oss-security mailing list - 2025/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2025/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 7	³ 11	⁴ 6	⁵ 5	⁶ 12	⁷ 5	⁸
⁹ 3	¹⁰ 5	¹¹ 5	¹²	¹³ 1	¹⁴ 2	¹⁵ 1
¹⁶ 6	¹⁷ 7	¹⁸ 2	¹⁹ 1	²⁰ 3	²¹	²²
²³ 2	²⁴ 8	²⁵ 1	²⁶ 1	²⁷ 2	²⁸ 1	²⁹
³⁰ 1

Messages by day:

June 2 (7 messages)

Roundcube webmail: Post-Auth RCE via PHP Object Deserialization reported by firs0v (Hanno Böck <hanno@...eck.de>)
Re: CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths (Florian Weimer <fweimer@...hat.com>)
Re: Roundcube webmail: Post-Auth RCE via PHP Object Deserialization reported by firs0v (Anton Luka Šijanec <anton@...anec.eu>)
Re: Local information disclosure in apport and systemd-coredump (Jelle van der Waa <jelle@...aa.nl>)
Re: CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths (Florian Weimer <fweimer@...hat.com>)
Re: CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths (Leon Timmermans <fawaka@...il.com>)
Re: Re: CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended p… (Vincent Lefevre <vincent@...c17.net>)

June 3 (11 messages)

Re: Re: CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended p… (Vincent Lefevre <vincent@...c17.net>)
Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Demi Marie Obenour <demiobenour@...il.com>)
Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
Re: Local information disclosure in apport and systemd-coredump (Vegard Nossum <vegard.nossum@...cle.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)
CVE-2025-46548: Apache Pekko Management, Apache Pekko Management, Apache Pekko Management: management API basic authenticat… (Arnout Engelen <engelen@...che.org>)
Samba 4.21.6 fixes CVE-2025-0620 in SMB session re-authentication (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2024-47081: Netrc credential leak in PSF requests library (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Local information disclosure in apport and systemd-coredump (Marco Benatto <mbenatto@...hat.com>)
Re: CVE-2024-47081: Netrc credential leak in PSF requests library (Dave Walker <email@...iey.com>)

June 4 (6 messages)

Re: CVE-2024-47081: Netrc credential leak in PSF requests library (Demi Marie Obenour <demiobenour@...il.com>)
[SECURITY AVISORY] curl: CVE-2025-5399: WebSocket endless loop (Daniel Stenberg <daniel@...x.se>)
Re: Local information disclosure in apport and systemd-coredump (David Fernandez Gonzalez <david.fernandez.gonzalez@...cle.com>)
Re: Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Greg KH <gregkh@...uxfoundation.org>)
CVE-2025-48432: Django: Potential log injection via unescaped request path (Natalia Bidart <nataliabidart@...ngoproject.com>)
Re: CVE-2024-47081: Netrc credential leak in PSF requests library (Jakub Wilk <jwilk@...lk.net>)

June 5 (5 messages)

Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
CVE-2011-10007: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters … (Timothy Legge <timlegge@...nsec.org>)
Go 1.24.4 and Go 1.23.10 fix CVE-2025-4673, CVE-2025-0913, CVE-2025-22874 (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 6 (12 messages)

Re: CVE-2011-10007: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a cra… (Sam James <sam@...too.org>)
Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
Re: CVE-2011-10007: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encount… (Timothy Legge <timlegge@...nsec.org>)
Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Solar Designer <solar@...nwall.com>)
Re: Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Eli Schwartz <eschwartz@...too.org>)
Vulnerability in Jenkins Gatling Plugin (Daniel Beck <ml@...kweb.net>)
Re: Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Local information disclosure in apport and systemd-coredump (Vegard Nossum <vegard.nossum@...cle.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)
Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)

June 7 (5 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Simon McVittie <smcv@...ian.org>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Sasha Levin <sashal@...nel.org>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Bastian Blank <bblank@...nkmo.de>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Sasha Levin <sashal@...nel.org>)

June 9 (3 messages)

CVE-2025-27817: Apache Kafka Client: Arbitrary file read and SSRF vulnerability (Luke Chen <showuon@...che.org>)
CVE-2025-27818: Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration (Luke Chen <showuon@...che.org>)
CVE-2025-27819: Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration (Luke Chen <showuon@...che.org>)

June 10 (5 messages)

Re: Local information disclosure in apport and systemd-coredump (Zbigniew Jędrzejewski-Szmek <zbyszek@...waw.pl>)
Django CVE-2025-48432 (follow-up patch releases) (Sarah Boyce <sarahboyce@...ngoproject.com>)
Re: Django CVE-2025-48432 (follow-up patch releases) (Sarah Boyce <sarahboyce@...ngoproject.com>)
Re: Django CVE-2025-48432 (follow-up patch releases) (Sebastian Pipping <sebastian@...ping.org>)
CVE-2025-49091: Konsole: Code execution from web browser using URL schemes handled by KDE's KTelnetService and Konsole < … (Dennis Dast <dennis.dast@...ofnet.de>)

