Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list

• 2024/10/08 #4: Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Solar Designer <solar@...nwall.com>)
• 2024/10/08 #3: CVE-2024-45720: Apache Subversion: Command line argument injection on Windows platforms (Stefan Sperling <stsp@...che.org>)
• 2024/10/08 #2: Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Simon Josefsson <simon@...efsson.org>)
• 2024/10/08 #1: Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Solar Designer <solar@...nwall.com>)
• 2024/10/06 #1: [vim-security] use-after-free when closing buffers in Vim < 9.1.0764 (Christian Brabandt <cb@...bit.org>)
• 2024/10/05 #2: OSSA-2024-004 / CVE-2024-47211: OpenStack Ironic <26.1.1 fails to verify checksums of supplied image_source URLs when configured to c… (Jay Faulkner <jay@....cc>)
• 2024/10/05 #1: Re: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Simon Josefsson <simon@...efsson.org>)
• 2024/10/04 #5: CVE-2024-8508 in Unbound DNS server prior to 1.21.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/10/04 #4: Re: CVE-2024-42415: Integer Overflow in GNOME libgsf (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/10/04 #3: CVE-2024-42415: Integer Overflow in GNOME libgsf (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/10/04 #2: CVE-2024-47191: Local root exploit in the PAM module pam_oath.so (Johannes Segitz <jsegitz@...e.de>)
• 2024/10/04 #1: Re[2]: cups-browsed vulnerable to DDoS amplification attack (larry0@...com)
• 2024/10/03 #6: Re: cups-browsed vulnerable to DDoS amplification attack (Larry Cashdollar <larry0@...com>)
• 2024/10/03 #5: Re: cups-browsed vulnerable to DDoS amplification attack ("Peter van Dijk" <peter@...ts.nl>)
• 2024/10/03 #4: cups-browsed vulnerable to DDoS amplification attack (Larry Cashdollar <larry0@...com>)
• 2024/10/03 #3: PowerDNS Security Advisory 2024-04 (Otto Moerbeek <otto.moerbeek@...erdns.com>)
• 2024/10/03 #2: CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader ("Gary D. Gregory" <ggregory@...che.org>)
• 2024/10/03 #1: CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK) (Martin Tzvetanov Grigorov <mgrigorov@...che.org>)
• 2024/10/02 #1: Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
• 2024/09/29 #1: CVE-2024-45772: Apache Lucene Replicator: Deserialization of Untrusted Data (Robert Muir <rmuir@...che.org>)
• 2024/09/27 #8: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Sam Bull <9m199i@...bull.org>)
• 2024/09/27 #7: Re: List linux CVEs for a given stable release? (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)
• 2024/09/27 #6: Re: CUPS printing system vulnerabilities (Will Dormann <will.dormann@...lygence.com>)
• 2024/09/27 #5: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Fabian Bäumer <fabian.baeumer@....de>)
• 2024/09/27 #4: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Alexander Patrakov <patrakov@...il.com>)
• 2024/09/27 #3: Re: CUPS printing system vulnerabilities (Michael Sweet <msweet@...eet.org>)
• 2024/09/27 #2: Re: CUPS printing system vulnerabilities (Mark Esler <mark.esler@...onical.com>)
• 2024/09/27 #1: Re: CUPS printing system vulnerabilities (Zdenek Dohnal <zdohnal@...hat.com>)
• 2024/09/26 #7: Re: CUPS printing system vulnerabilities (Solar Designer <solar@...nwall.com>)
• 2024/09/26 #6: Re: CUPS printing system vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/09/26 #5: CUPS printing system vulnerabilities (Solar Designer <solar@...nwall.com>)
• 2024/09/26 #4: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Solar Designer <solar@...nwall.com>)
• 2024/09/26 #3: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Fabian Bäumer <fabian.baeumer@....de>)
• 2024/09/26 #2: CVE-2024-47197: Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published … (Slawomir Jaranowski <sjaranowski@...che…)
• 2024/09/26 #1: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (LinkinStar <linkinstar@...che.org>)
• 2024/09/25 #8: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Jeffrey Walton <noloader@...il.com>)
