oss-security mailing list - 2023/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 8	² 1	³ 1	⁴	⁵
⁶ 1	⁷ 2	⁸ 3	⁹ 2	¹⁰ 1	¹¹	¹²
¹³ 2	¹⁴ 11	¹⁵ 8	¹⁶ 2	¹⁷ 5	¹⁸ 3	¹⁹ 4
²⁰ 7	²¹ 5	²² 2	²³ 1	²⁴ 4	²⁵	²⁶
²⁷ 6	²⁸ 7	²⁹ 4	³⁰ 5	³¹ 5

Messages by day:

March 1 (8 messages)

Re: sudo: double free with per-command chroot sudoers rules (John Helmert III <ajak@...too.org>)
Re: sudo: double free with per-command chroot sudoers rules (Noryungi <noryungi@...il.com>)
Re: sudo: double free with per-command chroot sudoers rules ("Todd C. Miller" <Todd.Miller@...o.ws>)
CVE-2023-1079: Linux Kernel: Use-After-Free in asus_kbd_backlight_set() (Pietro Borrello <borrello@...g.uniroma1.it>)
CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket UID to root (Pietro Borrello <borrello@...g.uniroma1.it>)
CVE-2023-1075 - Linux Kernel: Type Confusion in tls_is_tx_ready() (Pietro Borrello <borrello@...g.uniroma1.it>)
CVE-2023-1077: Linux kernel: Type confusion in pick_next_rt_entity() (Pietro Borrello <borrello@...g.uniroma1.it>)
Re: sudo: double free with per-command chroot sudoers rules (Marc Deslauriers <marc.deslauriers@...onical.com>)

March 2 (1 message)

Linux kernel: CVE-2023-1118: UAF vulnerabilities in "drivers/media/rc" directory (duoming@....edu.cn)

March 3 (1 message)

UAF in OpenSSL up to 3.0.7 (Octavio Galland <octavio.galland@...il.com>)

March 6 (1 message)

Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Georgi Guninski <gguninski@...il.com>)

March 7 (2 messages)

CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy (Eric Covener <covener@...che.org>)
CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting (Eric Covener <covener@...che.org>)

March 8 (3 messages)

CVE-2023-23638: Apache Dubbo Deserialization Vulnerability Gadgets Bypass (Albumen Kevin <albumenj@...che.org>)
Shell command and Emacs Lisp code injection in emacsclient-mail.desktop (Gabriel Corona <gabriel.corona@...e.fr>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)

March 9 (2 messages)

Re: Shell command and Emacs Lisp code injection in emacsclient-mail.desktop (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Qualys Security Advisory <qsa@...lys.com>)

March 10 (1 message)

CVE-2023-26464: Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender (Arnout Engelen <engelen@...che.org>)

March 13 (2 messages)

A USB-accessible slab-out-of-bounds read in Linux kernel driver (Jisoo Jang <jisoo.jang@...sei.ac.kr>)
CVE-2023-1032 - Linux kernel io_uring IORING_OP_SOCKET double free (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

March 14 (11 messages)

Re: A USB-accessible slab-out-of-bounds read in Linux kernel driver (Jisoo Jang <jisoo.jang@...sei.ac.kr>)
TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Peter Bex <peter@...e-magic.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Peter Bex <peter@...e-magic.net>)
Re: sox: patches for old vulnerabilities (Helmut Grohne <helmut@...divi.de>)
Security issue in Hotspot elevate_perf_privileges.sh (CVE-2023-28144) (Matthias Gerstner <mgerstner@...e.de>)
Re: Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
Re: TTY pushback vulnerabilities / TIOCSTI (Shawn Webb <shawn.webb@...denedbsd.org>)

March 15 (8 messages)

Re: TTY pushback vulnerabilities / TIOCSTI (Fabian Keil <freebsd-listen@...iankeil.de>)
CVE-2023-25695: Information disclosure in Apache Airflow (Jarek Potiuk <potiuk@...che.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Dave Horsfall <dave@...sfall.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Casper Dik <casper.dik@...cle.com>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jan Engelhardt <jengelh@...i.de>)
Minor stack-based buffer overflow in OpenBSD's libskey (Qualys Security Advisory <qsa@...lys.com>)
Announce: OpenSSH 9.3 released (Damien Miller <djm@....openbsd.org>)

March 16 (2 messages)

CVE-2023-24278 - Reflected XSS vulnerabilities in Squidex "/squid.svg" endpoint (Giannis Christodoulakos <gchristodoulakos@...sus-labs.com>)
CVE-2023-24278 - Reflected XSS vulnerabilities in Squidex "/squid.svg" endpoint (Giannis Christodoulakos <gchristodoulakos@...sus-labs.com>)

March 17 (5 messages)

flatpak: CVE-2023-28100: TIOCLINUX can send commands outside sandbox if running on a virtual console (Simon McVittie <smcv@...ian.org>)
flatpak: CVE-2023-28101: escape characters in metadata can hide app permissions in terminal (Simon McVittie <smcv@...ian.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Ed Maste <emaste@...ebsd.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)

March 18 (3 messages)

