oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2024/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹	² 1	³ 6	⁴ 5	⁵ 2	⁶ 1
⁷	⁸ 4	⁹ 1	¹⁰ 1	¹¹	¹² 1	¹³
¹⁴ 2	¹⁵ 9	¹⁶ 1	¹⁷ 1	¹⁸ 2	¹⁹	²⁰
²¹	²²	²³ 1	²⁴ 2	²⁵ 1	²⁶	²⁷
²⁸ 1	²⁹ 2	³⁰ 4	³¹ 4

Messages by day:

October 2 (1 message)

Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

October 3 (6 messages)

CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK) (Martin Tzvetanov Grigorov <mgrigorov@...che.org>)
CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader ("Gary D. Gregory" <ggregory@...che.org>)
PowerDNS Security Advisory 2024-04 (Otto Moerbeek <otto.moerbeek@...erdns.com>)
cups-browsed vulnerable to DDoS amplification attack (Larry Cashdollar <larry0@...com>)
Re: cups-browsed vulnerable to DDoS amplification attack ("Peter van Dijk" <peter@...ts.nl>)
Re: cups-browsed vulnerable to DDoS amplification attack (Larry Cashdollar <larry0@...com>)

October 4 (5 messages)

Re[2]: cups-browsed vulnerable to DDoS amplification attack (larry0@...com)
CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Johannes Segitz <jsegitz@...e.de>)
CVE-2024-42415: Integer Overflow in GNOME libgsf (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2024-42415: Integer Overflow in GNOME libgsf (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2024-8508 in Unbound DNS server prior to 1.21.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 5 (2 messages)

Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Simon Josefsson <simon@...efsson.org>)
OSSA-2024-004 / CVE-2024-47211: OpenStack Ironic <26.1.1 fails to verify checksums of supplied image_source URLs when configured to c… (Jay Faulkner <jay@....cc>)

October 6 (1 message)

[vim-security] use-after-free when closing buffers in Vim < 9.1.0764 (Christian Brabandt <cb@...bit.org>)

October 8 (4 messages)

Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Solar Designer <solar@...nwall.com>)
Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Simon Josefsson <simon@...efsson.org>)
CVE-2024-45720: Apache Subversion: Command line argument injection on Windows platforms (Stefan Sperling <stsp@...che.org>)
Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Solar Designer <solar@...nwall.com>)

October 9 (1 message)

CVE-2024-28168: Apache XML Graphics FOP: XML External Entity (XXE) Processing (Simon Steiner <ssteiner@...che.org>)

October 10 (1 message)

libarchive 3.7.5 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 12 (1 message)

CVE-2024-46911: Apache Roller: Weakness in CSRF protection allows privilege escalation ("David M. Johnson" <snoopdave@...che.org>)

October 14 (2 messages)

[kubernetes] CVE-2024-9486 and CVE-2024-9594: VM images built with Kubernetes Image Builder use default credentials (Joel Smith <joelsmith@...hat.com>)
CVE-2023-50780: Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans (Justin Bertram <jbertram@...che.org>)

October 15 (9 messages)

Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Matthias Gerstner <mgerstner@...e.de>)
CVE-2024-45219: Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrast… (Daniel Augusto Veronezi Salvador <gutov…)
CVE-2024-45461: Apache CloudStack Quota plugin: Access checks not enforced in Quota (Daniel Augusto Veronezi Salvador <gutoveronezi@...che.org>)
CVE-2024-45462: Apache CloudStack: Incomplete session invalidation on web interface logout (Daniel Augusto Veronezi Salvador <gutoveronezi@...che.org>)
CVE-2024-45693: Apache CloudStack: Request origin validation bypass makes account takeover possible (Daniel Augusto Veronezi Salvador <gutoveronezi@...che.org…)
Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Solar Designer <solar@...nwall.com>)
CVE-2024-45216: Apache Solr: Authentication bypass possible using a fake URL Path ending (Houston Putman <houston@...che.org>)
CVE-2024-45217: Apache Solr: ConfigSets created during a backup restore command are trusted implicitly (Houston Putman <houston@...che.org>)

October 16 (1 message)

CVE-2024-9143: OpenSSL: Low-level invalid GF(2^m) parameters lead to OOB memory access (Tomas Mraz <tomas@...nssl.org>)

October 17 (1 message)

Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Matthias Gerstner <mgerstner@...e.de>)

October 18 (2 messages)

Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Steffen Nurpmeso <steffen@...oden.eu>)
Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Solar Designer <solar@...nwall.com>)

October 23 (1 message)

Re: CVE-2024-9143: OpenSSL: Low-level invalid GF(2^m) parameters lead to OOB memory access ("Dr. Christopher Kunz" <info@...istopher-kunz.de>)

October 24 (2 messages)

Re: CVE-2024-9143: OpenSSL: Low-level invalid GF(2^m) parameters lead to OOB memory access ("Dr. Christopher Kunz" <info@...istopher-kunz.de>)
CVE-2024-45031: Apache Syncope: Stored XSS in Console and Enduser (Francesco Chicchiriccò <ilgrosso@...che.org>)

October 25 (1 message)

CVE-2024-9050: NetworkManager-libreswan IPSec VPN plugin local code execution (Lubomir Rintel <lrintel@...hat.com>)

October 28 (1 message)

CVE-2024-45477: Apache NiFi: Improper Neutralization of Input in Parameter Description (David Handermann <exceptionfactory@...che.org>)

October 29 (2 messages)

CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Joel GUITTET <jguittet.opensource@...ekio.com>)
CVE-2024-9632: X.Org X server and Xwayland: Heap-based buffer overflow privilege escalation in _XkbSetCompatMap (Jose Exposito Quintana <jexposit@...hat.com>)

October 30 (4 messages)

Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Jacob Bachmeyer <jcb62281@...il.com>)
mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) (Marco Benatto <mbenatto@...hat.com>)
qBittorrent RCE, Browser Hijacking vulnerabilities (Sec Guy <0xsee4@...il.com>)

October 31 (4 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0006 (Adrian Perez de Castro <aperez@...lia.com>)
CVE-2024-43383: Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator (Paul Irwin <paulirwin@...che.org>)
Re: qBittorrent RCE, Browser Hijacking vulnerabilities (Eli Schwartz <eschwartz@...too.org>)
Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) (Marco Benatto <mbenatto@...hat.com>)

52 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.