oss-security mailing list - 2021/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 2	² 1	³ 1	⁴	⁵ 2	⁶ 2
⁷ 2	⁸ 9	⁹ 2	¹⁰ 16	¹¹ 1	¹² 2	¹³
¹⁴ 1	¹⁵ 1	¹⁶ 3	¹⁷ 1	¹⁸ 1	¹⁹ 2	²⁰
²¹ 2	²²	²³ 1	²⁴	²⁵ 1	²⁶ 1	²⁷
²⁸ 3	²⁹	³⁰ 2

Messages by day:

June 1 (2 messages)

Linux kernel: nfc: null ptr dereference in llcp_sock_getname (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: CVE-2021-3564 Linux Bluetooth device initialization implementation bug (Mart111n <mmmart11nnnnn@...il.com>)

June 2 (1 message)

Django security releases 3.2.4, 3.1.12, and 2.2.24 for CVE-2021-33203 and CVE-2021-33571 (Carlton Gibson <carlton.gibson@...il.com>)

June 3 (1 message)

CVE-2021-3560 polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() (Cedric Buissart <cbuissar@...hat.com>)

June 5 (2 messages)

XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock (Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>)
Re: XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock (Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>)

June 6 (2 messages)

Re: Re: XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock ("Mike O'Connor" <mjo@...o.mi.org>)
Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname (butt3rflyh4ck <butterflyhuangxx@...il.com>)

June 7 (2 messages)

CVE-2021-3578: possible remote code execution in isync/mbsync (Oswald Buddenhagen <oswald.buddenhagen@....de>)
[CVE-2021-33896] Path traversal in Dino file transfers (Dino Team <team@...o.im>)

June 8 (9 messages)

Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname (Wade Mealing <wmealing@...hat.com>)
CVE-2021-3573: UAF in hci_sock_bound_ioctl() function (Lin Horse <kylin.formalin@...il.com>)
Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname (butt3rflyh4ck <butterflyhuangxx@...il.com>)
CVE-2021-33190: Apache APISIX Dashboard: Bypass network access control (JunXu Chen <chenjunxu@...che.org>)
Xen Security Advisory 372 v3 (CVE-2021-28693) - xen/arm: Boot modules are not scrubbed (Xen.org security team <security@....org>)
Xen Security Advisory 374 v2 (CVE-2021-28691) - Guest triggered use-after-free in Linux xen-netback (Xen.org security team <security@....org>)
Xen Security Advisory 375 v2 (CVE-2021-0089) - Speculative Code Store Bypass (Xen.org security team <security@....org>)
Xen Security Advisory 377 v2 (CVE-2021-28690) - x86: TSX Async Abort protections not restored after S3 (Xen.org security team <security@....org>)
Xen Security Advisory 373 v2 (CVE-2021-28692) - inappropriate x86 IOMMU timeout detection / handling (Xen.org security team <security@....org>)

June 9 (2 messages)

connman stack buffer overflow in dnsproxy CVE-2021-33833 (Marcus Meissner <meissner@...e.de>)
Xen Security Advisory 375 v3 (CVE-2021-0089,CVE-2021-26313) - Speculative Code Store Bypass (Xen.org security team <security@....org>)

June 10 (16 messages)

