oss-security mailing list - 2026/10

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 30	² 8	³	⁴ 2
⁵ 17	⁶ 3	⁷ 33	⁸ 10	⁹ 21	¹⁰ 8	¹¹ 1
¹² 7	¹³ 12	¹⁴ 12	¹⁵ 12	¹⁶ 39	¹⁷ 6	¹⁸ 6
¹⁹ 6	²⁰ 39	²¹ 31	²² 28	²³	²⁴	²⁵
²⁶	²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

October 1 (30 messages)

CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/styles… (James Netherton <jamesnetherton@...che.…)
CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels… (Stig Palmquist <stig@...g.io>)
CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_g… (Stig Palmquist <stig@...g.io>)
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (Eric Covener <covener@...che.org>)
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow (Eric Covener <covener@...che.org>)
CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service (Eric Covener <covener@...che.org>)
CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect (Eric Covener <covener@...che.org>)
CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack (Eric Covener <covener@...che.org>)
CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char (Eric Covener <covener@...che.org>)
CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} (Eric Covener <covener@...che.org>)
CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content (Eric Covener <covener@...che.org>)
CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (Eric Covener <covener@...che.org>)
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access (Eric Covener <covener@...che.org>)
CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTE… (Eric Covener <covener@...che.org>)
CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function (Eric Covener <covener@...che.org>)
CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling (Eric Covener <covener@...che.org>)
CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow (Eric Covener <covener@...che.org>)
CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure (Eric Covener <covener@...che.org>)
CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling (Eric Covener <covener@...che.org>)
CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack (Eric Covener <covener@...che.org>)
CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack (Eric Covener <covener@...che.org>)
CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure (Eric Covener <covener@...che.org>)
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow (Eric Covener <covener@...che.org>)

October 2 (8 messages)

CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41… (Masakazu Kitajo <maskit@...che.org>)
CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover (Dave Fisher <wave@...che.org>)
CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the … (Emmanuel Lécharny <elecharny@...che.or…)
CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values (Emmanuel Lécharny <elecharny@...che.org>)

October 4 (2 messages)

Apache Thrift 0.25.0: 61 CVEs fixed (combined announcement) (Jens Geyer <jensg@...che.org>)
cloud computing provider disclosures (Jan Schaumann <jschauma@...meister.org>)

October 5 (17 messages)

Re: cloud computing provider disclosures (Jonathan Wright <jonathan@...alinux.org>)
Re: cloud computing provider disclosures (Demi Marie Obenour <demiobenour@...il.com>)
Re: cloud computing provider disclosures (Aaron Rainbolt <arraybolt3@...il.com>)
Re: cloud computing provider disclosures (Katie <katie@...ricane.ca>)
openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/… ("Security @ Red Eagle Tech" <security@r…)
[cups] Multiple security fixes in incoming new version 2.4.20 (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which c… (Stig Palmquist <stig@...g.io>)
CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes (Stig Palmquist <stig@...g.io>)
CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for th… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests (Lukasz Lenart <lukaszlenart@...che.org>)
Re: cloud computing provider disclosures (Jan Schaumann <jschauma@...meister.org>)
Re: cloud computing provider disclosures (Jeremy Stanley <fungi@...goth.org>)
libexpat 2.9.0 fixes two vulnerabilities (Sebastian Pipping <sebastian@...ping.org>)
Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released (Chad Dougherty <crd@...rew.cmu.edu>)

October 6 (3 messages)

CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an … (Timothy Legge <timlegge@...nsec.org>)
Announce: OpenSSH 10.6 released (Damien Miller <djm@....openbsd.org>)
Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 (Sarah Boyce <sarahboyce@...ngoproject.com>)

October 7 (33 messages)

CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths (Michael Smith <michaelsmith@...che.org>)
CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans (Michael Smith <michaelsmith@...che.org>)
CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass (Michael Smith <michaelsmith@...che.org>)
FW: X.Org Security Advisory: multiple security issues in X.Org X server (Peter Hutterer <peter.hutterer@...-t.net>)
CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (Julian Reschke <reschke@...che.org>)
CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies… (Julian Reschke <reschke@...che.org>)
CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File (Jinwoo Hwang <jinwoo@...che.org>)
[OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pendi… (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-1… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSN-0109] Cross-project metric association bypass in Gnocchi (Goutham Pacha Ravi <gouthampravi@...il.com>)
tor-0.4.9.14 released (Sam James <sam@...too.org>)

October 8 (10 messages)

CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information… (Wenjun Ruan <wenjun@...che.org>)
Re: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover (Demi Marie Obenour <demiobenour@...il.com>)
OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) (TheSecguy <thesecguy45@...il.com>)
Fwd: Go 1.27.2 and Go 1.26.9 are released (Alan Coopersmith <alan.coopersmith@...cle.com>)
Fwd: Vulnerabilities in golang.org/x/net (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 9 (21 messages)

[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-938… (Jeremy Stanley <fungi@...goth.org>)
[OSSN-0110] Ironic can leak basic auth credentials to image server (Jay Faulkner <jay@....cc>)
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets (Xen.org security team <security@....org>)
CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) (Colm O hEigeartaigh <coheigea@...che.org…)
CVE-2026-79650: Apache CXF: OIDC RP Open Redirect (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state b… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of servic… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character l… (Colm O hEigeartaigh <coheigea@...che.or…)
Re: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) (Stuart Henderson <stu@...cehopper.org>)
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml (Andrea Cosentino <acosentino@...che.org>)
Multiple CVEs for illumos and distros: door server processes (Dan McDonald <danmcd@...decomputer.com>)
CVE for illumos and distros: VMM/BHYVE (Dan McDonald <danmcd@...decomputer.com>)
Unfixed vulnerabilities in Cyrus SASL (Alan Coopersmith <alan.coopersmith@...cle.com>)
mutt 2.4.3 released, fixes CVE-2026-107570 (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 10 (8 messages)

3 Vulnerabilities in GNU Aspell before 0.60.8.3 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption … (Lee Rhodes <leerho@...che.org>)
CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows m… (Lee Rhodes <leerho@...che.org>)
CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows … (Lee Rhodes <leerho@...che.org>)
CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial… (Lee Rhodes <leerho@...che.org>)
CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of ser… (Lee Rhodes <leerho@...che.org>)
CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list (Robert Rothenberg <rrwo@...nsec.org>)

October 11 (1 message)

Incomplete fix for Emacs CVE-2026-79992 (Sean Whitton <spwhitton@...hitton.name>)

October 12 (7 messages)

Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459) (Nebojša Jaćović <nebojsa.jacovic@...il.co…)
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-203… (Nebojša Jaćović <nebojsa.jacovic@gma…)
CVE-2026-92116: Apache Allura: OAuth1 missing callback validation (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-92119: Apache Allura: REST API Mass Assignment (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-92120: Apache Allura: Oauth1 Replay Attack (Dave Brondsema <dave@...ndsema.net>)
[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 (Christian Brabandt <cb@...bit.org>)
[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 (Christian Brabandt <cb@...bit.org>)

October 13 (12 messages)

Fwd: Announcing FreeType version 2.15.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding (Shuxin Pan <psxjoy@...che.org>)
Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update (Xen.org security team <security@....org>)
Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround (Xen.org security team <security@....org>)
Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems (Xen.org security team <security@....org>)
Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race (Xen.org security team <security@....org>)
Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states (Xen.org security team <security@....org>)
Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush (Xen.org security team <security@....org>)
Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak (Xen.org security team <security@....org>)
Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() (Xen.org security team <security@....org>)
Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 (Thomas GERBET <thomas@...bet.me>)
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) (Rainer Gerhards <rgerhards@...adiscon.com>)

October 14 (12 messages)

