oss-security mailing list - 2024/12

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2024/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 1
² 1	³ 1	⁴ 3	⁵	⁶ 1	⁷	⁸
⁹ 4	¹⁰	¹¹ 2	¹² 1	¹³ 1	¹⁴	¹⁵
¹⁶	¹⁷ 6	¹⁸ 3	¹⁹ 1	²⁰ 1	²¹ 3	²² 1
²³ 6	²⁴ 2	²⁵ 3	²⁶ 2	²⁷	²⁸ 1	²⁹
³⁰	³¹

Messages by day:

December 1 (1 message)

Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (tianshu qiu <jimuchutianshu97@...il.com>)

December 2 (1 message)

CVE-2024-45106: Apache Ozone: Improper authentication when generating S3 secrets (Ethan Rose <erose@...che.org>)

December 3 (1 message)

[OSSA-2024-005] Neutron: Authorization bypassed when setting tags on Neutron networks (CVE-2024-53916) (Jay Faulkner <jay@....cc>)

December 4 (3 messages)

Re: Local Privilege Escalations in needrestart (Jakub Wilk <jwilk@...lk.net>)
CVE-2022-41137: Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore (Stamatis Zampetakis <zabetak@...che.org>)
Django CVE-2024-53907 and CVE-2024-53908 (Sarah Boyce <sarahboyce@...ngoproject.com>)

December 6 (1 message)

Fwd: [Security-announce][CVE-2024-12254] Unbounded memory buffering in SelectorSocketTransport.writelines() (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 9 (4 messages)

[SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released (Daniel Sahlberg <dsahlberg@...che.org>)
CVE-2024-53947: Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2024-53948: Apache Superset: Error verbosity exposes metadata in analytics databases (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2024-53949: Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled (Daniel Gaspar <dpgaspar@...che.org>)

December 11 (2 messages)

[SECURITY ADVISORY] curl: CVE-2024-11053: netrc and redirect credential leak (Daniel Stenberg <daniel@...x.se>)
Vulnerability in golang.org/x/crypto [CVE-2024-45337: misuse of ServerConfig.PublicKeyCallback may cause authorization … (Jan Schaumann <jschauma@...meister.org>)

December 12 (1 message)

CVE-2024-55633: Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access (Daniel Gaspar <dpgaspar@...che.org>)

December 13 (1 message)

GStreamer 1.24.10 stable security bug-fix release (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 17 (6 messages)

Xen Security Advisory 465 v3 (CVE-2024-53240) - Backend can crash Linux netfront (Xen.org security team <security@....org>)
Xen Security Advisory 466 v3 (CVE-2024-53241) - Xen hypercall page unsafe against speculative attacks (Xen.org security team <security@....org>)
CVE-2024-11614: DPDK Vhost Rx checksum vulnerability (Maxime Coquelin <maxime.coquelin@...hat.com>)
CVE-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation (Mark Thomas <markt@...che.org>)
CVE-2024-54677: Apache Tomcat: DoS in examples web application (Mark Thomas <markt@...che.org>)
Re: CVE-2024-54677: Apache Tomcat: DoS in examples web application (Agostino Sarubbo <ago@...too.org>)

December 18 (3 messages)

Re: CVE-2024-54677: Apache Tomcat: DoS in examples web application (Mark Thomas <markt@...che.org>)
Re: CVE-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation (Nick Boyce <nick.boyce@...il.com>)
CVE-2024-56128: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption (Manikumar <manikumar@...che.org>)

December 19 (1 message)

SSSD: Weaknesses in Privilege Separation due to Issues in Privileged Helper Programs (Matthias Gerstner <mgerstner@...e.de>)

December 20 (1 message)

CVE-2024-56337: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete (Mark Thomas <markt@...che.org>)

December 21 (3 messages)

Fwd: Operational Notification: BIND 9.20 defect in QPzone implementation (Solar Designer <solar@...nwall.com>)
Re: Out-of-bounds read & write in the glibc's qsort() (Yuri Gribov <tetra2005@...il.com>)
Re: Re: Out-of-bounds read & write in the glibc's qsort() (Jan Engelhardt <ej@...i.de>)

December 22 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0008 (Adrian Perez de Castro <aperez@...lia.com>)

December 23 (6 messages)

Re: Xen Security Advisory 466 v3 (CVE-2024-53241) - Xen hypercall page unsafe against speculative attacks (David Woodhouse <dwmw2@...radead.org>)
CVE-2024-23945: Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails (Stamatis Zampetakis <zabetak@...che.org>)
CVE-2024-45387: Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments (Eric Friedrich <friede@...che.org>)
Re: Re: Out-of-bounds read & write in the glibc's qsort() (Florian Weimer <fweimer@...hat.com>)
Re: Re: Out-of-bounds read & write in the glibc's qsort() (Florian Weimer <fweimer@...hat.com>)
Re: Re: Out-of-bounds read & write in the glibc's qsort() (Yuri Gribov <tetra2005@...il.com>)

December 24 (2 messages)

Re: Re: Out-of-bounds read & write in the glibc's qsort() (Yuri Gribov <tetra2005@...il.com>)
CVE-2024-43441: Apache HugeGraph-Server: Fixed JWT Token(Secret) (Imba Jin <jin@...che.org>)

December 25 (3 messages)

CVE-2024-52046: Apache MINA: MINA applications using unbounded deserialization may allow RCE (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2024-40896 Analysis: libxml2 XXE due to type confusion (Yair Mizrahi <yairm@...og.com>)
Re: CVE-2024-40896 Analysis: libxml2 XXE due to type confusion (Solar Designer <solar@...nwall.com>)

December 26 (2 messages)

Re: CVE-2024-40896 Analysis: libxml2 XXE due to type confusion (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2024-40896 Analysis: libxml2 XXE due to type confusion (Solar Designer <solar@...nwall.com>)

December 28 (1 message)

CVE-2024-56512: Apache NiFi: Missing Complete Authorization for Parameter and Service References (David Handermann <exceptionfactory@...che.org>)

44 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.