oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 12	² 4	³ 7	⁴ 1	⁵	⁶ 3
⁷ 4	⁸ 21	⁹ 3	¹⁰ 2	¹¹ 6	¹²	¹³
¹⁴ 4	¹⁵	¹⁶ 4	¹⁷	¹⁸	¹⁹	²⁰
²¹ 8	²² 4	²³ 6	²⁴ 5	²⁵ 1	²⁶	²⁷
²⁸ 3	²⁹ 1	³⁰ 1	³¹ 2

Messages by day:

January 1 (12 messages)

wget / chromium: URL metadata and potential password leaks via extended filesystem attributes (Hanno Böck <hanno@...eck.de>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (Matthew Fernandez <matthew.fernandez@...il.com>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (nisse@...ator.liu.se (Niels Möller))
Re: Asserts considered harmful (or GMP spills its sensitive information) (Vincent Lefevre <vincent@...c17.net>)
Disabling ptrace (was Re: Asserts considered harmful (or GMP spills its sensitive information)) (nisse@...ator.liu.se (Niels Möller))
Re: Asserts considered harmful (or GMP spills its sensitive information) (nisse@...ator.liu.se (Niels Möller))
Re: Re: Asserts considered harmful (or GMP spills its sensitive information) (Simon McVittie <smcv@...ian.org>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (halfdog <me@...fdog.net>)
Re: Re: Asserts considered harmful (or GMP spills its sensitive information) (halfdog <me@...fdog.net>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (tg@...lib.org (Torbjörn Granlund))
Re: Asserts considered harmful (or GMP spills its sensitive information) (Jeffrey Walton <noloader@...il.com>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (Jeffrey Walton <noloader@...il.com>)

January 2 (4 messages)

Re: wget / chromium: URL metadata and potential password leaks via extended filesystem attributes (Amos Jeffries <squid3@...enet.co.nz>)
aria2 leaks passwords for HTTP based authentication (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
Re: Disabling ptrace (Jakub Wilk <jwilk@...lk.net>)
Re: Disabling ptrace (nisse@...ator.liu.se (Niels Möller))

January 3 (7 messages)

Re: Re: Asserts considered harmful (or GMP spills its sensitive information) (Jeffrey Walton <noloader@...il.com>)
Re: Re: Asserts considered harmful (or GMP spills its sensitive information) (halfdog <me@...fdog.net>)
Re: wget / chromium: URL metadata and potential password leaks via extended filesystem attributes (Hanno Böck <hanno@...eck.de>)
Re: Asserts considered harmful (or GMP spills its sensitive information) ("Marco Bodrato" <bodrato@...l.dm.unipi.it>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (Jeffrey Walton <noloader@...il.com>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (tg@...lib.org (Torbjörn Granlund))
Re: Asserts considered harmful (or GMP spills its sensitive information) (Jeffrey Walton <noloader@...il.com>)

January 4 (1 message)

Django security releases issued: 2.1.5, 2.0.10, and 1.11.18 (Tim Graham <timograham@...il.com>)

January 6 (3 messages)

[SECURITY] New security advisory for CVE-2018-11788 released for Apache Karaf (Jean-Baptiste Onofré <jb@...thrax.net>)
Re: Asserts considered harmful (or GMP spills its sensitive information) (nisse@...ator.liu.se (Niels Möller))
Re: Asserts considered harmful (or GMP spills its sensitive information) (Jeffrey Walton <noloader@...il.com>)

January 7 (4 messages)

New pagecache based sidechannel attack published (Marcus Meissner <meissner@...e.de>)
Re: New pagecache based sidechannel attack published (Marcus Meissner <meissner@...e.de>)
[SECURITY] CVE-2018-1320 Announcement ("James E. King III" <jking@...che.org>)
[SECURITY] CVE-2018-11798 Announcement ("James E. King III" <jking@...che.org>)

January 8 (21 messages)

