oss-security mailing list - 2019/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹	² 6	³ 4	⁴	⁵ 1	⁶	⁷ 1
⁸ 1	⁹ 2	¹⁰ 6	¹¹ 1	¹² 2	¹³	¹⁴ 2
¹⁵ 1	¹⁶ 1	¹⁷ 3	¹⁸ 20	¹⁹ 1	²⁰ 1	²¹
²² 1	²³ 5	²⁴ 4	²⁵ 8	²⁶ 1	²⁷ 3	²⁸
²⁹ 3	³⁰ 8

Messages by day:

April 2 (6 messages)

CVE-2019-0196: mod_http2, read-after-free on a string compare (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-0197: mod_http2, possible crash on late upgrade (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-0215: mod_ssl access control bypass (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-0217: mod_auth_digest access control bypass (Daniel Ruggeri <druggeri@...che.org>)
CVE-2019-0220: URL normalization inconsistincies (Daniel Ruggeri <druggeri@...che.org>)

April 3 (4 messages)

CVE-2019-3882: Linux kernel: DoS through vfio/type1 DMA mappings (Vladis Dronov <vdronov@...hat.com>)
CVE-2019-3837: RHEL6: memory leak in tcp_recvmsg() with NET_DMA (Vladis Dronov <vdronov@...hat.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Linux kernel < 4.8 local generic ASLR bypass for setuid binaries (Federico Manuel Bento <up201407890@...up.pt>)

April 5 (1 message)

XSS in roundup bug tracker 404 page (Hanno Böck <hanno@...eck.de>)

April 7 (1 message)

Re: XSS in roundup bug tracker 404 page (Henri Salo <henri@...v.fi>)

April 8 (1 message)

CVE-2019-3887 Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS (P J P <ppandit@...hat.com>)

April 9 (2 messages)

DLL injection in Go < 1.12.2 [CVE-2019-9634] ("Jason A. Donenfeld" <Jason@...c4.com>)
[OSSA-2019-002] neutron-openvswitch-agent: Unable to install new flows on compute nodes when having broken security group rules … (Gage Hugo <gagehugo@...il.com>)

April 10 (6 messages)

Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
wpa_supplicant/hostapd: SAE side-channel attacks (Jouni Malinen <j@...fi>)
wpa_supplicant/hostapd: EAP-pwd side-channel attack (Jouni Malinen <j@...fi>)
hostapd: SAE confirm missing state validation (Jouni Malinen <j@...fi>)
wpa_supplicant/hostapd: EAP-pwd missing commit validation (Jouni Malinen <j@...fi>)
CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component (Ash Berlin-Taylor <ash@...che.org>)

April 11 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2019-0002 (Michael Catanzaro <mcatanzaro@...lia.com>)

April 12 (2 messages)

[SECURITY] CVE-2019-0228 Apache PDFBox XML External Entity vulnerability (Andreas Lehmkuehler <andreas@...mi.de>)
Re: Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

April 14 (2 messages)

[CVE-2019-0231] MINA SSLFilter security Issue (Emmanuel Lecharny <elecharny@...che.org>)
CVE-2019-3893: Foreman: Compute resource credentials exposed during deletion on API (Tomer Brisker <tbrisker@...hat.com>)

April 15 (1 message)

Re: Linux kernel < 4.8 local generic ASLR - CVE-ID (Vladis Dronov <vdronov@...hat.com>)

April 16 (1 message)

kernel address leak in drivers/media/dvb-frontends/ascot2e.c - linux 4.14.111 LTS (Fuqian Huang <huangfq.daxian@...il.com>)

April 17 (3 messages)

3 pacemaker security flaws (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
urllib3: adds system certificates to ssl_context (Havoc Pennington <hp@...elift.com>)

April 18 (20 messages)

Announce: OpenSSH 8.0 released (Damien Miller <djm@...nbsd.org>)
Re: 3 pacemaker security flaws (Jan Pokorný <jpokorny@...hat.com>)
CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. (Aki Tuomi <aki.tuomi@...ecot.fi>)
Security issues in snapcraft snap-confine set*id binary (Matthias Gerstner <mgerstner@...e.de>)
Re: Linux kernel < 4.8 local generic ASLR - another CVE-ID (Vladis Dronov <vdronov@...hat.com>)
wpa_supplicant/hostapd: EAP-pwd message reassembly issue with unexpected fragment (Jouni Malinen <j@...fi>)
Linux kernel < 4.14.111 drivers/media/dvb-frontends/cxd2841er.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/media/dvb-frontends/helene.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/media/dvb-frontends/horus3a.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/media/pci/saa7164/saa7164-core.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/message/fusion/mptbase.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/message/fusion/mptscsih.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/net/wan/lmc/lmc_main.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/nfc/nfcmrvl/usb.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/scsi/cxgbi/cxgb3i/cxgb3i.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel < 4.14.111 drivers/scsi/cxgbi/cxgb4i/cxgb4i.c kernel address dumps to user space (Fuqian Huang <huangfq.daxian@...il.com>)
Linux kernel address leaks (Solar Designer <solar@...nwall.com>)
Re: Linux kernel address leaks (Greg KH <greg@...ah.com>)

