oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2025/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 8	² 3
³ 4	⁴ 9	⁵ 18	⁶ 6	⁷ 2	⁸	⁹
¹⁰	¹¹ 10	¹² 2	¹³ 2	¹⁴ 7	¹⁵ 1	¹⁶ 1
¹⁷ 6	¹⁸ 10	¹⁹ 1	²⁰ 2	²¹	²² 1	²³
²⁴ 1	²⁵	²⁶ 4	²⁷ 5	²⁸ 3	²⁹	³⁰

Messages by day:

November 1 (8 messages)

Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Multiple vulnerabilities in Jenkins plugins (Solar Designer <solar@...nwall.com>)
Re: Questionable CVE's reported against dnsmasq (Solar Designer <solar@...nwall.com>)
Re: Questionable CVE's reported against dnsmasq (Art Manion <zmanion@...tonmail.com>)
Re: Questionable CVE's reported against dnsmasq (Russ Allbery <eagle@...ie.org>)
Re: Questionable CVE's reported against dnsmasq (Collin Funk <collin.funk1@...il.com>)
Re: Questionable CVE's reported against dnsmasq (Demi Marie Obenour <demiobenour@...il.com>)
Re: Questionable CVE's reported against dnsmasq (Russ Allbery <eagle@...ie.org>)

November 2 (3 messages)

Re: Questionable CVE's reported against dnsmasq (Solar Designer <solar@...nwall.com>)
Re: Questionable CVE's reported against dnsmasq (Jeremy Stanley <fungi@...goth.org>)
Re: Questionable CVE's reported against dnsmasq ("Olle E. Johansson" <oej@...ina.net>)

November 3 (4 messages)

Re: Questionable CVE's reported against dnsmasq (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Questionable CVE's reported against dnsmasq (Russ Allbery <eagle@...ie.org>)
Re: Questionable CVE's reported against dnsmasq (Art Manion <zmanion@...tonmail.com>)
Re: Questionable CVE's reported against dnsmasq (Demi Marie Obenour <demiobenour@...il.com>)

November 4 (9 messages)

[SECURITY ADVISORY] wcurl path traversal with percent-encoded slashes (Daniel Stenberg <daniel@...x.se>)
[OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE P… (Jeremy Stanley <fungi@...goth.org>)
Re: Questionable CVE's reported against dnsmasq ("Olle E. Johansson" <oej@...ina.net>)
Becoming a CVE Naming Authority for your project (Rodrigo Freire <rfreire@...hat.com>)
CVE-2025-58337: Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-serve… (Mingyu Chen <morningman@...che.org>)
Re: Questionable CVE's reported against dnsmasq (Art Manion <zmanion@...tonmail.com>)
[CVE-2019-18860] SQUID-2023:6 Cross Site Scripting in cachemgr.cgi (Amos Jeffries <squid3@...enet.co.nz>)
Re: [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorizat… (Demi Marie Obenour <demiobenour@...il.c…)
Re: Becoming a CVE Naming Authority for your project (Greg KH <greg@...ah.com>)

November 5 (18 messages)

Re: [CVE-2019-18860] SQUID-2023:6 Cross Site Scripting in cachemgr.cgi (Solar Designer <solar@...nwall.com>)
[SECURITY ADVISORY] curl: missing SFTP host verification with wolfSSH (Daniel Stenberg <daniel@...x.se>)
runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 (Aleksa Sarai <cyphar@...har.com>)
Xen Security Advisory 471 v3 (CVE-2024-36350,CVE-2024-36357) - x86: Transitive Scheduler Attacks (Xen.org security team <security@....org>)
[CVE-2025-54574] SQUID-2025:1 Buffer Overflow in URN Handling (Amos Jeffries <squid3@...enet.co.nz>)
[CVE-2025-62168] SQUID-2025:2 Information Disclosure in Error handling (Amos Jeffries <squid3@...enet.co.nz>)
Re: [CVE-2019-18860] SQUID-2023:6 Cross Site Scripting in cachemgr.cgi (Amos Jeffries <squid3@...enet.co.nz>)
Re: Becoming a CVE Naming Authority for your project ("Olle E. Johansson" <oej@...ina.net>)
Re: Questionable CVE's reported against dnsmasq ("Olle E. Johansson" <oej@...ina.net>)
Re: Becoming a CVE Naming Authority for your project (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Becoming a CVE Naming Authority for your project (Yogesh Mittal <ymittal@...hat.com>)
Django CVE-2025-64458 and CVE-2025-64459 (Natalia Bidart <nataliabidart@...ngoproject.com>)
Re: [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (… (Jeremy Stanley <fungi@...goth.org>)
Re: Becoming a CVE Naming Authority for your project (Matthew Fernandez <matthew.fernandez@...il.com>)
Re: Becoming a CVE Naming Authority for your project (Art Manion <zmanion@...tonmail.com>)
Re: Becoming a CVE Naming Authority for your project (Pedro Sampaio <psampaio@...hat.com>)
Re: Becoming a CVE Naming Authority for your project (Pedro Sampaio <psampaio@...hat.com>)
Re: Questionable CVE's reported against dnsmasq (Pedro Sampaio <psampaio@...hat.com>)

