oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	²	³
⁴ 6	⁵ 2	⁶ 1	⁷ 1	⁸ 1	⁹	¹⁰ 3
¹¹ 6	¹² 13	¹³ 6	¹⁴ 1	¹⁵ 2	¹⁶ 2	¹⁷ 2
¹⁸ 3	¹⁹ 10	²⁰ 1	²¹ 4	²² 3	²³	²⁴ 1
²⁵ 1	²⁶ 4	²⁷ 6	²⁸ 3	²⁹ 6	³⁰ 2	³¹ 2

Messages by day:

January 4 (6 messages)

Re: DPDK security advisory for multiple vhost crypto issues (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: [dpdk-dev] DPDK security advisory for multiple vhost crypto issues (Ferruh Yigit <ferruh.yigit@...el.com>)
CVE-2020-25275: Dovecot: MIME parsing crash (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE-2020-24386: Dovecot: IMAP hibernation allows accessing other peoples mail (Aki Tuomi <aki.tuomi@...ecot.fi>)
Re: [dpdk-dev] DPDK security advisory for multiple vhost crypto issues (Mauro Matteo Cascella <mcascell@...hat.com>)
CVE-2020-26297: mdBook XSS (Pietro Albini <pietro@...troalbini.org>)

January 5 (2 messages)

[CVE-2020-17518] Apache Flink directory traversal attack: remote file writing through the REST API (Robert Metzger <rmetzger@...che.org>)
[CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST API (Robert Metzger <rmetzger@...che.org>)

January 6 (1 message)

A security vulnerability in linux kernel 5.8.10 (Anthony Liguori <aliguori@...zon.com>)

January 7 (1 message)

Trovent Security Advisory 2010-01 / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability (Stefan Pietsch <s.pietsch@...vent.io>)

January 8 (1 message)

Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability (Stefan Pietsch <s.pietsch@...vent.io>)

January 10 (3 messages)

Re: distros list archive (Solar Designer <solar@...nwall.com>)
Re: Gentoo's "contributing back" linux-distros tasks (Solar Designer <solar@...nwall.com>)
Re: Gentoo's "contributing back" linux-distros tasks (Solar Designer <solar@...nwall.com>)

January 11 (6 messages)

[CVE-2020-17534] HTML/Java API 1.7: A race condition between deletion of the temporary file and creation of the temporar… (Jaroslav Tulach <jaroslav.tulach@...il.…)
Various security fixes in sudo 1.9.5 (CVE-2021-23239, CVE-2021-23240) (Matthias Gerstner <mgerstner@...e.de>)
Advisory: ES2021-01 - Loopback access control bypass in coturn by using 0.0.0.0, [::1] or [::] as the peer address ("Sandro Gauci" <sandro@...blesecurity.com>)
Re: Gentoo's "contributing back" linux-distros tasks (Thomas Deutschmann <whissi@...too.org>)
Re: Gentoo's "contributing back" linux-distros tasks (Anthony Liguori <aliguori@...n.com>)
[Security Advisory] CVE-2020-8570: Path Traversal bug in the Java Kubernetes Client (Brendan Burns <bburns@...rosoft.com>)

January 12 (13 messages)

CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (Wade Mealing <wmealing@...hat.com>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (Greg KH <greg@...ah.com>)
Security issues in hawk2 and crmsh (Marcus Meissner <meissner@...e.de>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (John Haxby <john.haxby@...cle.com>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (Sasha Levin <sashal@...nel.org>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (Greg KH <greg@...ah.com>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic (Philip Pettersson <philip.pettersson@...il.com>)
Re: Gentoo's "contributing back" linux-distros tasks (Solar Designer <solar@...nwall.com>)
RE: Gentoo's "contributing back" linux-distros tasks (Anthony Liguori <aliguori@...zon.com>)
CVE-2020-28374: Linux SCSI target (LIO) unrestricted copy offload (David Disseldorp <ddiss@...e.de>)
Re: CVE-2020-28374: Linux SCSI target (LIO) unrestricted copy offload (John Haxby <john.haxby@...cle.com>)

January 13 (6 messages)

Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability (Stefan Pietsch <s.pietsch@...vent.io>)
Re: CVE-2020-28374: Linux SCSI target (LIO) unrestricted copy offload (David Disseldorp <ddiss@...e.de>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2020-11947 QEMU: heap buffer overflow in iSCSI block driver may lead to information disclosure (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: CVE-2020-28374: Linux SCSI target (LIO) unrestricted copy offload (Marcus Meissner <meissner@...e.de>)
CVE-2021-23926: XMLBeans XML Entity Expansion ("fanningpj@...che.org" <fanningpj@...che.org>)

January 14 (1 message)

[SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure (Mark Thomas <markt@...che.org>)

January 15 (2 messages)

Re: [vs] Cinnamon lock screen bypass in multiple distributions ("Alexander E. Patrakov" <patrakov@...il.com>)
Re: Re: [vs] Cinnamon lock screen bypass in multiple distributions (Morten Linderud <foxboron@...hlinux.org>)

January 16 (2 messages)

Adding an additional Amazon Linux member to distros@ (Anthony Liguori <aliguori@...zon.com>)
MATE screensaver screen lock bypass with external monitor (Hanno Böck <hanno@...eck.de>)

January 17 (2 messages)

Re: Adding an additional Amazon Linux member to distros@ (Solar Designer <solar@...nwall.com>)
mutt recipient parsing memory leak (Tavis Ormandy <taviso@...il.com>)

January 18 (3 messages)