Re: TTY pushback vulnerabilities / TIOCSTI ("Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>)
Re: TTY pushback vulnerabilities / TIOCSTI (Christos Zoulas <christos@...las.com>)
Re: TTY pushback vulnerabilities / TIOCSTI (Eric Ashley <eric@...data.us>)

March 19 (4 messages)

Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
First result on google promotes insecure coding (XSS) (Georgi Guninski <gguninski@...il.com>)
Re: First result on google promotes insecure coding (XSS) (Solar Designer <solar@...nwall.com>)
Re: First result on google promotes insecure coding (XSS) (Georgi Guninski <gguninski@...il.com>)

March 20 (7 messages)

[SECURITY ADVISORY] curl: CVE-2023-27533: TELNET option IAC injection (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27534: SFTP path ~ resolving discrepancy (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27535: FTP too eager connection reuse (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27536: GSS delegation too eager connection re-use (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27537: HSTS double-free (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27538: SSH connection too eager reuse still (Daniel Stenberg <daniel@...x.se>)
CVE-2023-26513: Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to … (Radu Cotescu <radu@...che.org>)

March 21 (5 messages)

Xen Security Advisory 427 v2 (CVE-2022-42332) - x86 shadow plus log-dirty mode use-after-free (Xen.org security team <security@....org>)
Xen Security Advisory 428 v3 (CVE-2022-42333,CVE-2022-42334) - x86/HVM pinned cache attributes mis-handling (Xen.org security team <security@....org>)
Xen Security Advisory 429 v3 (CVE-2022-42331) - x86: speculative vulnerability in 32bit SYSCALL path (Xen.org security team <security@....org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)

March 22 (2 messages)

CVE-2023-28708: Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations (Mark Thomas <markt@...che.org>)
CVE-2023-0464: OpenSSL: Excessive Resource Usage Verifying X.509 Policy Constraints (Solar Designer <solar@...nwall.com>)

March 23 (1 message)

[CVE-2023-28686] Insufficient message sender validation in Dino (Dino Team <team@...o.im>)

March 24 (4 messages)

New distros list statistics (Anthony Liguori <anthony@...emonkey.ws>)
CVE-2022-38745: Apache OpenOffice: Empty entry in Java class path (Marcus Lange <marcus@...che.org>)
CVE-2022-47502: Apache OpenOffice: Macro URL arbitrary script execution (Marcus Lange <marcus@...che.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)

March 27 (6 messages)

CVE-2023-27296: Apache InLong: JDBC Deserialization Vulnerability in InLong (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-25195: Apache Fineract: SSRF template type vulnerability in certain authenticated users (James Dailey <jdailey@...che.org>)
CVE-2023-25196: Apache Fineract: SQL injection vulnerability (James Dailey <jdailey@...che.org>)
CVE-2023-25197: apache fineract: SQL injection vulnerability in certain procedure calls (James Dailey <jdailey@...che.org>)
Re: New distros list statistics (Solar Designer <solar@...nwall.com>)
Re: New distros list statistics (Anthony Liguori <anthony@...emonkey.ws>)

March 28 (7 messages)

CVE-2023-28326: Apache OpenMeetings: allows user impersonation (Maxim Solodovnik <solomax@...che.org>)
CVE-2023-28464: Linux: Bluetooth: hci_conn_cleanup function has double free (Zhenghan Wang <wzhmmmmm@...il.com>)
Re: CVE-2023-28464: Linux: Bluetooth: hci_conn_cleanup function has double free (Solar Designer <solar@...nwall.com>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
Re: CVE-2023-28464: Linux: Bluetooth: hci_conn_cleanup function has double free (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2023-28464: Linux: Bluetooth: hci_conn_cleanup function has double free (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-28464: Linux: Bluetooth: hci_conn_cleanup function has double free (Seth Arnold <seth.arnold@...onical.com>)

March 29 (4 messages)

Fwd: X.Org Security Advisory: CVE-2023-1393: X.Org Server Overlay Window Use-After-Free (Olivier Fourdan <ofourdan@...hat.com>)
CVE-2023-28158: Apache Archiva privilege escalation (Olivier Lamy <olamy@...che.org>)
polkitd service user privilege separation (Johannes Segitz <jsegitz@...e.de>)
Re: polkitd service user privilege separation (Simon McVittie <smcv@...ian.org>)

March 30 (5 messages)

Re: polkitd service user privilege separation (Johannes Segitz <jsegitz@...e.de>)
CVE-2023-28935: Apache UIMA DUCC: DUCC (EOL) allows RCE (Arnout Engelen <engelen@...che.org>)
Re: polkitd service user privilege separation (Jordan Glover <Golden_Miller83@...tonmail.ch>)
Re: Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
Irssi SA-2023-03 / Use after free in printing routine (Ailin Nemui <ailin@...io.us>)

March 31 (5 messages)

Re: Re: sox: patches for old vulnerabilities (Nam Nguyen <namn@...keley.edu>)
Re: Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2023-26269: Apache James server: Privilege escalation through unauthenticated JMX (Benoit Tellier <btellier@...che.org>)
Re: polkitd service user privilege separation (Johannes Segitz <jsegitz@...e.de>)
Re: CVE-2023-29132: Irssi SA-2023-03 / Use after free in printing routine (Ailin Nemui <ailin@...io.us>)

100 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.