Sandbox bypass in multiple Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Linux Kernel 4.20(21) deadlock vulnerability. (Entropy Moe <3ntr0py1337@...il.com>)
KASAN stack out of bound bug (Entropy Moe <3ntr0py1337@...il.com>)
Re: KASAN stack out of bound bug (Entropy Moe <3ntr0py1337@...il.com>)
Re: Linux Kernel 4.20(21) deadlock vulnerability. (Eric Dumazet <edumazet@...gle.com>)
Re: KASAN stack out of bound bug (Greg KH <greg@...ah.com>)
Re: KASAN stack out of bound bug (Entropy Moe <3ntr0py1337@...il.com>)
Re: KASAN stack out of bound bug (Eric Dumazet <edumazet@...gle.com>)
Re: KASAN stack out of bound bug (Entropy Moe <3ntr0py1337@...il.com>)
Re: Linux Kernel 4.20(21) deadlock vulnerability. (Greg KH <gregkh@...uxfoundation.org>)
Re: Linux Kernel 4.20(21) deadlock vulnerability. (Entropy Moe <3ntr0py1337@...il.com>)
Re: Linux Kernel 4.20(21) deadlock vulnerability. (Greg KH <gregkh@...uxfoundation.org>)
Re: Linux Kernel 4.20(21) deadlock vulnerability. (Entropy Moe <3ntr0py1337@...il.com>)
Xen Security Advisory 277 v3 (CVE-2018-19964) - x86: incorrect error handling for guest p2m page removals (Xen.org security team <security@....org>)
Xen Security Advisory 279 v3 (CVE-2018-19965) - x86: DoS from attempting to use INVPCID with a non-canonical addresses (Xen.org security team <security@....org…)
Xen Security Advisory 276 v3 (CVE-2018-19963) - resource accounting issues in x86 IOREQ server handling (Xen.org security team <security@....org>)
Xen Security Advisory 280 v3 (CVE-2018-19966) - Fix for XSA-240 conflicts with shadow paging (Xen.org security team <security@....org>)
Xen Security Advisory 275 v3 (CVE-2018-19961,CVE-2018-19962) - insufficient TLB flushing / improper large page mappings… (Xen.org security team <security@....org…)
Xen Security Advisory 282 v2 (CVE-2018-19967) - guest use of HLE constructs may lock up host (Xen.org security team <security@....org>)
RCE, CSRF and Information leak vulnerabilities against Airflow <= 1.8.2 (CVE-2017-15720, CVE-2017-17835, CVE-2017-17836) (Ash Berlin-Taylor <ash@...che.org>)
CVE-2018-20245: Apache Airflow LDAP auth backend did not validate SSL certificate for <= 1.10.0 (Ash Berlin-Taylor <ash@...che.org>)

January 9 (3 messages)

Re: Re: Linux Kernel 4.20(21) deadlock vulnerability. (Michael Ellerman <mpe@...erman.id.au>)
Fastbin double free issue in MP4v2 2.0.0 (Purushottam Choudhary <Purushottam.Choudhary@...t.com>)
System Down: A systemd-journald exploit (Qualys Security Advisory <qsa@...lys.com>)

January 10 (2 messages)

Irssi 1.1.2: CVE-2019-5882 (Ailin Nemui <ailin.nemui@...il.com>)
X41 D-Sec GmbH Security Advisory X41-2018-009: ReDoS Vulnerability in UA-Parser (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)

January 11 (6 messages)

[CVE-2018-17198] Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller (Dave <snoopdave@...il.com>)
Linux kernel: Bluetooth: two remote infoleaks (CVE-2019-3459, CVE-2019-3460) (Solar Designer <solar@...nwall.com>)
Memory leak in libiec61850 protocol (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
Memory leak in libiec61850 (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
NULL pointer dereference in lib60870 protocol (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
SEGV in libIEC61850 protocol (Dhiraj Mishra <mishra.dhiraj95@...il.com>)

January 14 (4 messages)

SCP client multiple vulnerabilities (Harry Sintonen <security-advisories@...er.fi>)
Re: Linux kernel: Bluetooth: two remote infoleaks (CVE-2019-3459, CVE-2019-3460) (Michael Ellerman <mpe@...erman.id.au>)
CVE-2018-16886 etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway (Paul Harvey <pharvey@...hat.com>)
Statistics for distros lists updated for 2018Q4 (Kristian Fiskerstrand <k_f@...too.org>)

