oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list

	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2020	52	47	38	82	70	67	76	64	71	84
2019	102	48	49	86	51	103	107	80	71	75	67	70
2018	122	81	84	81	71	104	71	135	78	120	75	84
2017	252	278	171	171	209	278	225	157	214	162	196	93
2016	258	207	271	183	267	193	214	184	287	294	257	241
2015	377	336	355	319	277	243	266	197	195	206	205	208
2014	214	252	249	211	183	317	273	201	413	485	382	318
2013	217	323	246	258	200	201	260	265	163	203	182	199
2012	333	189	294	216	234	128	150	207	234	192	191	161
2011	153	169	318	354	159	224	258	164	137	203	241	146
2010	72	96	123	118	115	142	119	144	203	84	187	139
2009	89	81	75	114	96	59	84	99	102	122	108	74
2008		104	103	143	136	112	150	125	127	123	128	107

Recent messages:

2020/10/27 #1: CVE-2020-25654 pacemaker: ACL restrictions bypass (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
2020/10/23 #1: CVE-2020-27174: Firecracker serial console emulation may allocate an unbounded amount of memory ("Iordache, Alexandra" <aghecen@...zon.com>)
2020/10/22 #1: CVE-2019-16127, CVE-2019-16128 and CVE-2019-16129 for Microchip code (Dimitrios Glynos <dimitris@...sus-labs.com>)
2020/10/21 #1: [CVE-2018-11764] Apache Hadoop Privilege escalation in web endpoint (Akira Ajisaka <aajisaka@...che.org>)
2020/10/20 #8: Re: CVE-2020-15999 fixed in FreeType 2.10.4 (Werner LEMBERG <wl@....org>)
2020/10/20 #7: CVE-2020-15999 fixed in FreeType 2.10.4 (Alan Coopersmith <alan.coopersmith@...cle.com>)
2020/10/20 #6: Xen Security Advisory 347 v2 - unsafe AMD IOMMU page table updates (Xen.org security team <security@....org>)
2020/10/20 #5: Xen Security Advisory 346 v2 - undue deferral of IOMMU TLB flushes (Xen.org security team <security@....org>)
2020/10/20 #4: Xen Security Advisory 345 v3 - x86: Race condition in Xen mapping code (Xen.org security team <security@....org>)
2020/10/20 #3: Xen Security Advisory 332 v3 - Rogue guests can cause DoS of Dom0 via high frequency events (Xen.org security team <security@....org>)
2020/10/20 #2: Xen Security Advisory 286 v4 - x86 PV guest INVLPG-like flushes may leave stale TLB entries (Xen.org security team <security@....org>)
2020/10/20 #1: Xen Security Advisory 331 v2 - Race condition in Linux event handler may crash dom0 (Xen.org security team <security@....org>)
2020/10/19 #4: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Simon McVittie <smcv@...ian.org>)
2020/10/19 #3: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Ian Zimmerman <itz@...y.loosely.org>)
2020/10/19 #2: [SECURITY][CVE-2020-13937] Unauthenticated Configuration Disclosure ("Xiaoxiang Yu" <xxyu@...che.org>)
2020/10/19 #1: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Solar Designer <solar@...nwall.com>)
2020/10/16 #5: [OSSA-2020-007] Blazar: Remote code execution in blazar-dashboard (CVE-2020-26943) (Pierre Riteau <pierre@...ckhpc.com>)
2020/10/16 #4: Re: CVE-2020-25656: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (Greg KH <gregkh@...uxfoundation.org>)
2020/10/16 #3: Re: CVE-2020-25656: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (Jiri Slaby <jirislaby@...nel.org>)
2020/10/16 #2: Kubernetes: Multiple secret leaks when verbose logging is enabled (Sam Fowler <sfowler@...hat.com>)
2020/10/16 #1: CVE-2020-25656: Linux kernel concurrency UAF in vt_do_kdgkb_ioctl (Minh Yuan <yuanmingbuaa@...il.com>)
2020/10/15 #1: CVE-2020-15157: containerd v1.2.x can be coerced into leaking credentials during image pull ("Karp, Samuel" <skarp@...zon.com>)
2020/10/14 #2: Re: CVE-2020-16120 - incorrect unprivileged overlayfs permission checking (Jordan Glover <Golden_Miller83@...tonmail.ch>)
2020/10/14 #1: Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Matthias Gerstner <mgerstner@...e.de>)
2020/10/13 #7: CVE-2020-16119 - Linux kernel DCCP CCID structure use-after-free (Steve Beattie <steve.beattie@...onical.com>)
2020/10/13 #6: CVE-2020-16120 - incorrect unprivileged overlayfs permission checking (Steve Beattie <steve.beattie@...onical.com>)
2020/10/13 #5: Re: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Solar Designer <solar@...nwall.com>)
