Advisory <qsa@...lys.com>)
qmail: short/int vs. gid_t (Qualys Security Advisory <qsa@...lys.com>)

May 20 (5 messages)

[CVE-2020-1956] Apache Kylin command injection vulnerability (George Ni <nic@...che.org>)
Re: Remote Code Execution in qmail (CVE-2005-1513) (Georgi Guninski <gguninski@...il.com>)
Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Matthias Gerstner <mgerstner@...e.de>)
CVE-2020-9484 Apache Tomcat Remote Code Execution via session persistence (Mark Thomas <markt@...che.org>)
Re: Remote Code Execution in qmail (CVE-2005-1513) (Qualys Security Advisory <qsa@...lys.com>)

May 21 (1 message)

Short notes on qmail security guarantee (Georgi Guninski <gguninski@...il.com>)

May 22 (6 messages)

Re: Short notes on qmail security guarantee (Solar Designer <solar@...nwall.com>)
Re: Short notes on qmail security guarantee (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Short notes on qmail security guarantee (Georgi Guninski <gguninski@...il.com>)
Re: Short notes on qmail security guarantee (Arrigo Triulzi <arrigo@...hemistowl.org>)
Re: Short notes on qmail security guarantee ("Perry E. Metzger" <perry@...rmont.com>)
Re: Short notes on qmail security guarantee (Jeffrey Walton <noloader@...il.com>)

May 27 (5 messages)

Announce: OpenSSH 8.3 released (Damien Miller <djm@...nbsd.org>)
CVE-2020-13253 QEMU: sd: OOB access could crash the guest resulting in DoS (P J P <ppandit@...hat.com>)
CVE-2020-10751 - Linux kernel: SELinux netlink permission check bypass (Ondrej Mosnacek <omosnace@...hat.com>)
Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Benjamin Gilbert <benjamin.gilbert@...eos.com>)
Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities (Vincent Batts <vbatts@...volk.io>)

May 28 (2 messages)

CVE-2020-13361 QEMU: es1370: OOB access due to incorrect frame count leads to DoS (P J P <ppandit@...hat.com>)
CVE-2020-13362 QEMU: megasas: OOB read access due to invalid index leads to DoS (P J P <ppandit@...hat.com>)

70 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.