oss-security mailing list - 2024/11

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2024/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	²	³ 1
⁴	⁵	⁶ 6	⁷ 7	⁸ 5	⁹ 2	¹⁰ 4
¹¹	¹² 11	¹³ 2	¹⁴	¹⁵ 1	¹⁶ 7	¹⁷ 1
¹⁸ 6	¹⁹ 1	²⁰ 2	²¹	²²	²³	²⁴
²⁵	²⁶	²⁷	²⁸	²⁹	³⁰

Messages by day:

November 1 (3 messages)

Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) (Alexander Patrakov <patrakov@...il.com>)
Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)

November 3 (1 message)

CVE-2024-23590: Apache Kylin: Session fixation in web interface (Li Yang <liyang@...che.org>)

November 6 (6 messages)

shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
[SECURITY ADVISTORY] curl: CVE-2024-9681 HSTS subdomain overwrites parent cache entry (Daniel Stenberg <daniel@...x.se>)
Re: shell wildcard expansion (un)safety ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: shell wildcard expansion (un)safety (Eli Schwartz <eschwartz@...too.org>)
CVE-2024-51504: Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server (Andor Molnar <andor@...che.org>)
Re: shell wildcard expansion (un)safety (Fay Stegerman <flx@...usk.net>)

November 7 (7 messages)

Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
Re: shell wildcard expansion (un)safety (Jakub Wilk <jwilk@...lk.net>)
Re: shell wildcard expansion (un)safety (Max Nikulin <manikulin@...il.com>)
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: shell wildcard expansion (un)safety (Mats Wichmann <mats@...hmann.us>)

November 8 (5 messages)

Re: shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777 (Solar Designer <solar@...nwall.com>)
Re: shell wildcard expansion (un)safety (Georgi Guninski <gguninski@...il.com>)
CVE-2024-50378: Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli (Ephraim Anierobi <ephraimanierobi@...che.org>)

November 9 (2 messages)

Re: shell wildcard expansion (un)safety (Dominik Czarnota <dominik.b.czarnota@...il.com>)
4 recent security bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 10 (4 messages)

Re: shell wildcard expansion (un)safety (Eli Schwartz <eschwartz@...too.org>)
Re: shell wildcard expansion (un)safety (lists@...atla.org.uk)
Re: shell wildcard expansion (un)safety (Jeroen Roovers <jer@...all.nl>)
Re: shell wildcard expansion (un)safety (Fay Stegerman <flx@...usk.net>)

November 12 (11 messages)

Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables (Xen.org security team <security@....org>)
Xen Security Advisory 463 v2 (CVE-2024-45818) - Deadlock in x86 HVM standard VGA handling (Xen.org security team <security@....org>)
CVE-2024-50386: Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure (Daniel Augusto Veronezi Salvador <gutoveronezi…)
Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Solar Designer <solar@...nwall.com>)
Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Clemens Lang <cllang@...hat.com>)
RE: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Joel GUITTET <jguittet.opensource@...ekio.com>)
Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: 4 recent security bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: shell wildcard expansion (un)safety (Ali Polatel <alip@...sys.org>)
Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2024-52533: Buffer overflow in socks proxy code in glib < 2.82.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 13 (2 messages)

[ANNOUNCE] Apache Traffic Server is vulnerable to specific user inputs (Masakazu Kitajo <maskit@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

November 15 (1 message)

CVE-2024-45784: Apache Airflow: Sensitive configuration values are not masked in the logs by default (Ephraim Anierobi <ephraimanierobi@...che.org>)

November 16 (7 messages)

Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2024-48962: Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF lea… (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-47208: Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-45505: Apache HertzBeat (incubating): Exists Native Deser RCE and file writing vulnerabilities (Chao Gong <gongchao@...che.org>)
CVE-2024-45791: Apache HertzBeat: Exposure sensitive token via http GET method with query string (Chao Gong <gongchao@...che.org>)
CVE-2024-41151: Apache HertzBeat: RCE by notice template injection vulnerability (Chao Gong <gongchao@...che.org>)
PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 (Solar Designer <solar@...nwall.com>)

November 17 (1 message)

Re: PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 (Solar Designer <solar@...nwall.com>)

November 18 (6 messages)

Re: shell wildcard expansion (un)safety (Sean Whitton <spwhitton@...hitton.name>)
CVE-2024-52316: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (Mark Thomas <markt@...che.org>)
CVE-2024-52317: Apache Tomcat: Request/response mix-up with HTTP/2 (Mark Thomas <markt@...che.org>)
CVE-2024-52318: Apache Tomcat: Incorrect JSP tag recycling leads to XSS (Mark Thomas <markt@...che.org>)
CVE-2024-31141: Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider (Greg Harris <gharris@...che.org>)
Fwd: wget-1.25.0 released [fixes CVE-2024-10524] (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 19 (1 message)

Local Privilege Escalations in needrestart (Qualys Security Advisory <qsa@...lys.com>)

November 20 (2 messages)

[kubernetes] CVE-2024-10220: Arbitrary command execution through gitRepo volume (Craig Ingram <cjingram@...gle.com>)
CVE-2024-52067: Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log (David Handermann <exceptionfactory@...che.org>)

59 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.