oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 1	²	³ 1
⁴ 5	⁵ 5	⁶ 1	⁷ 6	⁸ 6	⁹ 1	¹⁰
¹¹ 4	¹² 2	¹³	¹⁴ 3	¹⁵ 3	¹⁶ 1	¹⁷
¹⁸ 1	¹⁹ 3	²⁰ 2	²¹ 4	²²	²³	²⁴
²⁵ 6	²⁶ 9	²⁷ 4	²⁸ 6	²⁹	³⁰ 1	³¹ 1

Messages by day:

October 1 (1 message)

3 new CVE's in vim (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 3 (1 message)

Supply Chain Security and Tar (Samanta Navarro <ferivoz@...eup.net>)

October 4 (5 messages)

CVE-2021-28116 / ZDI-CAN-11610 / SQUID-2020:12 Out-Of-Bounds memory access in WCCPv2 (Amos Jeffries <squid3@...enet.co.nz>)
Re: 3 new CVE's in vim (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: 3 new CVE's in vim (Alex Gaynor <alex.gaynor@...il.com>)
Re: 3 new CVE's in vim (Alan Coopersmith <alan.coopersmith@...cle.com>)
Moby (Docker Engine) CVE-2021-41089 ("Karp, Samuel" <skarp@...zon.com>)

October 5 (5 messages)

CVE-2021-41524: Apache HTTP Server: null pointer dereference in h2 fuzzing (Stefan Eissing <icing@...che.org>)
CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (Stefan Eissing <icing@...che.org>)
Fwd: Node.js security updates for all active release lines, October 2021 (Matteo Collina <matteo.collina@...il.com>)
CVE-2021-39226 Grafana snapshot authentication bypass (Richard Hartmann <richih.mailinglist@...il.com>)
Xen Security Advisory 386 v1 (CVE-2021-28702) - PCI devices with RMRRs not deassigned correctly (Xen.org security team <security@....org>)

October 6 (1 message)

Multiple vulnerabilities in Jenkins and Jenkins plugins (Wadeck Follonier <wfollonier@...udbees.com>)

October 7 (6 messages)

RE: CVE-2021-41773: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 ("Tim Wadhwa-Brown (twadhwab)" <twadhwab@...co.com>)
Xen Security Advisory 386 v2 (CVE-2021-28702) - PCI devices with RMRRs not deassigned correctly (Xen.org security team <security@....org>)
CVE-2021-33035: Apache OpenOffice: Buffer overflow from a crafted DBF file (Dave Fisher <wave@...che.org>)
CVE-2021-40439: Apache OpenOffice: Billion Laughs (Dave Fisher <wave@...che.org>)
CVE-2021-28129: DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid (Dave Fisher <wave@...che.org>)
CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-… (Stefan Eissing <icing@...che.org>)

October 8 (6 messages)

Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of… (Roman Medina-Heigl Hernandez <roman@rs-…)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Yann Ylavic <ylavic.dev@...il.com>)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Yann Ylavic <ylavic.dev@...il.com>)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Yann Ylavic <ylavic.dev@...il.com>)

October 9 (1 message)

Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of… (Roman Medina-Heigl Hernandez <roman@rs-…)

October 11 (4 messages)

CVE-2021-41830: Apache OpenOffice: Double Certificate Attack (Dave Fisher <wave@...che.org>)
CVE-2021-41831: Apache OpenOffice: Timestamp Manipulation with Signature Wrapping (Dave Fisher <wave@...che.org>)
CVE-2021-41832: Apache OpenOffice: Content Manipulation with Certificate Validation Attack (Dave Fisher <wave@...che.org>)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Yann Ylavic <ylavic.dev@...il.com>)

October 12 (2 messages)

CVE-2021-42009: Apache Traffic Control Arbitrary Email Content Insertion in /deliveryservices/request (Eric Friedrich <friede@...che.org>)
CVE-2021-38295 Apache CouchDB <= 3.1.1 privilege escalation (Jan Lehnardt <jan@...che.org>)

October 14 (3 messages)

