oss-security mailing list - 2024/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2024/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 1	⁴ 2	⁵ 1	⁶ 2	⁷ 1	⁸	⁹ 2
¹⁰ 1	¹¹ 1	¹² 5	¹³ 3	¹⁴ 3	¹⁵ 1	¹⁶
¹⁷ 3	¹⁸	¹⁹	²⁰ 1	²¹ 1	²² 1	²³ 3
²⁴ 3	²⁵ 3	²⁶ 2	²⁷ 1	²⁸ 5	²⁹ 1	³⁰

Messages by day:

June 3 (1 message)

CVE-2024-36104: Apache OFBiz: Path traversal leading to a RCE (Jacques Le Roux <jleroux@...che.org>)

June 4 (2 messages)

Go 1.22.4 and Go 1.21.11 released with 2 security fixes (CVE-2024-24789, CVE-2024-24790) (Alan Coopersmith <alan.coopersmith@...cle.com>)
libarchive 3.7.4 released with 2 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 5 (1 message)

Re: libarchive 3.7.4 released with 2 security fixes (Tavis Ormandy <taviso@...il.com>)

June 6 (2 messages)

[SBA-ADV-20240202-01] CVE-2024-5657: CraftCMS Plugin - Two-Factor Authentication 3.3.1 to 3.3.3 - Password Hash Disclos… (SBA Research Security Advisory <advisor…)
[SBA-ADV-20240202-02] CVE-2024-5658: CraftCMS Plugin - Two-Factor Authentication through 3.3.3 - TOTP Token Stays Valid… (SBA Research Security Advisory <advisor…)

June 7 (1 message)

PHP security releases 8.3.8, 8.2.20, and 8.1.29 (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 9 (2 messages)

vte 0.76.3 released with fix for CVE-2024-37535 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: vte 0.76.3 released with fix for CVE-2024-37535 (Solar Designer <solar@...nwall.com>)

June 10 (1 message)

CVE-2024-36471: Apache Allura: sensitive information exposure via DNS rebinding (David Philip Brondsema <brondsem@...che.org>)

June 11 (1 message)

CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777 (Zdenek Dohnal <zdohnal@...hat.com>)

June 12 (5 messages)

CVE-2024-36263: Apache Submarine Server Core: SQL injection (Arnout Engelen <engelen@...che.org>)
CVE-2024-36264: Apache Submarine Commons Utils: default secret (Arnout Engelen <engelen@...che.org>)
CVE-2024-36265: Apache Submarine Server Core: authorization bypass (Arnout Engelen <engelen@...che.org>)
Re: CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777 (Tavis Ormandy <taviso@...il.com>)
Re: Re: CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777 (Matthew Fernandez <matthew.fernandez@...il.com>)

June 13 (3 messages)

CVE-2024-25142: Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache (Jarek Potiuk <potiuk@...che.org>)
Re: Security vulnerability in fprintd (Marco Trevisan <mail@...n0.net>)
Re: Security vulnerability in fprintd (Mark Esler <mark.esler@...onical.com>)

June 14 (3 messages)

Re: Security vulnerability in fprintd (Yaron Shahrabani <sh.yaron@...il.com>)
Re: Security vulnerability in fprintd (Benjamin Cance <wireless.insecurity@...il.com>)
Re: Security vulnerability in fprintd (Mark Esler <mark.esler@...onical.com>)

June 15 (1 message)

iTerm2 3.5.x title reporting bug (David Leadbeater <dgl@....cx>)

June 17 (3 messages)

Re: iTerm2 3.5.x title reporting bug (David Leadbeater <dgl@....cx>)
Fwd: [Security-announce][CVE-2024-0397] Memory race condition in ssl.SSLContext certificate store methods (Alan Coopersmith <alan.coopersmith@...cle.com>)
Fwd: [Security-announce][CVE-2024-4032] Incorrect IPv4 and IPv6 private ranges (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 20 (1 message)

CVE-2024-34693: Apache Superset: Server arbitrary file read (Daniel Gaspar <dpgaspar@...che.org>)

June 21 (1 message)

CVE-2024-38379: Apache Allura: Stored authenticated XSS (David Philip Brondsema <brondsem@...che.org>)

June 22 (1 message)

CVE-2024-29868: Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) … (Dominik Riemer <riemer@...che.org>)

June 23 (3 messages)

Arbitrary shell command evaluation in Org mode (GNU Emacs) (Ihor Radchenko <yantar92@...teo.net>)
Re: Arbitrary shell command evaluation in Org mode (GNU Emacs) (Russ Allbery <eagle@...ie.org>)
CVE-2024-27136: Apache JSPWiki: Cross-site scripting vulnerability on upload page (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)

June 24 (3 messages)

Re: Arbitrary shell command evaluation in Org mode (GNU Emacs) (Florian Weimer <fweimer@...hat.com>)
Re: Arbitrary shell command evaluation in Org mode (GNU Emacs) (Russ Allbery <eagle@...ie.org>)
Re: Out-of-bounds read & write in the glibc's qsort() (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)

June 25 (3 messages)

Re: Out-of-bounds read & write in the glibc's qsort() (Qualys Security Advisory <qsa@...lys.com>)
Fwd: Node.js security updates for all active release lines, July 2024 (Rafael Gonzaga <work@...aelgss.dev>)
Fwd: [siren] Reputation Farming Using Closed Github Issues / PRs (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 26 (2 messages)

Re: Fwd: Node.js security updates for all active release lines, July 2024 (Solar Designer <solar@...nwall.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

June 27 (1 message)

CVE-2024-5535: OpenSSL: SSL_select_next_proto buffer overread (Solar Designer <solar@...nwall.com>)

June 28 (5 messages)

Indirector: High-Precision Branch Target Injection Attacks Exploiting the Indirect Branch Predictor (Alan Coopersmith <alan.coopersmith@...cle.com>)
Ghostscript 10.03.1 (2024-05-02) fixed 5 CVEs including CVE-2024-33871 arbitrary code execution (Solar Designer <solar@...nwall.com>)
Re: Fwd: [siren] Reputation Farming Using Closed Github Issues / PRs (Solar Designer <solar@...nwall.com>)
Fwd: [Security-announce][CVE-2024-5642] Buffer over-read in SSLContext.set_npn_protocols() for Python 3.9 and earlier (Alan Coopersmith <alan.coopersmith@...cl…)
Kerberos 1.21.3 fixes vulnerabilities in GSS message token handling (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 29 (1 message)

Linux non-security almost non-issue: stack-out-of-bounds Read in profile_pc (Solar Designer <solar@...nwall.com>)

47 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.