oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	² 1	³ 5
⁴ 1	⁵ 1	⁶ 1	⁷ 2	⁸ 2	⁹ 1	¹⁰ 5
¹¹ 4	¹² 2	¹³ 9	¹⁴ 8	¹⁵ 2	¹⁶ 2	¹⁷ 3
¹⁸ 4	¹⁹ 6	²⁰ 4	²¹ 1	²² 4	²³	²⁴
²⁵	²⁶ 2	²⁷ 1	²⁸ 4	²⁹	³⁰	³¹

Messages by day:

August 2 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2025-0005 (Adrian Perez de Castro <aperez@...lia.com>)

August 3 (5 messages)

Linux kernel: eBPF vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: Linux kernel: eBPF vulnerabilities (Demi Marie Obenour <demiobenour@...il.com>)
CVE-2024-52279: Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string (PJ Fanning <fanningpj@...che.org>)
CVE-2024-41177: Apache Zeppelin: XSS in the Helium module (PJ Fanning <fanningpj@...che.org>)
CVE-2024-51775: Apache Zeppelin: Command Injection via CSWSH (PJ Fanning <fanningpj@...che.org>)

August 4 (1 message)

StarDict sends the user's X11 selection to the network (Vincent Lefevre <vincent@...c17.net>)

August 5 (1 message)

CVE-2025-54466: Apache OFBiz: RCE Vulnerability in scrum plugin (Nicolas Malin <nmalin@...che.org>)

August 6 (1 message)

CVE-2025-47906 & CVE-2025-47907 fixed in Go 1.24.6 & 1.23.12 (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 7 (2 messages)

CVE-2025-53606: Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server (Min Ji <jimin@...che.org>)
CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE (Colm O hEigeartaigh <coheigea@...che.org>)

August 8 (2 messages)

Re: Five new CVEs published for Cyberark Conjur OSS (Solar Designer <solar@...nwall.com>)
Re: StarDict sends the user's X11 selection to the network (Maytham Alsudany <maytham@...ian.org>)

August 9 (1 message)

CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (lunbun <lunbun021@...il.com>)

August 10 (5 messages)

Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Jacob Bachmeyer <jcb62281@...il.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (lunbun <lunbun021@...il.com>)
[vim-security] heap use-after-free was found in Vim < 9.1.1400 (Christian Brabandt <cb@...bit.org>)
[vim-security] A double-free was found in Vim >v9.1.1231 and < 9.1.1406 (Christian Brabandt <cb@...bit.org>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Jacob Bachmeyer <jcb62281@...il.com>)

August 11 (4 messages)

Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (lunbun <lunbun021@...il.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Jacob Bachmeyer <jcb62281@...il.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Vincent Lefevre <vincent@...c17.net>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (lunbun <lunbun021@...il.com>)

August 12 (2 messages)

CVE-2025-40920: Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonce… (Robert Rothenberg <rrwo@...n.org>)
CVE-2025-54472: Apache bRPC: Redis Parser Remote Denial of Service (Wang Weibing <wwbmmm@...che.org>)

August 13 (9 messages)

Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Jens-Wolfhard Schicke-Uffmann <drahflow@....de>)
CVE-2025-48989: Apache Tomcat: h2 DoS - Made You Reset (Mark Thomas <markt@...che.org>)
CVE-2025-55668: Apache Tomcat: session fixation via rewrite valve (Mark Thomas <markt@...che.org>)
xterm terminal crash due to malicious character sequences in file name (Vincent Lefevre <vincent@...c17.net>)
CVE-2025-53859: nginx: ngx_mail_smtp_module buffer over-read potentially resulting in sensitive information leak (Solar Designer <solar@...nwall.com>)
HTTP/2 implementations are vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: xterm terminal crash due to malicious character sequences in file name (Thomas Dickey <dickey@....com>)
Re: xterm terminal crash due to malicious character sequences in file name (Erik Auerswald <auerswal@...x-ag.uni-kl.de>)
Question about (in)security of fdk-aac-free in linux distros (Jordan Glover <Golden_Miller83@...tonmail.ch>)

August 14 (8 messages)

