oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 2	² 1	³
⁴ 2	⁵ 2	⁶ 10	⁷	⁸ 7	⁹ 1	¹⁰
¹¹ 1	¹² 2	¹³ 5	¹⁴ 9	¹⁵ 1	¹⁶	¹⁷
¹⁸ 3	¹⁹ 3	²⁰ 5	²¹ 6	²² 11	²³	²⁴
²⁵ 12	²⁶ 11	²⁷ 2	²⁸ 7	²⁹ 14	³⁰ 5

Messages by day:

September 1 (2 messages)

Replacement of Allan McRae on linux-distros for Arch Linux (Levente Polyak <levente@...entepolyak.net>)
Re: Replacement of Allan McRae on linux-distros for Arch Linux (Solar Designer <solar@...nwall.com>)

September 2 (1 message)

CVE-2023-41180: Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++ (Marton Szasz <szaszm@...che.org>)

September 4 (2 messages)

Django: CVE-2023-41164: Potential denial of service vulnerability in django.utils.encoding.uri_to_iri() (Mariusz Felisiak <felisiak.mariusz@...il.com>)
Re: linux-distros list policy and Linux kernel, again (Willy Tarreau <w@....eu>)

September 5 (2 messages)

CVE-2023-40743: Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService (Arnout Engelen <engelen@...che.org>)
Xen Security Advisory 437 v2 (CVE-2023-34321) - arm32: The cache may not be properly cleaned/invalidated (Xen.org security team <security@....org>)

September 6 (10 messages)

CVE-2023-36387: Apache Superset: Improper API permission for low privilege users (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-36388: Apache Superset: Improper API permission for low privilege users allows for SSRF (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-27523: Apache Superset: Improper data permission validation on Jinja templated queries (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-27526: Apache Superset: Improper Authorization check on import charts (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-39264: Apache Superset: Stack traces enabled by default (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-39265: Apache Superset: Possible Unauthorized Registration of SQLite Database Connections (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-37941: Apache Superset: Metadata db write access can lead to remote code execution (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-32672: Apache Superset: SQL parser edge case bypasses data access authorization (Daniel Gaspar <dpgaspar@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: CVE-2023-38633 in librsvg: Arbitrary file read when xinclude href has special characters (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 8 (7 messages)

OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
croc: multiple issues in file sharing utility (Matthias Gerstner <mgerstner@...e.de>)
Re: OpenSSL Security Advisory (Alex Gaynor <alex.gaynor@...il.com>)
Re: linux-distros list policy and Linux kernel, again (Solar Designer <solar@...nwall.com>)
CVE-2023-4809: FreeBSD pf bypass when using IPv6 (Enrico Bassetti <bassetti@...uniroma1.it>)
Re: CVE-2023-4809: FreeBSD pf bypass when using IPv6 (Alexander Bluhm <alexander.bluhm@....net>)
Re: CVE-2023-4809: FreeBSD pf bypass when using IPv6 (Demi Marie Obenour <demi@...isiblethingslab.com>)

September 9 (1 message)

mutt 2.2.12 security update (Tavis Ormandy <taviso@...il.com>)

September 11 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0008 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

September 12 (2 messages)

CVE-2023-40712: Apache Airflow: Secrets can be unmasked in the "Rendered Template" (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-40611: Apache Airflow Dag Runs Broken Access Control Vulnerability (Ephraim Anierobi <ephraimanierobi@...che.org>)

September 13 (5 messages)

CVE-2023-38039 curl: HTTP headers eat all memory (Daniel Stenberg <daniel@...x.se>)
[SECURITY] CVE-2023-41081 Apache Tomcat Connectors (mod_jk) Information Disclosure (Mark Thomas <markt@...che.org>)
CVE-2023-42503: Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file ("Gary D. Gregory" <ggregory@...che.org>)
illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
Re: illumos (or at least danmcd) membership in the distros list (Katherine Mcmillan <kmcmi046@...tawa.ca>)

September 14 (9 messages)

Re: illumos (or at least danmcd) membership in the distros list (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
CVE-2023-41267: Apache HDFS Provider error message suggested installation of incorrect pip package (Elad Kalif <eladkal@...che.org>)
Re: illumos (or at least danmcd) membership in the distros list (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
Re: illumos (or at least danmcd) membership in the distros list (Solar Designer <solar@...nwall.com>)
Re: illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
Re: illumos (or at least danmcd) membership in the distros list (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: illumos (or at least danmcd) membership in the distros list (Jean Luc Picard <atari2600a@...il.com>)

September 15 (1 message)

Re: illumos (or at least danmcd) membership in the distros list (Solar Designer <solar@...nwall.com>)

September 18 (3 messages)

Re: illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
Possible AMD Zen2 CVE (Steve Thompson <susurrus.of.qualia@...il.com>)
[CVE-2023-42752] integer overflow in Linux kernel leading to exploitable memory access (Kyle Zeng <zengyhkyle@...il.com>)

September 19 (3 messages)

Re: Possible AMD Zen2 CVE (Mathias Krause <minipli@...glemail.com>)
RE: [External] : Possible AMD Zen2 CVE (Casper Dik <casper.dik@...cle.com>)
[CVE-2023-41834] Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF S… (Martijn Visser <martijnvisser@...che.or…)

