oss-security mailing list - 2022/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	² 3	³ 6
⁴ 8	⁵ 8	⁶ 12	⁷ 3	⁸ 2	⁹	¹⁰
¹¹ 1	¹² 5	¹³ 1	¹⁴ 1	¹⁵ 1	¹⁶	¹⁷ 1
¹⁸ 2	¹⁹ 6	²⁰ 4	²¹	²²	²³ 2	²⁴ 3
²⁵ 2	²⁶ 3	²⁷ 1	²⁸ 2	²⁹	³⁰	³¹

Messages by day:

July 2 (3 messages)

Re: GnuPG signature spoofing via status line injection (Salvatore Bonaccorso <carnil@...ian.org>)
Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Solar Designer <solar@...nwall.com>)

July 3 (6 messages)

Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Demi Marie Obenour <demi@...isiblethingslab.com>)
Linux kernel: UAF vulnerabilities in rose protocol (duoming@....edu.cn)
Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Solar Designer <solar@...nwall.com>)
Linux kernel: Netfilter heap buffer overflow: Is this CVE-2022-32250? (Keine Eile <keine-eile@...ail.de>)
Re: Linux kernel: Netfilter heap buffer overflow: Is this CVE-2022-32250? (Solar Designer <solar@...nwall.com>)

July 4 (8 messages)

Denial of service in GnuPG (Demi Marie Obenour <demi@...isiblethingslab.com>)
Django: CVE-2022-34265: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments. (Mariusz Felisiak <felisiak.mariusz@...il.com>)
DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Peter van Dijk <peter.van.dijk@...erdns.com>)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Jens-Wolfhard Schicke-Uffmann <j.schicke@...xlogic.com>)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Noel Kuntze <noel.kuntze@...rmi.consulting>)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Peter van Dijk <peter.van.dijk@...erdns.com>)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Jakub Wilk <jwilk@...lk.net>)
Re: Denial of service in GnuPG (Demi Marie Obenour <demi@...isiblethingslab.com>)

July 5 (8 messages)

Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Marcus Meissner <meissner@...e.de>)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Dave Horsfall <dave@...sfall.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2022-0006 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Xen Security Advisory 406 v3 (CVE-2022-33744) - Arm guests can cause Dom0 DoS via PV devices (Xen.org security team <security@....org>)
Xen Security Advisory 405 v3 (CVE-2022-33743) - network backend may cause Linux netfront to use freed SKBs (Xen.org security team <security@....org>)
Xen Security Advisory 403 v3 (CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742) - Linux disk/nic frontends d… (Xen.org security team <security@....org…)
Re: Linux kernel: UAF vulnerabilities in rose protocol (duoming@....edu.cn)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Kurt H Maier <khm@...ops.net>)

July 6 (12 messages)

CVE-2022-32533: Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues ("Mark J. Cox" <mjc@...che.org>)
Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Tavis Ormandy <taviso@...il.com>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2021-37839: Apache Superset: Improper access to dataset metadata information (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2022-33980: Apache Commons Configuration insecure interpolation defaults (Matt Juntunen <mattjuntunen@...che.org>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Alexander Burke <alex@...xburke.ca>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Solar Designer <solar@...nwall.com>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2022-30550: Privilege escalation possible in dovecot when similar master and non-master passdbs are used (Aki Tuomi <aki.tuomi@...ecot.fi>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Solar Designer <solar@...nwall.com>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Grant Taylor <gtaylor@...tconsulting.net>)
Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Demi Marie Obenour <demi@...isiblethingslab.com>)

July 7 (3 messages)

Re: Re: DO NOT OPEN PREVIOUS MAIL Re: Denial of service in GnuPG (Florian Weimer <fweimer@...hat.com>)
CVE-2021-44791: Apache Druid: Reflected XSS on certain HTTP endpoints (Abhishek Agarwal <abhishek@...che.org>)
CVE-2022-28889: Apache Druid: Clickjacking in the web console (Abhishek Agarwal <abhishek@...che.org>)

July 8 (2 messages)

Re: CVE-2022-30550: Privilege escalation possible in dovecot when similar master and non-master passdbs are used (Aki Tuomi <aki.tuomi@...ecot.fi>)
Fwd: CVE-2022-2347 - Unchecked Download Size and Direction in U-Boot USB DFU ("Eduardo' Vela\" <Nava>" <evn@...gle.com>)