January 16 (4 messages)

Heap based buffer overflow in wolfSSL (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
CVE-2018-11790: Apache OpenOffice: Arithmetic overflow and wrap around during string length calculation (Peter Kovacs <Petko@...che.org>)
Re: Heap based buffer overflow in wolfSSL (Alexander Potapenko <glider@...gle.com>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)

January 21 (8 messages)

Apache web server use after free bugs (unfixed) (Hanno Böck <hanno@...eck.de>)
Re: Apache web server use after free bugs (unfixed) (Florian Weimer <fweimer@...hat.com>)
GattLib 0.2 has a stack-based buffer - CVE-2019-6498 (Dhiraj Mishra <mishra.dhiraj95@...il.com>)
Unfixed FreeBSD uninitialized memory disclosures (Vlad Tsyrklevich <vlad@...rklevich.net>)
Re: Apache web server use after free bugs (unfixed) (Craig Young <cyoung@...pwire.com>)
Xen Security Advisory 289 v2 - Spectre V1 gadgets exploitable with L1TF (Xen.org security team <security@....org>)
PowerDNS Security Advisories 2011-01 and 2019-02 (Remi Gacogne <remi.gacogne@...erdns.com>)
Xen Security Advisory 289 v3 - Cache-load gadgets exploitable with L1TF (Xen.org security team <security@....org>)

January 22 (4 messages)

Re: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284 (Thomas Jarosch <thomas.jarosch@...ra2net.com>)
CVE-2018-17189: mod_http2, DoS via slow, unneeded request bodies (Daniel Ruggeri <druggeri@...che.org>)
CVE-2018-17199: mod_session_cookie does not respect expiry time (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-0190: mod_ssl 2.4.37 remote DoS when used with OpenSSL 1.1.1 (Daniel Ruggeri <druggeri@...che.org>)

January 23 (6 messages)

[CVE-2018-11803] Apache Subversion Denial of Service Vulnerability (Troy Curtis <troycurtisjr@...che.org>)
Re: Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: Sandbox bypass in multiple Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (Tavis Ormandy <taviso@...gle.com>)
Linux Kernel: Missing access_ok() checks in IOCTL function (gpu/drm/i915 Driver) (Timothy Michaud <tmm08a@....edu>)

January 24 (5 messages)

CVE-2019-6501 QEMU: scsi-generic: possible OOB access while handling inquiry request (P J P <ppandit@...hat.com>)
CVE-2018-1340: Apache Guacamole: Secure flag missing from session cookie (Mike Jumper <mjumper@...che.org>)
CVE-2018-1296: Apache Hadoop HDFS Permissive listXAttr Authorization (Akira Ajisaka <aajisaka@...che.org>)
Re: Linux Kernel: Missing access_ok() checks in IOCTL function (gpu/drm/i915 Driver) (Yves-Alexis Perez <corsac@...ian.org>)
CVE-2019-6778 QEMU: slirp: heap buffer overflow in tcp_emu() (P J P <ppandit@...hat.com>)

January 25 (1 message)

CVE-2018-16880 Linux kernel: oob-write in drivers/vhost/net.c:get_rx_bufs() (Vladis Dronov <vdronov@...hat.com>)

January 28 (3 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2019-3813: spice: Off-by-one error in array access in spice/server/memslot.c (Scott Gayou <sgayou@...hat.com>)
Re: CVE-2019-3813: spice: Off-by-one error in array access in spice/server/memslot.c (Peter Korsgaard <peter@...sgaard.com>)

January 29 (1 message)

CVE-2018-11760: Apache Spark local privilege escalation vulnerability (Imran Rashid <irashid@...che.org>)

January 30 (1 message)

[CVE-2018-14013] Reflected Cross-Site Scripting (XSS) vulnerabilities in Zimbra Collaboration (Sysdream Labs <labs@...dream.com>)

January 31 (2 messages)

[CVE-2018-20242] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
Re: [CVE-2018-20242] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki (Henri Salo <henri@...v.fi>)

102 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.