September 20 (5 messages)

Xen Security Advisory 438 v2 (CVE-2023-34322) - top-level shadow reference dropped too early for 64-bit PV guests (Xen.org security team <security@....org>)
ISC has disclosed two vulnerabilities in BIND 9 (CVE-2023-3341, CVE-2023-4236) (Michał Kępień <michal@....org>)
CVE-2023-4504 cups, libppd: Postscript parsing heap-based buffer overflow (Zdenek Dohnal <zdohnal@...hat.com>)
Re: CVE-2023-4504 cups, libppd: Postscript parsing heap-based buffer overflow (Solar Designer <solar@...nwall.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

September 21 (6 messages)

MOV{H,L}PS instructions can fail on Genoa (Zen 4) (Tavis Ormandy <taviso@...il.com>)
Advisory X41-2023-001: Two Vulnerabilities in OPNsense (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
Supply Chain Issues in PyPI (Stian Kristoffersen <wayphinder@...il.com>)
CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Solar Designer <solar@...nwall.com>)
Re: croc: multiple issues in file sharing utility (Salvatore Bonaccorso <carnil@...ian.org>)
Re: linux-distros list policy and Linux kernel, again (Solar Designer <solar@...nwall.com>)

September 22 (11 messages)

Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Hanno Böck <hanno@...eck.de>)
Plone security advisory 2023/09/21 (Maurits van Rees <maurits@...rees.org>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Rodrigo Freire <rfreire@...hat.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Vincent Rabaud <vrabaud@...gle.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Vincent Rabaud <vrabaud@...gle.com>)
Re: illumos (or at least danmcd) membership in the distros list (Solar Designer <solar@...nwall.com>)
[CVE-2023-42753] Array Indexing error in Linux kernel (Kyle Zeng <zengyhkyle@...il.com>)
Re: illumos (or at least danmcd) membership in the distros list (Solar Designer <solar@...nwall.com>)

September 25 (12 messages)

CVE-2023-4527: glibc: Stack read overflow in getaddrinfo in no-aaaa mode (Solar Designer <solar@...nwall.com>)
Re: illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Xen.org security team <security@....org>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
Xen Security Advisory 439 v2 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Xen.org security team <security@....org>)
Re: illumos (or at least danmcd) membership in the distros list (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
Re: illumos (or at least danmcd) membership in the distros list (Solar Designer <solar@...nwall.com>)
Re: illumos (or at least danmcd) membership in the distros list (Dan McDonald <danmcd@....io>)
Re: illumos (or at least danmcd) membership in the distros list (Solar Designer <solar@...nwall.com>)
[CVE-2023-42755] Linux kernel wild pointer access <= v6.2 (Kyle Zeng <zengyhkyle@...il.com>)

September 26 (11 messages)

Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [CVE-2023-42755] Linux kernel wild pointer access <= v6.2 (Greg KH <greg@...ah.com>)
Re: [CVE-2023-42755] Linux kernel wild pointer access <= v6.2 (Kyle Zeng <zengyhkyle@...il.com>)
Re: [CVE-2023-42755] Linux kernel wild pointer access <= v6.2 (Greg KH <gregkh@...uxfoundation.org>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: mutt 2.2.12 security update (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Andrew Cooper <andrew.cooper3@...rix.com>)
CVE-2023-43040 Ceph: Improperly verified POST keys. ("Sage [They / Them] McTaggart" <amctagga@...hat.com>)
Re: administrative tasks (was: illumos (or at least danmcd) membership in the distros list) (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 27 (2 messages)

Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Demi Marie Obenour <demi@...isiblethingslab.com>)
[CVE-2023-42756] Linux kernel race condition in netfilter (Kyle Zeng <zengyhkyle@...il.com>)

September 28 (7 messages)

Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Jeffrey Walton <noloader@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec (Emilio Pozuelo Monfort <pochu27@...il.com>)
CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2023-41081: Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request [CORRE… (Christopher Schultz <chris@...istophers…)

September 29 (14 messages)

Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (nightmare.yeah27@...ecat.org)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Michael Orlitzky <michael@...itzky.com>)
Multiple Exim4 Zero Days (Markus Gschwendt <office+osssecurity@...out.at>)
Re: Multiple Exim4 Zero Days (Alex Gaynor <alex.gaynor@...il.com>)
Exim4 MTA CVEs assigned from ZDI (Heiko Schlittermann <hs@...marc.schlittermann.de>)
CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK (Ryan Skraba <rskraba@...che.org>)
Re: Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Jeffrey Walton <noloader@...il.com>)
RE: Exim4 MTA CVEs assigned from ZDI ("zdi@...ndmicro.com" <zdi@...ndmicro.com>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Travis Finkenauer <tmfink@...iper.net>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Shawn Webb <shawn.webb@...denedbsd.org>)
3 buffer overflows in gstreamer's gst-plugins-bad before 1.22.6 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Michael Orlitzky <michael@...itzky.com>)

September 30 (5 messages)

Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Dominique Martinet <asmadeus@...ewreck.org>)
Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Steffen Nurpmeso <steffen@...oden.eu>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Michael Orlitzky <michael@...itzky.com>)

122 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.