oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2019/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 2	² 2	³ 1	⁴ 1	⁵	⁶
⁷	⁸ 3	⁹ 7	¹⁰ 1	¹¹	¹²	¹³ 1
¹⁴ 1	¹⁵ 2	¹⁶ 7	¹⁷ 3	¹⁸	¹⁹	²⁰
²¹	²² 2	²³ 3	²⁴ 4	²⁵ 17	²⁶ 2	²⁷ 1
²⁸	²⁹ 3	³⁰ 5	³¹ 7

Messages by day:

October 1 (2 messages)

PDFex: Security weakness in PDF encryption (Jens Müller <jens.a.mueller@....de>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

October 2 (2 messages)

Multiple vulnerabilities in Online store system v1.0 Stored XSS and unauthenticated product deletions. (Akamai <larry0@...com>)
Minerva: ECDSA key recovery from bit-length leakage (Ján Jančár <445358@...l.muni.cz>)

October 3 (1 message)

Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow (Tina Li <tli@...italocean.com>)

October 4 (1 message)

CVE-2018-11768: Apache Hadoop HDFS FSImage Corruption (Akira Ajisaka <aajisaka@...che.org>)

October 8 (3 messages)

Multiple vulnerabilities in Centreon-Web and Centreon-VM (Guillaume Quéré <guillaume@...re.eu>)
[OSSA-2019-005] Octavia Amphora-Agent not requiring Client-Certificate (CVE-2019-17134) (Daniel 'f0o' Preussker <daniel@...ussker.net>)
CVE-2019-16760: Cargo prior to Rust 1.26.0 may download the wrong dependency (Pietro Albini <pietro@...troalbini.org>)

October 9 (7 messages)

Announce: OpenSSH 8.1 released (Damien Miller <djm@...nbsd.org>)
Re: Multiple vulnerabilities in Centreon-Web and Centreon-VM (Guillaume Quéré <guillaume@...re.eu>)
Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow (bo Zhang <zhangbo5891001@...il.com>)
CVE-2019-17365: Nix per-user profile directory hijack (Michael Orlitzky <michael@...itzky.com>)
Koji CVE-2019-17109: koji hub allows arbitrary upload destinations (Patrick Uiterwijk <puiterwijk@...hat.com>)
Re: CVE-2019-17365: Nix per-user profile directory hijack ("Graham Christensen" <graham@...hamc.com>)
Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow (Tina Li <tli@...italocean.com>)

October 10 (1 message)

Re: CVE-2019-17365: Nix per-user profile directory hijack (Michael Orlitzky <michael@...itzky.com>)

October 13 (1 message)

Statistics for distros lists updated for 2019Q3 (Kristian Fiskerstrand <k_f@...too.org>)

October 14 (1 message)

Sudo: CVE-2019-14287 ("Todd C. Miller" <Todd.Miller@...o.ws>)

October 15 (2 messages)

Re: Statistics for distros lists updated for 2019Q3 (Kristian Fiskerstrand <k_f@...too.org>)
Re: Sudo: CVE-2019-14287 ("Todd C. Miller" <Todd.Miller@...o.ws>)

October 16 (7 messages)

Fwd: [CVE-2016-4977] Apache Fineract remote code execution vulnerabilities fixed in v1.3.0 (Vishwas Babu <vishwasbabuaj@...il.com>)
[SBA-ADV-20190913-01] CVE-2019-16522: WordPress Plugin - EU Cookie Law (GDPR) <= 3.0.6 and possibly upwards - Stored XS… (SBA Research Advisory <advisory@...-res…)
[SBA-ADV-20190913-02] CVE-2019-16521: WordPress Plugin - Broken Link Checker <= 1.11.8 - Reflected XSS (SBA Research Advisory <advisory@...-research.org>)
[SBA-ADV-20190913-03] CVE-2019-16523: WordPress Plugin - Events Manager <= 5.9.5 - Stored XSS (SBA Research Advisory <advisory@...-research.org>)
[SBA-ADV-20190913-04] CVE-2019-16520: WordPress Plugin - All in One SEO Pack <= 3.2.6 - Stored XSS (SBA Research Advisory <advisory@...-research.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
BIND9 CVE-2019-6475 and CVE-2019-6476 (ISC Security Officer <security-officer@....org>)

October 17 (3 messages)

CVE-2019-0205: Apache Thrift: potential DoS when processing untrusted Thrift payload (Jens Geyer <jensgeyer@...mail.com>)
CVE-2019-0210: Apache Thrift: out-of-bounds read vulnerability ("Jens Geyer" <jensg@...che.org>)
CVE-2019-18192: Insecure permissions on Guix profile directory (Ludovic Courtès <ludo@....org>)

October 22 (2 messages)

[CVE-2019-15587] Loofah XSS Vulnerability (Mike Dalessio <mike.dalessio@...il.com>)
Re: [CVE-2019-15587] Loofah XSS Vulnerability (Mike Dalessio <mike.dalessio@...il.com>)

October 23 (3 messages)

CVE-2019-12415 - XML External Entity (XXE) Processing in Apache POI (Dominik Stadler <centic@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Membership application for linux-distros - VMware (Sasha Levin <sashal@...nel.org>)