2020/10/13 #4: kdeconnect: CVE-2020-26164: multiple security issues in kdeconnectd network daemon (Matthias Gerstner <mgerstner@...e.de>)
2020/10/13 #3: PowerDNS Recursor 4.3.5, 4.2.5. and 4.1.18 released fixing a cache pollution issue (CVE-2020-25829) (Otto Moerbeek <otto.moerbeek@...n-xchange.com>)
2020/10/13 #2: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Eli Schwartz <eschwartz@...hlinux.org>)
2020/10/13 #1: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Russ Allbery <eagle@...ie.org>)
2020/10/12 #11: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Brian May <brian@...uxpenguins.xyz>)
2020/10/12 #10: Re: You are using an old email address "@stahl.de". Please note our new email addresses "@r-stahl.com" (Jeffrey Walton <noloader@...il.com>)
2020/10/12 #9: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Jeffrey Walton <noloader@...il.com>)
2020/10/12 #8: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Kurt H Maier <khm@...ops.net>)
2020/10/12 #7: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Solar Designer <solar@...nwall.com>)
2020/10/12 #6: [CVE-2020-13957] The checks added to unauthenticated configset uploads in Apache Solr can be circumvented (Tomas Fernandez Lobbe <tflobbe@...che.org>)
2020/10/12 #5: Re: Gentoo's "contributing back" linux-distros tasks (Yury German <blueknight@...too.org>)
2020/10/12 #4: Linux kernel: crypto: bcm - Verify GCM/CCM key length in setkey (kiyin(尹亮) <kiyin@...cent.com>)
2020/10/12 #3: Re: Gentoo's "contributing back" linux-distros tasks (Anthony Liguori <aliguori@...n.com>)
2020/10/12 #2: Gentoo's "contributing back" linux-distros tasks (Solar Designer <solar@...nwall.com>)
2020/10/12 #1: [SECURITY] CVE-2020-13943 Apache Tomcat HTTP/2 Request mix-up (Mark Thomas <markt@...che.org>)
2020/10/09 #3: CVE-2018-20243: Apache Fineract: password passed in URL, not via POST (James Dailey <jamespdailey@...il.com>)
2020/10/09 #2: [CVE-2020-13955] Apache Calcite Disabled HTTPS Hostname Verification (Stamatis Zampetakis <zabetak@...il.com>)
2020/10/09 #1: Linux kernel: powerpc: RTAS calls can be used to compromise kernel integrity (Andrew Donnellan <ajd@...ux.ibm.com>)
2020/10/08 #8: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Seth Arnold <seth.arnold@...onical.com>)
2020/10/08 #7: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Georgi Guninski <gguninski@...il.com>)
2020/10/08 #6: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
2020/10/08 #5: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
2020/10/08 #4: [CVE-2020-13956] Apache HttpClient incorrect handling of malformed URI authority component (Oleg Kalnichevski <olegk@...che.org>)
2020/10/08 #3: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Giacomo Catenazzi <cate@...ian.org>)
2020/10/08 #2: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Jeffrey Walton <noloader@...il.com>)
2020/10/08 #1: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Seth Arnold <seth.arnold@...onical.com>)
2020/10/07 #8: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
2020/10/07 #7: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Brian May <brian@...uxpenguins.xyz>)
2020/10/07 #6: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Noel Kuntze <noel.kuntze@...rmi.consulting>)
2020/10/07 #5: Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Jeremy Stanley <fungi@...goth.org>)
2020/10/07 #4: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 (Georgi Guninski <gguninski@...il.com>)
2020/10/07 #3: Re: [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. (caveman رجل الكهف <toraboracaveman@...tonmail.com>)
2020/10/07 #2: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Georgi Guninski <gguninski@...il.com>)
2020/10/07 #1: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Greg KH <greg@...ah.com>)
2020/10/06 #14: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Steve Grubb <sgrubb@...hat.com>)
2020/10/06 #13: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Brian May <brian@...uxpenguins.xyz>)
2020/10/06 #12: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Simon McVittie <smcv@...ian.org>)
2020/10/06 #11: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Simon McVittie <smcv@...ian.org>)