July 11 (1 message)

[kubernetes] CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass ("Hausler, Micah" <mhausler@...zon.com>)

July 12 (5 messages)

Fwd: X.Org Security Advisory: July 12, 2022 (Povilas Kanapickas <povilas@...ix.lt>)
Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code exe… (Xen.org security team <security@....org…)
[CVE-2022-31781] Apache Tapestry denial of service vulnerability ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)
Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative cod… (Salvatore Bonaccorso <carnil@...ian.org…)
Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative cod… (Salvatore Bonaccorso <carnil@...ian.org…)

July 13 (1 message)

Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative cod… (Andrew Cooper <Andrew.Cooper3@...rix.co…)

July 14 (1 message)

Git v2.37.1 and friends for CVE-2022-29187 (Junio C Hamano <junio@...ox.com>)

July 15 (1 message)

[Security] CVE-2021-34538: Security vulnerability in Hive with UDFs (Naveen Gangam <ngangam@...udera.com>)

July 17 (1 message)

CVE-2022-33891: Apache Spark shell command injection vulnerability via Spark UI (Sean Owen <srowen@...che.org>)

July 18 (2 messages)

CVE-2022-36127: Apache SkyWalking NodeJS Agent: Service unavailability impact in NodeJS agent(version <= 0.5.0) (Zhenxu Ke <kezhenxu94@...che.org>)
[ADVISORY] Apache CloudStack SAML Single Sign-On XXE (CVE-2022-35741) (Rohit Yadav <rohit@...che.org>)

July 19 (6 messages)

snowflakedb security contacts (Seth Arnold <seth.arnold@...onical.com>)
CVE-2021-33655: Linux kernel: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write m… ("Weigang (Jimmy)" <weigang12@...wei.com…)
CVE-2021-33656: Linux kernel: When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out o… ("Weigang (Jimmy)" <weigang12@...wei.com…)
CVE-2022-21505: Kernel lockdown bypass bug (John Haxby <john.haxby@...cle.com>)
CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT style… ("Mark J. Cox" <mjc@...che.org>)
Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XS… (John Helmert III <ajak@...too.org>)

July 20 (4 messages)

Re: [ADVISORY] Apache CloudStack SAML Single Sign-On XXE (CVE-2022-35741) (Rohit Yadav <rohit@...che.org>)
Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious X… (Roxana Bradescu <roxxbee@...il.com>)
Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious X… (Moritz Muehlenhoff <jmm@...til.org>)
Grails Framework Remote Code Execution Vulnerability, CVE-2022-35912 ("Myers, Christopher" <Christopher.Myers@...or.edu>)

July 23 (2 messages)

CVE Request: heap buffer overflow in gdk-pixbuf (Pedro Ribeiro <pedrib@...il.com>)
Re: CVE Request: heap buffer overflow in gdk-pixbuf (John Helmert III <ajak@...too.org>)

July 24 (3 messages)

Re: CVE Request: heap buffer overflow in gdk-pixbuf (Pedro Ribeiro <pedrib@...il.com>)
CVE-2022-24294: ReDoS in Apache MXNet RTC Module (Sheng Zha <zhasheng@...che.org>)
Re: snowflakedb security contacts (Roxana Bradescu <roxxbee@...il.com>)

July 25 (2 messages)

Re: CVE Request: heap buffer overflow in gdk-pixbuf (Pedro Ribeiro <pedrib@...il.com>)
Re: snowflakedb security contacts (Seth Arnold <seth.arnold@...onical.com>)

July 26 (3 messages)

Re: snowflakedb security contacts (Christian Heinrich <christian.heinrich@...h.id.au>)
Xen Security Advisory 408 v2 (CVE-2022-33745) - insufficient TLB flush for x86 PV guests in shadow mode (Xen.org security team <security@....org>)
Xen Security Advisory 408 v3 (CVE-2022-33745) - insufficient TLB flush for x86 PV guests in shadow mode (Xen.org security team <security@....org>)

July 27 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

July 28 (2 messages)

CVE-2022-36364: Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector (Ruben Q L <rubenql@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2022-0007 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

77 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.