oss-security mailing list - 2025/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2025/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 2	² 3	³ 1	⁴	⁵ 1	⁶ 1
⁷ 2	⁸ 5	⁹ 4	¹⁰ 13	¹¹ 5	¹² 1	¹³ 1
¹⁴ 1	¹⁵ 3	¹⁶ 7	¹⁷	¹⁸ 3	¹⁹	²⁰
²¹ 3	²² 3	²³ 1	²⁴ 2	²⁵	²⁶	²⁷
²⁸ 2	²⁹ 1	³⁰ 3	³¹

Messages by day:

July 1 (2 messages)

Xen Security Advisory 470 v2 (CVE-2025-27465) - x86: Incorrect stubs exception handling for flags recovery (Xen.org security team <security@....org>)
CVE-2024-35164: Apache Guacamole: Improper input validation of console codes (Michael Jumper <mjumper@...che.org>)

July 2 (3 messages)

CVE-2025-46647: Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect (Junxu Chen <chenjunxu@...che.org>)
CVE-2025-38089: Linux kernel: NFS server remote DoS via NULL pointer dereference (tianshuo han <hantianshuo233@...il.com>)
DoS segfault (NULL pointer deref) in SOPE / SOGo (Stefan Bühler <source@...uehler.de>)

July 3 (1 message)

CVE-2025-53367: An exploitable OOB write in DjVuLibre (Kevin Backhouse <kevinbackhouse@...hub.com>)

July 5 (1 message)

Re: DoS segfault (NULL pointer deref) in SOPE / SOGo (Salvatore Bonaccorso <carnil@...ian.org>)

July 6 (1 message)

CVE-2025-27446: Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local a… (YuanSheng Wang <membphis@...che.org>)

July 7 (2 messages)

Re: CVE-2025-27446: Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a loc… (Cuong Duy <duycuong200798@...il.com>)
Electric Charger Research (Brandon Perry <bperry.volatile@...il.com>)

July 8 (5 messages)

Re: Electric Charger Research (Solar Designer <solar@...nwall.com>)
Xen Security Advisory 471 v1 (CVE-2024-36350,CVE-2024-36357) - x86: Transitive Scheduler Attacks (Xen.org security team <security@....org>)
Fwd: Node.js security updates for all active release lines, May 2025 (Rafael Gonzaga <work@...aelgss.dev>)
Multiple vulnerabilities fixed in Git (Taylor Blau <me@...ylorr.com>)
Go 1.24.5 & 1.23.11 fix CVE-2025-4674 (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 9 (4 messages)

Re: Fwd: Node.js security updates for all active release lines, May 2025 (Solar Designer <solar@...nwall.com>)
Re: Fwd: Node.js security updates for all active release lines, May 2025 (Salvatore Bonaccorso <carnil@...ian.org>)
Opossum attack / Opportunistic HTTP (RFC 2817) insecure (Hanno Böck <hanno@...eck.de>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)

July 10 (13 messages)

Release of pqcscan ("Vincent Berg" <gvb@...ilax.io>)
CVE fixes in Apache HTTP Server 2.4.64 (Solar Designer <solar@...nwall.com>)
CVE-2024-42516: Apache HTTP Server: HTTP response splitting (Eric Covener <covener@...che.org>)
CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header (Eric Covener <covener@...che.org>)
CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths (Eric Covener <covener@...che.org>)
CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping (Eric Covener <covener@...che.org>)
CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service (Eric Covener <covener@...che.org>)
CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption (Eric Covener <covener@...che.org>)
CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack (Eric Covener <covener@...che.org>)
CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase (Eric Covener <covener@...che.org>)
CVE-2025-52434: Apache Tomcat: APR/Native Connector crash leading to DoS (Mark Thomas <markt@...che.org>)
CVE-2025-52520: Apache Tomcat: DoS via integer overflow in multipart file upload (Mark Thomas <markt@...che.org>)
CVE-2025-53506: Apache Tomcat: DoS via excessive h2 streams at connection start (Mark Thomas <markt@...che.org>)

July 11 (5 messages)

CVE-2025-48924: Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs ("Gary D. Gregory" <ggregory@...che.org>)
Re: 5 security issues disclosed in libxml2 (Alan Coopersmith <alan.coopersmith@...cle.com>)
gnutls 3.8.10 fixes 4 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)
PHP security releases 8.4.10, 8.3.23, 8.2.29, 8.1.33 (Alan Coopersmith <alan.coopersmith@...cle.com>)
GHSL-2025-054: Use After Free (UAF) in Poppler - CVE-2025-52886 (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 12 (1 message)

