oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2024/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 3	²	³ 7	⁴ 1	⁵ 2	⁶	⁷
⁸ 2	⁹ 1	¹⁰ 2	¹¹	¹² 3	¹³	¹⁴
¹⁵ 3	¹⁶ 5	¹⁷	¹⁸ 4	¹⁹ 3	²⁰ 1	²¹
²² 2	²³ 6	²⁴ 10	²⁵ 3	²⁶ 3	²⁷	²⁸ 1
²⁹ 1	³⁰ 10	³¹ 7

Messages by day:

January 1 (3 messages)

Re: CVE-2023-51766: Exim: SMTP smuggling (halfdog <me@...fdog.net>)
Re: CVE-2023-51766: Exim: SMTP smuggling (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2023-51766: Exim: SMTP smuggling (Jeffrey Walton <noloader@...il.com>)

January 3 (7 messages)

CVE-2023-51784: Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-51785: Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-47804: Apache OpenOffice: Macro URL arbitrary script execution (Arrigo Marchiori <ardovm@...che.org>)
CVE-2023-1183: Apache OpenOffice: Arbitrary file write in Apache OpenOffice Base (Arrigo Marchiori <ardovm@...che.org>)
CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat (Arrigo Marchiori <ardovm@...che.org>)
CVE-2012-5639: Apache OpenOffice: Loading internal / external resources without warning (Arrigo Marchiori <ardovm@...che.org>)
Re: CVE-2012-5639: Apache OpenOffice: Loading internal / external resources without warning (Timo Warns <timo.warns@...il.com>)

January 4 (1 message)

Re: hplip: security issues in `hpps` program due to fixed /tmp path usage in prnt/hpps/hppsfilter.c (Matthias Gerstner <mgerstner@...e.de>)

January 5 (2 messages)

Re: Security vulnerability in Debian's cpio 2.13 (Mark Esler <mark.esler@...onical.com>)
CVE-2023-51441: Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API (Arnout Engelen <engelen@...che.org>)

January 8 (2 messages)

Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Eddie Chapman <eddie@...k.net>)

January 9 (1 message)

OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)

January 10 (2 messages)

CVE-2023-49619: Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions… (Enxin Xie <linkinstar@...che.org>)
CVE-2024-22368: Spreadsheet::ParseXLSX for Perl is vulnerable to DoS via out-of-memory bugs (Stig Palmquist <stig@...g.io>)

January 12 (3 messages)

CVE-2023-6040: Linux Kernel netfilter out-of-bounds access (Cengiz Can <cengiz.can@...onical.com>)
CVE-2023-46749: Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an … (Brian Demers <bdemers@...che.org>)
CVE-2023-50290: Apache Solr: Host environment variables are published via the Metrics API (Houston Putman <houston@...che.org>)

January 15 (3 messages)

CVE-2023-46226: Apache IoTDB: Remote Code Execution (RCE) risk via the UDF (Haonan Hou <haonan@...che.org>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
CVE-2023-4001: a password bypass vulnerability in the downstream GRUB boot manager (Maxim Suhanov <dfirblog@...il.com>)

January 16 (5 messages)

CVE-2023-6395 Mock: Privilege escalation for users that can access mock configuration (Marco Benatto <mbenatto@...hat.com>)
CVE-2023-45229 and others: Multiple vulnerabilities in EDK II UEFI stack (PixieFAIL) (Valtteri Vuorikoski <vuori@...com.org>)
Mock, Snap, LXC expose(d) chroot, container trees with unsafe permissions and contents to host users, pose risk to host (Solar Designer <solar@...nwall.com>)
Re: Mock, Snap, LXC expose(d) chroot, container trees with unsafe permissions and contents to host users, pose risk to host (Willy Tarreau <w@....eu>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)

January 18 (4 messages)

Fwd: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.11 and Xwayland prior to 23.2.4 (Jose Exposito Quintana <jexposit@...hat.com>)
GNU coreutils v9.4; v9.3; v9.2 split heap buffer overflow vulnerability (Valentin Metz <valentin.metz@....de>)
pam: pam_namespace misses O_DIRECTORY flag in `protect_dir()` (CVE-2024-22365) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2024-23525: Spreadsheet::ParseXLSX for Perl is vulnerable to XXE attacks (Stig Palmquist <stig@...g.io>)

January 19 (3 messages)