November 6 (6 messages)

scx: Unauthenticated scx_loader D-Bus Service can lead to major Denial-of-Service (Matthias Gerstner <mgerstner@...e.de>)
Re: runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 ("akendo@...ndo.eu" <akendo@...ndo.eu>)
Re: Questionable CVE's reported against dnsmasq ("Olle E. Johansson" <oej@...ina.net>)
Re: Becoming a CVE Naming Authority for your project ("Olle E. Johansson" <oej@...ina.net>)
Re: Becoming a CVE Naming Authority for your project (Pat Gunn <pgunn01@...il.com>)
Re: Becoming a CVE Naming Authority for your project (Jeremy Stanley <fungi@...goth.org>)

November 7 (2 messages)

Re: Becoming a CVE Naming Authority for your project (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 (Ali Polatel <alip@...sys.org>)

November 11 (10 messages)

CVE-2025-59118: Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload (Jacques Le Roux <jleroux@...che.org>)
CVE-2025-61623: Apache OFBiz: Reflected Cross-site Scripting (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-47866 Ceph: RGW DoS via improper input validation. ("Sage [They / Them] McTaggart" <amctagga@...hat.com>)
CVE-2025-64401: Apache OpenOffice: Remote documents loaded without prompt via IFrame (Arrigo Marchiori <ardovm@...che.org>)
CVE-2025-64402: Apache OpenOffice: Remote documents loaded without prompt via OLE objects (Arrigo Marchiori <ardovm@...che.org>)
CVE-2025-64403: Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc (Arrigo Marchiori <ardovm@...che.org>)
CVE-2025-64404: Apache OpenOffice: Remote documents loaded without prompt via background and bullet images (Arrigo Marchiori <ardovm@...che.org>)
CVE-2025-64405: Apache OpenOffice: Remote documents loaded without prompt via DDE function (Arrigo Marchiori <ardovm@...che.org>)
CVE-2025-64406: Apache OpenOffice: Possible memory corruption during CSV import (Arrigo Marchiori <ardovm@...che.org>)
CVE-2025-64407: Apache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variab… (Arrigo Marchiori <ardovm@...che.org>)

November 12 (2 messages)

CVE-2025-57812 libcupsfilters, cups-filters 1.x: Multiple TIFF-related issues in libcupsfilters (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2025-64503 libcupsfilters, cups-filters 1.x: out of bounds write in pdftoraster (Zdenek Dohnal <zdohnal@...hat.com>)

November 13 (2 messages)

Re: Questionable CVE's reported against dnsmasq (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Questionable CVE's reported against dnsmasq (Alexander Patrakov <patrakov@...il.com>)

November 14 (7 messages)

Re: Questionable CVE's reported against dnsmasq (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Questionable CVE's reported against dnsmasq (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2025-40300 / VMScape (Bjoern Franke <bjo@...afweide.org>)
Re: CVE-2025-40300 / VMScape (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Questionable CVE's reported against dnsmasq (Jeffrey Walton <noloader@...il.com>)
Re: CVE-2025-40300 / VMScape (Moritz Mühlenhoff <jmm@...til.org>)
PostgreSQL releases fixes for CVE-2025-12817 & CVE-2025-12818 (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 15 (1 message)