• 2024/09/25 #7: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Demi Marie Obenour <demi@...isiblethingslab.com>)
• 2024/09/25 #6: RE: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses ("Goldberg, Adam" <Adam.Goldberg@...y.com>)
• 2024/09/25 #5: Re: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Solar Designer <solar@...nwall.com>)
• 2024/09/25 #4: WebKitGTK and WPE WebKit Security Advisory WSA-2024-0005 (Adrian Perez de Castro <aperez@...lia.com>)
• 2024/09/25 #3: Re: CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length (Sandipan Roy <saroy@...hat.com>)
• 2024/09/25 #2: CVE-2024-40761: Apache Answer: Avatar URL leaked user email addresses (Enxin Xie <linkinstar@...che.org>)
• 2024/09/25 #1: CVE-2024-23454: Apache Hadoop: Temporary File Local Information Disclosure (Shilun Fan <slfan1989@...che.org>)
• 2024/09/24 #4: Re: CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length (Solar Designer <solar@...nwall.com>)
• 2024/09/24 #3: CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length (Joel GUITTET <jguittet@...ekio.com>)
• 2024/09/24 #2: CVE-2024-39928: Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability (Heping Wang <peacewong@...che.org>)
• 2024/09/24 #1: Xen Security Advisory 462 v2 (CVE-2024-45817) - x86: Deadlock in vlapic_error() (Xen.org security team <security@....org>)
• 2024/09/23 #2: CVE-2024-38286: Apache Tomcat: Denial of Service (Mark Thomas <markt@...che.org>)
• 2024/09/23 #1: CVE-2024-46544: Apache Tomcat Connectors: mod_jk: local users can view and modify configuration (Mark Thomas <markt@...che.org>)
• 2024/09/21 #1: CVE-2024-42323: Apache HertzBeat: RCE by snakeYaml deser load malicious xml (Chao Gong <gongchao@...che.org>)
• 2024/09/20 #1: Performance Co-Pilot (PCP): pmcd network daemon security issues and review results (CVE-2024-45769), (CVE-2024-45770) (Matthias Gerstner <mgerstner@...e.de>)
• 2024/09/17 #2: CVE-2024-45537: Apache Druid: Users can provide MySQL JDBC properties not on allow list (Karan Kumar <karan@...che.org>)
• 2024/09/17 #1: CVE-2024-45384: Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cook… (Karan Kumar <karan@...che.org>)
• 2024/09/11 #2: CVE-2024-22399: Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server (Min Ji <jimin@...che.org>)
• 2024/09/11 #1: [SECURITY ADVISORY] curl: CVE-2024-8096: OCSP stapling bypass with GnuTLS (Daniel Stenberg <daniel@...x.se>)
• 2024/09/09 #1: CVE-2024-6655 Library injection from CWD in GTK-2/GTK-3 (Dimitrios Glynos <dglynos.pub@...il.com>)
• 2024/09/07 #3: Security fixes available in Python 3.13.0RC2, 3.12.6, 3.11.10, 3.10.15, 3.9.20, and 3.8.20 (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/09/07 #2: CVE-2024-45751: CHAP authentication bypass in user-space Linux target framework (tgt) up to v1.0.92 (David Gstir <david@...ma-star.at>)
• 2024/09/07 #1: libpcap 1.10.5 released with two security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/09/06 #4: CVE-2024-7012, CVE-2024-7923: Authentication bypass in Foreman & Pulpcore (Christian Hoffmann <christian@...fie.info>)
• 2024/09/06 #3: CVE-2024-45034: Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes (Ephraim Anierobi <ephraimanierobi@...che.org>)
• 2024/09/06 #2: CVE-2024-45498: Apache Airflow: Command Injection in an example DAG (Ephraim Anierobi <ephraimanierobi@...che.org>)
• 2024/09/06 #1: Re: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() (Michael Ellerman <mpe@...erman.id.au>)
• 2024/09/05 #1: Go 1.23.1 and Go 1.22.7 released with 3 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/09/04 #4: [OSSA-2024-003] OpenStack Ironic: Unvalidated image data passed to qemu-img (CVE-2024-44082) (Brian Rosmaita <rosmaita.fossdev@...il.com>)
• 2024/09/04 #3: CVE-2024-43402: Rust before 1.81.0 didn't fully fix argument escaping for batch files ("Pietro Albini" <pietro@...troalbini.org>)
• 2024/09/04 #2: Re: CVE-2024-45310: runc can be tricked into creating empty files/directories on host (Aleksa Sarai <cyphar@...har.com>)
