oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	² 1	³	⁴ 2
⁵ 5	⁶ 14	⁷ 8	⁸ 8	⁹ 3	¹⁰	¹¹
¹² 11	¹³ 7	¹⁴ 2	¹⁵ 1	¹⁶ 5	¹⁷	¹⁸
¹⁹ 4	²⁰ 8	²¹ 1	²² 1	²³ 1	²⁴	²⁵
²⁶	²⁷ 1	²⁸	²⁹	³⁰ 1	³¹

Messages by day:

October 1 (1 message)

[ANNOUNCE] Apache NiFi CVE-2020-9486, CVE-2020-9487, CVE-2020-9491, CVE-2020-13940 (Andy LoPresto <alopresto@...che.org>)

October 2 (1 message)

CVE-2020-25637 libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (Mauro Matteo Cascella <mcascell@...hat.com>)

October 4 (2 messages)

the Bugtraq list archives before 2000 (Georgi Guninski <gguninski@...il.com>)
Re: the Bugtraq list archives before 2000 (Solar Designer <solar@...nwall.com>)

October 5 (5 messages)

major changes if gnu/linux dominates the desktop and/or mobile market? (Georgi Guninski <gguninski@...il.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Greg KH <greg@...ah.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Ian Zimmerman <itz@...y.loosely.org>)
Re: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Stephen John Smoogen <smooge@...il.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Solar Designer <solar@...nwall.com>)

October 6 (14 messages)

Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Steve Grubb <sgrubb@...hat.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Greg KH <greg@...ah.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Stephen John Smoogen <smooge@...il.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Grant Taylor <gtaylor@...tconsulting.net>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Daniel Sprouse <daniel.a.sprouse@...il.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Eli Schwartz <eschwartz@...hlinux.org>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Georgi Guninski <gguninski@...il.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Michael Ellerman <mpe@...erman.id.au>)
Re: CVE-2020-25641 kernel: soft lockup when submitting zero length bvecs. (Michael Ellerman <mpe@...erman.id.au>)
CVE-2020-14355 spice: multiple buffer overflow vulnerabilities in QUIC decoding code (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Simon McVittie <smcv@...ian.org>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Simon McVittie <smcv@...ian.org>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Brian May <brian@...uxpenguins.xyz>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Steve Grubb <sgrubb@...hat.com>)

October 7 (8 messages)

Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Greg KH <greg@...ah.com>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Georgi Guninski <gguninski@...il.com>)
Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (caveman رجل الكهف <toraboracaveman@...tonmail.com>)
Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Georgi Guninski <gguninski@...il.com>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Jeremy Stanley <fungi@...goth.org>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Noel Kuntze <noel.kuntze@...rmi.consulting>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Brian May <brian@...uxpenguins.xyz>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)

October 8 (8 messages)

Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Seth Arnold <seth.arnold@...onical.com>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Jeffrey Walton <noloader@...il.com>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Giacomo Catenazzi <cate@...ian.org>)
[CVE-2020-13956] Apache HttpClient incorrect handling of malformed URI authority component (Oleg Kalnichevski <olegk@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Georgi Guninski <gguninski@...il.com>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Seth Arnold <seth.arnold@...onical.com>)

October 9 (3 messages)

Linux kernel: powerpc: RTAS calls can be used to compromise kernel integrity (Andrew Donnellan <ajd@...ux.ibm.com>)
[CVE-2020-13955] Apache Calcite Disabled HTTPS Hostname Verification (Stamatis Zampetakis <zabetak@...il.com>)
CVE-2018-20243: Apache Fineract: password passed in URL, not via POST (James Dailey <jamespdailey@...il.com>)

October 12 (11 messages)

[SECURITY] CVE-2020-13943 Apache Tomcat HTTP/2 Request mix-up (Mark Thomas <markt@...che.org>)
Gentoo's "contributing back" linux-distros tasks (Solar Designer <solar@...nwall.com>)
Re: Gentoo's "contributing back" linux-distros tasks (Anthony Liguori <aliguori@...n.com>)
Linux kernel: crypto: bcm - Verify GCM/CCM key length in setkey (kiyin(尹亮) <kiyin@...cent.com>)
Re: Gentoo's "contributing back" linux-distros tasks (Yury German <blueknight@...too.org>)
[CVE-2020-13957] The checks added to unauthenticated configset uploads in Apache Solr can be circumvented (Tomas Fernandez Lobbe <tflobbe@...che.org>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Solar Designer <solar@...nwall.com>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Kurt H Maier <khm@...ops.net>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Jeffrey Walton <noloader@...il.com>)
Re: You are using an old email address "@stahl.de". Please note our new email addresses "@r-stahl.com" (Jeffrey Walton <noloader@...il.com>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Brian May <brian@...uxpenguins.xyz>)

