oss-security mailing list - 2025/10

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2025/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 3	² 3	³ 2	⁴ 3	⁵ 3
⁶ 2	⁷ 2	⁸ 1	⁹ 2	¹⁰ 2	¹¹ 1	¹² 2
¹³ 6	¹⁴ 13	¹⁵ 4	¹⁶ 7	¹⁷ 4	¹⁸ 4	¹⁹
²⁰	²¹	²²	²³	²⁴	²⁵	²⁶
²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

October 1 (3 messages)

Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Mike O'Connor" <mjo@...o.mi.org>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Emilio Pozuelo Monfort <pochu27@...il.com>)
Django CVE-2025-59681 and CVE-2025-59682 (Jacob Walls <jwalls@...ngoproject.com>)

October 2 (3 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)

October 3 (2 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
fetchmail-SA-2025-01: SMTP AUTH denial of service (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 4 (3 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: fetchmail-SA-2025-01: SMTP AUTH denial of service now called CVE-2025-61962. (Matthias Andree <matthias.andree@....de>)

October 5 (3 messages)

Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (nightmare.yeah27@...ecat.org)
Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (nightmare.yeah27@...ecat.org)

October 6 (2 messages)

Announce: OpenSSH 10.1 released (Damien Miller <djm@....openbsd.org>)
Resource consumption weakness in Postgres-using applications & frameworks (Peter Bex <peter@...e-magic.net>)

October 7 (2 messages)

Re: Announce: OpenSSH 10.1 released (David Leadbeater <dgl@....cx>)
redis: CVE-2025-49844: Lua Use-After-Free may lead to remote code execution (Jan Schaumann <jschauma@...meister.org>)

October 8 (1 message)

several vulnerabilities fixed in Go 1.25.2 and Go 1.24.8 (Jan Schaumann <jschauma@...meister.org>)

October 9 (2 messages)

Fwd: Heads-up: Upcoming Samba security releases (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
CVE-2025-62228: Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via mal… (Leonard Xu <leonard@...che.org>)

October 10 (2 messages)

Announce: OpenSSH 10.2 released (Damien Miller <djm@....openbsd.org>)
Go 1.25.2 and Go 1.24.8 fix 10 vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 11 (1 message)

Linux kernel: KASAN: out-of-bounds Read in proc_pid_stack on RISC-V (许佳凯 <xujiakai24@...ls.ucas.ac.cn>)

October 12 (2 messages)

Re: Announce: OpenSSH 10.1 released (Demi Marie Obenour <demiobenour@...il.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (lunbun <lunbun021@...il.com>)

October 13 (6 messages)

BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
GHSL-2025-042: Use After Free (UAF) in Poppler - CVE-2025-52885 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: BoringSSL private key loading is not constant time (Jeffrey Walton <noloader@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0007 (Adrian Perez de Castro <aperez@...lia.com>)
Re: BoringSSL private key loading is not constant time (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Announce: OpenSSH 10.1 released (David Leadbeater <dgl@....cx>)

October 14 (13 messages)

Re: BoringSSL private key loading is not constant time (Alex Gaynor <alex.gaynor@...il.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: BoringSSL private key loading is not constant time (Demi Marie Obenour <demiobenour@...il.com>)
CVE-2024-44088: Apache Geode: Reflected XSS (William Hodges <whodges@...che.org>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (David Benjamin <davidben@...gle.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (Hanno Böck <hanno@...eck.de>)
CVE-2025-55039: Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext … (Holden Karau <holden@...che.org>)
Re: BoringSSL private key loading is not constant time (Alex Gaynor <alex.gaynor@...il.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)

October 15 (4 messages)

Re: BoringSSL private key loading is not constant time (Jacob Bachmeyer <jcb62281@...il.com>)
Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
CVE-2025-54539: Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data (Krzysztof Porębski <havret@...che.org>)
RE: Samba security releases for CVE-2025-10230 and CVE-2025-9640 ("Caveney, Seamus G" <sgcaveney@...ttleschools.org>)

October 16 (7 messages)

Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
CVE-2025-61581: Apache Traffic Control: ReDoS issue in Traffic Router configuration (Arnout Engelen <engelen@...che.org>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Demi Marie Obenour <demiobenour@...il.com>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: Linux kernel: KASAN: out-of-bounds Read in proc_pid_stack on RISC-V (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Solar Designer <solar@...nwall.com>)

October 17 (4 messages)

Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2025-47410: Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute … (William Hodges <whodges@...che.org>)
rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Vincent Lefevre <vincent@...c17.net>)
Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Solar Designer <solar@...nwall.com>)

October 18 (4 messages)

Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Vincent Lefevre <vincent@...c17.net>)
Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Jacob Bachmeyer <jcb62281@...il.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Fabio Degrigis <degrigis@...il.com>)

64 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.