oss-security mailing list - 2023/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 5	² 7	³ 3	⁴ 5	⁵ 1
⁶ 1	⁷ 8	⁸ 2	⁹ 1	¹⁰ 1	¹¹	¹²
¹³ 1	¹⁴ 5	¹⁵ 6	¹⁶ 2	¹⁷	¹⁸	¹⁹
²⁰ 3	²¹	²² 2	²³ 8	²⁴	²⁵	²⁶
²⁷	²⁸ 1

Messages by day:

February 1 (5 messages)

CVE-2023-24977: Apache InLong: Jdbc Connection causes arbitrary file reading in InLong (Charles Zhang <dockerzhang@...che.org>)
Re: pesign: Local privilege escalation on pesign systemd service (Matthias Gerstner <mgerstner@...e.de>)
CVE-2023-24997: Apache InLong: Jdbc Connection Security Bypass in InLong (Charles Zhang <dockerzhang@...che.org>)
Django: CVE-2023-23969: Potential denial-of-service via Accept-Language headers. (Mariusz Felisiak <felisiak.mariusz@...il.com>)
Re: Fwd: X.Org Security Advisory: Issues handling XPM files in libXpm prior to 3.5.15 (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 2 (7 messages)

Re: Linux Kernel: hid: Use-After-Free in bigben_set_led() (Thomas Leroy <tleroy@...e.de>)
double-free vulnerability in OpenSSH server 9.1 (Qualys Security Advisory <qsa@...lys.com>)
Announce: OpenSSH 9.2 released (Damien Miller <djm@....openbsd.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2023-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: double-free vulnerability in OpenSSH server 9.1 (Georgi Guninski <gguninski@...il.com>)
Re: double-free vulnerability in OpenSSH server 9.1 (Matthias Schmidt <oss-sec@...c.org>)
Re: double-free vulnerability in OpenSSH server 9.1 (Qualys Security Advisory <qsa@...lys.com>)

February 3 (3 messages)

CVE-2023-0045: Linux Kernel: Bypassing Spectre-BTI User Space Mitigations (Rafael Correa De Ysasi <rcorreadeysasi@...omium.org>)
Re: CVE-2023-0045: Linux Kernel: Bypassing Spectre-BTI User Space Mitigations (Rodrigo Branco <rodrigo@...nelhacking.com>)
sox: patches for old vulnerabilities (Helmut Grohne <helmut@...divi.de>)

February 4 (5 messages)

CVE-2023-22849: Apache Sling App CMS: XSS in CMS Reference / UI Components (Dan Klco <dklco@...che.org>)
Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2022-45786: Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection (John Gemignani <jgemignani@...che.org>)
CVE-2022-45786: Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection (John Gemignani <jgemignani@...che.org>)
Re: CVE-2023-0045: Linux Kernel: Bypassing Spectre-BTI User Space Mitigations (Rodrigo Branco <rodrigo@...nelhacking.com>)

February 5 (1 message)

Re: sox: patches for old vulnerabilities (Helmut Grohne <helmut@...divi.de>)

February 6 (1 message)

Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)

February 7 (8 messages)

X.Org Security Advisory: Security issue in the X server (Peter Hutterer <peter.hutterer@...hat.com>)
SEGV in `alloca(BIG)` and `long pl[BIG]` (Georgi Guninski <gguninski@...il.com>)
Re: X.Org Security Advisory: Security issue in the X server (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: SEGV in `alloca(BIG)` and `long pl[BIG]` (Russ Allbery <eagle@...ie.org>)
CVE-2023-25194: Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Co… (Manikumar <manikumar@...che.org>)
Fwd: Node.js security upates for all active release lines, February 2023 (Michael Dawson <midawson@...hat.com>)
CVE-2022-46663: less -R filtering bypass (David Leadbeater <dgl@....cx>)
Fwd: OpenSSL Security Advisory (Solar Designer <solar@...nwall.com>)

February 8 (2 messages)