October 24 (4 messages)

Membership application for linux-distros - VMware ("Srivatsa S. Bhat" <srivatsa@...il.mit.edu>)
Re: Membership application for linux-distros - VMware (Steven Rostedt <rostedt@...dmis.org>)
Re: Re: Membership application for linux-distros - VMware (Dhaval Giani <dhaval.giani@...cle.com>)
CVE-2019-11043: PHP: env_path_info underflow in fpm_main.c can lead to RCE (Solar Designer <solar@...nwall.com>)

October 25 (17 messages)

Xen Security Advisory 284 v3 (CVE-2019-17340) - grant table transfer issues on large hosts (Xen.org security team <security@....org>)
Xen Security Advisory 287 v3 (CVE-2019-17342) - x86: steal_page violates page_struct access discipline (Xen.org security team <security@....org>)
Xen Security Advisory 290 v3 (CVE-2019-17344) - missing preemption in x86 PV page table unvalidation (Xen.org security team <security@....org>)
Xen Security Advisory 291 v3 (CVE-2019-17345) - x86/PV: page type reference counting issue with failed IOMMU update (Xen.org security team <security@....org>)
Xen Security Advisory 292 v3 (CVE-2019-17346) - x86: insufficient TLB flushing when using PCID (Xen.org security team <security@....org>)
Xen Security Advisory 285 v3 (CVE-2019-17341) - race with pass-through device hotplug (Xen.org security team <security@....org>)
Xen Security Advisory 294 v3 (CVE-2019-17348) - x86 shadow: Insufficient TLB flushing when using PCID (Xen.org security team <security@....org>)
Xen Security Advisory 293 v4 (CVE-2019-17347) - x86: PV kernel context switch corruption (Xen.org security team <security@....org>)
Xen Security Advisory 300 v3 (CVE-2019-17351) - Linux: No grant table and foreign mapping limits (Xen.org security team <security@....org>)
Xen Security Advisory 288 v3 (CVE-2019-17343) - x86: Inconsistent PV IOMMU discipline (Xen.org security team <security@....org>)
Formal verification of open source software (Georgi Guninski <gguninski@...il.com>)
Re: Formal verification of open source software (Hanno Böck <hanno@...eck.de>)
Re: Formal verification of open source software (Pascal Cuoq <cuoq@...st-in-soft.com>)
Re: Formal verification of open source software (Georgi Guninski <gguninski@...il.com>)
Do distros want to see CVEs for Linux kernel USB bugs? (Andrey Konovalov <andreyknvl@...il.com>)
Re: Formal verification of open source software (Julien Lepiller <security@...iller.eu>)
Security fixes from Android 10 release which are relevant outside the Android ecosystem? (Moritz Mühlenhoff <jmm@...til.org>)

October 26 (2 messages)

Re: Do distros want to see CVEs for Linux kernel USB bugs? (Marcus Meissner <meissner@...e.de>)
Re: Do distros want to see CVEs for Linux kernel USB bugs? (Igor Seletskiy <i@...udlinux.com>)

October 27 (1 message)

Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem? (Stiepan <stie@...tonmail.ch>)

October 29 (3 messages)

Bodhi: Script injection (Randy Barlow <randy@...ctronsweatshop.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2019-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: Membership application for linux-distros - VMware ("Srivatsa S. Bhat" <srivatsa@...il.mit.edu>)

October 30 (5 messages)

Re: Bodhi: Script injection (Henri Salo <henri@...v.fi>)
[CVE-2019-12417] Apache Airflow stored xss and local file disclosure vulnerability <= 1.10.5 (Ash Berlin-Taylor <ash@...che.org>)
Python-3.5.8.tar.xz does NOT contain the fix for bpo-38243 (Peter van Dijk <peter.van.dijk@...erdns.com>)
Re: Membership application for linux-distros - VMware (Solar Designer <solar@...nwall.com>)
Re: Membership application for linux-distros - VMware (Solar Designer <solar@...nwall.com>)

October 31 (7 messages)

Xen Security Advisory 296 v4 (CVE-2019-18420) - VCPUOP_initialise DoS (Xen.org security team <security@....org>)
Xen Security Advisory 298 v3 (CVE-2019-18425) - missing descriptor table limit checking in x86 PV emulation (Xen.org security team <security@....org>)
Xen Security Advisory 299 v4 (CVE-2019-18421) - Issues with restartable PV type change operations (Xen.org security team <security@....org>)
Xen Security Advisory 301 v3 (CVE-2019-18423) - add-to-physmap can be abused to DoS Arm hosts (Xen.org security team <security@....org>)
Xen Security Advisory 303 v4 (CVE-2019-18422) - ARM: Interrupts are unconditionally unmasked in exception handlers (Xen.org security team <security@....org>)
Xen Security Advisory 302 v5 (CVE-2019-18424) - passed through PCI devices may corrupt host memory after deassignment (Xen.org security team <security@....org>)
Re: Python-3.5.8.tar.xz does NOT contain the fix for bpo-38243 (Peter van Dijk <peter.van.dijk@...erdns.com>)

75 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.