Re: Question about (in)security of fdk-aac-free in linux distros (Sam James <sam@...too.org>)
Re: Question about (in)security of fdk-aac-free in linux distros (Martin Storsjö <martin@...tin.st>)
CVE-2025-55673: Apache Superset: Metadata exposure in embedded charts (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2025-55672: Apache Superset: Store XSS on charts metadata (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2025-55674: Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2025-55675: Apache Superset: Incorrect datasource authorization on REST API (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2025-54389 - aide (<= 0.19.1): improper output neutralization (potential AIDE detection bypass) (Hannes von Haugwitz <hannes@...haugwitz.com>)
CVE-2025-54409 - aide (>= 0.13 <= 0.19.1): null pointer dereference after reading incorrectly encoded xattr attributes … (Hannes von Haugwitz <hannes@...haugwitz…)

August 15 (2 messages)

Re: Question about (in)security of fdk-aac-free in linux distros (Demi Marie Obenour <demiobenour@...il.com>)
Re: Question about (in)security of fdk-aac-free in linux distros (Jordan Glover <Golden_Miller83@...tonmail.ch>)

August 16 (2 messages)

Re: HTTP/2 implementations are vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: xterm terminal crash due to malicious character sequences in file name (Collin Funk <collin.funk1@...il.com>)

August 17 (3 messages)

Re: xterm terminal crash due to malicious character sequences in file name (Vincent Lefevre <vincent@...c17.net>)
Re: xterm terminal crash due to malicious character sequences in file name (Solar Designer <solar@...nwall.com>)
Re: xterm terminal crash due to malicious character sequences in file name (Erik Auerswald <auerswal@...x-ag.uni-kl.de>)

August 18 (4 messages)

Re: xterm terminal crash due to malicious character sequences in file name (Vincent Lefevre <vincent@...c17.net>)
Re: xterm terminal crash due to malicious character sequences in file name ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Local information disclosure in apport and systemd-coredump (Solar Designer <solar@...nwall.com>)
CVE-2025-53192: Apache Commons OGNL: Expression Injection leading to RCE (Arnout Engelen <engelen@...che.org>)

August 19 (6 messages)

Re: RSYNC: 6 vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: blocking weird file names (was: xterm terminal crash due to malicious character sequences in file name) (Jacob Bachmeyer <jcb62281@...il.com>)
Re: blocking weird file names (was: xterm terminal crash due to malicious character sequences in file name) (Simon McVittie <smcv@...ian.org>)
Re: blocking weird file names (was: xterm terminal crash due to malicious character sequences in file name) (Ali Polatel <alip@...sys.org>)
Re: Question about (in)security of fdk-aac-free in linux distros (Martin Storsjö <martin@...tin.st>)
Re: Question about (in)security of fdk-aac-free in linux distros (Demi Marie Obenour <demiobenour@...il.com>)

August 20 (4 messages)

Security pre-notification policy for vLLM project (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE-2025-54988: Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA (Tim Allison <tallison@...che.org>)
CVE-2025-54988: Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA (Tim Allison <tallison@...che.org>)
Re: HTTP/2 implementations are vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames (Nick Tait <ntait@...hat.com>)

August 21 (1 message)

Re: CVE-2025-54988: Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA (Hanno Böck <hanno@...eck.de>)

August 22 (4 messages)

CVE-2024-48988: Apache StreamPark: SQL injection vulnerability (Huajie Wang <benjobs@...che.org>)
CVE-2025-54812: Apache Log4cxx: Improper HTML escaping in HTMLLayout (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2025-54813: Apache Log4cxx: Improper escaping with JSONLayout (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2025-43023 in HPLIP for Use of 1024-bit DSA Key (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 26 (2 messages)

libssh2 Base64 Encoding Heap Overflow in Known Hosts SHA1 Hash Processing (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
Re: libssh2 Base64 Encoding Heap Overflow in Known Hosts SHA1 Hash Processing (Solar Designer <solar@...nwall.com>)

August 27 (1 message)

ISC has disclosed one vulnerability in Kea (CVE-2025-40779) (Ben Scott <bscott@....org>)

August 28 (4 messages)

CVE-2025-8067 - UDisks (Marco Benatto <mbenatto@...hat.com>)
Xen Security Advisory 471 v2 (CVE-2024-36350,CVE-2024-36357) - x86: Transitive Scheduler Attacks (Xen.org security team <security@....org>)
CVE-2025-58047: DoS in Volto (Plone CMS) ("Maurits van Rees (Plone)" <maurits@...ne.org>)
Re: CVE-2025-8067 - UDisks (Solar Designer <solar@...nwall.com>)

75 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.