oss-security mailing list - 2021/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 4	² 3	³ 1	⁴ 3	⁵ 2	⁶ 2	⁷
⁸ 1	⁹ 3	¹⁰ 2	¹¹ 2	¹²	¹³ 1	¹⁴
¹⁵ 3	¹⁶ 2	¹⁷ 18	¹⁸ 9	¹⁹ 16	²⁰	²¹ 2
²² 1	²³ 3	²⁴ 5	²⁵	²⁶	²⁷ 2	²⁸ 4
²⁹ 3	³⁰ 4	³¹ 2

Messages by day:

March 1 (4 messages)

CVE-2021-25122: Apache Tomcat h2c request mix-up (Mark Thomas <markt@...che.org>)
CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484 (Mark Thomas <markt@...che.org>)
Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804) (Marc <mh@...sec.de>)
CVE-2020-1926: Timing attack in Cookie signature verification (Chao Sun <sunchao@...che.org>)

March 2 (3 messages)

CVE-2020-1936: Stored XSS in Apache Ambari (Szabolcs Beki <szabolcs.beki@...il.com>)
Re: Vulnerability in the Linux Audit Framework Auditd (Steve Grubb <sgrubb@...hat.com>)
Multiple GRUB2 vulnerabilities (John Haxby <john.haxby@...cle.com>)

March 3 (1 message)

Announce: OpenSSH 8.5 released (Damien Miller <djm@....openbsd.org>)

March 4 (3 messages)

Xen Security Advisory 367 v1 - Linux: netback fails to honor grant mapping errors (Xen.org security team <security@....org>)
Xen Security Advisory 369 v1 - Linux: special config may crash when trying to map foreign pages (Xen.org security team <security@....org>)
CVE-2021-27907: Apache Superset stored XSS on Dashboard markdown (daniel gaspar <danielvazgaspar@...il.com>)

March 5 (2 messages)

Xen Security Advisory 367 v2 (CVE-2021-28038) - Linux: netback fails to honor grant mapping errors (Xen.org security team <security@....org>)
Xen Security Advisory 369 v2 (CVE-2021-28039) - Linux: special config may crash when trying to map foreign pages (Xen.org security team <security@....org>)

March 6 (2 messages)

Linux iscsi security fixes (Marcus Meissner <meissner@...e.de>)
Re: Multiple DoS issues fixed in Privoxy 3.0.32 stable (Fabian Keil <freebsd-listen@...iankeil.de>)

March 8 (1 message)

CVE-2021-20263 QEMU: virtiofsd: 'security.capabilities' is not dropped with xattrmap option (Mauro Matteo Cascella <mcascell@...hat.com>)

March 9 (3 messages)

CVE-2021-3409 QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085 (Mauro Matteo Cascella <mcascell@...hat.com>)
CVE-2020-35451: Oozie local privilege escalation (Gézapeti Cseh <gezapeti@...che.org>)
git: malicious repositories can execute remote code while cloning (Johannes Schindelin <Johannes.Schindelin@....de>)

March 10 (2 messages)

CVE-2020-13936: Velocity Sandbox Bypass (Will Glass-Husain <wglass@...che.org>)
CVE-2020-13959: Velocity Tools XSS Vulnerability (Will Glass-Husain <wglass@...che.org>)

March 11 (2 messages)

CVE-2021-20261: kernel: panic in start_motor+0x21 when /dev/fd0 is read by multiple threads. (Wade Mealing <wmealing@...hat.com>)
CVE-2021-20269: kexec-tools: incorrect permissions on vmcore-dmesg.txt file (Wade Mealing <wmealing@...hat.com>)

March 13 (1 message)

CVE-2021-27576: Apache OpenMeetings: bandwidth can be overloaded with public web service (Maxim Solodovnik <solomax@...che.org>)

March 15 (3 messages)

ES2021-02: VoIPmonitor WEB GUI vulnerable to Cross-Site Scripting via SIP messages ("Sandro Gauci" <sandro@...blesecurity.com>)
ES2021-03: VoIPmonitor is vulnerable to a buffer overflow when using the live sniffer ("Sandro Gauci" <sandro@...blesecurity.com>)
ES2021-04: VoIPmonitor static builds are compiled without any standard memory corruption protection ("Sandro Gauci" <sandro@...blesecurity.com>)

March 16 (2 messages)

[CVE-2020-28466][CVE-2021-3127] NATS.io vulnerabilities (Phil Pennock <oss-security-phil@...dhuis.org>)
[CVE-2020-28466][CVE-2021-3127] NATS.io vulnerabilities (Phil Pennock <oss-security-phil@...dhuis.org>)

March 17 (18 messages)

CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Rohit Keshri <rkeshri@...hat.com>)
Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Greg KH <greg@...ah.com>)
Use After Free and Double Free bugs in Linux Kernel mainline (lyl2019@...l.ustc.edu.cn)
Re: Use After Free and Double Free bugs in Linux Kernel mainline (John Haxby <john.haxby@...cle.com>)
Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Use After Free and Double Free bugs in Linux Kernel mainline (Greg KH <greg@...ah.com>)
Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Wolfgang Frisch <wolfgang.frisch@...e.com>)
Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)
Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Brad Spengler <spender@...ecurity.net>)
CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Rohit Keshri <rkeshri@...hat.com>)
Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Greg KH <greg@...ah.com>)
Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2021-3428 Linux kernel: integer overflow in ext4_es_cache_extent (Jan Kara <jack@...e.cz>)
Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Evgenii Shatokhin <eshatokhin@...tuozzo.com>)
Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Evgenii Shatokhin <eshatokhin@...tuozzo.com>)
Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Greg KH <greg@...ah.com>)
CVE-2020-35519 Linux kernel: x25_bind out-of-bounds read (Rohit Keshri <rkeshri@...hat.com>)
Re: CVE-2020-35519 Linux kernel: x25_bind out-of-bounds read (Sasha Levin <sashal@...nel.org>)

