oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 3
²	³ 2	⁴ 3	⁵ 1	⁶	⁷ 13	⁸
⁹ 1	¹⁰ 5	¹¹ 9	¹² 1	¹³ 1	¹⁴ 2	¹⁵
¹⁶ 2	¹⁷ 6	¹⁸ 3	¹⁹	²⁰ 2	²¹	²²
²³ 1	²⁴ 3	²⁵ 10	²⁶ 6	²⁷ 4	²⁸	²⁹
³⁰ 1	³¹ 3

Messages by day:

August 1 (3 messages)

GPSD time will jump back 1024 weeks at after week=2180 (23-October-2021) (Bernd Zeimetz <bernd@...d.de>)
Re: Polipo: denial-of-service using range (John Helmert III <jchelmert3@...teo.net>)
[CVE-2021-34556,CVE-2021-35477] Linux kernel BPF protection against Speculative Store Bypass can be bypassed to disclose arbi… (Piotr Krysiuk <piotras@...il.com>)

August 3 (2 messages)

Re: CVE-2020-28020: Integer overflow in Exim that can lead to RCE: Some questions to the Qualys researchers who designe… (Qualys Security Advisory <qsa@...lys.co…)
Re: Polipo: denial-of-service using range ("Alexandr Savca (chinarulezzz)" <alexandr.savca89@...il.com>)

August 4 (3 messages)

Reminder: QtWebKit known vulnerabilities ("Alex Xu (Hello71)" <alex_y_xu@...oo.ca>)
Re: Pop!_OS Membership to linux-distros list ("Jeremy Soller" <jeremy@...tem76.com>)
Re: Pop!_OS Membership to linux-distros list (Tyler Hicks <code@...icks.com>)

August 5 (1 message)

Fwd: Node.js security updates for all active release lines, August 2021 (Michael Dawson <midawson@...hat.com>)

August 7 (13 messages)

Re: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) (Axel Beckert <abe@...ian.org>)
Re: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) (Thorsten Glaser <tg@...bsd.de>)
Re: bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) (Axel Beckert <abe@...ian.org>)
SNI is a security vulnerability all by itself (was Re: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in c… (Thorsten Glaser <tg@...bsd.de>)
Re: bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) (Thorsten Glaser <tg@...bsd.de>)
Re: Re: bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) (Stuart Henderson <stu@...cehopper.org>)
Re: Re: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circums… (Ariadne Conill <ariadne@...eferenced.or…)
Re: SNI is a security vulnerability all by itself (was Re: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks pass… (Jeffrey Walton <noloader@...il.com>)
Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some … (Salvatore Bonaccorso <carnil@...ian.org…)
Re: [Lynx-dev] Re: bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circumstances) (Thorsten Glaser <tg@...bsd.de>)
Re: Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circu… (Axel Beckert <abe@...ian.org>)
Re: Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under s… (Ariadne Conill <ariadne@...eferenced.or…)
Re: Re: Bug#991971: [Lynx-dev] bug in Lynx' SSL certificate validation -> leaks password in clear text via SNI (under some circu… (Axel Beckert <abe@...ian.org>)

August 9 (1 message)

fetchmail 6.4.21 released/regression fix for 6.4.20's security fix, and UPDATE: fetchmail <= 6.4.19 security announceme… (Matthias Andree <matthias.andree@....de…)

August 10 (5 messages)

[SECURITY ADVISORY] c-ares: Missing input validation on hostnames returned by DNS servers (Daniel Stenberg <daniel@...x.se>)
STARTTLS vulnerabilities (Hanno Böck <hanno@...eck.de>)
CVE-2021-21501: Apache ServiceComb: ServiceComb ServiceCenter Directory Traversal (Willem Jiang <ningjiang@...che.org>)
Re: STARTTLS vulnerabilities (Guido Berhoerster <guido+openwall.com@...hoerster.name>)
[OSSA-2021-003] Keystone: Account name and UUID oracles in account locking (CVE-2021-38155) (Jeremy Stanley <fungi@...goth.org>)

August 11 (9 messages)

Re: STARTTLS vulnerabilities (Hanno Böck <hanno@...eck.de>)
Re: STARTTLS vulnerabilities (Matthew Wild <mwild1@...il.com>)
Re: STARTTLS vulnerabilities (Hanno Böck <hanno@...eck.de>)
firebase/php-jwt Algorithm Confusion with Key IDs (Paragon Initiative Enterprises Security Team <security@...agonie.com>)
Re: STARTTLS vulnerabilities (Matthew Wild <mwild1@...il.com>)
CVE-2021-20314: Remote stack buffer overflow in libspf2 ("Philipp Jeitner (SIT)" <philipp.jeitner@....fraunhofer.de>)
Re: STARTTLS vulnerabilities (Eric Blake <eblake@...hat.com>)
Re: STARTTLS vulnerabilities (Hanno Böck <hanno@...eck.de>)
[CVE-2021-37608] Arbitrary file upload vulnerability in OFBiz ("jleroux@...che.org" <jleroux@...che.org>)

August 12 (1 message)

Re: CVE-2021-20314: Remote stack buffer overflow in libspf2 (Sam James <sam@...ct.info>)

