oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹	² 1	³ 6	⁴ 1	⁵ 2	⁶ 8	⁷ 4
⁸ 11	⁹ 8	¹⁰ 2	¹¹ 2	¹² 1	¹³ 2	¹⁴ 3
¹⁵ 1	¹⁶ 1	¹⁷ 1	¹⁸ 6	¹⁹	²⁰ 1	²¹
²²	²³ 3	²⁴	²⁵ 5	²⁶ 4	²⁷	²⁸
²⁹ 5	³⁰ 6	³¹ 2

Messages by day:

August 2 (1 message)

CVE-2022-29154: Rsync client-side arbitrary file write vulnerability. (EGE BALCI <ege@...daft.com>)

August 3 (6 messages)

Django: CVE-2022-36359: Potential reflected file download vulnerability in FileResponse. (Carlton Gibson <carlton.gibson@...il.com>)
CVE-2022-27166: Apache JSPWiki: XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
CVE-2022-28730: Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
CVE-2022-28731: Apache JSPWiki CSRF in UserPreferences.jsp (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
CVE-2022-28732: Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
CVE-2022-34158: Apache JSPWiki: User Group Privilege Escalation (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)

August 4 (1 message)

gromox: potential local privilege escalation (CVE-2022-37030) (Filippo Bonazzi <fbonazzi@...e.de>)

August 5 (2 messages)

Freeciv < 2.6.7, freeciv-3.0 < 3.0.3, Modpack Installer buffer overflow (Marko Lindqvist <cazfi74@...il.com>)
zlib buffer overflow (Evgeny Legerov <admin@...ndisco.cc>)

August 6 (8 messages)

Exim 4.95 invalid free (Evgeny Legerov <admin@...ndisco.cc>)
Re: Exim 4.95 invalid free (John Helmert III <ajak@...too.org>)
Re: Exim 4.95 invalid free (Evgeny Legerov <admin@...ndisco.cc>)
Re: Exim 4.95 invalid free (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init (Solar Designer <solar@...nwall.com>)
Re: CVE-2022-1972: out-of-bound write in Linux netfilter subsystem leads to local privilege escalation (Solar Designer <solar@...nwall.com>)
Re: Exim 4.95 invalid free (Solar Designer <solar@...nwall.com>)
Exim < 4.95 heap overflow (Evgeny Legerov <admin@...ndisco.cc>)

August 7 (4 messages)

Re: Exim < 4.95 heap overflow (John Helmert III <ajak@...too.org>)
Re: Exim < 4.95 heap overflow (Stuart Henderson <sthen@...nbsd.org>)
Re: Exim 4.95 invalid free (Evgeny Legerov <admin@...ndisco.cc>)
Re: Exim < 4.95 heap overflow (Roxana Bradescu <roxabee@...omium.org>)

August 8 (11 messages)

CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions (David Hildenbrand <david@...hat.com>)
Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions (Solar Designer <solar@...nwall.com>)
Re: Linux: UaF due to concurrency issue in io_uring timeouts (Solar Designer <solar@...nwall.com>)
Linux kernel: io_uring: free of unallocated buffer list in io_register_pbuf_ring() (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: io_uring: free of unallocated buffer list in io_register_pbuf_ring() (Florian Weimer <fweimer@...hat.com>)
wolfSSL 5.4.0 fixes CVE-2022-34293 and other issues (Fabian Keil <freebsd-listen@...iankeil.de>)
Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions (David Hildenbrand <david@...hat.com>)
Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2022-35724: Apache Avro: Denial of service while reading data in Avro Rust SDK (Ryan Skraba <rskraba@...che.org>)
CVE-2022-36124: Apache Avro: Memory overconsumption in Avro Rust SDK (Ryan Skraba <rskraba@...che.org>)
CVE-2022-36125: Apache Avro: Integer overflow when reading corrupted .avro file in Avro Rust SDK (Ryan Skraba <rskraba@...che.org>)

August 9 (8 messages)

Re: zlib buffer overflow (Alan Coopersmith <alan.coopersmith@...cle.com>)
Apache mod_dav off-by-one (Evgeny Legerov <admin@...ndisco.cc>)
Exim 4.96 overflow (Evgeny Legerov <admin@...ndisco.cc>)
Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions (David Hildenbrand <david@...hat.com>)
CVE-2022-2586 - Linux kernel nf_tables cross-table reference UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2022-2588 - Linux kernel cls_route UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2022-2585 - Linux kernel POSIX CPU timer UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
Re: CVE-2022-2588 - Linux kernel cls_route UAF (Vegard Nossum <vegard.nossum@...cle.com>)

August 10 (2 messages)

Re: [Exim-Security] Exim < 4.95 heap overflow (Graeme Fowler <graeme+osssec@...emef.net>)
Re: Apache mod_dav off-by-one (John Helmert III <ajak@...too.org>)

August 11 (2 messages)

Re: CVE-2022-20359 is not mentioned in linked bulletin (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2022-20359 is not mentioned in linked bulletin (Neil Williams <codehelp@...ian.org>)

