oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹	²	³ 4	⁴ 1	⁵	⁶ 5	⁷
⁸ 3	⁹ 3	¹⁰ 5	¹¹ 2	¹²	¹³	¹⁴
¹⁵ 2	¹⁶ 2	¹⁷ 1	¹⁸ 1	¹⁹ 2	²⁰	²¹
²² 3	²³ 6	²⁴ 11	²⁵ 6	²⁶ 4	²⁷ 10	²⁸ 12
²⁹ 12	³⁰ 12

Messages by day:

September 3 (4 messages)

CVE-2024-43115: Apache DolphinScheduler: Alert Script Attack (Lidong Dai <lidongdai@...che.org>)
CVE-2024-43166: Apache DolphinScheduler: CWE-276 Incorrect Default Permissions (Lidong Dai <lidongdai@...che.org>)
CVE-2025-57833: Django: Potential SQL injection in FilteredRelation column aliases (Sarah Boyce <sarahboyce@...ngoproject.com>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)

September 4 (1 message)

CVE-2025-30001: Apache StreamPark: Authenticated users can trigger remote command execution (Huajie Wang <benjobs@...che.org>)

September 6 (5 messages)

SQLite: Integer truncation in findOrCreateAggInfoColumn [CVE-2025-6965] (Alan Coopersmith <alan.coopersmith@...cle.com>)
SQLite - Integer Overflow in FTS5 Extension [CVE-2025-7709] (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-58782: Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory (Marcel Reutegger <mreutegg@...che.org>)
CVE-2025-24404: Apache HertzBeat (incubating): RCE by parse http sitemap xml response (Chao Gong <gongchao@...che.org>)
CVE-2025-48208: Apache HertzBeat (incubating): Jmx JNDI injection vulnerability (Chao Gong <gongchao@...che.org>)

September 8 (3 messages)

CVE-2025-40929: Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing … (Robert Rothenberg <rrwo@...n.org>)
CVE-2025-40928: JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted … (Robert Rothenberg <rrwo@...n.org>)
CVE-2025-40930: JSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when… (Robert Rothenberg <rob@...tmail.net>)

September 9 (3 messages)

Xen Security Advisory 472 v2 (CVE-2025-27466,CVE-2025-58142,CVE-2025-58143) - Mutiple vulnerabilities in the Viridian i… (Xen.org security team <security@....org…)
Xen Security Advisory 473 v2 (CVE-2025-58144,CVE-2025-58145) - Arm issues with page refcounting (Xen.org security team <security@....org>)
Xen Security Advisory 474 v2 (CVE-2025-58146) - XAPI UTF-8 string handling (Xen.org security team <security@....org>)

September 10 (5 messages)

[SECURITY ADVISORY] curl: CVE-2025-9086: Out of bounds read for cookie path (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2025-10148: predictable WebSocket mask (Daniel Stenberg <daniel@...x.se>)
Re: [SECURITY ADVISORY] curl: CVE-2025-10148: predictable WebSocket mask (Daniel Stenberg <daniel@...x.se>)
Re: [SECURITY ADVISORY] curl: CVE-2025-10148: predictable WebSocket mask (Emilio Pozuelo Monfort <pochu27@...il.com>)
ISC has disclosed one vulnerability in Stork (CVE-2025-8696) (Ben Scott <bscott@....org>)

September 11 (2 messages)

CVE-2025-58060 cups: Authentication bypass with AuthType Negotiate (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2025-58364 cups: Remote DoS via null dereference (Zdenek Dohnal <zdohnal@...hat.com>)

September 15 (2 messages)

CVE-2025-59328: Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data (Chaokun Yang <chaokunyang@...che.org>)
[CVE-2025-38501] Linux kernel: KSMBD service DoS by TCP handshake (tianshuo han <hantianshuo233@...il.com>)

September 16 (2 messages)

[kubernetes] CVE-2025-9708: Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-… (Rita Zhang <rita.z.zhang@...il.com>)
libexpat 2.7.2 fixes CVE-2025-59375 (DoS, CWE-770) (Sebastian Pipping <sebastian@...ping.org>)

September 17 (1 message)

Multiple vulnerabilities in Jenkins (Daniel Beck <dbeck@...udbees.com>)

September 18 (1 message)

PowerDNS Security Advisory 2025-05 for DNSdist: Denial of service via crafted DoH exchange (Remi Gacogne <remi.gacogne@...erdns.com>)

September 19 (2 messages)

CVE-2025-59355: Apache Linkis: Password Exposure (Chen Xia <casion@...che.org>)
CVE-2025-29847: Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass (Chen Xia <casion@...che.org>)

September 22 (3 messages)

CVE-2023-51767: a bogus CVE in OpenSSH (Damien Miller <djm@...drot.org>)
Re: CVE-2023-51767: a bogus CVE in OpenSSH (Stuart D Gathman <stuart@...hman.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0006 (Adrian Perez de Castro <aperez@...lia.com>)

September 23 (6 messages)

Re: CVE-2023-51767: a bogus CVE in OpenSSH (Pedro Sampaio <psampaio@...hat.com>)
Re: CVE-2023-51767: a bogus CVE in OpenSSH (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-51767: a bogus CVE in OpenSSH (Jacob Bachmeyer <jcb62281@...il.com>)
Re: process exit statuses (was: CVE-2023-51767) (Simon McVittie <smcv@...ian.org>)
Re: CVE-2023-51767: a bogus CVE in OpenSSH (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Todd C. Miller" <Todd.Miller@...o.ws>)

