oss-security mailing list - 2022/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹	² 1	³ 1	⁴ 2	⁵	⁶ 1
⁷ 1	⁸ 1	⁹	¹⁰ 3	¹¹ 1	¹²	¹³ 1
¹⁴ 4	¹⁵ 3	¹⁶ 2	¹⁷ 2	¹⁸ 2	¹⁹	²⁰
²¹	²²	²³ 1	²⁴ 3	²⁵ 2	²⁶ 1	²⁷ 4
²⁸ 5	²⁹ 2	³⁰ 3	³¹ 1

Messages by day:

March 2 (1 message)

CVE-2022-23648: containerd CRI plugin: Insecure handling of image volumes ("Karp, Samuel" <skarp@...zon.com>)

March 3 (1 message)

DNS rebinding on ReadyMedia/minidlna v1.3.0 and below (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

March 4 (2 messages)

CVE-2022-26336: poi-scratchpad: A carefully crafted TNEF file can cause an out of memory exception (PJ Fanning <fanningpj@...che.org>)
CVE-2022-25312: An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet ext… (lewis john mcgibbney <lewismc@...che.or…)

March 6 (1 message)

Re: DNS rebinding on ReadyMedia/minidlna v1.3.0 and below (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

March 7 (1 message)

CVE-2022-0847: Linux kernel: overwriting read-only files (Max Kellermann <max.kellermann@...os.com>)

March 8 (1 message)

Xen Security Advisory 398 v1 - Multiple speculative security issues (Xen.org security team <security@....org>)

March 10 (3 messages)

CVE-2022-26652: nats-server arbitrary file write (Phil Pennock <oss-security-phil@...dhuis.org>)
Xen Security Advisory 396 v3 (CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,… (Xen.org security team <security@....org…)
Grant Opportunities to Protect Open Source (Deepesh Chaudhari <deepesh@...intextgroup.com>)

March 11 (1 message)

CVE-2022-26878: Memory leak in Linux VirtIO Bluetooth driver (Sönke Huster <soenke.huster@...oes.de>)

March 13 (1 message)

Memory leak in Linux HID-elo driver (Dongliang Mu <mudongliangabcd@...il.com>)

March 14 (4 messages)

CVE-2022-23943: Apache HTTP Server: mod_sed: Read/write beyond bounds (Stefan Eissing <icing@...che.org>)
CVE-2022-22721: Apache HTTP Server: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (Stefan Eissing <icing@...che.org>)
CVE-2022-22720: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (Stefan Eissing <icing@...che.org>)
CVE-2022-22719: Apache HTTP Server: mod_lua Use of uninitialized value of in r:parsebody (Stefan Eissing <icing@...che.org>)

March 15 (3 messages)

CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation (Daan <dahn@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2022-0742: Remote Denial of Service on Linux Kernel >=5.13 icmp6 ("sirdarckcat ." <sirdarckcat@...omium.org>)

March 16 (2 messages)

Fwd: Node.js security updates for all active release lines, March 2022 (Joe Sepi <joesepi@...il.com>)
Four vulnerabilities disclosed in BIND (CVE-2021-25220, CVE-2022-0396, CVE-2022-0635 and CVE-2022-0667) ("Everett B. Fulton" <ebf@....org>)

March 17 (2 messages)

Linux Kernel 5.15-rc-ksmbd-part2 is affected by: Buffer Overflow. The impact is: use-after-free (local). ("王明义" <6201613047@....jiangnan.edu.cn>)
Re: Linux Kernel 5.15-rc-ksmbd-part2 is affected by: Buffer Overflow. The impact is: use-after-free (local). (Filip Palian <s3810@...stk.edu.pl>)

March 18 (2 messages)

Fwd: Node.js security updates for all active release lines, March 2022 (Joe Sepi <joesepi@...il.com>)
Xen Security Advisory 398 v2 - Multiple speculative security issues (Xen.org security team <security@....org>)

March 23 (1 message)

Lack of TLS certification chain validation in ZAP Proxy (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

March 24 (3 messages)

zlib memory corruption on deflate (i.e. compress) (Tavis Ormandy <taviso@...il.com>)
Re: zlib memory corruption on deflate (i.e. compress) (Petr Štetiar <ynezz@...e.cz>)
Re: Lack of TLS certification chain validation in ZAP Proxy (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

March 25 (2 messages)

Security Advisory 2022-01 for PowerDNS Authoritative Server 4.4.2, 4.5.3, 4.6.0 and PowerDNS Recursor 4.4.7, 4.5.7, 4.6… (Otto Moerbeek <otto.moerbeek@...n-xchan…)
Re: zlib memory corruption on deflate (i.e. compress) (John Helmert III <ajak@...too.org>)

March 26 (1 message)

Re: zlib memory corruption on deflate (i.e. compress) (Tavis Ormandy <taviso@...il.com>)

March 27 (4 messages)

Re: zlib memory corruption on deflate (i.e. compress) (Eric Biggers <ebiggers@...nel.org>)
Re: zlib memory corruption on deflate (i.e. compress) ("Adler, Mark" <madler@...mni.caltech.edu>)
Re: zlib memory corruption on deflate (i.e. compress) (ariel.byd@...il.com)
Re: zlib memory corruption on deflate (i.e. compress) (Eric Biggers <ebiggers@...nel.org>)

March 28 (5 messages)

Re: zlib memory corruption on deflate (i.e. compress) (Eric Biggers <ebiggers@...nel.org>)
CVE-2022-25757: Apache APISIX: the body_schema check in request-validation plugin can be bypassed (Zexuan Luo <spacewander@...che.org>)
Re: Re: zlib memory corruption on deflate (i.e. compress) (Tavis Ormandy <taviso@...il.com>)
Linux Kernel: Race Condition in snd_pcm_hw_free leading to use-after-free (Hu Jiahui <kirin.say@...il.com>)
Linux kernel: CVE-2022-1015,CVE-2022-1016 in nf_tables cause privilege escalation, information leak (David Bouman <davidbouman35@...il.com>)

March 29 (2 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: zlib memory corruption on deflate (i.e. compress) (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 30 (3 messages)

SpringShell and recent OpenJDK updates (Jeffrey Walton <noloader@...il.com>)
Re: SpringShell and recent OpenJDK updates (Seth Arnold <seth.arnold@...onical.com>)
Re: SpringShell and recent OpenJDK updates (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 31 (1 message)

Re: SpringShell and recent OpenJDK updates ("Kevin Decherf" <kevin@...cherf.com>)

47 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.