oss-security mailing list - 2022/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 2	² 1	³ 1	⁴ 4	⁵ 4
⁶	⁷ 5	⁸ 10	⁹ 4	¹⁰ 1	¹¹	¹²
¹³	¹⁴ 4	¹⁵ 2	¹⁶ 1	¹⁷	¹⁸	¹⁹ 1
²⁰ 1	²¹ 2	²² 3	²³ 1	²⁴	²⁵	²⁶
²⁷ 5	²⁸ 2	²⁹	³⁰ 4

Messages by day:

June 1 (2 messages)

Re: Linux Kernel eBPF Improper Input Validation Vulnerability (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-4204: Linux Kernel eBPF Improper Input Validation Vulnerability (Solar Designer <solar@...nwall.com>)

June 2 (1 message)

CVE-2022-1972: out-of-bound write in Linux netfilter subsystem leads to local privilege escalation ("张子明(明程)" <zhangziming.zzm@...group.com>)

June 3 (1 message)

Re: Linux Kernel use-after-free write in netfilter (Salvatore Bonaccorso <carnil@...ian.org>)

June 4 (4 messages)

Re: Linux Kernel use-after-free write in netfilter (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-4204: Linux Kernel eBPF Improper Input Validation Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Linux Kernel eBPF Improper Input Validation Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Linux Kernel: Exploitable vulnerability in io_uring (Solar Designer <solar@...nwall.com>)

June 5 (4 messages)

CVE-2022-1974: Linux kernel: use-after-free caused by improper check device_is_registered() in nfc netlink related functions (duoming@....edu.cn)
CVE-2022-1975: Linux kernel: sleep in atomic context bug when nfc firmware download timeout (duoming@....edu.cn)
Linux kernel: UAF, null-ptr-deref and double-free vulnerabilities in nfcmrvl module (duoming@....edu.cn)
Re: Linux kernel: UAF, null-ptr-deref and double-free vulnerabilities in nfcmrvl module (Salvatore Bonaccorso <carnil@...ian.org>)

June 7 (5 messages)

CVE-2022-31030: containerd CRI plugin: Host memory exhaustion through ExecSync (Samuel Karp <sam@...uelkarp.com>)
Re: CVE-2021-4204: Linux Kernel eBPF Improper Input Validation Vulnerability (tr3e wang <tr3e.wang@...il.com>)
Re: Linux Kernel eBPF Improper Input Validation Vulnerability (tr3e wang <tr3e.wang@...il.com>)
UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool (Roman Fiedler <roman.fiedler@...aralleled.eu>)
[SECURITY PATCH 00/30] Multiple GRUB2 vulnerabilities - 2022/06/07 round (John Haxby <john.haxby@...cle.com>)

June 8 (10 messages)

CVE-2022-1973: Linux Kernel: fs/ntfs3: invalid free in log_replay (Gerald Lee <sundaywind2004@...il.com>)
CVE-2022-26377: Apache HTTP Server: mod_proxy_ajp: Possible request smuggling (Stefan Eissing <icing@...che.org>)
CVE-2022-28330: Apache HTTP Server: read beyond bounds in mod_isapi (Stefan Eissing <icing@...che.org>)
CVE-2022-28614: Apache HTTP Server: read beyond bounds via ap_rwrite() (Stefan Eissing <icing@...che.org>)
CVE-2022-29404: Apache HTTP Server: Denial of service in mod_lua r:parsebody (Stefan Eissing <icing@...che.org>)
CVE-2022-30522: Apache HTTP Server: mod_sed denial of service (Stefan Eissing <icing@...che.org>)
CVE-2022-30556: Apache HTTP Server: Information Disclosure in mod_lua with websockets (Stefan Eissing <icing@...che.org>)
CVE-2022-31813: Apache HTTP Server: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (Stefan Eissing <icing@...che.org>)
CVE-2022-28615: Apache HTTP Server: Read beyond bounds in ap_strcmp_match() (Stefan Eissing <icing@...che.org>)
firejail: local root exploit reachable via --join logic (CVE-2022-31214) (Matthias Gerstner <mgerstner@...e.de>)

