oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 1
² 2	³ 3	⁴ 7	⁵ 3	⁶ 2	⁷	⁸
⁹ 3	¹⁰ 7	¹¹ 6	¹² 3	¹³ 2	¹⁴ 2	¹⁵ 2
¹⁶ 8	¹⁷ 5	¹⁸ 1	¹⁹ 7	²⁰ 5	²¹	²²
²³ 3	²⁴ 8	²⁵ 1	²⁶ 1	²⁷ 1	²⁸	²⁹ 1
³⁰ 6

Messages by day:

November 1 (1 message)

[CVE-2020-25670,CVE-2020-25671,CVE-2020-25672,CVE-2020-25673]Linux kernel: many bugs in nfc socket (kiyin(尹亮) <kiyin@...cent.com>)

November 2 (2 messages)

CVE-2020-27617 QEMU: net: an assert failure via eth_get_gso_type (P J P <ppandit@...hat.com>)
[CVE-2020-26521][CVE-2020-26892] NATS JWT vulnerabilities (Phil Pennock <oss-security-phil@...dhuis.org>)

November 3 (3 messages)

CVE-2020-27152 Kernel: KVM: host stack overflow via loop due to lazy update IOAPIC (P J P <ppandit@...hat.com>)
CVE-2020-27616 QEMU: ati-vga: potential crash via invalid x y parameter values (P J P <ppandit@...hat.com>)
Xen Security Advisory 286 v5 - x86 PV guest INVLPG-like flushes may leave stale TLB entries (Xen.org security team <security@....org>)

November 4 (7 messages)

Security Issues in the spice-vdagentd daemon (Matthias Gerstner <mgerstner@...e.de>)
sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file (Matthias Gerstner <mgerstner@...e.de>)
Re: CVE-2020-25668: Linux kernel concurrency use-after-free in vt (Minh Yuan <yuanmingbuaa@...il.com>)
Re: Linux kernel: crypto: bcm - Verify GCM/CCM key length in setkey (Mohammad Tausif Siddiqui <msiddiqu@...hat.com>)
RE: Linux kernel: crypto: bcm - Verify GCM/CCM key length in setkey(Internet mail) (kiyin(尹亮) <kiyin@...cent.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
[CVE-2020-17510] Apache Shiro Authentication Bypass Vulnerability (Brian Demers <bdemers@...che.org>)

November 5 (3 messages)

Git LFS (git-lfs) - Remote Code Execution (RCE) exploit CVE-2020-27955 - Clone to Pwn (Dawid Golunski <dawid@...alhackers.com>)
CVE-2020-25669: Linux Kernel use-after-free in sunkbd_reinit (- Nop <nopitydays@...il.com>)
CVE-2020-27347: tmux buffer overflow in escape sequence parser (snizovtsev@...il.com)

November 6 (2 messages)

Advisory: ES2020-02 - Asterisk crash due to INVITE flood over TCP ("Sandro Gauci" <sandro@...blesecurity.com>)
RE: Linux kernel: crypto: bcm - Verify GCM/CCM key length in setkey(Internet mail) (P J P <ppandit@...hat.com>)

November 9 (3 messages)

[CVE-2020-25704] Linux kernel: perf_event_parse_addr_filter memory leak (kiyin(尹亮) <kiyin@...cent.com>)
Linux kernel slab-out-of-bounds Read in fbcon (Minh Yuan <yuanmingbuaa@...il.com>)
The importance of mutual authentication: Local Privilege Escalation in X11 ("Demi M. Obenour" <demiobenour@...il.com>)

November 10 (7 messages)

[CVE-2020-13927] - Insecure Default Configuration for Experimental API in Airflow < 1.10.11 (Kaxil Naik <kaxilnaik@...il.com>)
Re: The importance of mutual authentication: Local Privilege Escalation in X11 ("Vladimir D. Seleznev" <vseleznv@...msu.ru>)
Re: The importance of mutual authentication: Local Privilege Escalation in X11 ("Demi M. Obenour" <demiobenour@...il.com>)
Xen Security Advisory 351 v1 - Information leak via power sidechannel (Xen.org security team <security@....org>)
CVE-2020-8694 RAPL power meter, Linux intel_powercap (Len Brown <lenb@...nel.org>)
Re: The importance of mutual authentication: Local Privilege Escalation in X11 ("Vladimir D. Seleznev" <vseleznv@...linux.org>)
Re: The importance of mutual authentication: Local Privilege Escalation in X11 ("Demi M. Obenour" <demiobenour@...il.com>)

November 11 (6 messages)

Re: The importance of mutual authentication: Local Privilege Escalation in X11 (Alan Coopersmith <alan.coopersmith@...cle.com>)
[CVE-2020-13958] Apache OpenOffice - Unrestricted actions leads to arbitrary code execution in crafted documents (Dave Fisher <wave@...che.org>)
Dash executes code when noexec ("-n") is specified (Eric Pruitt <eric.pruitt@...il.com>)
Re: [CVE-2020-13958] Apache OpenOffice - Unrestricted actions leads to arbitrary code execution in crafted documents (Imre Rad <radimre83@...il.com>)
Re: Dash executes code when noexec ("-n") is specified (Jakub Wilk <jwilk@...lk.net>)
Re: Dash executes code when noexec ("-n") is specified (Michael Orlitzky <michael@...itzky.com>)

November 12 (3 messages)

Re: Dash executes code when noexec ("-n") is specified (Michael Orlitzky <michael@...itzky.com>)
CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2014-4508 (John Haxby <john.haxby@...cle.com>)