• 2024/09/04 #1: Webmin UDP/10000 discovery service Loop DoS (COK-2024-05-05) (Sergei G <serg.gordey@...il.com>)
• 2024/09/03 #7: CVE-2024-45507: Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE (Jacques Le Roux <jleroux@...che.org>)
• 2024/09/03 #6: CVE-2024-45195: Apache OFBiz: Confused controller-view authorization logic (forced browsing) (Jacques Le Roux <jleroux@...che.org>)
• 2024/09/03 #5: CPython: [CVE-2024-6232] Regular-expression DoS when parsing TarFile headers (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/09/03 #4: CVE-2024-6119: OpenSSL: Possible denial of service in X.509 name checks (Tomas Mraz <tomas@...nssl.org>)
• 2024/09/03 #3: Django CVE-2024-45230 and CVE-2024-45231 (Natalia Bidart <nataliabidart@...ngoproject.com>)
• 2024/09/03 #2: Re: CVE-2024-45310: runc can be tricked into creating empty files/directories on host ("Mike O'Connor" <mjo@...o.mi.org>)
• 2024/09/03 #1: CVE-2024-45310: runc can be tricked into creating empty files/directories on host (Aleksa Sarai <cyphar@...har.com>)
• 2024/09/02 #2: Re: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() (Solar Designer <solar@...nwall.com>)
• 2024/09/02 #1: Linux kernel: memory leak in arch/powerpc/platforms/powernv/opal-irqchip.c: opal_event_init() ("2639161967" <2639161967@...com>)
• 2024/08/31 #1: [vim-security] heap-buffer-overflow in Vim > 9.1.0038 && < 9.1.0707 (Christian Brabandt <cb@...bit.org>)
• 2024/08/26 #1: CVE-2023-49582: Apache Portable Runtime (APR): Unexpected lax shared memory permissions (Eric Covener <covener@...che.org>)
• 2024/08/25 #1: [vim-security] heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697 (Christian Brabandt <cb@...bit.org>)
• 2024/08/23 #2: Re: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Fay Stegerman <flx@...usk.net>)
• 2024/08/23 #1: Re: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Fay Stegerman <flx@...usk.net>)
• 2024/08/22 #4: Re: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Fay Stegerman <flx@...usk.net>)
• 2024/08/22 #3: [vim-security] heap-buffer-overflow in do_search() in Vim < 9.1.0689 (Christian Brabandt <cb@...bit.org>)
• 2024/08/22 #2: gh:facebook/rocksdb v9.5.2 - SupplyChainAttackPoC for Meta BB (Andreas Stieger <Andreas.Stieger@....de>)
• 2024/08/22 #1: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2024/08/21 #3: CVE-2024-41937: Apache Airflow: Stored XSS Vulnerability on provider link (Ephraim Anierobi <ephraimanierobi@...che.org>)
• 2024/08/21 #2: CVE-2023-49198: Apache SeaTunnel Web: Arbitrary file read vulnerability (Jun Gao <gaojun2048@...che.org>)
• 2024/08/21 #1: Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
• 2024/08/20 #3: CVE-2024-22281: Apache Helix Front (UI): Helix front hard-coded secret in the express-session (Junkai Xue <jxue@...che.org>)
• 2024/08/20 #2: CVE-2024-43202: Apache DolphinScheduler: Remote Code Execution Vulnerability (ShunFeng Cai <caishunfeng@...che.org>)
• 2024/08/20 #1: Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Steffen Nurpmeso <steffen@...oden.eu>)
• 2024/08/19 #2: Re: AI Cyber Challenge (AIxCC) semi-final results from DEF CON 32 (2024) ("David A. Wheeler" <dwheeler@...eeler.com>)
• 2024/08/19 #1: Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
• 2024/08/18 #1: Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Peter Gutmann <pgut001@...auckland.ac.nz>)
• 2024/08/17 #3: Re: AI Cyber Challenge (AIxCC) semi-final results from DEF CON 32 (2024) (Alfredo Ortega <ortegaalfredo@...il.com>)
• 2024/08/17 #2: Landlock Houdini fix: CVE-2024-42318 (Mickaël Salaün <mic@...ikod.net>)
• 2024/08/17 #1: Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
• 2024/08/16 #8: WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004 (Adrian Perez de Castro <aperez@...lia.com>)
• 2024/08/16 #7: AI Cyber Challenge (AIxCC) semi-final results from DEF CON 32 (2024) ("David A. Wheeler" <dwheeler@...eeler.com>)

30535 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.