June 9 (4 messages)

Re: Linux kernel: UAF, null-ptr-deref and double-free vulnerabilities in nfcmrvl module (duoming@....edu.cn)
Re: firejail: local root exploit reachable via --join logic (CVE-2022-31214) (Alex Murray <alex.murray@...onical.com>)
Xen Security Advisory 401 v2 (CVE-2022-26362) - x86 pv: Race condition in typeref acquisition (Xen.org security team <security@....org>)
Xen Security Advisory 402 v4 (CVE-2022-26363,CVE-2022-26364) - x86 pv: Insufficient care with non-coherent mappings (Xen.org security team <security@....org>)

June 10 (1 message)

[kubernetes] CVE-2021-25748: Ingress-nginx `path` sanitization can be bypassed with newline character (CJ Cullen <cjcullen@...gle.com>)

June 14 (4 messages)

CVE-2022-25167 - Apache Flume JMSSource does not protect from malicious JNDI urls (Ralph Goers <rgoers@...che.org>)
CVE-2022-1976: Linux Kernel: A use-after-free in __lock_acquire (Gerald Lee <sundaywind2004@...il.com>)
CVE-2022-32981: Linux kernel for powerpc 32-bit, buffer overflow in ptrace PEEKUSER/POKEUSER (Michael Ellerman <mpe@...erman.id.au>)
Xen Security Advisory 404 v1 (CVE-2022-21123,CVE-2022-21124,CVE-2022-21166) - x86: MMIO Stale Data vulnerabilities (Xen.org security team <security@....org>)

June 15 (2 messages)

CVE-2022-33140: Apache NiFi, Apache NiFi Registry: Improper Neutralization of Command Elements in Shell User Group Prov… (David Handermann <exceptionfactory@...c…)
CVE-2021-33036: Apache Hadoop Privilege escalation vulnerability (Akira Ajisaka <aajisaka@...che.org>)

June 16 (1 message)

Xen Security Advisory 404 v2 (CVE-2022-21123,CVE-2022-21125,CVE-2022-21166) - x86: MMIO Stale Data vulnerabilities (Xen.org security team <security@....org>)

June 19 (1 message)

Linux kernel: CVE-2022-1516: NULL pointer dereference in Linux kernel`s X.25 network protocol (duoming@....edu.cn)

June 20 (1 message)

Re: Linux Kernel use-after-free write in netfilter (Moritz Mühlenhoff <jmm@...til.org>)

June 21 (2 messages)

Multiple vulnerabilities affecting Uyuni / SUSE Manager (Paolo Perego <paolo.perego@...e.com>)
Request for comment: kmod signing by AlmaLinux OS Foundation (Igor Seletskiy <i@...udlinux.com>)

June 22 (3 messages)

CVE-2022-2153: Linux Kernel: x86/kvm: NULL pointer dereference in kvm_irq_delivery_to_apic_fast (kangel <22021034@....edu.cn>)
CVE-2022-32549: Apache Sling: log injection in Sling logging (Robert Munteanu <rombert@...che.org>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

June 23 (1 message)

CVE-2022-34305: Apache Tomcat: XSS in examples web application (Mark Thomas <markt@...che.org>)

June 27 (5 messages)

[SECURITY ADVISORY] curl: CVE-2022-32205: Set-Cookie denial of service (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2022-32206: HTTP compression denial of service (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2022-32207: Unpreserved file permissions (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: FTP-KRB bad message verification (Daniel Stenberg <daniel@...x.se>)
CVE-2022-33879: Apache Tika: Incomplete fix and new regex DoS in StandardsExtractingContentHandler (Tim Allison <tallison@...che.org>)

June 28 (2 messages)

Fwd: Node.js security updates for all active release lines, July 2022 (Matteo Collina <matteo.collina@...il.com>)
CVE-2022-32532: Apache Shiro: Authentication Bypass Vulnerability (Brian Demers <bdemers@...che.org>)

June 30 (4 messages)

GnuPG signature spoofing via status line injection (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation (Solar Designer <solar@...nwall.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation (Norbert Slusarek <nslusarek@....net>)

58 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.