Re: GNU coreutils v9.4; v9.3; v9.2 split heap buffer overflow vulnerability (Valentin Metz <valentin.metz@....de>)
CVE-2024-21733: Apache Tomcat: Leaking of unrelated request bodies in default error page (Mark Thomas <markt@...che.org>)
GnuTLS 3.8.3 released, fixes CVE-2024-0553 & CVE-2024-0567 (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 20 (1 message)

Pillow 10.2.0 released, fixes CVE-2023-50447 (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 22 (2 messages)

Postfix updated SMTP smuggling countermeasure (Solar Designer <solar@...nwall.com>)
Xen Security Advisory 448 v2 (CVE-2023-46838) - Linux: netback processing of zero-length transmit fragment (Xen.org security team <security@....org>)

January 23 (6 messages)

Re: announcing sponsorship; distros list statistics for 2023 (Solar Designer <solar@...nwall.com>)
darkhttpd: timing attack and local leak of HTTP basic auth credentials (Matthias Gerstner <mgerstner@...e.de>)
CVE-2023-49657: Apache Superset: Stored XSS in Dashboard Title and Chart Title (Daniel Gaspar <dpgaspar@...che.org>)
Re: Postfix updated SMTP smuggling countermeasure (Wietse Venema <wietse@...cupine.org>)
Re: CVE-2023-49657: Apache Superset: Stored XSS in Dashboard Title and Chart Title (Christian Fischer <christian.fischer@...enbone.net>)
Re: Re: Postfix updated SMTP smuggling countermeasure (Alexander Burke <alex@...xburke.ca>)

January 24 (10 messages)

Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials (Hanno Böck <hanno@...eck.de>)
Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials (Johannes Segitz <jsegitz@...e.de>)
CVE-2023-51702: Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without en… (Ephraim Anierobi <ephraimanierobi@...ch…)
CVE-2023-50943: Apache Airflow: Potential pickle deserialization vulnerability in XComs (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-50944: Apache Airflow: Bypass permission verification to read code of other dags (Ephraim Anierobi <ephraimanierobi@...che.org>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials (nightmare.yeah27@...ecat.org)
Re: Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials (Anton Luka Šijanec <anton@...anec.eu>)
Re: Fwd: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2023-45853: overflows in MiniZip in zlib through 1.3 (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 25 (3 messages)

Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials (Matthias Gerstner <mgerstner@...e.de>)
OpenSSL Security Advisory (Matt Caswell <matt@...nssl.org>)
Re: OpenSSL Security Advisory (sjw@....ch)

January 26 (3 messages)

shim 15.8 released with 6 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Numerous unconfirmed FOSS CVEs disclosed on FD mailing list (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Numerous unconfirmed FOSS CVEs disclosed on FD mailing list (Matthew Fernandez <matthew.fernandez@...il.com>)

January 28 (1 message)

Re: Numerous unconfirmed FOSS CVEs disclosed on FD mailing list (Christian Brabandt <cb@...bit.org>)

January 29 (1 message)

CVE-2023-29055: Apache Kylin: Insufficiently protected credentials in config file (Li Yang <liyang@...che.org>)

January 30 (10 messages)

Xen Security Advisory 449 v2 (CVE-2023-46839) - pci: phantom functions assigned to incorrect contexts (Xen.org security team <security@....org>)
Xen Security Advisory 450 v2 (CVE-2023-46840) - VT-d: Failure to quarantine devices in !HVM builds (Xen.org security team <security@....org>)
FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Armin Kuster <akuster@...sta.com>)
Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Solar Designer <solar@...nwall.com>)
Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Greg KH <greg@...ah.com>)
CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() (Qualys Security Advisory <qsa@...lys.com>)
Out-of-bounds read & write in the glibc's qsort() (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Solar Designer <solar@...nwall.com>)
Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Greg KH <greg@...ah.com>)

January 31 (7 messages)

[SECURITY ADVISORY] curl: CVE-2024-0853 : OCSP verification bypass with TLS session reuse (Daniel Stenberg <daniel@...x.se>)
Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631 (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2023-44313: Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend API ("bismy" <bismy@...com>)
CVE-2023-44312: Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center server ("bismy" <bismy@...com>)
runc: CVE-2024-21626: high severity container breakout attack (Aleksa Sarai <cyphar@...har.com>)
Re: TTY handling when executing code in different lower-privileged context (su, virt containers) (Jakub Wilk <jwilk@...lk.net>)

80 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.