Hex 2.5.2 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape (fourie <littleddfu@...il.com>)
[SECURITY ADVISORIES] curl 8.23.0 (Daniel Stenberg <daniel@...x.se>)
Re: Incomplete fix for Emacs CVE-2026-79992 (Sam James <sam@...too.org>)
Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 (Sam James <sam@...too.org>)
Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup (Tomasz Kaye <tomasz.brain@...il.com>)
DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries (Maxime Coquelin <maxime.coquelin@...hat.com>)
Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader (Tomasz Kaye <tomasz.brain@...il.com>)
Godot 4.x: heap out-of-bounds write in Radiance HDR image loader (Tomasz Kaye <tomasz.brain@...il.com>)
Upcoming Node.js security release 2026/10/21 (Antoine du Hamel <duhamelantoine1995@...il.com>)
Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-338… (Oleh Konko <security@...al.org>)
NSD 4.15.3 security release (Willem Toorop <willem@...etlabs.nl>)

October 15 (12 messages)

Re: Incomplete fix for Emacs CVE-2026-79992 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup (Tomasz Kaye <tomasz.brain@...il.com>)
Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader (Tomasz Kaye <tomasz.brain@...il.com>)
Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader (Tomasz Kaye <tomasz.brain@...il.com>)
linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) (Jan Schaumann <jschauma@...meister.org>)
[vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201 (Christian Brabandt <cb@...bit.org>)
FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (eddyflores100@...il.com)
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (Solar Designer <solar@...nwall.com>)
CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log rea… (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddlewa… (Jarek Potiuk <potiuk@...che.org>)

October 16 (39 messages)

CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure (Li Yang <liyang@...che.org>)
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump (Li Yang <liyang@...che.org>)
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization (Li Yang <liyang@...che.org>)
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints (Li Yang <liyang@...che.org>)
CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass (Li Yang <liyang@...che.org>)
CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env (Li Yang <liyang@...che.org>)
CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup (Li Yang <liyang@...che.org>)
CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard (Li Yang <liyang@...che.org>)
CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation (Li Yang <liyang@...che.org>)
CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController (Li Yang <liyang@...che.org>)
CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) (Li Yang <liyang@...che.org>)
CVE-2026-108743: Apache Kylin: spark job OS command injection (Li Yang <liyang@...che.org>)
CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass (Li Yang <liyang@...che.org>)
CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF (Li Yang <liyang@...che.org>)
CVE-2026-108766: Apache Kylin: missing JDBC-config authorization (Li Yang <liyang@...che.org>)
CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization (Li Yang <liyang@...che.org>)
CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection (Li Yang <liyang@...che.org>)
CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue (Li Yang <liyang@...che.org>)
CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement (Li Yang <liyang@...che.org>)
CVE-2026-108833: Apache Kylin: default startup profile miss security settings (Li Yang <liyang@...che.org>)
CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion (Li Yang <liyang@...che.org>)
CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication (Enxin Xie <linkinstar@...che.org>)
CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show question… (Enxin Xie <linkinstar@...che.org>)
CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover (Enxin Xie <linkinstar@...che.org>)
CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup (Enxin Xie <linkinstar@...che.org>)
CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions (Enxin Xie <linkinstar@...che.org>)
CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension (Enxin Xie <linkinstar@...che.org>)
CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs (Bharath SM <bharathsm.hsk@...il.com>)
Infinity Core: Linux Kernel Core LPEs (Hyunwoo Kim <imv4bel@...il.com>)
Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries (Alan Coopersmith <alan.coopersmith@...cle.com>)
Text::CSV_XS versions before 1.65 for Perl (8 CVEs) (Stig Palmquist <stig@...g.io>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Solar Designer <solar@...nwall.com>)

October 17 (6 messages)

Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (eddyflores100@...il.com)
CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata ("Alexander A. Shvedov" <sigdevel@...amail.c…)
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Rihards Simanovics <security@...ffin-web.studio>)

