oss-security mailing list - 2020/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 1	² 7	³ 1	⁴	⁵
⁶ 1	⁷ 6	⁸ 1	⁹ 2	¹⁰ 1	¹¹ 1	¹²
¹³ 1	¹⁴ 5	¹⁵ 6	¹⁶ 1	¹⁷ 1	¹⁸	¹⁹ 1
²⁰ 10	²¹ 3	²² 1	²³ 8	²⁴ 1	²⁵ 1	²⁶
²⁷	²⁸ 3	²⁹ 3	³⁰ 8	³¹ 2

Messages by day:

July 1 (1 message)

PowerDNS Recursor 4.3.2, 4.2.3. and 4.1.17 released fixing CVE-2020-14196: Access restriction,bypass (Otto Moerbeek <otto.moerbeek@...n-xchange.com>)

July 2 (7 messages)

CVE-2020-15469 QEMU: MMIO ops null pointer dereference may lead to DoS (P J P <ppandit@...hat.com>)
[SECURITY] CVE-2020-9497: Apache Guacamole: Improper input validation of RDP static virtual channels (Mike Jumper <mjumper@...che.org>)
[SECURITY] CVE-2020-9498: Apache Guacamole: Dangling pointer in RDP static virtual channel handling (Mike Jumper <mjumper@...che.org>)
Contributing Back (Zhang Xiao <xiao.zhang@...driver.com>)
Re: Contributing Back (Francis Perron <francisp@...gle.com>)
Re: Contributing Back (Daniel Stenberg <daniel@...x.se>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

July 3 (1 message)

Re: Contributing Back (Zhang Xiao <xiao.zhang@...driver.com>)

July 6 (1 message)

CVE-2020-13640: WordPress Plugin wpDiscuz <= 5.3.5 SQL injection (asterite <asterite@...lab.cs.msu.su>)

July 7 (6 messages)

veyon: Veyon uses fixed logfile paths in /tmp in versions prior v4.4.0 (Matthias Gerstner <mgerstner@...e.de>)
Xen Security Advisory 317 v3 (CVE-2020-15566) - Incorrect error handling in event channel port allocation (Xen.org security team <security@....org>)
Xen Security Advisory 319 v3 (CVE-2020-15563) - inverted code paths in x86 dirty VRAM tracking (Xen.org security team <security@....org>)
Xen Security Advisory 321 v3 (CVE-2020-15565) - insufficient cache write-back under VT-d (Xen.org security team <security@....org>)
Xen Security Advisory 327 v3 (CVE-2020-15564) - Missing alignment check in VCPUOP_register_vcpu_info (Xen.org security team <security@....org>)
Xen Security Advisory 328 v3 (CVE-2020-15567) - non-atomic modification of live EPT PTE (Xen.org security team <security@....org>)

July 8 (1 message)

[Security Advisory] CVE-2020-8558: Kubernetes: Node setting allows for neighboring hosts to bypass localhost boundary (Joel Smith <joelsmith@...hat.com>)

July 9 (2 messages)

SQL Injection in search field of phpzag live add edit delete data tables records with ajax php mysql ("Larry W. Cashdollar" <larry0@...com>)
X41 D-Sec GmbH Security Advisory X41-2020-006: Memory Corruption Vulnerability in bspatch (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)

July 10 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2020-0006 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

July 11 (1 message)

Re: Contributing Back (Solar Designer <solar@...nwall.com>)

July 13 (1 message)

Re: Contributing Back (Zhang Xiao <xiao.zhang@...driver.com>)

July 14 (5 messages)

[SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability (ShaoFeng Shi <shaofengshi@...che.org>)
[SECURITY][CVE-2020-13926] Apache Kylin SQL injection vulnerability (ShaoFeng Shi <shaofengshi@...che.org>)
[SECURITY] CVE-2020-13935 Apache Tomcat WebSocket Denial of Service (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2020-13934 Apache Tomcat HTTP/2 Denial of Service (Mark Thomas <markt@...che.org>)
Flatcar membership on the linux-distros list (Vincent Batts <vbatts@...volk.io>)

July 15 (6 messages)

Re: Flatcar membership on the linux-distros list (Randy Barlow <randy@...ctronsweatshop.com>)
[CVE-2020-13923] IDOR in Apache OFBiz (Jacques Le Roux <jacques.le.roux@...7arts.com>)
[CVE-2020-9496] Apache OFBiz XML-RPC requests vulnerable without authentication (Jacques Le Roux <jacques.le.roux@...7arts.com>)
CVE-2020-8557: Kubernetes: Node disk DOS by writing to container /etc/hosts (Joel Smith <joelsmith@...hat.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Wadeck Follonier <wfollonier@...udbees.com>)
Kubernetes: CVE-2020-8559: Privilege escalation from compromised node to cluster (Tim Allclair <tallclair@...gle.com>)

July 16 (1 message)

