oss-security mailing list - 2021/12

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 7	²	³ 2	⁴	⁵
⁶ 3	⁷ 1	⁸	⁹ 2	¹⁰ 4	¹¹	¹²
¹³ 2	¹⁴ 5	¹⁵ 4	¹⁶	¹⁷ 1	¹⁸ 2	¹⁹ 1
²⁰ 8	²¹	²²	²³ 2	²⁴	²⁵ 1	²⁶
²⁷ 1	²⁸ 1	²⁹	³⁰	³¹

Messages by day:

December 1 (7 messages)

Re: IMA gadgets (Grant Taylor <gtaylor@...tconsulting.net>)
Re: IMA gadgets (Johannes Segitz <jsegitz@...e.de>)
Re: IMA gadgets (Jens Timmerman <jens@...et.be>)
CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures (Dennis Jackson <djackson@...illa.com>)
Re: CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures (Kai Engert <kaie@...x.de>)
Re: IMA gadgets (Travis Finkenauer <tmfink@...iper.net>)

December 3 (2 messages)

CVE-2021-3657: multiple buffer overflows in isync/mbsync (Oswald Buddenhagen <oswald.buddenhagen@....de>)
CVE-2021-44143: heap overflow in isync/mbsync (Oswald Buddenhagen <oswald.buddenhagen@....de>)

December 6 (3 messages)

CVE-2021-43784: integer overflow in runc's netlink bytemsg allows malicious configuration to discreetly modify container confi… (Aleksa Sarai <cyphar@...har.com>)
tmate-ssh-server: Local Privilege Escalation Issues and DoS issues (CVE-2021-44512, CVE-2021-44513) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2021-43410: Apache Airavata Django Portal: airavata-django-portal allows CRLF log injection because of the lack of … (Marcus Christie <machristie@...che.org>)

December 7 (1 message)

Django: CVE-2021-44420: Potential bypass of an upstream access control based on URL paths (Mariusz Felisiak <felisiak.mariusz@...il.com>)

December 9 (2 messages)

Multiple issues fixed in Privoxy 3.0.33 stable (Fabian Keil <freebsd-listen@...iankeil.de>)
CVE-2021-43798 Grafana directory traversal (Daniel Lee <daniel@...fana.com>)

December 10 (4 messages)

CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (Ralph Goers <rgoers@...che.org>)
Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related … (Moritz Bechler <mbechler@...terphace.or…)
Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related … (Moritz Bechler <mbechler@...terphace.or…)
CVE-2021-43813 and CVE-2021-43815 - Grafana directory traversal for some .md and .csv files (Timur Olzhabayev <timur.olzhabayev@...fana.com>)

December 13 (2 messages)

CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 (Ralph Goers <rgoers@...che.org>)
Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 (Moritz Bechler <mbechler@...terphace.org>)

December 14 (5 messages)

Fwd: X.Org Security Advisory: December 14, 2021 (Povilas Kanapickas <povilas@...ix.lt>)
CVE-2021-4095: kernel: KVM: NULL pointer dereference in kvm_dirty_ring_get() in virt/kvm/dirty_ring.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
Re: Fwd: X.Org Security Advisory: December 14, 2021 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service… (Ron Grabowski <rgrabowski@...che.org>)
[CVE-2021-44528] Possible Open Redirect in Host Authorization Middleware (Aaron Patterson <aaron.patterson@...il.com>)

December 15 (4 messages)

Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of servi… (Jeffrey Walton <noloader@...il.com>)
Trovent Security Advisory 2109-01 / CVE-2021-41843: Authenticated SQL injection in OpenEMR calendar search (Stefan Pietsch <s.pietsch@...vent.io>)
Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of s… (Moritz Bechler <mbechler@...terphace.or…)
CVE-2021-39685 : Linux Kernel USB Gadget buffer overflow (Szymon Heidrich <szymon.heidrich@...il.com>)

December 17 (1 message)

CVE-2021-44145: Apache NiFi information disclosure by XXE (Nathan Gough <thenatog@...che.org>)

December 18 (2 messages)

Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of s… (Moritz Bechler <mbechler@...terphace.or…)
CVE-2021-44548: Apache Solr information disclosure vulnerability through DataImportHandler (Jan Høydahl <janhoy@...che.org>)

December 19 (1 message)

CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation (Matt Sicker <mattsicker@...che.org>)

December 20 (8 messages)

CVE-2021-41561: Apache Parquet-MR potential DoS in case of malicious Parquet file (Gábor Szádovszky <gabor@...che.org>)
CVE-2021-43083: Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response (Christofer Dutz <cdutz@...che.org>)
CVE-2021-44224: Apache HTTP Server: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2… (Stefan Eissing <icing@...che.org>)
CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server … (Stefan Eissing <icing@...che.org>)
Xen Security Advisory 376 v1 - frontends vulnerable to backends (Xen.org security team <security@....org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Xen Security Advisory 391 v3 (CVE-2021-28711,CVE-2021-28712,CVE-2021-28713) - Rogue backends can cause DoS of guests vi… (Xen.org security team <security@....org…)
Xen Security Advisory 392 v4 (CVE-2021-28714,CVE-2021-28715) - Guest can force Linux netback driver to hog large amount… (Xen.org security team <security@....org…)

December 23 (2 messages)

binutils: Stack-overflow in debug_write_type in debug.c (Pavel Mayorov <pmayorov@...udlinux.com>)
CVE-2021-44273: e2guardian did not validate TLS hostnames ("Alexander E. Patrakov" <patrakov@...il.com>)

December 25 (1 message)

CVE-2021-45469: Linux kernel: an out-of-bounds memory access in fs/f2fs/xattr.c __f2fs_setxattr (Wenqing Liu <liu@...fsu.edu>)

December 27 (1 message)

CVE-2021-45232: Apache APISIX Dashboard: security vulnerability on unauthorized access (JunXu Chen <chenjunxu@...che.org>)

December 28 (1 message)

CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration (Matt Sicker <mattsicker@...che.org>)

47 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.