September 24 (11 messages)

Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Adiletta, Andrew" <ajadiletta@....edu>)
Re: Linux kernel: eBPF vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools (Solar Designer <solar@...nwall.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Linux kernel: eBPF vulnerabilities (Willy Tarreau <w@....eu>)
Re: CVE-2023-51767: a bogus CVE in OpenSSH (Damien Miller <djm@...drot.org>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2025-48459: Apache IoTDB: Deserialization of untrusted Data (Haonan Hou <haonan@...che.org>)
CVE-2025-48392: Apache IoTDB: DoS Vulnerability (Haonan Hou <haonan@...che.org>)
CVE-2025-58457: Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands (Damien Diederen <ddiederen@...che.org>)
libexpat 2.7.3 improves fixes to CVE-2024-8176 and CVE-2025-59375 (Sebastian Pipping <sebastian@...ping.org>)

September 25 (6 messages)

Re: Linux kernel: eBPF vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Jacob Bachmeyer <jcb62281@...il.com>)
Re: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools (VMware PSIRT <vmware.psirt@...adcom.com>)
CVE-2025-54831: Apache Airflow: Connection sensitive details exposed to users with READ permissions (Kaxil Naik <kaxilnaik@...che.org>)
Re: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools (Matthew Fernandez <matthew.fernandez@...il.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Demi Marie Obenour <demiobenour@...il.com>)

September 26 (4 messages)

Re: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Jacob Bachmeyer <jcb62281@...il.com>)
libtiff 4.7.0: Out-of-Bounds Write in TIFFReadRGBAImageOriented() (CVE-2025-9900) (Christian Hoffmann <christian@...fie.info>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Demi Marie Obenour <demiobenour@...il.com>)

September 27 (10 messages)

Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Demi Marie Obenour <demiobenour@...il.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Demi Marie Obenour <demiobenour@...il.com>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Demi Marie Obenour <demiobenour@...il.com>)
How to do secure coding and create secure software (Amit <amitchoudhary0523@...il.com>)
Re: How to do secure coding and create secure software (Solar Designer <solar@...nwall.com>)
Re: How to do secure coding and create secure software (Jeremy Stanley <fungi@...goth.org>)

September 28 (12 messages)

Re: How to do secure coding and create secure software (Michael Jumper <mjumper@...che.org>)
Re: How to do secure coding and create secure software (Mats Wichmann <mats@...hmann.us>)
Re: How to do secure coding and create secure software (Amit <amitchoudhary0523@...il.com>)
Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Theo de Raadt" <deraadt@...nbsd.org>)
Re: How to do secure coding and create secure software (Jeremy Stanley <fungi@...goth.org>)
Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Adiletta, Andrew" <ajadiletta@....edu>)
Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Theo de Raadt" <deraadt@...nbsd.org>)
Re: How to do secure coding and create secure software (Katie <katie@...ricane.ca>)
Re: How to do secure coding and create secure software (Eli Schwartz <eschwartz@...too.org>)
Re: How to do secure coding and create secure software (Jeffrey Walton <noloader@...il.com>)
Re: How to do secure coding and create secure software (Lucas Holt <luke@...lishgames.com>)
Re: How to do secure coding and create secure software (lists@...atla.org.uk)

September 29 (12 messages)

Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Damien Miller <djm@...drot.org>)
Re: How to do secure coding and create secure software (Amit <amitchoudhary0523@...il.com>)
CVE-2025-61622: Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory (Chaokun Yang <chaokunyang@...che.org>)
Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Theo de Raadt" <deraadt@...nbsd.org>)
Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Theo de Raadt" <deraadt@...nbsd.org>)
Re: How to do secure coding and create secure software (Jeremy Stanley <fungi@...goth.org>)
Re: How to do secure coding and create secure software ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: How to do secure coding and create secure software (Amit <amitchoudhary0523@...il.com>)
[Security Advisory] open-vm-tools: Local privilege escalation (CVE-2025-41244) (VMware PSIRT <vmware.psirt@...adcom.com>)
Re: How to do secure coding and create secure software (Dan Cross <crossd@...il.com>)
Re: How to do secure coding and create secure software (Dan Cross <crossd@...il.com>)

September 30 (12 messages)

Re: How to do secure coding and create secure software (Solar Designer <solar@...nwall.com>)
Re: How to do secure coding and create secure software (Jacob Bachmeyer <jcb62281@...il.com>)
Re: How to do secure coding and create secure software (Solar Designer <solar@...nwall.com>)
Re: Shellshock (was: How to do secure coding and create secure software) ("David A. Wheeler" <dwheeler@...eeler.com>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
FreeIPA - CVE-2025-7493 - Privilege Escalation from host to domain admin (Marco Benatto <mbenatto@...hat.com>)
CVE-2025-61733: Apache Kylin: Authentication bypass (Li Yang <liyang@...che.org>)
CVE-2025-61734: Apache Kylin: improper restriction of file read (Li Yang <liyang@...che.org>)
CVE-2025-61735: Apache Kylin: Server-Side Request Forgery (Li Yang <liyang@...che.org>)
Re: How to do secure coding and create secure software (Amit <amitchoudhary0523@...il.com>)
Re: How to do secure coding and create secure software (Solar Designer <solar@...nwall.com>)
malware in SoopSocks package on PyPi (Alan Coopersmith <alan.coopersmith@...cle.com>)

107 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.