oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 3	⁴ 4	⁵ 8	⁶ 7	⁷ 4	⁸	⁹ 1
¹⁰ 1	¹¹ 4	¹² 2	¹³ 5	¹⁴ 8	¹⁵	¹⁶ 3
¹⁷ 2	¹⁸ 4	¹⁹ 1	²⁰ 1	²¹ 5	²² 1	²³
²⁴ 3	²⁵ 1	²⁶ 2	²⁷ 3	²⁸ 2

Messages by day:

February 3 (3 messages)

CVE-2024-27137: Apache Cassandra: unrestricted deserialization of JMX authentication credentials (Paulo Motta <paulo@...che.org>)
CVE-2025-23015: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe a… (Paulo Motta <paulo@...che.org>)
CVE-2025-24860: Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to diff… (Paulo Motta <paulo@...che.org>)

February 4 (4 messages)

Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
CVE-2024-48019: Apache Doris: allows admin users to read arbitrary files through the REST API (Mingyu Chen <morningman@...che.org>)
KL-001-2025-001: Checkmk NagVis Reflected Cross-site Scripting (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2025-002: Checkmk NagVis Remote Code Execution (KoreLogic Disclosures <disclosures@...elogic.com>)

February 5 (8 messages)

[SECURITY ADVISORY] curl: CVE-2025-0167: netrc and default credential leak (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2025-0665: eventfd double close (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2025-0725: gzip integer overflow (Daniel Stenberg <daniel@...x.se>)
Curl SSH Insufficient Host Identity Verification (Harry Sintonen <sintonen@....fi>)
Re: [SECURITY ADVISORY] curl: CVE-2025-0665: eventfd double close (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2024-37358: Apache James: denial of service through the use of IMAP literals (Benoit Tellier <btellier@...che.org>)
CVE-2024-45626: Apache James: denial of service through JMAP HTML to text conversion (Benoit Tellier <btellier@...che.org>)
CVE-2025-23419: nginx: Client certificate authentication bypass with TLSv1.3 and session resumption (Solar Designer <solar@...nwall.com>)

February 6 (7 messages)

Re: AMD Microcode Signature Verification Vulnerability (Jacob Bachmeyer <jcb62281@...il.com>)
Re: [SECURITY ADVISORY] curl: CVE-2025-0725: gzip integer overflow (Daniel Stenberg <daniel@...x.se>)
pam_pkcs11: Possible Authentication Bypass in Error Situations (CVE-2025-24531) (Matthias Gerstner <mgerstner@...e.de>)
Re: [SECURITY ADVISORY] curl: CVE-2025-0725: gzip integer overflow (Fay Stegerman <flx@...usk.net>)
Linux: kernel BUG at fs/ocfs2/refcounttree.c:2678 ocfs2_refcount_cal_cow_clusters in 6.13.0 (Solar Designer <solar@...nwall.com>)
Fwd: libtasn1-4.20.0 released [fixes CVE-2024-12133] (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: pam_pkcs11: Possible Authentication Bypass in Error Situations (CVE-2025-24531) ("Douglas R. Reno" <renodr@...uxfromscratch.org>)

February 7 (4 messages)

Re: AMD Microcode Signature Verification Vulnerability (trinity pointard <trinity.pointard@...il.com>)
Re: AMD Microcode Signature Verification Vulnerability (Jacob Bachmeyer <jcb62281@...il.com>)
Re: pam_pkcs11: Possible Authentication Bypass in Error Situations (CVE-2025-24531) (Jacob Bachmeyer <jcb62281@...il.com>)
CVE-2025-25069: Apache Kvrocks: Cross-Protocol Scripting Vulnerability (Mingyang Liu <twice@...che.org>)

February 9 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2025-0001 (Adrian Perez de Castro <aperez@...lia.com>)

February 10 (1 message)

FELIX-6751: CVE-2025-25247: Apache Felix Webconsole: XSS in services console (Carsten Ziegeler <cziegeler@...che.org>)

February 11 (4 messages)

Re: CVE-2025-23015: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsa… (Paulo Motta <paulo@...che.org>)
CVE-2025-26467: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe a… (Paulo Motta <paulo@...che.org>)
CVE-2024-12797: OpenSSL: RFC7250 handshakes with unauthenticated servers don't abort as expected (Tomas Mraz <tomas@...nssl.org>)
Re: CVE-2024-12797: OpenSSL: RFC7250 handshakes with unauthenticated servers don't abort as expected (sjw@....ch)

February 12 (2 messages)

CVE-2024-32838: Apache Fineract: SQL injection vulnerabilities in offices API endpoint (Arnout Engelen <engelen@...che.org>)
CVE-2024-46910: Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user (Madhan Neethiraj <madhan@...che.org>)

