oss-security mailing list - 2024/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2024/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 2	³ 7	⁴ 4	⁵ 1	⁶ 4	⁷ 3	⁸
⁹ 1	¹⁰	¹¹ 2	¹²	¹³	¹⁴	¹⁵
¹⁶	¹⁷ 2	¹⁸	¹⁹	²⁰	²¹	²²
²³	²⁴	²⁵	²⁶	²⁷	²⁸	²⁹
³⁰

Messages by day:

September 2 (2 messages)

Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() ("2639161967" <2639161967@...com>)
Re: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() (Solar Designer <solar@...nwall.com>)

September 3 (7 messages)

CVE-2024-45310: runc can be tricked into creating empty files/directories on host (Aleksa Sarai <cyphar@...har.com>)
Re: CVE-2024-45310: runc can be tricked into creating empty files/directories on host ("Mike O'Connor" <mjo@...o.mi.org>)
Django CVE-2024-45230 and CVE-2024-45231 (Natalia Bidart <nataliabidart@...ngoproject.com>)
CVE-2024-6119: OpenSSL: Possible denial of service in X.509 name checks (Tomas Mraz <tomas@...nssl.org>)
CPython: [CVE-2024-6232] Regular-expression DoS when parsing TarFile headers (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2024-45195: Apache OFBiz: Confused controller-view authorization logic (forced browsing) (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-45507: Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE (Jacques Le Roux <jleroux@...che.org>)

September 4 (4 messages)

Webmin UDP/10000 discovery service Loop DoS (COK-2024-05-05) (Sergei G <serg.gordey@...il.com>)
Re: CVE-2024-45310: runc can be tricked into creating empty files/directories on host (Aleksa Sarai <cyphar@...har.com>)
CVE-2024-43402: Rust before 1.81.0 didn't fully fix argument escaping for batch files ("Pietro Albini" <pietro@...troalbini.org>)
[OSSA-2024-003] OpenStack Ironic: Unvalidated image data passed to qemu-img (CVE-2024-44082) (Brian Rosmaita <rosmaita.fossdev@...il.com>)

September 5 (1 message)

Go 1.23.1 and Go 1.22.7 released with 3 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 6 (4 messages)

Re: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() (Michael Ellerman <mpe@...erman.id.au>)
CVE-2024-45498: Apache Airflow: Command Injection in an example DAG (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2024-45034: Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2024-7012, CVE-2024-7923: Authentication bypass in Foreman & Pulpcore (Christian Hoffmann <christian@...fie.info>)

September 7 (3 messages)

libpcap 1.10.5 released with two security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2024-45751: CHAP authentication bypass in user-space Linux target framework (tgt) up to v1.0.92 (David Gstir <david@...ma-star.at>)
Security fixes available in Python 3.13.0RC2, 3.12.6, 3.11.10, 3.10.15, 3.9.20, and 3.8.20 (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 9 (1 message)

CVE-2024-6655 Library injection from CWD in GTK-2/GTK-3 (Dimitrios Glynos <dglynos.pub@...il.com>)

September 11 (2 messages)

[SECURITY ADVISORY] curl: CVE-2024-8096: OCSP stapling bypass with GnuTLS (Daniel Stenberg <daniel@...x.se>)
CVE-2024-22399: Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server (Min Ji <jimin@...che.org>)

September 17 (2 messages)

CVE-2024-45384: Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cook… (Karan Kumar <karan@...che.org>)
CVE-2024-45537: Apache Druid: Users can provide MySQL JDBC properties not on allow list (Karan Kumar <karan@...che.org>)

26 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.