Re: Questionable CVE's reported against dnsmasq (Peter Gutmann <pgut001@...auckland.ac.nz>)

November 16 (1 message)

Re: [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorizat… (Salvatore Bonaccorso <carnil@...ian.org…)

November 17 (6 messages)

GitGuardian GGShield SSL/TLS Verification Bypass (No CVE) (tanish saxena <tanish.saxena26@...il.com>)
Re: CVE-2025-40300 / VMScape (Bjoern Franke <bjo@...afweide.org>)
Re: CVE-2025-40300 / VMScape (Solar Designer <solar@...nwall.com>)
lightdm-kde-greeter: Privilege Escalation from lightdm Service User to root in KAuth Helper Service (CVE-2025-62876) (Matthias Gerstner <mgerstner@...e.de>)
Re: [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (… (Jeremy Stanley <fungi@...goth.org>)
[OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE-2… (Jeremy Stanley <fungi@...goth.org>)

November 18 (10 messages)

[SECURITY PATCH 0/8] GRUB2 vulnerabilities - 2025/11/18 (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 1/8] commands/test: Fix error in recursion depth calculation (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 2/8] kern/file: Call grub_dl_unref() after fs->fs_close() (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 3/8] net/net: Unregister net_set_vlan command on unload (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 4/8] gettext/gettext: Unregister gettext command on module unload (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 5/8] normal/main: Unregister commands on module unload (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 6/8] tests/lib/functional_test: Unregister commands on module unload (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 7/8] commands/usbtest: Use correct string length field (Daniel Kiper <daniel.kiper@...cle.com>)
[SECURITY PATCH 8/8] commands/usbtest: Ensure string length is sufficient in usb string processing (Daniel Kiper <daniel.kiper@...cle.com>)
Re: SQLite - Integer Overflow in FTS5 Extension [CVE-2025-7709] ("John Hein" <josec-ml0@...mail.com>)

November 19 (1 message)

CVE-2025-64408: Apache Causeway: Java deserialization vulnerability to authenticated attackers (Dan Haywood <danhaywood@...che.org>)

November 20 (2 messages)

CVE-2025-64524 cups-filters: Heap Buffer Overflow in rastertopclx Filter Leading to Potential Arbitrary Code Execution (Zdenek Dohnal <zdohnal@...hat.com>)
gnutls 3.8.11 released with fix for CVE-2025-9820 (Alan Coopersmith <alan.coopersmith@...cle.com>)

November 22 (1 message)

libpng 1.6.51: Four buffer overflow vulnerabilities fixed: CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-65018 (Cosmin Truta <ctruta@...il.com>)

November 24 (1 message)

CVE-2025-65998: Apache Syncope: Default AES key used for internal password encryption (Francesco Chicchiriccò <ilgrosso@...che.org>)

November 26 (4 messages)

CVE-2025-59390: Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. (Karan Kumar <karan@...che.org>)
5 CVE's fixed in Fluent Bit (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-62728: Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS … (Stamatis Zampetakis <zabetak@...che.org…)
Unbound: 1.24.2 addresses CVE-2025-11411 (again) (Yorgos Thessalonikefs <yorgos@...etlabs.nl>)

November 27 (5 messages)

CVE-2025-54057: Apache SkyWalking: Stored XSS vulnerability (Zhenxu Ke <kezhenxu94@...che.org>)
CVE-2025-59302: Apache CloudStack: Potential remote code execution on Javascript engine defined rules (Harikrishna Patnala <harikrishna@...che.org>)
CVE-2025-59454: Apache CloudStack: Lack of user permission validation leading to data leak for few APIs (Harikrishna Patnala <harikrishna@...che.org>)
CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues (Zdenek Dohnal <zdohnal@...hat.com>)

November 28 (3 messages)

CVE-2023-48796: Apache DolphinScheduler: Sensitive information disclosure (Lidong Dai <lidongdai@...che.org>)
CVE-2025-59790: Apache Kvrocks: RESET command grants admin privileges (Hulk Lin <hulk@...che.org>)
CVE-2025-59792: Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins (Hulk Lin <hulk@...che.org>)

106 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.