February 13 (5 messages)

[kubernetes] CVE-2025-0426: Node Denial of Service via kubelet Checkpoint API (Craig Ingram <cjingram@...gle.com>)
CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv() (Rich Felker <dalias@...c.org>)
Re: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv() (Rich Felker <dalias@...c.org>)
Re: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv() (Rich Felker <dalias@...c.org>)
Re: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv() (Daniel Gutson <danielgutson@...il.com>)

February 14 (8 messages)

Monero 18.3.4 zero-day DoS vulnerability has been dropped publicly on social network. ("upper.underflow" <upper.underflow@...ton.me>)
CVE-2024-52577: Apache Ignite: Possible RCE when deserializing incoming messages by the server node (Nikita Amelchev <namelchev@...che.org>)
Re: Monero 18.3.4 zero-day DoS vulnerability has been dropped publicly on social network. (sjw@....ch)
CVE-2025-23359: Nvidia-container-toolkit: GPU Container Escape (CVE-2024-0132 fix bypass) ("Yupeng(Roc)" <roc.yupeng@...wei.com>)
Re: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv() (Nick Wellnhofer <wellnhofer@...um.de>)
Re: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv() (Daniel Gutson <danielgutson@...il.com>)
CVE-2024-56180: Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution (Xue Weiming <mikexue@...che.org>)
[CVE-2024-3220] CPython: Default mimetype known files writeable on Windows (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 16 (3 messages)

[vim-security] heap use-after-free in str_to_reg() in Vim < (Christian Brabandt <cb@...bit.org>)
CVE-2025-1094: PostgreSQL: Quoting APIs miss neutralizing quoting syntax in text that fails encoding validation, enabling ps… (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-1094: PostgreSQL: Quoting APIs miss neutralizing quoting syntax in text that fails encoding validation, enab… (James Addison <james@...iperadar.com>)

February 17 (2 messages)

Multiple Vulnerabilities in Barebox (Richard Weinberger <richard@...ma-star.at>)
Multiple Vulnerabilities in U-Boot (Richard Weinberger <richard@...ma-star.at>)

February 18 (4 messages)

MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Qualys Security Advisory <qsa@...lys.com>)
Multiple vulnerabilities in libxml2 (Nick Wellnhofer <wellnhofer@...um.de>)
GRUB CVE disclosures (Jan Setje-Eilers <Jan.SetjeEilers@...cle.com>)
Announce: OpenSSH 9.9p2 released (Damien Miller <djm@....openbsd.org>)

February 19 (1 message)

Exim: CVE-2025-26794: upcoming security release (Heiko Schlittermann <hs@...marc.schlittermann.de>)

February 20 (1 message)

Re: CVE-2025-1094: PostgreSQL: Quoting APIs miss neutralizing quoting syntax in text that fails encoding validation, enablin… (Solar Designer <solar@...nwall.com>)

February 21 (5 messages)

Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Jordy Zomer <jordy@...ing.systems>)
OpenH264 Decoding Functions Heap Overflow Vulnerability (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Qualys Security Advisory <qsa@...lys.com>)
CVE-2025-26794: Exim: SQL injection (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2025-26794: Exim: SQL injection (Solar Designer <solar@...nwall.com>)

February 22 (1 message)

Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Solar Designer <solar@...nwall.com>)

February 24 (3 messages)

Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Dmitry Belyavskiy <dbelyavs@...hat.com>)
Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Solar Designer <solar@...nwall.com>)
Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Dmitry Belyavskiy <dbelyavs@...hat.com>)

February 25 (1 message)

Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Olivier Fourdan <ofourdan@...hat.com>)

February 26 (2 messages)

CPAN Security Group is CNA for Perl and CPAN Modules (Stig Palmquist <stig@...g.io>)
GNU Emacs 30.1 released with 2 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 27 (3 messages)

Xen Security Advisory 467 v1 (CVE-2025-1713) - deadlock potential with VT-d and legacy PCI device pass-through (Xen.org security team <security@....org>)
Re: GNU Emacs 30.1 released with 2 CVE fixes (Max Nikulin <manikulin@...il.com>)
Re: Xen Security Advisory 467 v1 (CVE-2025-1713) - deadlock potential with VT-d and legacy PCI device pass-through ("Teddy Astie" <teddy.astie@...es.tech>)

February 28 (2 messages)

Re: Re: Xen Security Advisory 467 v1 (CVE-2025-1713) - deadlock potential with VT-d and legacy PCI device pass-through (Demi Marie Obenour <demi@...isiblething…)
CVE-2025-27531: Apache InLong: An arbitrary file read vulnerability for JDBC (Charles Zhang <dockerzhang@...che.org>)

75 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.