October 18 (6 messages)

Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Martin Steigerwald <martin@...htvoll.de>)
Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0 (Andrea Cosentino <ancosen@...il.com>)
CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compi… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Jan Schaumann <jschauma@...meister.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) ("David A. Wheeler" <dwheeler@...eeler.com>)

October 19 (6 messages)

Linux KVM/x86: stale SMM MMIO cache bypasses write tracking (Jinu Kim <kimjw04271234@...il.com>)
CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Ca… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account (Jarek Potiuk <potiuk@...che.org>)
Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs) (Stig Palmquist <stig@...g.io>)
CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the defaul… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host v… (Adam Reeve <areeve@...che.org>)

October 20 (39 messages)

eMudhra Intermediates Compromise (Dennis Jackson <djackson@...illa.com>)
CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure (Arnout Engelen <engelen@...che.org>)
CVE-2026-108087: Apache Cocoon: SQL Injection (Arnout Engelen <engelen@...che.org>)
CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning (Arnout Engelen <engelen@...che.org>)
CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces (Arnout Engelen <engelen@...che.org>)
CVE-2025-52290: FFmpeg NULL pointer dereference in avpriv_h264_has_num_reorder_frames ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-55654: Use-after-free in GPAC/MP4Box gf_filter_pid_get_packet via crafted NHML export input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-55667: NULL pointer dereference in GPAC/MP4Box dump_isom_saps via crafted MP4 input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60480: Heap buffer overflow in GPAC/MP4Box gf_odf_ac4_cfg_alternative_info via crafted AC-4 file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Roundcube webmail: multiple vulnerabilities prior to 1.6.20 / 1.7.5 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user (Jan Lehnardt <jan@...che.org>)
CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session (Jan Lehnardt <jan@...che.org>)
CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely (Jan Lehnardt <jan@...che.org>)
CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence… (Jan Lehnardt <jan@...che.org>)
CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases (Jan Lehnardt <jan@...che.org>)
CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs (Jan Lehnardt <jan@...che.org>)
[OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856) (Brian Rosmaita <rosmaita.fossdev@...il.com>)
[OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195) (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: eMudhra Intermediates Compromise (Valtteri Vuorikoski <vuori@...com.org>)
[GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up (Mark Thomas <markt@...che.org>)
CVE-2026-74049: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) (Mark Thomas <markt@...che.org>)
CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not… (Mark Thomas <markt@...che.org>)
CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination (Mark Thomas <markt@...che.org>)
CVE-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures (Mark Thomas <markt@...che.org>)
CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms (Mark Thomas <markt@...che.org>)
CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing (Mark Thomas <markt@...che.org>)
CVE-2026-103119: Apache Tomcat: AJP response mix-up (Mark Thomas <markt@...che.org>)
Go 1.27.3 and Go 1.26.10 are released for CA certificate removal (Alan Coopersmith <alan.coopersmith@...cle.com>)
NSS 3.131.1 Release - Important Security Updates (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: eMudhra Intermediates Compromise (Jeffrey Walton <noloader@...il.com>)
Re: eMudhra Intermediates Compromise (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: eMudhra Intermediates Compromise (Jeffrey Walton <noloader@...il.com>)
Upcoming Critical PHP Security Release (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited conne… (Yusuf Can TURK <iamcanturk@...il.com>)
CVE-2026-113812: Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compro… (Stig Palmquist <stig@...g.io>)
CVE-2026-108518: DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is dest… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-111879: DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data do… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanza… (Robert Rothenberg <rrwo@...nsec.org>)

October 21 (31 messages)

