oss-security mailing list - 2021/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 6	² 3	³	⁴	⁵
⁶ 2	⁷ 3	⁸ 3	⁹ 2	¹⁰	¹¹ 2	¹²
¹³	¹⁴ 2	¹⁵ 6	¹⁶ 3	¹⁷ 5	¹⁸ 2	¹⁹
²⁰ 1	²¹ 3	²²	²³	²⁴ 1	²⁵	²⁶ 1
²⁷ 1	²⁸	²⁹ 2	³⁰ 1

Messages by day:

September 1 (6 messages)

Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (Xen.org security team <security@....org>)
Xen Security Advisory 380 v3 (CVE-2021-28698) - long running loops in grant table handling (Xen.org security team <security@....org>)
Re: Linux kernel: fs/btrfs: null-ptr-dereference bug in btrfs_rm_device in fs/btrfs/volumes.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
CVE-2021-3753: A out-of-bounds caused by the race of KDSETMODE in vt for latest Linux (Minh Yuan <yuanmingbuaa@...il.com>)
Re: Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (Jason Andryuk <jandryuk@...il.com>)
Re: Xen Security Advisory 378 v3 (CVE-2021-28694,CVE-2021-28695,CVE-2021-28696) - IOMMU page mapping issues on x86 (Andrew Cooper <andrew.cooper3@...rix.com>)

September 2 (3 messages)

CVE-2019-10095: Apache Zeppelin: bash command injection in spark interpreter (Jeff Zhang <zjffdu@...che.org>)
CVE-2020-13929: Apache Zeppelin: Notebook permissions bypass (Jeff Zhang <zjffdu@...che.org>)
CVE-2021-27578: Apache Zeppelin: Cross Site Scripting in markdown interpreter (Jeff Zhang <zjffdu@...che.org>)

September 6 (2 messages)

Re: Oracle Solaris membership in the distros list (Solar Designer <solar@...nwall.com>)
Re: Possible memory leak on getspnam / getspnam_r (Solar Designer <solar@...nwall.com>)

September 7 (3 messages)

CVE-2021-3715 Linux kernel: use-after-free in route4_change() in net/sched/cls_route.c (Rohit Keshri <rkeshri@...hat.com>)
Re: CVE-2021-3715 Linux kernel: use-after-free in route4_change() in net/sched/cls_route.c (Greg KH <greg@...ah.com>)
Re: Pop!_OS Membership to linux-distros list ("Jeremy Soller" <jeremy@...tem76.com>)

September 8 (3 messages)

Re: CVE-2021-3715 Linux kernel: use-after-free in route4_change() in net/sched/cls_route.c (Rohit Keshri <rkeshri@...hat.com>)
Xen Security Advisory 384 v3 (CVE-2021-28701) - Another race in XENMAPSPACE_grant_table handling (Xen.org security team <security@....org>)
CVE-2021-3773: Lack of port sanity checking in natd and Netfilter leads to exploit of OpenVPN clients on Linux and FreeBSD platf… (Ben <ben@...akpointingbad.com>)

September 9 (2 messages)

CVE-2021-38540: Apache Airflow: Variable Import endpoint missed authentication check (Kaxil Naik <kaxilnaik@...che.org>)
[OSSA-2021-006] Neutron: Routes middleware memory leak for nonexistent controllers (CVE-2021-40797) (Jeremy Stanley <fungi@...goth.org>)

September 11 (2 messages)

CVE-2021-38555: An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java (lewis john mcgibbney <lewismc@...che.org>)
CVE-2021-40146: A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java (lewis john mcgibbney <lewismc@...che.org>)

September 14 (2 messages)

Disclosure: CVE-2021-3744: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (Marcus Meissner <meissner@...e.de>)
Re: Oracle Solaris membership in the distros list (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 15 (6 messages)

[SECURITY ADVISORY] curl: UAF and double-free in MQTT sending (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: Protocol downgrade required TLS bypassed (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: STARTTLS protocol injection via MITM (Daniel Stenberg <daniel@...x.se>)
CVE-2021-3752: Linux kernel: a uaf bug in bluetooth ("Luo Likang" <luolikang@...ocus.com>)
[CVE-2021-38300] Linux kernel cBPF JIT compiler for MIPS emits incorrect branches leading to execution of arbitrary Kernel co… (Piotr Krysiuk <piotras@...il.com>)
CVE-2021-41079: Apache Tomcat DoS with unexpected TLS packet (Mark Thomas <markt@...che.org>)

September 16 (3 messages)

[kubernetes] CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access (CJ Cullen <cjcullen@...gle.com>)
[kubernetes] CVE-2020-8561: Webhook redirect in kube-apiserver ("Hausler, Micah" <mhausler@...zon.com>)
CVE-2021-39239: Apache Jena: XML External Entity (XXE) vulnerability (Andy Seaborne <andy@...che.org>)

September 17 (5 messages)

CVE-2021-41303: Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cau… (Brian Demers <bdemers@...che.org>)
Containers-optimized OS (COS) membership in the linux-distros list (Oleksandr Tymoshenko <ovt@...gle.com>)
CVE-2021-40690: Apache Santuario: Bypass of the secureValidation property (Colm O hEigeartaigh <coheigea@...che.org>)
Re: Containers-optimized OS (COS) membership in the linux-distros list (Solar Designer <solar@...nwall.com>)
Re: Oracle Solaris membership in the distros list (Solar Designer <solar@...nwall.com>)

September 18 (2 messages)

Re: Containers-optimized OS (COS) membership in the linux-distros list (Kees Cook <keescook@...omium.org>)
Linux Kernel: Exploitable vulnerability in io_uring (Valentina Palmiotti <chompie@...plsecurity.com>)

September 20 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2021-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

September 21 (3 messages)

Re: Containers-optimized OS (COS) membership in the linux-distros list (Oleksandr Tymoshenko <gonzo@...ezbox.com>)
CVE-2021-38153: Timing Attack Vulnerability for Apache Kafka Connect and Clients (Randall Hauch <rhauch@...che.org>)
Re: Containers-optimized OS (COS) membership in the linux-distros list (Solar Designer <solar@...nwall.com>)

September 24 (1 message)

CVE-2021-36749: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (in… (Clint Wylie <cwylie@...che.org>)

September 26 (1 message)

Announce: OpenSSH 8.8 released (Damien Miller <djm@....openbsd.org>)

September 27 (1 message)

[OSSA-2021-002] Nova: Open Redirect in noVNC proxy (CVE-2021-3654) (Jeremy Stanley <fungi@...goth.org>)

September 29 (2 messages)

CVE-2021-41616: Apache ddlutils 1.0 readobject vulnerability (Bryan Pendleton <bpendleton@...che.org>)
CVE-2021-3762 quay/claircore: directory traversal when scanning crafted container image (Przemyslaw Roguski <proguski@...hat.com>)

September 30 (1 message)

security issues in Litex IP stack (Philipp Takacs <philipp+enjoy-digital@...eaucracy.de>)

49 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.