June 11 (5 messages)

Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Demi Marie Obenour <demiobenour@...il.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Simon McVittie <smcv@...ian.org>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Linux kernel: HFS+ filesystem implementation issues, exposure in distros (Demi Marie Obenour <demiobenour@...il.com>)

June 13 (1 message)

sslh: Remote Denial-of-Service Vulnerabilities (CVE-2025-46807, CVE-2025-46806) (Matthias Gerstner <mgerstner@...e.de>)

June 14 (2 messages)

CVE-2025-47868: Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition. (Tomasz Cedro <cederom@...che.org>)
CVE-2025-47869: Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size. (Tomasz Cedro <cederom@...che.org>)

June 15 (1 message)

Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)

June 16 (6 messages)

CVE-2025-48988: Apache Tomcat: FileUpload large number of parts with headers DoS (Mark Thomas <markt@...che.org>)
CVE-2025-49125: Apache Tomcat: Security constraint bypass for pre/post-resources (Mark Thomas <markt@...che.org>)
CVE-2025-49124: Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows (Mark Thomas <markt@...che.org>)
CVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2025-4748: Erlang/OTP 17.0–28.0.0 absolute-path traversal in zip:unzip/zip:extract (Jonatan Männchen <jonatan@...nnchen.ch>)
5 security issues disclosed in libxml2 (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 17 (7 messages)

pam: pam_namespace local privilege escalation (CVE-2025-6020) (BAL-PETRE Olivier <Olivier.Bal-Petre@....gouv.fr>)
[kubernetes] Race Condition in Go allows Volume Deletion in older Kubernetes versions (Craig Ingram <cjingram@...gle.com>)
Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Olivier Fourdan <ofourdan@...hat.com>)
CVE-2025-6019: LPE from allow_active to root in libblockdev via udisks (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2025-6019: LPE from allow_active to root in libblockdev via udisks (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2025-6019: LPE from allow_active to root in libblockdev via udisks (Simon McVittie <smcv@...ian.org>)
[ANNOUNCE] Apache Traffic Server has an ACL issue, and also has a vulnerability in ESI processing (Masakazu Kitajo <maskit@...che.org>)

June 18 (2 messages)

Re: CVE-2025-6019: LPE from allow_active to root in libblockdev via udisks (Jakub Wilk <jwilk@...lk.net>)
Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Olivier Fourdan <ofourdan@...hat.com>)

June 19 (1 message)

[kubernetes] CVE-2025-4563: Nodes can bypass dynamic resource allocation authorization checks (Rita Zhang <rita.z.zhang@...il.com>)

June 20 (3 messages)

Re: path traversal in tar extract in intel cve-bin-tool (Jakub Wilk <jwilk@...lk.net>)
ClamAV 1.4.3 and 1.0.9 security patch versions published (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: path traversal in tar extract in intel cve-bin-tool (lists@...atla.org.uk)

June 23 (2 messages)

xdg-open bypassing SameSite=Strict (grape mingijung <mingijung.grape@...il.com>)
Re: xdg-open bypassing SameSite=Strict (Solar Designer <solar@...nwall.com>)

June 24 (8 messages)

CPython: Multiple CVEs (1 CRITICAL, 3 HIGH, 1 MODERATE) affecting the tarfile module (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: xdg-open bypassing SameSite=Strict (Simon McVittie <smcv@...ian.org>)
CVE-2025-50213: Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator (Elad Kalif <eladkal@...che.org>)
sox_ng fixes 20 CVEs in sox (Martin Guy <martinwguy@...il.com>)
Re: xdg-open bypassing SameSite=Strict (grape mingijung <mingijung.grape@...il.com>)
Re: xdg-open bypassing SameSite=Strict (Anton Luka Šijanec <anton@...anec.eu>)
Re: xdg-open bypassing SameSite=Strict (Gabriel Corona <gabriel.corona@...e.fr>)
Re: xdg-open bypassing SameSite=Strict (Lucas Holt <luke@...lishgames.com>)

June 25 (1 message)

Re: sox_ng fixes 20 CVEs in sox (Martin Guy <martinwguy@...il.com>)

June 26 (1 message)

CVE-2025-52555 Ceph: CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS ("Sage [They / Them] McTaggart" <amctagga@...hat.com>)

June 27 (2 messages)

Re: CVE-2025-52555 Ceph: CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS (Jacob Bachmeyer <jcb62281@...il.com>)
libssh 0.11.2 security and bugfix release (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 28 (1 message)

CVE-2025-32897: Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server (Min Ji <jimin@...che.org>)

June 30 (1 message)

CVE-2024-39954: Apache EventMesh Runtime: SSRF (Xue Weiming <mikexue@...che.org>)

98 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.