oss-security mailing list - 2024/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2024/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 2	³ 7	⁴ 4	⁵ 1	⁶ 4	⁷ 3	⁸
⁹ 1	¹⁰	¹¹ 2	¹²	¹³	¹⁴	¹⁵
¹⁶	¹⁷ 2	¹⁸	¹⁹	²⁰ 1	²¹ 1	²²
²³ 2	²⁴ 4	²⁵ 8	²⁶ 7	²⁷ 8	²⁸	²⁹ 1
³⁰

Messages by day:

September 2 (2 messages)

Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() ("2639161967" <2639161967@...com>)
Re: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() (Solar Designer <solar@...nwall.com>)

September 3 (7 messages)

CVE-2024-45310: runc can be tricked into creating empty files/directories on host (Aleksa Sarai <cyphar@...har.com>)
Re: CVE-2024-45310: runc can be tricked into creating empty files/directories on host ("Mike O'Connor" <mjo@...o.mi.org>)
Django CVE-2024-45230 and CVE-2024-45231 (Natalia Bidart <nataliabidart@...ngoproject.com>)
CVE-2024-6119: OpenSSL: Possible denial of service in X.509 name checks (Tomas Mraz <tomas@...nssl.org>)
CPython: [CVE-2024-6232] Regular-expression DoS when parsing TarFile headers (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2024-45195: Apache OFBiz: Confused controller-view authorization logic (forced browsing) (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-45507: Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE (Jacques Le Roux <jleroux@...che.org>)

September 4 (4 messages)

Webmin UDP/10000 discovery service Loop DoS (COK-2024-05-05) (Sergei G <serg.gordey@...il.com>)
Re: CVE-2024-45310: runc can be tricked into creating empty files/directories on host (Aleksa Sarai <cyphar@...har.com>)
CVE-2024-43402: Rust before 1.81.0 didn't fully fix argument escaping for batch files ("Pietro Albini" <pietro@...troalbini.org>)
[OSSA-2024-003] OpenStack Ironic: Unvalidated image data passed to qemu-img (CVE-2024-44082) (Brian Rosmaita <rosmaita.fossdev@...il.com>)

September 5 (1 message)

Go 1.23.1 and Go 1.22.7 released with 3 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 6 (4 messages)

Re: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() (Michael Ellerman <mpe@...erman.id.au>)
CVE-2024-45498: Apache Airflow: Command Injection in an example DAG (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2024-45034: Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2024-7012, CVE-2024-7923: Authentication bypass in Foreman & Pulpcore (Christian Hoffmann <christian@...fie.info>)

September 7 (3 messages)

libpcap 1.10.5 released with two security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2024-45751: CHAP authentication bypass in user-space Linux target framework (tgt) up to v1.0.92 (David Gstir <david@...ma-star.at>)
Security fixes available in Python 3.13.0RC2, 3.12.6, 3.11.10, 3.10.15, 3.9.20, and 3.8.20 (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 9 (1 message)

CVE-2024-6655 Library injection from CWD in GTK-2/GTK-3 (Dimitrios Glynos <dglynos.pub@...il.com>)

September 11 (2 messages)

[SECURITY ADVISORY] curl: CVE-2024-8096: OCSP stapling bypass with GnuTLS (Daniel Stenberg <daniel@...x.se>)
CVE-2024-22399: Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server (Min Ji <jimin@...che.org>)

September 17 (2 messages)

CVE-2024-45384: Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cook… (Karan Kumar <karan@...che.org>)
CVE-2024-45537: Apache Druid: Users can provide MySQL JDBC properties not on allow list (Karan Kumar <karan@...che.org>)

September 20 (1 message)

Performance Co-Pilot (PCP): pmcd network daemon security issues and review results (CVE-2024-45769), (CVE-2024-45770) (Matthias Gerstner <mgerstner@...e.de>)

September 21 (1 message)

CVE-2024-42323: Apache HertzBeat: RCE by snakeYaml deser load malicious xml (Chao Gong <gongchao@...che.org>)

September 23 (2 messages)

CVE-2024-46544: Apache Tomcat Connectors: mod_jk: local users can view and modify configuration (Mark Thomas <markt@...che.org>)
CVE-2024-38286: Apache Tomcat: Denial of Service (Mark Thomas <markt@...che.org>)

September 24 (4 messages)

Xen Security Advisory 462 v2 (CVE-2024-45817) - x86: Deadlock in vlapic_error() (Xen.org security team <security@....org>)
CVE-2024-39928: Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability (Heping Wang <peacewong@...che.org>)
CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length (Joel GUITTET <jguittet@...ekio.com>)
Re: CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length (Solar Designer <solar@...nwall.com>)

September 25 (8 messages)

CVE-2024-23454: Apache Hadoop: Temporary File Local Information Disclosure (Shilun Fan <slfan1989@...che.org>)
CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Enxin Xie <linkinstar@...che.org>)
Re: CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length (Sandipan Roy <saroy@...hat.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2024-0005 (Adrian Perez de Castro <aperez@...lia.com>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Solar Designer <solar@...nwall.com>)
RE: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses ("Goldberg, Adam" <Adam.Goldberg@...y.com>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Jeffrey Walton <noloader@...il.com>)

September 26 (7 messages)

Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (LinkinStar <linkinstar@...che.org>)
CVE-2024-47197: Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published … (Slawomir Jaranowski <sjaranowski@...che…)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Fabian Bäumer <fabian.baeumer@....de>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Solar Designer <solar@...nwall.com>)
CUPS printing system vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: CUPS printing system vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CUPS printing system vulnerabilities (Solar Designer <solar@...nwall.com>)

September 27 (8 messages)

Re: CUPS printing system vulnerabilities (Zdenek Dohnal <zdohnal@...hat.com>)
Re: CUPS printing system vulnerabilities (Mark Esler <mark.esler@...onical.com>)
Re: CUPS printing system vulnerabilities (Michael Sweet <msweet@...eet.org>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Alexander Patrakov <patrakov@...il.com>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Fabian Bäumer <fabian.baeumer@....de>)
Re: CUPS printing system vulnerabilities (Will Dormann <will.dormann@...lygence.com>)
Re: List linux CVEs for a given stable release? (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)
Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Sam Bull <9m199i@...bull.org>)

September 29 (1 message)

CVE-2024-45772: Apache Lucene Replicator: Deserialization of Untrusted Data (Robert Muir <rmuir@...che.org>)

58 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.