oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2024/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	²	³ 1
⁴	⁵	⁶ 6	⁷ 7	⁸ 5	⁹ 2	¹⁰ 4
¹¹	¹² 11	¹³ 2	¹⁴	¹⁵ 1	¹⁶ 7	¹⁷ 1
¹⁸ 6	¹⁹ 1	²⁰ 2	²¹	²² 1	²³	²⁴ 1
²⁵ 5	²⁶ 6	²⁷ 3	²⁸ 3	²⁹ 3	³⁰ 6

Messages by day:

November 1 (3 messages)

Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) (Alexander Patrakov <patrakov@...il.com>)
Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mpg123 buffer overflow in versions before 1.32.8 (Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)

November 3 (1 message)

CVE-2024-23590: Apache Kylin: Session fixation in web interface (Li Yang <liyang@...che.org>)

November 6 (6 messages)

shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
[SECURITY ADVISTORY] curl: CVE-2024-9681 HSTS subdomain overwrites parent cache entry (Daniel Stenberg <daniel@...x.se>)
Re: shell wildcard expansion (un)safety ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: shell wildcard expansion (un)safety (Eli Schwartz <eschwartz@...too.org>)
CVE-2024-51504: Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server (Andor Molnar <andor@...che.org>)
Re: shell wildcard expansion (un)safety (Fay Stegerman <flx@...usk.net>)

November 7 (7 messages)

Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
Re: shell wildcard expansion (un)safety (Jakub Wilk <jwilk@...lk.net>)
Re: shell wildcard expansion (un)safety (Max Nikulin <manikulin@...il.com>)
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: shell wildcard expansion (un)safety (Mats Wichmann <mats@...hmann.us>)

November 8 (5 messages)

Re: shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
Re: CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777 (Solar Designer <solar@...nwall.com>)
Re: shell wildcard expansion (un)safety (Georgi Guninski <gguninski@...il.com>)
CVE-2024-50378: Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli (Ephraim Anierobi <ephraimanierobi@...che.org>)

November 9 (2 messages)

Re: shell wildcard expansion (un)safety (Dominik Czarnota <dominik.b.czarnota@...il.com>)
4 recent security bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 10 (4 messages)

Re: shell wildcard expansion (un)safety (Eli Schwartz <eschwartz@...too.org>)
Re: shell wildcard expansion (un)safety (lists@...atla.org.uk)
Re: shell wildcard expansion (un)safety (Jeroen Roovers <jer@...all.nl>)
Re: shell wildcard expansion (un)safety (Fay Stegerman <flx@...usk.net>)

November 12 (11 messages)

Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables (Xen.org security team <security@....org>)
Xen Security Advisory 463 v2 (CVE-2024-45818) - Deadlock in x86 HVM standard VGA handling (Xen.org security team <security@....org>)
CVE-2024-50386: Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure (Daniel Augusto Veronezi Salvador <gutoveronezi…)
Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Solar Designer <solar@...nwall.com>)
Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Clemens Lang <cllang@...hat.com>)
RE: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Joel GUITTET <jguittet.opensource@...ekio.com>)
Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: 4 recent security bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: shell wildcard expansion (un)safety (Ali Polatel <alip@...sys.org>)
Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2024-52533: Buffer overflow in socks proxy code in glib < 2.82.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 13 (2 messages)

[ANNOUNCE] Apache Traffic Server is vulnerable to specific user inputs (Masakazu Kitajo <maskit@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

November 15 (1 message)

CVE-2024-45784: Apache Airflow: Sensitive configuration values are not masked in the logs by default (Ephraim Anierobi <ephraimanierobi@...che.org>)

November 16 (7 messages)

Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2024-48962: Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF lea… (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-47208: Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-45505: Apache HertzBeat (incubating): Exists Native Deser RCE and file writing vulnerabilities (Chao Gong <gongchao@...che.org>)
CVE-2024-45791: Apache HertzBeat: Exposure sensitive token via http GET method with query string (Chao Gong <gongchao@...che.org>)
CVE-2024-41151: Apache HertzBeat: RCE by notice template injection vulnerability (Chao Gong <gongchao@...che.org>)
PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 (Solar Designer <solar@...nwall.com>)

November 17 (1 message)

Re: PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 (Solar Designer <solar@...nwall.com>)

November 18 (6 messages)

Re: shell wildcard expansion (un)safety (Sean Whitton <spwhitton@...hitton.name>)
CVE-2024-52316: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (Mark Thomas <markt@...che.org>)
CVE-2024-52317: Apache Tomcat: Request/response mix-up with HTTP/2 (Mark Thomas <markt@...che.org>)
CVE-2024-52318: Apache Tomcat: Incorrect JSP tag recycling leads to XSS (Mark Thomas <markt@...che.org>)
CVE-2024-31141: Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider (Greg Harris <gharris@...che.org>)
Fwd: wget-1.25.0 released [fixes CVE-2024-10524] (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 19 (1 message)

Local Privilege Escalations in needrestart (Qualys Security Advisory <qsa@...lys.com>)

November 20 (2 messages)

[kubernetes] CVE-2024-10220: Arbitrary command execution through gitRepo volume (Craig Ingram <cjingram@...gle.com>)
CVE-2024-52067: Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log (David Handermann <exceptionfactory@...che.org>)

November 22 (1 message)

CVE-2024-45719: Apache Answer: Predictable Authorization Token Using UUIDv1 (Enxin Xie <linkinstar@...che.org>)

November 24 (1 message)

Re: Article: State of Sandboxing in Linux (Mickaël Salaün <mic@...ikod.net>)

November 25 (5 messages)

Re: Article: State of Sandboxing in Linux (Evan Carroll <me@...ncarroll.com>)
Re: Article: State of Sandboxing in Linux (Eli Schwartz <eschwartz@...too.org>)
Re: Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
Re: Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
Re: Article: State of Sandboxing in Linux (Evan Carroll <me@...ncarroll.com>)

November 26 (6 messages)

Re: Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
CVE-2024-47248: Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack (Szymon Janc <janc@...che.org>)
CVE-2024-47249: Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler (Szymon Janc <janc@...che.org>)
CVE-2024-47250: Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access (Szymon Janc <janc@...che.org>)
CVE-2024-51569: Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event … (Szymon Janc <janc@...che.org>)
Re: Local Privilege Escalations in needrestart (Mark Esler <mark.esler@...onical.com>)

November 27 (3 messages)

authentik: remote timing attack in MetricsView HTTP Basic Auth (CVE-2024-52307) (Matthias Gerstner <mgerstner@...e.de>)
WebKitGTK and WPE WebKit Security Advisory WSA-2024-0007 (Adrian Perez de Castro <aperez@...lia.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

November 28 (3 messages)

tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-523… (Matthias Gerstner <mgerstner@...e.de>)
Re: tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-523… (Simon McVittie <smcv@...ian.org>)
CVE-2024-52338: Apache Arrow R package: Arbitrary code execution when loading a malicious data file (Dewey Dunnington <paleolimbot@...che.org>)

November 29 (3 messages)

Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Solar Designer <solar@...nwall.com>)
Re: tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-202… (Matthias Gerstner <mgerstner@...e.de>)
stalld: unpatched fixed temporary file use and other issues (Matthias Gerstner <mgerstner@...e.de>)

November 30 (6 messages)

Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Luiz Augusto von Dentz <luiz.dentz@...il.com>)
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (tianshu qiu <jimuchutianshu97@...il.com>)
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Solar Designer <solar@...nwall.com>)
Re: Local Privilege Escalations in needrestart (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (tianshu qiu <jimuchutianshu97@...il.com>)
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Jeroen Roovers <jer@...all.nl>)

87 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.