August 13 (1 message)

Re: Polipo: denial-of-service using range (John Helmert III <jchelmert3@...teo.net>)

August 14 (2 messages)

CVE-2021-35936: Apache Airflow: No Authentication on Logging Server (Kaxil Naik <kaxilnaik@...che.org>)
kopano-core 11.0.2.43: Remote authenticated DoS with unhandled exception (Jan Engelhardt <jengelh@...i.de>)

August 16 (2 messages)

[CVE-2021-3653, CVE-2021-3656] SVM nested virtualization issues in KVM (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: STARTTLS vulnerabilities (Eric Blake <eblake@...hat.com>)

August 17 (6 messages)

Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Pop!_OS Membership to linux-distros list (Solar Designer <solar@...nwall.com>)
[OSSA-2021-004] Neutron: Linuxbridge ARP filter bypass on Netfilter platforms (CVE-2021-38598) (Jeremy Stanley <fungi@...goth.org>)
Re: [OSSA-2021-004] Neutron: Linuxbridge ARP filter bypass on Netfilter platforms (CVE-2021-38598) (Jan Engelhardt <jengelh@...i.de>)
Re: [OSSA-2021-004] Neutron: Linuxbridge ARP filter bypass on Netfilter platforms (CVE-2021-38598) (Jeremy Stanley <fungi@...goth.org>)

August 18 (3 messages)

CVE-2021-33580: Apache Roller: regex injection leading to DoS (Dave <snoopdave@...il.com>)
Re: STARTTLS vulnerabilities (Eric Blake <eblake@...hat.com>)
ISC has disclosed a vulnerability in BIND (CVE-2021-25218) (Michael McNally <mcnally@....org>)

August 20 (2 messages)

[CVE-2021-22942] Possible Open Redirect in Host Authorization Middleware (Aaron Patterson <aaron.patterson@...il.com>)
August BIND maintenance releases contain a defect affecting servers using the map zone file format (was: A vulnerability in B… (Michael McNally <mcnally@....org>)

August 23 (1 message)

CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 (Joe Orton <jorton@...che.org>)

August 24 (3 messages)

CVE-2021-33191: Apache NiFi - MiNiFi C++: MiNiFi CPP arbitrary script execution is possible on the agent's host machine through t… (Arpad Boda <aboda@...che.org>)
Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname (Mohammad Tausif Siddiqui <msiddiqu@...hat.com>)
Oracle Solaris membership in the distros list (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 25 (10 messages)

Possible memory leak on getspnam / getspnam_r (Jean Diogo <j@....com.br>)
Linux kernel: qrtr: another out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Linux kernel: fs/btrfs: null-ptr-dereference bug in btrfs_rm_device in fs/btrfs/volumes.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Xen Security Advisory 379 v2 (CVE-2021-28697) - grant table v2 status pages may remain accessible after de-allocation (Xen.org security team <security@....org>)
Xen Security Advisory 382 v2 (CVE-2021-28699) - inadequate grant-v2 status frames array bounds check (Xen.org security team <security@....org>)
Xen Security Advisory 383 v2 (CVE-2021-28700) - xen/arm: No memory limit for dom0less domUs (Xen.org security team <security@....org>)
Xen Security Advisory 380 v2 (CVE-2021-28698) - long running loops in grant table handling (Xen.org security team <security@....org>)
Xen Security Advisory 378 v2 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (Xen.org security team <security@....org>)
Re: Possible memory leak on getspnam / getspnam_r (Travis Finkenauer <tmfink@...iper.net>)
Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer (Qualys Security Advisory <qsa@...lys.com>)

August 26 (6 messages)

Re: Possible memory leak on getspnam / getspnam_r ("Jean D'Elboux" <j@....com.br>)
OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712) (Mark J Cox <mark@...nssl.org>)
Re: Linux kernel: fs/btrfs: null-ptr-dereference bug in btrfs_rm_device in fs/btrfs/volumes.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: Linux kernel: qrtr: another out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (John Haxby <john.haxby@...cle.com>)
libssh: Possible heap-buffer overflow when rekeying (CVE-2021-3634) (Marco Benatto <mbenatto@...hat.com>)
Re: Linux kernel: qrtr: another out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)

August 27 (4 messages)

Re: Linux kernel: qrtr: another out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: Linux kernel: qrtr: another out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
ANNOUNCE: fetchmail security announcement 2021-02 (CVE-2021-39272) - TLS bypass vulnerabilities ("NO STARTTLS") (Matthias Andree <matthias.andree@....de>)
Fwd: Node.js security updates for versions 12.x, and 14.x releases lines, August 31 2021 (Daniel Bevenius <dbeveniu@...hat.com>)

August 30 (1 message)

NTFS3G-SA-2021-0001: Multiple buffer overflows in all versions of NTFS-3G (Jussi Hietanen <jussi.hietanen@...era.com>)

August 31 (3 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
[OSSA-2021-005] Neutron: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085) (Jeremy Stanley <fungi@...goth.org>)
Fwd: Node.js security updates for versions 12.x, and 14.x releases lines, August 31 2021 (Daniel Bevenius <dbeveniu@...hat.com>)

82 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.