October 13 (7 messages)

Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Russ Allbery <eagle@...ie.org>)
Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Eli Schwartz <eschwartz@...hlinux.org>)
PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18 released fixing a cache pollution issue (CVE-2020-25829) (Otto Moerbeek <otto.moerbeek@...n-xchange.com>)
kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Matthias Gerstner <mgerstner@...e.de>)
Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Solar Designer <solar@...nwall.com>)
CVE-2020-16120 - incorrect unprivileged overlayfs permission checking (Steve Beattie <steve.beattie@...onical.com>)
CVE-2020-16119 - Linux kernel DCCP CCID structure use-after-free (Steve Beattie <steve.beattie@...onical.com>)

October 14 (2 messages)

Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Matthias Gerstner <mgerstner@...e.de>)
Re: CVE-2020-16120 - incorrect unprivileged overlayfs permission checking (Jordan Glover <Golden_Miller83@...tonmail.ch>)

October 15 (1 message)

CVE-2020-15157: containerd v1.2.x can be coerced into leaking credentials during image pull ("Karp, Samuel" <skarp@...zon.com>)

October 16 (5 messages)

CVE-2020-25656: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (Minh Yuan <yuanmingbuaa@...il.com>)
Kubernetes: Multiple secret leaks when verbose logging is enabled (Sam Fowler <sfowler@...hat.com>)
Re: CVE-2020-25656: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (Jiri Slaby <jirislaby@...nel.org>)
Re: CVE-2020-25656: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (Greg KH <gregkh@...uxfoundation.org>)
[OSSA-2020-007] Blazar: Remote code execution in blazar-dashboard (CVE-2020-26943) (Pierre Riteau <pierre@...ckhpc.com>)

October 19 (4 messages)

Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Solar Designer <solar@...nwall.com>)
[SECURITY][CVE-2020-13937] Unauthenticated Configuration Disclosure ("Xiaoxiang Yu" <xxyu@...che.org>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Ian Zimmerman <itz@...y.loosely.org>)
Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Simon McVittie <smcv@...ian.org>)

October 20 (8 messages)

Xen Security Advisory 331 v2 - Race condition in Linux event handler may crash dom0 (Xen.org security team <security@....org>)
Xen Security Advisory 286 v4 - x86 PV guest INVLPG-like flushes may leave stale TLB entries (Xen.org security team <security@....org>)
Xen Security Advisory 332 v3 - Rogue guests can cause DoS of Dom0 via high frequency events (Xen.org security team <security@....org>)
Xen Security Advisory 345 v3 - x86: Race condition in Xen mapping code (Xen.org security team <security@....org>)
Xen Security Advisory 346 v2 - undue deferral of IOMMU TLB flushes (Xen.org security team <security@....org>)
Xen Security Advisory 347 v2 - unsafe AMD IOMMU page table updates (Xen.org security team <security@....org>)
CVE-2020-15999 fixed in FreeType 2.10.4 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2020-15999 fixed in FreeType 2.10.4 (Werner LEMBERG <wl@....org>)

October 21 (1 message)

[CVE-2018-11764] Apache Hadoop Privilege escalation in web endpoint (Akira Ajisaka <aajisaka@...che.org>)

October 22 (1 message)

CVE-2019-16127, CVE-2019-16128 and CVE-2019-16129 for Microchip code (Dimitrios Glynos <dimitris@...sus-labs.com>)

October 23 (1 message)

CVE-2020-27174: Firecracker serial console emulation may allocate an unbounded amount of memory ("Iordache, Alexandra" <aghecen@...zon.com>)

October 27 (1 message)

CVE-2020-25654 pacemaker: ACL restrictions bypass (Huzaifa Sidhpurwala <huzaifas@...hat.com>)

October 30 (1 message)

CVE-2020-25668: Linux kernel concurrency use-after-free in vt (Minh Yuan <yuanmingbuaa@...il.com>)

85 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.