March 18 (9 messages)

Re: CVE-2020-35519 Linux kernel: x25_bind out-of-bounds read (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Rohit Keshri <rkeshri@...hat.com>)
Xen Security Advisory 368 v2 - HVM soft-reset crashes toolstack (Xen.org security team <security@....org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Greg KH <greg@...ah.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Xen Security Advisory 368 v3 (CVE-2021-28687) - HVM soft-reset crashes toolstack (Xen.org security team <security@....org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Kurt H Maier <khm@...ops.net>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Sasha Levin <sashal@...nel.org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Solar Designer <solar@...nwall.com>)

March 19 (16 messages)

Risk of local privilege escalation in GNU Guix (Leo Famulari <leo@...ulari.name>)
[CVE-2020-27170] Protection against speculatively out-of-bounds loads in the Linux kernel can be bypassed by unprivileged loc… (Piotr Krysiuk <piotras@...il.com>)
[CVE-2020-27171] Numeric error when restricting speculative pointer arithmetic allows unprivileged local users to leak conten… (Piotr Krysiuk <piotras@...il.com>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Greg KH <greg@...ah.com>)
Grafana 7.4.5, 7.3.10 and 6.7.6 released with security fixes for Grafana Enterprose (Vardan Torosyan <vardan.torosyan@...fana.com>)
kopano-core 11.0.1: Remote DoS by memory exhaustion (Jan Engelhardt <jengelh@...i.de>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Sasha Levin <sashal@...nel.org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Brad Spengler <spender@...ecurity.net>)
CVE-2021-27807: Apache PDFBox: A carefully crafted PDF file can trigger an infinite loop while loading the file (Andreas Lehmkuehler <lehmi@...che.org>)
CVE-2021-27906: Apache PDFBox: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file (Andreas Lehmkuehler <lehmi@...che.org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Sasha Levin <sashal@...nel.org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Brad Spengler <spender@...ecurity.net>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Eddie Chapman <eddie@...k.net>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Sasha Levin <sashal@...nel.org>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Brad Spengler <spender@...ecurity.net>)
Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Sasha Levin <sashal@...nel.org>)

March 21 (2 messages)

[CVE-2021-26295] RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (Jacques Le Roux <jacques.le.roux@...7arts.com>)
Re: kopano-core 11.0.1: Remote DoS by memory exhaustion (Robert Scheck <robert@...oraproject.org>)

March 22 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2021-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

March 23 (3 messages)

Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS (Petr Matousek <pmatouse@...hat.com>)
[CVE-2021-3444] Linux kernel bpf verifier incorrect mod32 truncation (Steve Beattie <steve.beattie@...onical.com>)
Re: Multiple memory leaks fixed in Privoxy 3.0.29 stable (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 24 (5 messages)

Re: Multiple memory leaks fixed in Privoxy 3.0.29 stable (Fabian Keil <freebsd-listen@...iankeil.de>)
Remote DoS Vulnerability in bitchx, ircii < 20210314 and scrollz (ortmann@...teo.de)
CVE-2020-1946: Apache SpamAssassin has an OS Command Injection vulnerability (Sidney Markowitz <sidney@...che.org>)
Re: [CVE-2020-27170] Protection against speculatively out-of-bounds loads in the Linux kernel can be bypassed by unprivileged… (Piotr Krysiuk <piotras@...il.com>)
Re: [CVE-2020-27171] Numeric error when restricting speculative pointer arithmetic allows unprivileged local users to leak co… (Piotr Krysiuk <piotras@...il.com>)

March 27 (2 messages)

OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in si… (Solar Designer <solar@...nwall.com>)
Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref i… (Gordon Tetlow <gordon@...lows.org>)

March 28 (4 messages)

Linux Kernel: out of bounds array access in dm-ioctl.c (- Nop <nopitydays@...il.com>)
Linux kernel: f2fs: out-of-bounds memory access bug (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in si… (Mark J Cox <mark@...nssl.org>)
Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in s… (Jeroen Roovers <jer@...all.nl>)

March 29 (3 messages)

Re: Linux Kernel: out of bounds array access in dm-ioctl.c (John Haxby <john.haxby@...cle.com>)
[CVE-2021-26919] Authenticated users can execute arbitrary code from malicious MySQL database systems (Jihoon Son <jihoonson@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2021-0003 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

March 30 (4 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Xen Security Advisory 371 v3 (CVE-2021-28688) - Linux: blkback driver may leak persistent grants (Xen.org security team <security@....org>)
CVE-2021-28657: Infinite loop in Apache Tika's MP3 parser (Tim Allison <tallison@...che.org>)
Re: Remote DoS Vulnerability in bitchx, ircii < 20210314 and scrollz (ortmann@...teo.de)

March 31 (2 messages)

[SECURITY ADVISORY] curl: Automatic referer leaks credentials (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: TLS 1.3 session ticket proxy host mixup (Daniel Stenberg <daniel@...x.se>)

98 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.