oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2025/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 6	² 5	³ 8	⁴ 10	⁵ 5	⁶	⁷
⁸ 3	⁹ 1	¹⁰ 7	¹¹ 7	¹² 5	¹³	¹⁴ 2
¹⁵ 1	¹⁶ 4	¹⁷ 3	¹⁸ 3	¹⁹ 1	²⁰ 2	²¹
²²	²³	²⁴	²⁵	²⁶ 2	²⁷ 2	²⁸ 5
²⁹	³⁰	³¹

Messages by day:

December 1 (6 messages)

CVE-2025-59789: Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser (Wang Weibing <wwbmmm@...che.org>)
CVE-2025-64775: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - S2-068 (Lukasz Lenart <lukaszlenart@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0008 (Adrian Perez de Castro <aperez@...lia.com>)
[kubernetes] CVE-2025-13281: Portworx Half-Blind SSRF in kube-controller-manager (Nathan Herz <nathan.herz97@...il.com>)
CVE-2025-12183 in lz4-java, fixed in new fork (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: 5 CVE's fixed in Fluent Bit (Christian Brabandt <cb@...bit.org>)

December 2 (5 messages)

expat looking for help with another unfixed non-public denial-of-service vulnerability [CVE-2025-66382] (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: 5 CVE's fixed in Fluent Bit (Christian Fischer <christian.fischer@...enbone.net>)
Django CVE-2025-13372 and CVE-2025-64460 (Natalia Bidart <nataliabidart@...ngoproject.com>)
Re: 5 CVE's fixed in Fluent Bit (Christian Brabandt <cb@...bit.org>)
[vim-security] A Windows uncontrolled search path vulnerability affects Vim < 9.1.1947 (Christian Brabandt <cb@...bit.org>)

December 3 (8 messages)

FW: X.Org Security Advisory: multiple security issues in xkbcomp (Peter Hutterer <peter.hutterer@...-t.net>)
Re: Questionable CVE's reported against dnsmasq (Christian Fischer <christian.fischer@...enbone.net>)
Re: 5 CVE's fixed in Fluent Bit (Christian Fischer <christian.fischer@...enbone.net>)
CVE-2025-55182: RCE in React Server Components (Jan Schaumann <jschauma@...meister.org>)
libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Cosmin Truta <ctruta@...il.com>)
Re: libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Cosmin Truta <ctruta@...il.com>)
Re: libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Greg Roelofs <roelofs@...ix.com>)

December 4 (10 messages)

CVE-2025-53960: Apache StreamPark: Use the user’s password as the secret key Vulnerability (Huajie Wang <benjobs@...che.org>)
CVE-2025-66516: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scop… (Tim Allison <tallison@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0009 (Adrian Perez de Castro <aperez@...lia.com>)
CVE-2025-55753: Apache HTTP Server: mod_md (ACME), unintended retry intervals (Eric Covener <covener@...che.org>)
CVE-2025-58098: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (Eric Covener <covener@...che.org>)
CVE-2025-59775: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (Eric Covener <covener@...che.org>)
CVE-2025-65082: Apache HTTP Server: CGI environment variable override (Eric Covener <covener@...che.org>)
CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (Eric Covener <covener@...che.org>)
Re: [webkit-gtk] WebKitGTK and WPE WebKit Security Advisory WSA-2025-0009 (Adrian Perez de Castro <aperez@...lia.com>)
React2Shell (CVE-2025-55182/CVE-2025-66478) (Jeffrey Walton <noloader@...il.com>)

December 5 (5 messages)

Island: Sandboxing tool powered by Landlock (Mickaël Salaün <mic@...ikod.net>)
CVE-2025-66566 fixed in lz4-java 1.10.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Go 1.25.5 and Go 1.24.11 are released - fix CVE-2025-61729 & CVE-2025-61727 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-66418 & CVE-2025-66471 fixed in urllib3 2.6.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CPython vulnerable to CVE-2025-13836, CVE-2025-13837, & CVE-2025-12084 (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 8 (3 messages)

PowerDNS Security Announcement 2025-07 and 2025-08 regarding PowerDNS Recursor (Otto Moerbeek <otto.moerbeek@...erdns.com>)
CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (Brad House <brad@...d-house.com>)
Re: CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (Demi Marie Obenour <demiobenour@...il.com>)

December 9 (1 message)

CVE-2025-26866: Apache HugeGraph-Server: RAFT and deserialization vulnerability (VGalaxies <vgalaxies@...che.org>)

December 10 (7 messages)

EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption (Heiko Schlittermann <hs@...marc.schlittermann.de>)
CVE-2025-66675: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges … (Lukasz Lenart <lukaszlenart@...che.org>)
LibreOffice puts searched text into the PRIMARY selection (Linux, X11) (Vincent Lefevre <vincent@...c17.net>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Re: LibreOffice puts searched text into the PRIMARY selection (Linux, X11) (Marco Moock <mm@...fdsl.de>)
smb4k: Major Vulnerabilities in KAuth Helper (CVE-2025-66002, CVE-2025-66003) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2025-8110 in Gogs self-hosted git service (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 11 (7 messages)

Re: LibreOffice puts searched text into the PRIMARY selection (Linux, X11) (Vincent Lefevre <vincent@...c17.net>)
Update: EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2025-8110 in Gogs self-hosted git service (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2025-8110 in Gogs self-hosted git service (Martin Weinelt <martin@...uxlounge.net>)
CVE-2025-23408: Apache Fineract: weak password policy (Adam Monsen <meonkeys@...che.org>)
CVE-2025-58130: Apache Fineract: Server Key not masked (Adam Monsen <meonkeys@...che.org>)
CVE-2025-58137: Apache Fineract: IDOR via self-service API (Adam Monsen <meonkeys@...che.org>)

December 12 (5 messages)

CVE-2025-66388: Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2025-65995: Apache Airflow: Disclosure of secrets to UI via kwargs (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2025-54947: Apache StreamPark: Use hard-coded key vulnerability (Huajie Wang <benjobs@...che.org>)
CVE-2025-54981: Apache StreamPark: Weak Encryption Algorithm in StreamPark (Huajie Wang <benjobs@...che.org>)
Re: CVE-2025-54947: Apache StreamPark: Use hard-coded key vulnerability (Solar Designer <solar@...nwall.com>)

December 14 (2 messages)

Re: Update: CVE-2025-67896: EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption (Heiko Schlittermann <hs@...marc.schlittermann.de>)
additional React vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779) (Jan Schaumann <jschauma@...meister.org>)

December 15 (1 message)

uriparser 1.0.0 fixes CVE-2025-67899 (DoS, CWE-674) (Sebastian Pipping <sebastian@...ping.org>)

December 16 (4 messages)

XXE vulnerabilities in electronic invoicing software (Kivitendo, peppol-py, ZUV) (Hanno Böck <hanno@...eck.de>)
Dropbear 2025.89 fixes privilege escalation, CVE-2025-14282 (Matt Johnston <matt@....asn.au>)
CVE-2025-67895: Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2 (Jarek Potiuk <potiuk@...che.org>)
[CVE-2025-14282] dropbear: privilege escalation via unix domain socket forwardings (turistu@...il.com)

December 17 (3 messages)

Re: [CVE-2025-14282] dropbear: privilege escalation via unix domain socket forwardings (Jacob Bachmeyer <jcb62281@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0010 (Adrian Perez de Castro <aperez@...lia.com>)
[kubernetes] CVE-2025-14269: Credential caching in Headlamp with Helm enabled (Craig Ingram <cjingram@...gle.com>)

December 18 (3 messages)

CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2025-66524: Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor (David Handermann <exceptionfactory@...che.org>)
Release: CVE-2025-67896: EXIM-Security-2025-12-09.1: Exim 4.99.1 released (Heiko Schlittermann <hs@...marc.schlittermann.de>)

December 19 (1 message)

Avahi simple protocol server accepts unlimited connections [CVE-2025-59529] (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 20 (2 messages)

Re: A couple of security issues? (Greg KH <greg@...ah.com>)
A couple of security issues? ("Artem S. Tashkinov" <aros@....com>)

December 26 (2 messages)

CVE-2018-25153 against GNU barcode seems bogus (Collin Funk <collin.funk1@...il.com>)
[Advisory] WebKit/iOS 26.2: Gigacage Boundary Violation via Logic Flaw enabling OOB Access (Joseph Goydish II <newt0ns_law@...ton.me>)

December 27 (2 messages)

CVE-2025-68460/CVE-2025-68461: Roundcube XSS + I-D prior to 1.5.12/1.6.12 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2025-68637: : Insecure SSL Configuration in Uniffle HTTP Client (roryqi <jerqi1242949407@...il.com>)

December 28 (5 messages)

Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Solar Designer <solar@...nwall.com>)
Re: Many vulnerabilities in GnuPG (Solar Designer <solar@...nwall.com>)
Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Many vulnerabilities in GnuPG (Jacob Bachmeyer <jcb62281@...il.com>)

82 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.