oss-security mailing list - 2025/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	² 1
³ 2	⁴	⁵ 3	⁶ 14	⁷ 2	⁸ 1	⁹ 1
¹⁰ 6	¹¹ 2	¹² 4	¹³ 12	¹⁴ 7	¹⁵ 2	¹⁶
¹⁷	¹⁸	¹⁹ 7	²⁰ 2	²¹ 2	²²	²³ 4
²⁴ 4	²⁵	²⁶ 3	²⁷ 8	²⁸ 2	²⁹ 1	³⁰
³¹ 1

Messages by day:

March 1 (2 messages)

Re: Re: GNU Emacs 30.1 released with 2 CVE fixes (Henrik Ahlgren <pablo@...stieto.com>)
Re: Re: GNU Emacs 30.1 released with 2 CVE fixes (Max Nikulin <manikulin@...il.com>)

March 2 (1 message)

[vim-security] potential code execution with tar.vim and special crafted tar files (Christian Brabandt <cb@...bit.org>)

March 3 (2 messages)

CVE-2024-24778: Apache StreamPipes: Resources Permission Escalation (Philipp Zehnder <zehnder@...che.org>)
CVE-2024-55532: Apache Ranger: Improper Neutralization of Formula Elements in a CSV File (Velmurugan Periasamy <vel@...che.org>)

March 5 (3 messages)

[ANNOUNCE] ATS is vulnerable to malformed requests, and also has ACL issues (Masakazu Kitajo <maskit@...che.org>)
Multiple vulnerabilities in Jenkins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)

March 6 (14 messages)

Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Jacob Bachmeyer <jcb62281@...il.com>)
Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Jacob Bachmeyer <jcb62281@...il.com>)
Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Bastian Blank <bblank@...nkmo.de>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Taylor R Campbell <campbell+oss-security@...ble.net>)
CVE-2025-26699: Django: Potential denial-of-service in django.utils.text.wrap() (Sarah Boyce <sarahboyce@...ngoproject.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Buherátor <buherator@...il.com>)

March 7 (2 messages)

CVE-2025-26865: Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE (Jacques Le Roux <jleroux@...che.org>)
Go CVE-2025-22870: proxy bypass using IPv6 zone IDs (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 8 (1 message)

Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)

March 9 (1 message)

CVE-2025-27636: Apache Camel: Camel Message Header Injection via Improper Filtering (Andrea Cosentino <acosentino@...che.org>)

March 10 (6 messages)

Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Qualys Security Advisory <qsa@...lys.com>)
CVE-2025-1937+more: Numerous memory-safety issues in Firefox & Thunderbird (Valtteri Vuorikoski <vuori@...com.org>)
[SBA-ADV-20241209-01] CVE-2024-13918: Laravel 11.9.0-11.35.1 Reflected XSS via Request Parameter in Debug-Mode Error Pa… (SBA Research Security Advisory <advisor…)
[SBA-ADV-20241209-02] CVE-2024-13919: Laravel 11.9.0-11.35.1 Reflected XSS via Route Parameter in Debug-Mode Error Page (SBA Research Security Advisory <advisor…)
CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (Mark Thomas <markt@...che.org>)
Re: CVE-2025-1937+more: Numerous memory-safety issues in Firefox & Thunderbird (Jacob Bachmeyer <jcb62281@...il.com>)

March 11 (2 messages)

CVE-2025-27017: Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record (Pierre Villard <pvillard@...che.org>)
Re: CVE-2025-1937+more: Numerous memory-safety issues in Firefox & Thunderbird (Moritz Mühlenhoff <jmm@...til.org>)

March 12 (4 messages)

Below: World Writable Directory in /var/log/below Allows Local Privilege Escalation (CVE-2025-27591) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2025-29891: Apache Camel: Camel Message Header Injection through request parameters (Andrea Cosentino <acosentino@...che.org>)
FELIX-6753: CVE-2025-27867: Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin (Carsten Ziegeler <cziegeler@...che.org>)
[vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Christian Brabandt <cb@...bit.org>)

March 13 (12 messages)

CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Michel Lind <michel@...hel-slm.name>)
CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Jonathan Wright <jonathan@...alinux.org>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: [vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Solar Designer <solar@...nwall.com>)
Re: [vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Eli Schwartz <eschwartz@...too.org>)
Re: [vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Christian Brabandt <cb@...bit.org>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Marc Deslauriers <marc.deslauriers@...onical.com>)
[kubernetes] CVE-2025-1767: GitRepo Volume Inadvertent Local Repository Access ("Vellore Rajakumar, Sri Saran Balaji" <srajakum@...zon.com>)
Triton Product Security announcement: Debian 12 LX image from 2024-07 has static SSH keys (Dan McDonald <danmcd@....io>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Vulnerability Disclosure <vulns@...a.com>)