[vs] heimdal: CVE-2022-45142: signature validation failure (Helmut Grohne <helmut@...divi.de>)
Re: SEGV in `alloca(BIG)` and `long pl[BIG]` (Florian Weimer <fweimer@...hat.com>)

February 9 (1 message)

CVE-2023-22832: Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes (David Handermann <exceptionfactory@...che.org>)

February 10 (1 message)

CVE-2023-25139: glibc-2.37 sprintf buffer overflow (Jan Schaumann <jschauma@...meister.org>)

February 13 (1 message)

Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Qualys Security Advisory <qsa@...lys.com>)

February 14 (5 messages)

Django - CVE-2023-24580: Potential denial-of-service vulnerability in file uploads (Carlton Gibson <carlton.gibson@...il.com>)
CVE-2022-46397: FD.io VPP (Vector Packet Processor) IPSec generates a predictable IV with AES-CBC mode (Dave Wallace <dwallacelf@...il.com>)
CVE-2023-25141: JNDI injection into Apache sling-org-apache-sling-jcr-base (Angela Schreiber <angela@...che.org>)
Xen Security Advisory 426 v1 (CVE-2022-27672) - x86: Cross-Thread Return Address Predictions (Xen.org security team <security@....org>)
[Announce] Git 2.39.2 and friends (Junio C Hamano <gitster@...ox.com>)

February 15 (6 messages)

curl: CVE-2023-23914: HSTS ignored on multiple requests (Daniel Stenberg <daniel@...x.se>)
curl: CVE-2023-23915: HSTS amnesia with --parallel (Daniel Stenberg <daniel@...x.se>)
curl: CVE-2023-23916: HTTP multi-header compression denial of service (Daniel Stenberg <daniel@...x.se>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2022-42735: Apache ShenYu Admin ultra vires (Zhang Yonglun <zhangyonglun@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2023-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

February 16 (2 messages)

EternalTerminal: Review report and findings (predictable /tmp file paths and file permission issues, 3 CVEs) (Matthias Gerstner <mgerstner@...e.de>)
Xen Security Advisory 426 v2 (CVE-2022-27672) - x86: Cross-Thread Return Address Predictions (Xen.org security team <security@....org>)

February 20 (3 messages)

CVE-2023-25613: LDAP Injection Vulnerability in Apache Kerby (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2023-24998: Apache Commons FileUpload: FileUpload DoS with excessive parts (Mark Thomas <markt@...che.org>)
CVE-2023-24998 Apache Tomcat - FileUpload DoS with excessive parts (Mark Thomas <markt@...che.org>)

February 22 (2 messages)

Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Qualys Security Advisory <qsa@...lys.com>)
Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Demi Marie Obenour <demi@...isiblethingslab.com>)

February 23 (8 messages)

Re: CVE-2023-0179: Linux kernel stack buffer overflow in nftables: PoC and writeup (butt3rflyh4ck <butterflyhuangxx@...il.com>)
CVE-2023-25621: Apache Sling does not allow to handle i18n content in a secure way (Carsten Ziegeler <cziegeler@...che.org>)
Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Qualys Security Advisory <qsa@...lys.com>)
CVE-2023-25691: Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution (Jarek Potiuk <potiuk@...che.org>)
CVE-2023-25692: Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service (Jarek Potiuk <potiuk@...che.org>)
CVE-2023-25693: Sqoop Apache Airflow Provider Remote Code Execution Vulnerability (Jarek Potiuk <potiuk@...che.org>)
CVE-2023-25696: Apache Airflow Hive Provider Beeline RCE (Jarek Potiuk <potiuk@...che.org>)
CVE-2023-25956: Apache Airflow AWS Provider: Arbitrary file read via AWS provider (Jarek Potiuk <potiuk@...che.org>)

February 28 (1 message)

sudo: double free with per-command chroot sudoers rules ("Todd C. Miller" <Todd.Miller@...lert.dev>)

62 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.