Xen Security Advisory 375 v4 (CVE-2021-0089,CVE-2021-26313) - Speculative Code Store Bypass (Xen.org security team <security@....org>)
CVE-2019-17567: Apache httpd: mod_proxy_wstunnel tunneling of non Upgraded connections (Christophe JAILLET <jailletc36@...che.org>)
CVE-2020-13938: Apache httpd: Improper Handling of Insufficient Privileges (Christophe JAILLET <jailletc36@...che.org>)
CVE-2020-13950: Apache httpd: mod_proxy_http NULL pointer dereference (Christophe JAILLET <jailletc36@...che.org>)
CVE-2020-35452: Apache httpd: mod_auth_digest possible stack overflow by one nul byte (Christophe JAILLET <jailletc36@...che.org>)
CVE-2021-26690: Apache httpd: mod_session NULL pointer dereference (Christophe JAILLET <jailletc36@...che.org>)
CVE-2021-26691: Apache httpd: mod_session response handling heap overflow (Christophe JAILLET <jailletc36@...che.org>)
CVE-2021-30641: Apache httpd: Unexpected URL matching with 'MergeSlashes OFF' (Christophe JAILLET <jailletc36@...che.org>)
CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request (Christophe JAILLET <jailletc36@...che.org>)
Re: Xen Security Advisory 375 v3 (CVE-2021-0089,CVE-2021-26313) - Speculative Code Store Bypass (Sven Kieske <S.Kieske@...twald.de>)
Re: Xen Security Advisory 375 v3 (CVE-2021-0089,CVE-2021-26313) - Speculative Code Store Bypass (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock (Gianluca Gabrielli <ggabrielli@...e.de>)
Re: XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock (Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request (John Helmert III <jchelmert3@...teo.net>)
Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request (Christophe JAILLET <christophe.jaillet@...adoo.fr>)

June 11 (1 message)

Re: XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock (Gianluca Gabrielli <ggabrielli@...e.de>)

June 12 (2 messages)

CVE-2021-31812: Apache PDFBox: A carefully crafted PDF file can trigger an infinite loop while loading the file (Andreas Lehmkuehler <andreas@...mi.de>)
CVE-2021-31811: Apache PDFBox: A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny fi… (Andreas Lehmkuehler <andreas@...mi.de>)

June 14 (1 message)

xscreensaver: filename command injection in vidwhacker screensaver (Hanno Böck <hanno@...eck.de>)

June 15 (1 message)

CVE-2021-34693: Infoleak in CAN BCM protocol in Linux kernel (Norbert Slusarek <nslusarek@....net>)

June 16 (3 messages)

CVE-2020-9493: Apache Chainsaw: Java deserialization in Chainsaw (Robert Middleton <rmiddleton@...che.org>)
CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter (Colm O hEigeartaigh <coheigea@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

June 17 (1 message)

New Open-Source Forensic Tool for SQLite Data Recovery (Andrew Zayine <scholarshipchile@...il.com>)

June 18 (1 message)

Vulnerability in Jenkins Generic Webhook Trigger Plugin (Daniel Beck <ml@...kweb.net>)

June 19 (2 messages)

CVE-2021-3609: Race condition in net/can/bcm.c leads to local privilege escalation (Norbert Slusarek <nslusarek@....net>)
Re: CVE-2021-3609: Race condition in net/can/bcm.c leads to local privilege escalation (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

June 21 (2 messages)

[CVE-2021-33624] Linux kernel BPF protection against speculative execution attacks can be bypassed to read arbitrary kernel me… (Adam Morrison <mad@...tau.ac.il>)
CVE-2021-26461: Apache NuttX (incubating): malloc, realloc and memalign implementations are vulnerable to integer wrap-aro… (Brennan Ashton <btashton@...che.org>)

June 23 (1 message)

CVE-2021-3600 - Linux kernel eBPF 32-bit source register truncation on div/mod (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

June 25 (1 message)

FW: An out-of-bound read/write in fsi driver ("Luo Likang" <luolikang@...ocus.com>)

June 26 (1 message)

Re: CVE-2021-22543 - /dev/kvm LPE ("Eduardo' Vela\" <Nava>" <evn@...gle.com>)

June 28 (3 messages)

CVE-2021-29157: Dovecot oauth2 JWT local validation path traversal (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE-2021-33515: Dovecot SMTP Submission service STARTTLS injection. (Aki Tuomi <aki.tuomi@...n-xchange.com>)
CVE-2020-28200: Dovecot Pigeonhole Sieve excessive resource usage (Aki Tuomi <aki.tuomi@...n-xchange.com>)

June 30 (2 messages)

Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Plone: stored XSS in folder contents (Maurits van Rees <maurits@...rees.org>)

59 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.