Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list - 2026/11/03

• Re: CVE-2026-98432: init_on_free=1 as an additional interim mitigation (Sultan Alsawaf <sultan@...neltoast.com>)
• Re: Brotli CVE-2026-111497 (Alan Coopersmith <alan.coopersmith@...cle.com>)
• CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords… (Robert Rothenberg <rrwo@...nsec.org>)
• CVE-2026-114442: Apache HertzBeat: incomplete XPath expression validation in aliasFields (Qingran Zhao <zhaoqingran@...che.org>)
• Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure (feng@...ora.ai)
• Xen Security Advisory 523 v2 (CVE-2026-102703,CVE-2026-102704) - arbitrary read/write via grant copy (Xen.org security team <security@....org>)
• [SECURITY] Apache Juneau 9.2.1 fixes multiple vulnerabilities (CVE-2026-73095, ..., CVE-2026-73117) (James Bognar <jamesbognar@...che.org>)
• Django CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733, and CVE-2026-114582 (Jacob Walls <jwalls@...ngoproject.com>)
• CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation (Andor Molnar <andor@...che.org>)
• CVE-2026-100252: Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID (Andor Molnar <andor@...che.org>)
• CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crash… (Andor Molnar <andor@...che.org>)
• CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling (Andor Molnar <andor@...che.org>)
• CVE-2026-115448: Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecover… (Andor Molnar <andor@...che.org>)
• OpenVox Server RCE and client impersonation vulnerabilities (Ben Ford <binford2k@...rlookinfratech.com>)
• CVE-2026-103582: Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWir… ("Christopher L. Shannon" <cshannon@...c…)
• CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection (Matt Pavlovich <mattrpav@...che.org>)
• CVE-2026-108946: Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches conne… ("Christopher L. Shannon" <cshannon@...c…)
• CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead t… ("Christopher L. Shannon" <cshannon@...c…)
• CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal… ("Christopher L. Shannon" <cshannon@...c…)
• CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocati… ("Christopher L. Shannon" <cshannon@...c…)
• CVE-2026-59263: Apache OpenOffice: Carefully crafted documents could display different data when opened with different pro… (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-59264: Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-59267: Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90626: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90627: Apache OpenOffice: Local file inclusion via SQL provider and flat file database references (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90628: Apache OpenOffice: Stack overflow in CFF hint handling (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90629: Apache OpenOffice: Out of bounds memory access during WMF import (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90632: Apache OpenOffice: Local file inclusion via GStreamer plugin (Arrigo Marchiori <ardovm@...che.org>)
• CVE-2026-90634: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files (Arrigo Marchiori <ardovm@...che.org>)

32 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.