Re: GHSL-2025-054: Use After Free (UAF) in Poppler - CVE-2025-52886 (Kevin Backhouse <kevinbackhouse@...hub.com>)

July 13 (1 message)

https://issues.apache.org/jira/browse/ZEPPELIN-6101: CVE-2024-41169: Apache Zeppelin: raft directory listing and file read (PJ Fanning <fanningpj@...che.org>)

July 14 (1 message)

CVE-2025-53689: Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons (Julian Reschke <reschke@...che.org>)

July 15 (3 messages)

[vim-security] path traversal issue with tar.vim and special crafted tar archives in Vim < 9.1.1552 (Christian Brabandt <cb@...bit.org>)
[vim-security]: path traversal issue with zip.vim and special crafted zip archives in Vim < v9.1.1551 (Christian Brabandt <cb@...bit.org>)
CVE-2025-48795: Apache CXF: Denial of Service and sensitive data exposure in logs (Colm O hEigeartaigh <coheigea@...che.org>)

July 16 (7 messages)

CVE-2025-30761：A vulnerability in JDK's Nashorn Allows for Arbitrary Code Execution ("liyajie" <liyajie@...neuler.sh>)
Fwd: Node.js security updates for all active release lines, July 2025 (Rafael Gonzaga <work@...aelgss.dev>)
CVE-2025-23267：A vulnerability in NVIDIA Container Toolkit can lead to container escape. ("liyajie" <liyajie@...neuler.sh>)
CVE-2025-40923: Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely (Robert Rothenberg <rrwo@...n.org>)
CVE-2025-40918: Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely (Robert Rothenberg <rrwo@...n.org>)
ISC has disclosed one vulnerability in BIND 9 (CVE-2025-40777) ("Everett B. Fulton" <ebf@....org>)
Five new CVEs published for Cyberark Conjur OSS (Andy Tinkham <andy.tinkham@...erark.com>)

July 18 (3 messages)

CVE-2025-53816: Memory corruption in 7-Zip before 25.00 (Jaras <jarlob@...il.com>)
CVE-2025-53817: Null pointer dereference in 7-Zip before 25.00 (Jaras <jarlob@...il.com>)
Re: CVE-2025-53367: An exploitable OOB write in DjVuLibre (Kevin Backhouse <kevinbackhouse@...hub.com>)

July 21 (3 messages)

CVE-2025-49656: Apache Jena: Administrative users can create files outside the server directory space via the admin UI (Andy Seaborne <andy@...che.org>)
CVE-2025-50151: Apache Jena: Configuration files uploaded by administrative users are not check properly (Andy Seaborne <andy@...che.org>)
Re: CVE-2025-30761：A vulnerability in JDK's Nashorn Allows for Arbitrary Code Execution (Moritz Bechler <mbechler@...terphace.org>)

July 22 (3 messages)

[kubernetes] CVE-2025-7342: VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials … (Rita Zhang <rita.z.zhang@...il.com>)
Re: Fwd: Node.js security updates for all active release lines, July 2025 (Solar Designer <solar@...nwall.com>)
non-issues in dailyaidecheck script in Debian's packaging of AIDE (Solar Designer <solar@...nwall.com>)

July 23 (1 message)

The GNU C Library security advisories update for 2025-07-23 (Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>)

July 24 (2 messages)

Re: CVE-2025-30761：A vulnerability in JDK's Nashorn Allows for Arbitrary Code Execution ("liyajie" <liyajie@...neuler.sh>)
CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64 (Eric Covener <covener@...che.org>)

July 28 (2 messages)

Fwd:[CVE-2025-8194] Cpython Tarfile infinite loop during parsing with negative member offset (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Fwd:[CVE-2025-8194] Cpython Tarfile infinite loop during parsing with negative member offset (Mats Wichmann <mats@...hmann.us>)

July 29 (1 message)

Re: Fwd:[CVE-2025-8194] Cpython Tarfile infinite loop during parsing with negative member offset (Seth Larson <seth@...hon.org>)

July 30 (3 messages)

CVE-2025-54656: Apache Struts Extras: Improper Output Neutralization for Logs (Arnout Engelen <engelen@...che.org>)
CVE-2025-24853: Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
CVE-2025-24854: Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)

68 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.