[SECURITY] CVE-2020-11997: Apache Guacamole: Inconsistent restriction of connection history visibility (Mike Jumper <mjumper@...che.org>)
CVE-2020-29443 QEMU: ide: atapi: OOB access while processing read commands (P J P <ppandit@...hat.com>)
libreoffice-online "loolforkit" privileged program local root exploit (Matthias Gerstner <mgerstner@...e.de>)

January 19 (10 messages)

Multiple CVEs in dnsmasq fixed in version 2.83 (Riccardo Schirone <rschiron@...hat.com>)
segv_handler junkcode snippet / openSUSE segv_handler package potential local root exploit (Matthias Gerstner <mgerstner@...e.de>)
Xen Security Advisory 331 v3 (CVE-2020-27675) - Race condition in Linux event handler may crash dom0 (Xen.org security team <security@....org>)
Xen Security Advisory 355 v3 (CVE-2020-29040) - stack corruption from XSA-346 change (Xen.org security team <security@....org>)
Xen Security Advisory 286 v6 (CVE-2020-27674) - x86 PV guest INVLPG-like flushes may leave stale TLB entries (Xen.org security team <security@....org>)
Xen Security Advisory 332 v4 (CVE-2020-27673) - Rogue guests can cause DoS of Dom0 via high frequency events (Xen.org security team <security@....org>)
Xen Security Advisory 345 v4 (CVE-2020-27672) - x86: Race condition in Xen mapping code (Xen.org security team <security@....org>)
Xen Security Advisory 346 v3 (CVE-2020-27671) - undue deferral of IOMMU TLB flushes (Xen.org security team <security@....org>)
Xen Security Advisory 347 v3 (CVE-2020-27670) - unsafe AMD IOMMU page table updates (Xen.org security team <security@....org>)
Re: mutt recipient parsing memory leak (Utkarsh Gupta <utkarsh@...ian.org>)

January 20 (1 message)

CVE-2021-3185 gstreamer: buffer overflow in gst_h264_slice_parse_dec_ref_pic_marking (Andrew Wesie <andrew@...ori.io>)

January 21 (4 messages)

CVE-2020-17532: ServiceComb Yaml remote deserialization vulnerability (wjm wjm <wujimin@...che.org>)
Re: libreoffice-online "loolforkit" privileged program local root exploit (Matthias Gerstner <mgerstner@...e.de>)
Xen Security Advisory 360 v1 - IRQ vector leak on x86 (Xen.org security team <security@....org>)
CVE-2021-21261: Flatpak sandbox escape via spawn portal (aka GHSA-4ppf-fxf6-vxg2) (Simon McVittie <smcv@...ian.org>)

January 22 (3 messages)

CVE-2020-35517 QEMU: virtiofsd: potential privileged host device access from guest (P J P <ppandit@...hat.com>)
Re: CVE-2020-35517 QEMU: virtiofsd: potential privileged host device access from guest (Daniel Walsh <dwalsh@...hat.com>)
Re: CVE-2020-35517 QEMU: virtiofsd: potential privileged host device access from guest (P J P <ppandit@...hat.com>)

January 24 (1 message)

CVE-2021-23901: An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser (lewis john mcgibbney <lewismc@...che.org>)

January 25 (1 message)

CVE-2020-17522: Traffic Control Mid Tier Cache Manipulation Attack (ocket 8888 <ocket8888@...il.com>)

January 26 (4 messages)

[CVE-2020-9492] Apache Hadoop Potential privilege escalation (Akira Ajisaka <aajisaka@...che.org>)
Vulnerability in Jenkins (Daniel Beck <ml@...kweb.net>)
Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (Qualys Security Advisory <qsa@...lys.com>)
Xen Security Advisory 360 v2 (CVE-2021-3308) - IRQ vector leak on x86 (Xen.org security team <security@....org>)

January 27 (6 messages)

Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (Hanno Böck <hanno@...eck.de>)
Re: Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156) (Dave Horsfall <dave@...sfall.org>)
glibc iconv crash with ISO-2022-JP-3 (Tavis Ormandy <taviso@...il.com>)
Re: glibc iconv crash with ISO-2022-JP-3 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support (Gary Tully <gtully@...che.org>)
CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind (Gary Tully <gtully@...che.org>)

January 28 (3 messages)

CVE-2021-20196 QEMU: block: fdc: null pointer dereference may lead to guest crash (P J P <ppandit@...hat.com>)
Re: glibc iconv crash with ISO-2022-JP-3 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Linux kernel: linux-block: nbd: use-after-free Read in nbd_queue_rq (butt3rflyh4ck <butterflyhuangxx@...il.com>)

January 29 (6 messages)

Linux Kernel: local priv escalation via futexes (Marcus Meissner <meissner@...e.de>)
X41 D-Sec GmbH Security Advisory X41-2021-001: Multiple Vulnerabilities in YARA (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
Re: Linux Kernel: local priv escalation via futexes (Solar Designer <solar@...nwall.com>)
Re: Linux Kernel: local priv escalation via futexes (Marcus Meissner <meissner@...e.de>)
Re: Linux Kernel: local priv escalation via futexes ("David A. Wheeler" <dwheeler@...eeler.com>)
CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitra… (Jihoon Son <jihoonson@...che.org>)

January 30 (2 messages)

sudo: Ineffective NO_ROOT_MAILER and Baron Samedit (Roman Fiedler <roman.fiedler@...aralleled.eu>)
Re: Linux kernel: linux-block: nbd: use-after-free Read in nbd_queue_rq (butt3rflyh4ck <butterflyhuangxx@...il.com>)

January 31 (2 messages)

Re: CVE request experience (Fabian Keil <freebsd-listen@...iankeil.de>)
Two DoS issues fixed in Privoxy 3.0.31 stable (Fabian Keil <freebsd-listen@...iankeil.de>)

92 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.