Xen Security Advisory 329 v2 - Linux ioperm bitmap context switching issues (Xen.org security team <security@....org>)

July 17 (1 message)

Re: Xen Security Advisory 329 v2 - Linux ioperm bitmap context switching issues (Mauro Matteo Cascella <mcascell@...hat.com>)

July 19 (1 message)

CVE-2018-21036: Sails.js before v1.0.0-46 DoS (ali.of.south@...mail.me)

July 20 (10 messages)

Perl 5.32.0 mishandling of rpath and runpath tokens (Jeffrey Walton <noloader@...il.com>)
Re: Perl 5.32.0 mishandling of rpath and runpath tokens (Jeffrey Walton <noloader@...il.com>)
Re: Xen Security Advisory 329 v2 - Linux ioperm bitmap context switching issues (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Perl 5.32.0 mishandling of rpath and runpath tokens (Phil Pennock <oss-security-phil@...dhuis.org>)
Re: Perl 5.32.0 mishandling of rpath and runpath tokens (Jeffrey Walton <noloader@...il.com>)
Re: Re: lockdown bypass on ubuntu 18.04's 4.15 kernel for loading unsigned modules (Marcus Meissner <meissner@...e.de>)
Re: Re: lockdown bypass on mainline kernel for loading unsigned modules (Marcus Meissner <meissner@...e.de>)
CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin (Gary Tully <gtully@...che.org>)
Re: Flatcar membership on the linux-distros list (Solar Designer <solar@...nwall.com>)
Re: Contributing Back (Solar Designer <solar@...nwall.com>)

July 21 (3 messages)

Re: Perl 5.32.0 mishandling of rpath and runpath tokens (Casper.Dik@...cle.COM)
Xen Security Advisory 329 v3 (CVE-2020-15852) - Linux ioperm bitmap context switching issues (Xen.org security team <security@....org>)
CVE-2020-15859 QEMU: net: e1000e: use-after-free while sending packets (P J P <ppandit@...hat.com>)

July 22 (1 message)

CVE-2020-15863 QEMU: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c (Mauro Matteo Cascella <mcascell@...hat.com>)

July 23 (8 messages)

Re: Contributing Back (Mohammad Tausif Siddiqui <msiddiqu@...hat.com>)
Re: Contributing Back (Zhang Xiao <xiao.zhang@...driver.com>)
Re: Contributing Back (Solar Designer <solar@...nwall.com>)
Re: Flatcar membership on the linux-distros list (Vincent Batts <vbatts@...volk.io>)
Re: Flatcar membership on the linux-distros list (Solar Designer <solar@...nwall.com>)
Re: Flatcar membership on the linux-distros list (Jeff Law <law@...hat.com>)
Re: Flatcar membership on the linux-distros list (Solar Designer <solar@...nwall.com>)
Re: Flatcar membership on the linux-distros list (Jeff Law <law@...hat.com>)

July 24 (1 message)

Re: Flatcar membership on the linux-distros list (Greg KH <greg@...ah.com>)

July 25 (1 message)

Re: Flatcar membership on the linux-distros list (Solar Designer <solar@...nwall.com>)

July 28 (3 messages)

Re: Contributing Back (Zhang Xiao <xiao.zhang@...driver.com>)
[CVE-2020-14331] Linux Kernel: buffer over write in vgacon_scrollback_update (张云海 <zhangyunhai@...ocus.com>)
Re: [CVE-2020-14331] Linux Kernel: buffer over write in vgacon_scrollback_update (Eric Biggers <ebiggers@...nel.org>)

July 29 (3 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2020-0007 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: [CVE-2020-14331] Linux Kernel: buffer over write in vgacon_scrollback_update (Solar Designer <solar@...nwall.com>)
multiple secure boot grub2 and linux kernel vulnerabilities (John Haxby <john.haxby@...cle.com>)

July 30 (8 messages)

Re: [CVE-2020-14331] Linux Kernel: buffer over write in vgacon_scrollback_update (张云海 <zhangyunhai@...ocus.com>)
UEFI SecureBoot bypass fixes rolled out to kernels below radar ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: UEFI SecureBoot bypass fixes rolled out to kernels below radar (John Haxby <john.haxby@...cle.com>)
Alternative CET ABI (Florian Weimer <fweimer@...hat.com>)
Re: Alternative CET ABI (Jann Horn <jannh@...gle.com>)
Re: Alternative CET ABI (Florian Weimer <fweimer@...hat.com>)
Re: Alternative CET ABI (Szabolcs Nagy <szabolcs.nagy@....com>)
Re: Alternative CET ABI ("H.J. Lu" <hjl.tools@...il.com>)

July 31 (2 messages)

Fwd: X.Org security advisory: July 31, 2020: libX11 (Matthieu Herrb <matthieu@...rb.eu>)
Fwd: X.Org security advisory: July 31, 2020: Xserver (Matthieu Herrb <matthieu@...rb.eu>)

76 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.