April 19 (1 message)

Re: urllib3: adds system certificates to ssl_context (Havoc Pennington <hp@...elift.com>)

April 20 (1 message)

[CVE-2019-0218] Apache Pony Mail (incubating) Reflected XSS (Daniel Gruno <humbedooh@...che.org>)

April 22 (1 message)

Nokogiri security update v1.10.3 (Mike Dalessio <mike.dalessio@...il.com>)

April 23 (5 messages)

Issues fixed in previous releases of Apache Zeppelin 0.7.3 and 0.8.0 (CVE-2017-12619 CVE-2018-1317 CVE-2018-1328) (Apache Security Team <security@...che.org>)
Re: Nokogiri security update v1.10.3 (Florian Weimer <fweimer@...hat.com>)
fprintd: found storing user fingerprints without encryption (Seong-Joong Kim <sungjungk@...il.com>)
[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability (Robbie Gemmell <robbie@...che.org>)
Re: Nokogiri security update v1.10.3 (Mike Dalessio <mike.dalessio@...il.com>)

April 24 (4 messages)

CVE-2018-11802: Apache Solr authorization bug vulnerability disclosure (Noble Paul <noble@...che.org>)
Re: CVE-2018-11802: Apache Solr authorization bug vulnerability disclosure (Ishan Chattopadhyaya <ichattopadhyaya@...il.com>)
CVE Request: golang-seccomp incorrectly handles multiple syscall arguments (Jamie Strandboge <jamie@...onical.com>)
Re: CVE Request: golang-seccomp incorrectly handles multiple syscall arguments (Jamie Strandboge <jamie@...onical.com>)

April 25 (8 messages)

Multiple BIND vulnerabilities disclosed (CVE-2018-5743, CVE-2019-6467, and CVE-2019-6468) (Michael McNally <mcnally@....org>)
CVE-2019-3900 Kernel: vhost_net: infinite loop while receiving packets leads to DoS (P J P <ppandit@...hat.com>)
Re: Multiple BIND vulnerabilities disclosed (CVE-2018-5743, CVE-2019-6467, and CVE-2019-6468) (Peter Korsgaard <peter@...sgaard.com>)
Linux kernel: no permission check during open() time of /proc/[pid]/maps in kernels < 3.18 (Matthias Gerstner <mgerstner@...e.de>)
Re: Linux kernel: no permission check during open() time of /proc/[pid]/maps in kernels < 3.18 (Solar Designer <solar@...nwall.com>)
Re: CVE Request: golang-seccomp incorrectly handles multiple syscall arguments (Jamie Strandboge <jamie@...onical.com>)
Re: Security issues in snapcraft snap-confine set*id binary (Jamie Strandboge <jamie@...onical.com>)
[CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks (Neil Griffin <asfgriff@...che.org>)

April 26 (1 message)

Re: wpa_supplicant/hostapd: EAP-pwd message reassembly issue with unexpected fragment (Salvatore Bonaccorso <carnil@...ian.org>)

April 27 (3 messages)

Re: Multiple BIND vulnerabilities disclosed (CVE-2018-5743, CVE-2019-6467, and CVE-2019-6468) (andreas@...mhold.de)
Re: Multiple BIND vulnerabilities disclosed (CVE-2018-5743, CVE-2019-6467, and CVE-2019-6468) (Peter Korsgaard <peter@...sgaard.com>)
Re: Multiple BIND vulnerabilities disclosed (CVE-2018-5743, CVE-2019-6467, and CVE-2019-6468) (andreas@...mhold.de)

April 29 (3 messages)

Linux kernel: multiple issues (Jann Horn <jannhorn@...glemail.com>)
Re: Linux kernel: multiple issues (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2019-9826] phpBB Native Fulltext Search denial of service (Colin Snover <mx1xcb@...afleet.com>)

April 30 (8 messages)

Re: Linux kernel: multiple issues (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] New security advisory CVE-2019-0194 released for Apache Camel (Andrea Cosentino <ancosen1985@...oo.com>)
Cross Site Scripting | Alkacon OpenCMS v10.5.4 and before (Pramod Rana <varchashva@...il.com>)
Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients) (Marcus Brinkmann <marcus.brinkmann@...r-uni-bochum.de>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Multiple vulnerabilities in Dovecot 2.3 (Aki Tuomi <aki.tuomi@...ecot.fi>)
[SECURITY] CVE-2019-0213: Apache Archiva Stored XSS (Martin <martin_s@...che.org>)
[SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server (Martin <martin_s@...che.org>)

86 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.