March 14 (7 messages)

Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Michel Lind <michel@...hel-slm.name>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 ("Michel Lind" <michel@...hel-slm.name>)
[CVE-2024-8176] Long linear chains of entities crash Expat with stack overflow due to use of unlimited recursion (Alan Coopersmith <alan.coopersmith@...cle.com…)
PHP security releases 8.4.5, 8.3.19, 8.2.28, 8.1.32 (Alan Coopersmith <alan.coopersmith@...cle.com>)
expat vulnerability CVE-2024-8176 / impact of recursion stack overflow vulnerabilities (Hanno Böck <hanno@...eck.de>)

March 15 (2 messages)

Re: expat vulnerability CVE-2024-8176 / impact of recursion stack overflow vulnerabilities (Qualys Security Advisory <qsa@...lys.com>)
tj-action/changed-files GitHub action was compromised (Mark Esler <mark.esler@...inguard.dev>)

March 19 (7 messages)

Re: tj-action/changed-files GitHub action was compromised (Mark Esler <mark.esler@...inguard.dev>)
Re: tj-action/changed-files GitHub action was compromised (Jacob Bachmeyer <jcb62281@...il.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2025-27018: Apache Airflow MySQL Provider: SQL injection in MySQL provider core function (Elad Kalif <eladkal@...che.org>)
CVE-2024-47552: Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server (Min Ji <jimin@...che.org>)
CVE-2024-54016: compression bomb attack in Apache Seata Server (Min Ji <jimin@...che.org>)
CVE-2025-27888: Apache Druid: Server-Side Request Forgery and Cross-Site Scripting (Adarsh Sanjeev <adarshsanjeev@...che.org>)

March 20 (2 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2025-0002 (Adrian Perez de Castro <aperez@...lia.com>)
[kubernetes] CVE-2024-7598: Network restriction bypass via race condition during namespace termination (Craig Ingram <cjingram@...gle.com>)

March 21 (2 messages)

CVE-2025-26796: Apache Oozie: XSS in Oozie Web Console (Arnout Engelen <engelen@...che.org>)
Mercurial 6.9.4 fixes CVE-2025-2361: XSS in hgweb (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 23 (4 messages)

CVE-2025-27553: Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2025-30474: Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2025-29927: Authorization Bypass in Next.js Middleware (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2025-29927: Authorization Bypass in Next.js Middleware (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 24 (4 messages)

CVE-2024-53678: Apache VCL: SQL injection vulnerability in New Block Allocation form (Josh Thompson <jfthomps@...che.org>)
CVE-2024-53679: Apache VCL: XSS vulnerability in User Lookup impacting user privileges (Josh Thompson <jfthomps@...che.org>)
[kubernetes] Multiple vulnerabilities in ingress-nginx (Tabitha Sable <tabitha.c.sable@...il.com>)
Re: [kubernetes] Multiple vulnerabilities in ingress-nginx (Kevin Daudt <me@...e.info>)

March 26 (3 messages)

CVE-2025-30232: UAF in Exim 4.96 to 4.98.1 (Valtteri Vuorikoski <vuori@...com.org>)
atop: Heap corruption (Solar Designer <solar@...nwall.com>)
Re: atop: Heap corruption (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 27 (8 messages)

Re: atop: Heap corruption (Thomas Ward <teward@...mas-ward.net>)
Re: atop: Heap corruption (Mark Steward <marksteward@...il.com>)
Re: atop: Heap corruption (Solar Designer <solar@...nwall.com>)
CVE-2025-30067: Apache Kylin: The remote code execution via jdbc url (Li Yang <liyang@...che.org>)
CVE-2024-48944: Apache Kylin: SSRF vulnerability in the diagnosis api (Li Yang <liyang@...che.org>)
Three bypasses of Ubuntu's unprivileged user namespace restrictions (Qualys Security Advisory <qsa@...lys.com>)
wait3() system call as a side-channel in setuid programs (nvidia-modprobe CVE-2024-0149) (Wolfgang Frisch <wfrisch@...e.de>)
CVE-2024-56325: Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication … (siddharth teotia <siddharthteotia@...il…)

March 28 (2 messages)

use-after-free (maybe?) in libspf2 (Hanno Böck <hanno@...eck.de>)
Re: atop: Heap corruption (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 29 (1 message)

CVE-2025-31160 Atop 2.11 heap problems (Gerlof Langeveld <gerlof.langeveld@...ptool.nl>)

March 31 (1 message)

CVE-2025-27427: Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission (Justin Bertram <jbertram@...che.org>)

93 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.