November 13 (2 messages)

Buffer Overflow in raptor widely unfixed in Linux distros (Hanno Böck <hanno@...eck.de>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros ("David A. Wheeler" <dwheeler@...eeler.com>)

November 14 (2 messages)

Re: Buffer Overflow in raptor widely unfixed in Linux distros (Dave Horsfall <dave@...sfall.org>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Marcus Meissner <meissner@...e.de>)

November 15 (2 messages)

Re: Buffer Overflow in raptor widely unfixed in Linux distros (Dave Horsfall <dave@...sfall.org>)
Linux kernel: net/x25: a couple of overflows (kiyin(尹亮) <kiyin@...cent.com>)

November 16 (8 messages)

Re: Buffer Overflow in raptor widely unfixed in Linux distros (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Stephen John Smoogen <smooge@...il.com>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Marius Bakke <marius@....org>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Sam James <sam@...ct.info>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Jeremy Stanley <fungi@...goth.org>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Sam James <sam@...too.org>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Seth Arnold <seth.arnold@...onical.com>)

November 17 (5 messages)

Re: Buffer Overflow in raptor widely unfixed in Linux distros (Marcus Meissner <meissner@...e.de>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Morten Linderud <foxboron@...hlinux.org>)
CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost (Ana McTaggart <amctagga@...hat.com>)
Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost (Ana McTaggart <amctagga@...hat.com>)
CVE-2019-12412: libapreq2 null pointer dereference (Joe Orton <jorton@...che.org>)

November 18 (1 message)

Polipo: denial-of-service using range (Alexandr Savca (chinarulezzz) <alexandr.savca89@...il.com>)

November 19 (7 messages)

Re: libass ass_outline.c signed integer overflow (Ian Zimmerman <itz@...y.loosely.org>)
Re: Buffer Overflow in raptor widely unfixed in Linux distros (Ian Zimmerman <itz@...y.loosely.org>)
Linux kernel NULL-ptr deref bug in spk_ttyio_ldisc_close (Shisong Qin <qinshisong1205@...il.com>)
Unpatched XSS in Redmine 4.1 (sjw@....ch)
Re: Linux kernel NULL-ptr deref bug in spk_ttyio_ldisc_close (Marcus Meissner <meissner@...e.de>)
Re: libass ass_outline.c signed integer overflow ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: libass ass_outline.c signed integer overflow (Moritz Mühlenhoff <jmm@...til.org>)

November 20 (5 messages)

Re: libass ass_outline.c signed integer overflow (Ian Zimmerman <itz@...y.loosely.org>)
Re: Re: libass ass_outline.c signed integer overflow (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2020-4788: Speculation on incompletely validated data on IBM Power9 (Daniel Axtens <dja@...ens.net>)
CVE-2020-28928: musl libc: wcsnrtombs destination buffer overflow (Rich Felker <dalias@...c.org>)
Re: CVE-2020-25669: Linux Kernel use-after-free in sunkbd_reinit (- Nop <nopitydays@...il.com>)

November 23 (3 messages)

Re: CVE-2020-4788: Speculation on incompletely validated data on IBM Power9 (Daniel Axtens <dja@...ens.net>)
Re: Linux kernel: powerpc: RTAS calls can be used to compromise kernel integrity (Andrew Donnellan <ajd@...ux.ibm.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0008 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

November 24 (8 messages)

Xen Security Advisory 355 v2 - stack corruption from XSA-346 change (Xen.org security team <security@....org>)
Re: Xen Security Advisory 355 v2 - stack corruption from XSA-346 change (Roger Pau Monné <roger.pau@...rix.com>)
Heads up: PAM 1.5.0 has a auth bypass under some conditions (Marcus Meissner <meissner@...e.de>)
OpenSC 0.21.0 released (Frank Morgner <frankmorgner@...il.com>)
CVE-2020-13942: Remote Code Execution in Apache Unomi (Serge Huber <shuber@...che.org>)
Re: Heads up: PAM 1.5.0 has a auth bypass under some conditions (John Helmert III <jchelmert3@...teo.net>)
Re: Heads up: PAM 1.5.0 has a auth bypass under some conditions ("Dmitry V. Levin" <ldv@...linux.org>)
Re: Heads up: PAM 1.5.0 has a auth bypass under some conditions (Érico Nogueira <ericonr@...root.org>)

November 25 (1 message)

Re: Linux kernel slab-out-of-bounds Read in fbcon ("Srivatsa S. Bhat" <srivatsa@...il.mit.edu>)

November 26 (1 message)

Xen Security Advisory 351 v2 (CVE-2020-28368) - Information leak via power sidechannel (Xen.org security team <security@....org>)

November 27 (1 message)

CVE-2020-29129 CVE-2020-29130 QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets (P J P <ppandit@...hat.com>)

November 29 (1 message)

Multiple memory leaks fixed in Privoxy 3.0.29 stable (Fabian Keil <freebsd-listen@...iankeil.de>)

November 30 (6 messages)

Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Matthias Gerstner <mgerstner@...e.de>)
Re: Xen Security Advisory 355 v2 - stack corruption from XSA-346 change (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: Xen Security Advisory 355 v2 - stack corruption from XSA-346 change (Andrew Cooper <andrew.cooper3@...rix.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2020-0009 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE-2020-27815 Linux kernel: jfs: array-index-out-of-bounds in dbAdjTree (butt3rflyh4ck <butterflyhuangxx@...il.com>)
CVE-2020-15257: containerd-shim API exposed to host network containers ("Karp, Samuel" <skarp@...zon.com>)

90 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.