CVE-2021-42340: Apache Tomcat: DoS via memory leak with WebSocket connections (Mark Thomas <markt@...che.org>)
CVE-2021-42257: check_smart.pl: unprivileged user can alter hard drive settings (Wolfgang Frisch <wolfgang.frisch@...e.com>)
CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up (Alon Zahavi <Alon.Zahavi@...erark.com>)

October 15 (3 messages)

CVE-2021-32609: Apache Superset: XSS vulnerability on Explore page (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2021-41971: Apache Superset: Possible SQL Injection when template processing is enabled (Daniel Gaspar <dpgaspar@...che.org>)
Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of… (Roman Medina-Heigl Hernandez <roman@rs-…)

October 16 (1 message)

Re: CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-… (Yann Ylavic <ylavic.dev@...il.com>)

October 18 (1 message)

Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up (halfdog <me@...fdog.net>)

October 19 (3 messages)

Linux kernel: isdn: cpai: array-index-out-of-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up (Miklos Szeredi <miklos@...redi.hu>)
Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

October 20 (2 messages)

Re: CVE-2021-3847: OverlayFS - Potential Privilege Escalation using overlays copy_up (Miklos Szeredi <miklos@...redi.hu>)
Core-dump handing issues with suid binaries (Itai Greenhut <itai.greenhut@...il.com>)

October 21 (4 messages)

CVE-2021-38294: Apache Storm: Shell Command Injection Vulnerability in Nimbus Thrift Server (Derek Dagit <dagit@...che.org>)
CVE-2021-40865: Apache Storm: Unsafe Pre-Authentication Deserialization In Workers (Derek Dagit <dagit@...che.org>)
[kubernetes] CVE-2021-25742: Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets a… (CJ Cullen <cjcullen@...gle.com>)
Mailman 2.1.35 security release (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 25 (6 messages)

Linux kernel: powerpc: KVM guest can trigger host crash on Power8 (Michael Ellerman <mpe@...erman.id.au>)
[ES2021-05] FreeSWITCH vulnerable to SIP digest leak for configured gateways ("Sandro Gauci" <sandro@...blesecurity.com>)
[ES2021-08] FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default ("Sandro Gauci" <sandro@...blesecurity.com>)
[ES2021-06] FreeSWITCH susceptible to Denial of Service via SIP flooding ("Sandro Gauci" <sandro@...blesecurity.com>)
[ES2021-09] FreeSWITCH susceptible to Denial of Service via invalid SRTP packets ("Sandro Gauci" <sandro@...blesecurity.com>)
[ES2021-07] FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing ("Sandro Gauci" <sandro@...blesecurity.com>)

October 26 (9 messages)

Re: Linux kernel: powerpc: KVM guest can trigger host crash on Power8 (John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>)
CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Lin Horse <kylin.formalin@...il.com>)
Re: CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Lin Horse <kylin.formalin@...il.com>)
Re: CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2021-21703: PHP-FPM 5.3.7 <= 8.0.12 Local Root (Charles Fol <c.fol@...fo.fr>)
RE: CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Anthony Liguori <aliguori@...zon.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

October 27 (4 messages)

Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Francis Perron <francis.perron@...pify.com>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Alberto Garcia <berto@...lia.com>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Samuel Groß <saelo@...gle.com>)

October 28 (6 messages)

Re: Linux kernel: powerpc: KVM guest can trigger host crash on Power8 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2021-3760: Linux kernel: Use-After-Free vulnerability of ndev->rf_conn_info object (Roxana Bradescu <roxana.bradescu@...cle.com>)
spacewalk-admin: CVE-2021-40348: arbitrary local code execution by 'tomcat' user via rhn-config-satellite.pl (Paolo Perego <paolo.perego@...e.com>)
Re: Linux kernel: powerpc: KVM guest can trigger host crash on Power8 (John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>)
Re: Linux kernel: powerpc: KVM guest can trigger host crash on Power8 (John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>)

October 30 (1 message)

CVE website transition from cve.mitre.org to cve.org (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 31 (1 message)

Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 (Salvatore Bonaccorso <carnil@...ian.org>)

76 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.