oss-security mailing list - 2020/08

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 2	⁴ 2	⁵ 3	⁶ 4	⁷ 5	⁸ 12	⁹ 2
¹⁰ 5	¹¹	¹² 4	¹³ 3	¹⁴ 1	¹⁵ 1	¹⁶
¹⁷ 3	¹⁸	¹⁹ 5	²⁰ 2	²¹ 1	²²	²³
²⁴ 3	²⁵ 5	²⁶	²⁷	²⁸	²⁹	³⁰
³¹ 1

Messages by day:

August 3 (2 messages)

ansi escape sequence injection into ubuntu's add-apt-repository ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Marco Benatto <mbenatto@...hat.com>)

August 4 (2 messages)

Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Debora Velarde Babb <debora@...ux.ibm.com>)
Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Marco Benatto <mbenatto@...hat.com>)

August 5 (3 messages)

Re: ansi escape sequence injection into ubuntu's add-apt-repository ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: ansi escape sequence injection into ubuntu's add-apt-repository ("Jason A. Donenfeld" <Jason@...c4.com>)
[CVE-2020-13921] Apache SkyWalking SQL injection vulnerability after H2/MySQL/TiDB storage option activated. (Sheng Wu <wusheng@...che.org>)

August 6 (4 messages)

Re: Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Jerry Snitselaar <jsnitsel@...hat.com>)
Re: Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Jonas Witschel <diabonas@...hlinux.org>)
Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Debora Velarde Babb <debora@...ux.ibm.com>)
Re: Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (James Bottomley <jejb@...ux.ibm.com>)

August 7 (5 messages)

CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Daniel Ruggeri <druggeri@...che.org>)
CVE-2020-11985: Apache httpd: CWE-345: Insufficient verification of data authenticity (Daniel Ruggeri <druggeri@...che.org>)
CVE-2020-11993: Apache httpd: Push Diary Crash on Specifically Crafted HTTP/2 Header (Daniel Ruggeri <druggeri@...che.org>)
CVE-2020-9490: Apache httpd: Push Diary Crash on Specifically Crafted HTTP/2 Header (Daniel Ruggeri <druggeri@...che.org>)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Solar Designer <solar@...nwall.com>)

August 8 (12 messages)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Seth Arnold <seth.arnold@...onical.com>)
[CVE-2020-9479] Directory traversal vulnerability in Apache AsterixDB (Ian Maxon <imaxon@...che.org>)
Voiding CVE-2020-16248 (Richard Hartmann <richih.mailinglist@...il.com>)
Re: Voiding CVE-2020-16248 (Hanno Böck <hanno@...eck.de>)
Re: [prometheus-team] Voiding CVE-2020-16248 (Bartłomiej Płotka <bwplotka@...il.com>)
Re: Voiding CVE-2020-16248 (Sylvain Beucler <beuc@...c.net>)
Re: [prometheus-team] Voiding CVE-2020-16248 (Julien Pivotto <roidelapluie@...metheus.io>)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Daniel Ruggeri <druggeri@...che.org>)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Daniel Ruggeri <druggeri@...che.org>)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Solar Designer <solar@...nwall.com>)
Re: Voiding CVE-2020-16248 (Bastian Blank <bblank@...nkmo.de>)
Re: Voiding CVE-2020-16248 (Jeffrey Walton <noloader@...il.com>)

August 9 (2 messages)

Re: Voiding CVE-2020-16248 (Richard Hartmann <richih.mailinglist@...il.com>)
Re: Voiding CVE-2020-16248 (Richard Hartmann <richih.mailinglist@...il.com>)

August 10 (5 messages)

CVE-2020-16092 QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: CVE-2020-16092 QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (Michael Tokarev <mjt@....msk.ru>)
Re: CVE-2020-16092 QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (Mauro Matteo Cascella <mcascell@...hat.com>)
[CVE-2020-11976] Apache Wicket information disclosure vulnerability (svenmeier@...che.org)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Seth Arnold <seth.arnold@...onical.com>)

August 12 (4 messages)

CVE-2020-12100: Dovecot IMAP server: Receiving mail with deeply nested MIME parts leads to resource exhaustion (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE-2020-12673: Dovecot IMAP server: Specially crafted NTLM package can crash auth service (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE-2020-12674: Dovecot IMAP server: Specially crafted RPA authentication message crashes auth (Aki Tuomi <aki.tuomi@...ecot.fi>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

August 13 (3 messages)

CVE-2020-16843: Firecracker v0.20.0, v0.21.0 and v0.21.1 network stack can freeze under heavy ingress traffic ("Iorga, Serban" <seriorga@...zon.com>)
Blind in/on-path attacks against VPN-tunneled connections (CVE-2019-14899 follow-up) (vpn-research@...akpointingbad.com)
Re: Re: [FD] libcroco multiple vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 14 (1 message)

Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon (Debora Velarde Babb <debora@...ux.ibm.com>)

August 15 (1 message)

[CVE-2020-13941] Apache Solr information disclosure vulnerability (David Smiley <dsmiley@...che.org>)

August 17 (3 messages)

Vulnerability in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow (Joe Orton <jorton@...che.org>)
[CVE-2020-13933] Apache Shiro Authentication Bypass Vulnerability (Brian Demers <bdemers@...che.org>)

August 19 (5 messages)

[SECURITY ADVISORY] libcurl: wrong connect-only connection (Daniel Stenberg <daniel@...x.se>)
Linux Kernel 5.7.9 DRM Double Free ("zdi-disclosures@...ndmicro.com" <zdi-disclosures@...ndmicro.com>)
Re: Linux Kernel 5.7.9 DRM Double Free (Greg KH <greg@...ah.com>)
Re: Linux Kernel 5.7.9 DRM Double Free (Greg KH <greg@...ah.com>)
Re: Linux Kernel 5.7.9 DRM Double Free (Greg KH <greg@...ah.com>)

August 20 (2 messages)

Fossil-SCM patch fixes RCE in all historic versions (Richard Hipp <drh@...ite.org>)
Five vulnerabilities disclosed in BIND (CVE-2020-8620, CVE-2020-8621, CVE-2020-8622, CVE-2020-8623, and CVE-2020-8624) (Michael McNally <mcnally@....org>)

August 21 (1 message)

chrony: CVE-2020-14367: unsafe pidfile creation allows privilege escalation from chrony user to root (Matthias Gerstner <mgerstner@...e.de>)

August 24 (3 messages)

CVE-2019-20794 kernel: task processes not being properly ended could lead to resource exhaustion (Rohit Keshri <rkeshri@...hat.com>)
Xen Security Advisory 335 v2 (CVE-2020-14364) - QEMU: usb: out-of-bounds r/w access issue (Xen.org security team <security@....org>)
CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets (P J P <ppandit@...hat.com>)

August 25 (5 messages)

Re: Fossil-SCM patch fixes RCE in all historic versions (Salvatore Bonaccorso <carnil@...ian.org>)
X.Org libX11 security advisory: August 25, 2020 (Matthieu Herrb <matthieu@...rb.eu>)
X.Org server security advisory: August 25, 2020 (Matthieu Herrb <matthieu@...rb.eu>)
[OSSA-2020-006] Nova: Live migration fails to update persistent domain XML (CVE-2020-17376) (Jeremy Stanley <fungi@...goth.org>)
Re: X.Org server security advisory: August 25, 2020 (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 31 (1 message)

CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX (Brandon Williams <brandonwilliams@...che.org>)

64 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.