August 12 (1 message)

Re: [Exim-Security] Exim < 4.95 heap overflow (Roxana Bradescu <roxxbee@...il.com>)

August 13 (2 messages)

CVE-2022-37400: Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Kn… ("Carl B. Marcum" <cmarcum@...che.org>)
CVE-2022-37401: Apache OpenOffice Weak Master Keys ("Carl B. Marcum" <cmarcum@...che.org>)

August 14 (3 messages)

Multiple DNS Cache poisoning vulnerabilities in dnrd DNS forwarder (CVE-2022-33993, CVE-2022-33992) ("Philipp Jeitner (SIT)" <philipp.jeitner@....fraunhofer.de…)
Fixed DNS UDP port in totd DNS forwarder (CVE-2022-34294) ("Philipp Jeitner (SIT)" <philipp.jeitner@....fraunhofer.de>)
Multiple DNS Cache poisoning vulnerabilities in dproxy and drpoxy-nexgen (CVE-2022-33988, CVE-2022-33989, CVE-2022-3399… ("Philipp Jeitner (SIT)" <philipp.jeitne…)

August 15 (1 message)

Re: CVE-2022-2590: Linux kernel: Modifying shmem/tmpfs files without write permissions (David Hildenbrand <david@...hat.com>)

August 16 (1 message)

CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dag (Ash Berlin-Taylor <ash@...che.org>)

August 17 (1 message)

Landlock news #2 (Mickaël Salaün <mic@...ikod.net>)

August 18 (6 messages)

Re: CVE-2022-2586 - Linux kernel nf_tables cross-table reference UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
Re: CVE-2022-2588 - Linux kernel cls_route UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
Re: CVE-2022-2585 - Linux kernel POSIX CPU timer UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2022-35278: Apache ActiveMQ Artemis: HTML Injection in ActiveMQ Artemis Web Console (Justin Bertram <jbertram@...che.org>)
Linux kernel: stack-out-of-bounds in profile_pc (黄晓 <NigelXiao@...look.com>)
Re: Linux kernel: stack-out-of-bounds in profile_pc (Greg KH <greg@...ah.com>)

August 20 (1 message)

CVE-2022-34916: Apache Flume: Improper Input Validation (JNDI Injection) in JMSMessageConsumer (Ralph Goers <rgoers@...che.org>)

August 23 (3 messages)

Security Advisory 2022-02 for PowerDNS Recursor up to and including 4.5.9, 4.6.2, 4.7.1 (Otto Moerbeek <otto.moerbeek@...n-xchange.com>)
Multiple vulnerabilities in Jenkins plugins (Wadeck Follonier <wadeck.follonier@...il.com>)
[SECURITY ADVISORY] open-vm-tools: Local privilege escalation vulnerability (CVE-2022-31676) (VMware Security Response Center <security@...are.com>)

August 25 (5 messages)

Re: Linux Kernel use-after-free write in netfilter (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: CVE-2022-1015,CVE-2022-1016 in nf_tables cause privilege escalation, information leak (Solar Designer <solar@...nwall.com>)
CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (Joe Orton <jorton@...che.org>)
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (Alex Gaynor <alex.gaynor@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

August 26 (4 messages)

Linux kernel slab-out-of-bound read in bpf (Hsin-Wei Hung <hsinweih@....edu>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (John Helmert III <ajak@...too.org>)
Re: Linux kernel slab-out-of-bound read in bpf (Hsin-Wei Hung <hsinweih@....edu>)
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (John Helmert III <ajak@...too.org>)

August 29 (5 messages)

Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2022-28199: DPDK mlx5 driver error recovery handling vulnerability (Thomas Monjalon <thomas@...jalon.net>)
CVE-2022-2132: DPDK copy_desc_to_mbuf() Vhost header vulnerability (Thomas Monjalon <thomas@...jalon.net>)
N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF (Alejandro Guerrero <aguerrero@...lys.com>)

August 30 (6 messages)

CVE-2022-2663: Linux netfilter: nf_conntrack_irc message handling (David Leadbeater <dgl@....cx>)
CVE-2022-31790 CVE-2022-31789: Watchguard XTM/Firebox firewalls: Multiple vulnerabilities (Charles Fol <c.fol@...fo.fr>)
CVE-2022-37021: Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. (Kirk Lund <klund@...che.org>)
CVE-2022-37022: Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11 (Kirk Lund <klund@...che.org>)
CVE-2022-37023: Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11 (Kirk Lund <klund@...che.org>)
Re: CVE-2022-31790 CVE-2022-31789: Watchguard XTM/Firebox firewalls: Multiple vulnerabilities (Moritz Mühlenhoff <jmm@...til.org>)

August 31 (2 messages)

Re: Freeciv < 2.6.7, freeciv-3.0 < 3.0.3, Modpack Installer buffer overflow (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY ADVISORY] CVE-2022-35252: control code in cookie denial of service (curl) (Daniel Stenberg <daniel@...x.se>)

86 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.