2020/10/06 #10: CVE-2020-14355 spice: multiple buffer overflow vulnerabilities in QUIC decoding code (Mauro Matteo Cascella <mcascell@...hat.com>)
2020/10/06 #9: Re: CVE-2020-25641 kernel: soft lockup when submitting zero length bvecs. (Michael Ellerman <mpe@...erman.id.au>)
2020/10/06 #8: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Michael Ellerman <mpe@...erman.id.au>)
2020/10/06 #7: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Georgi Guninski <gguninski@...il.com>)
2020/10/06 #6: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Eli Schwartz <eschwartz@...hlinux.org>)
2020/10/06 #5: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Daniel Sprouse <daniel.a.sprouse@...il.com>)
2020/10/06 #4: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Grant Taylor <gtaylor@...tconsulting.net>)
2020/10/06 #3: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Stephen John Smoogen <smooge@...il.com>)
2020/10/06 #2: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Greg KH <greg@...ah.com>)
2020/10/06 #1: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Steve Grubb <sgrubb@...hat.com>)
2020/10/05 #5: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Solar Designer <solar@...nwall.com>)
2020/10/05 #4: Re: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Stephen John Smoogen <smooge@...il.com>)
2020/10/05 #3: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Ian Zimmerman <itz@...y.loosely.org>)
2020/10/05 #2: Re: major changes if gnu/linux dominates the desktop and/or mobile market? (Greg KH <greg@...ah.com>)
2020/10/05 #1: major changes if gnu/linux dominates the desktop and/or mobile market? (Georgi Guninski <gguninski@...il.com>)
2020/10/04 #2: Re: the Bugtraq list archives before 2000 (Solar Designer <solar@...nwall.com>)
2020/10/04 #1: the Bugtraq list archives before 2000 (Georgi Guninski <gguninski@...il.com>)
2020/10/02 #1: CVE-2020-25637 libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (Mauro Matteo Cascella <mcascell@...hat.com>)
2020/10/01 #1: [ANNOUNCE] Apache NiFi CVE-2020-9486, CVE-2020-9487, CVE-2020-9491, CVE-2020-13940 (Andy LoPresto <alopresto@...che.org>)
2020/09/30 #7: [cve-request@...re.org: Re: [scr966354] oniguruma regular expression library - fixed in devel version cbe9f8bd9cfc6c3c8… (Seth Arnold <seth.arnold@...onical.com>)
2020/09/30 #6: [CVE-2020-11979] Apache Ant insecure temporary file vulnerability (Stefan Bodewig <bodewig@...che.org>)
2020/09/30 #5: CVE-2020-10763 heketi: gluster-block volume password details available in logs (Hardik Vyas <hvyas@...hat.com>)
2020/09/30 #4: CVE-2020-10762 gluster-block: information disclosure through world-readable gluster-block log files (Hardik Vyas <hvyas@...hat.com>)
2020/09/30 #3: [CVE-2020-26149] NATS project vulnerabilities: nats.js, (nats.ws, nats.deno) (Phil Pennock <oss-security-phil@...dhuis.org>)
2020/09/30 #2: Re: CVE-2020-25641 kernel: soft lockup when submitting zero length bvecs. (Greg KH <greg@...ah.com>)
2020/09/30 #1: CVE-2020-25641 kernel: soft lockup when submitting zero length bvecs. (Wade Mealing <wmealing@...hat.com>)
2020/09/29 #3: [CVE-2020-13952] Apache Superset Information Disclosure Vulnerability (Will Barrett <barrett.william@...il.com>)
2020/09/29 #2: libass ass_outline.c signed integer overflow (Fstark <f734222792@...il.com>)
2020/09/29 #1: QEMU: NULL pointer derefrence issues (P J P <ppandit@...hat.com>)
2020/09/28 #3: DPDK security advisory for multiple vhost crypto issues (Ferruh Yigit <ferruh.yigit@...el.com>)
2020/09/28 #2: [ANNOUNCE] CVE-2020-13951 - Apache Openmeetings: DoS via public web service (Maxim Solodovnik <solomax@...che.org>)
2020/09/28 #1: CVE-2018-11765: Potential information disclosure in Hadoop Web interfaces (Akira Ajisaka <aajisaka@...che.org>)
2020/09/26 #1: [CVE-2020-13953] Apache Tapestry WEB-INF file download vulnerability ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)
2020/09/23 #1: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
2020/09/22 #11: [Fwd: [Pdns-announce] security advisories for Authoritative 4.3.1, 4.2.3, 4.1.14] (Peter van Dijk <peter.van.dijk@...erdns.com>)

26385 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.