CVE-2026-112202: Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images (Stig Palmquist <stig@...g.io>)
Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) (Hanno Böck <hanno@...eck.de>)
Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 (Weibing Wang <wwbmmm@...che.org>)
Re: eMudhra Intermediates Compromise (Solar Designer <solar@...nwall.com>)
Re: eMudhra Intermediates Compromise (Solar Designer <solar@...nwall.com>)
CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption (Jakub Zelenka <bukka@....net>)
CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Jakub Zelenka <bukka@....net>)
ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) (Andoni Duarte Pintado <andoni@....org>)
PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
PowerDNS Security Advisory 2026-13: Crafted packet using compression pointers can lead to denial of service (Miod Vallat <miod.vallat@...erdns.com>)
Unbound: 1.26.2 addresses multiple CVE items (Yorgos Thessalonikefs <yorgos@...etlabs.nl>)
Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) (LN Liberda <lauren@...fisekai.rocks>)
Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) (Hanno Böck <hanno@...eck.de>)
Re: eMudhra Intermediates Compromise (Hanno Böck <hanno@...eck.de>)
Re: eMudhra Intermediates Compromise (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Aaron Rainbolt <arraybolt3@...il.com>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Yves-Alexis Perez <corsac@...ian.org>)
CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bound… (Rich Felker <dalias@...c.org>)
CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver (Haonan Hou <haonan@...che.org>)
CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface (Haonan Hou <haonan@...che.org>)
CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation (Haonan Hou <haonan@...che.org>)
CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC (Haonan Hou <haonan@...che.org>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Aaron Rainbolt <arraybolt3@...il.com>)
Pillow 13.0.0 fixes long list of vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
Apache Pulsar: 14 CVEs fixed in 4.0.14, 4.2.5 and 5.0.0 (combined announcement) (Lari Hotari <lhotari@...che.org>)
Apache Pulsar Manager: CVE-2026-105944, missing authentication and admin credential disclosure; end of life (Lari Hotari <lhotari@...che.org>)
CVE-2026-113811: Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cl… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because syn… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never chec… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-A… (Robert Rothenberg <rrwo@...nsec.org>)
Re: eMudhra Intermediates Compromise (Jakub Wilk <jwilk@...lk.net>)

October 22 (28 messages)

Header Accordions: QPACK amplification attacks against HTTP/3 servers (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Christian Fischer <christian.fischer@...enbone.net>)
one more reason to update libpcap to at least 1.10.7 (Denis Ovsienko <denis@...ienko.info>)
aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass… (Hannes von Haugwitz <hannes@...haugwitz…)
aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5… (Hannes von Haugwitz <hannes@...haugwitz…)
[OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458) (Jay Faulkner <jay@....cc>)
[OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419) (Jay Faulkner <jay@....cc>)
Re: Upcoming Node.js security release 2026/10/21 (Alan Coopersmith <alan.coopersmith@...cle.com>)
[OSSN-0111] oslo.utils can log LUKS key material (Brian Rosmaita <rosmaita.fossdev@...il.com>)
CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing (Piotr Karwasz <pkarwasz@...che.org>)
Re: eMudhra Intermediates Compromise (Stuart Henderson <stu@...cehopper.org>)
Comodo AAA Services Root and S/MIME (Hanno Böck <hanno@...eck.de>)
Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux) (賴奇佑 <leon.lai@...ian.co.jp>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Nicolas Vigier <boklm@...s-attacks.org>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Jakub Zelenka <bukka@....net>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Lukas Tribus <lukas@...i.eu>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Emmanuel Fleury <emmanuel.fleury@...ordeaux.fr>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Emmanuel Fleury <emmanuel.fleury@...ordeaux.fr>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Markus Gschwendt <office+osssecurity@...out.at>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state ("Goetz T. Fischer" <g.fischer@...-c.de>)
CVE-2025-60469: NULL pointer dereference in GPAC/MP4Box AC-4 parser via crafted file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame r… ("Alexander A. Shvedov" <sigdevel@...ama…)
CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and… (Oleksii Molchanov <oleksii.molchanov.pe…)
Information for Python users regarding eMudhra / emSign CA certificate security incident (Alan Coopersmith <alan.coopersmith@...cle.com>)

331 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.