oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2020/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 4	²	³ 5	⁴ 2	⁵ 2	⁶ 2
⁷ 4	⁸ 4	⁹ 4	¹⁰ 4	¹¹ 1	¹²	¹³
¹⁴ 1	¹⁵ 3	¹⁶ 6	¹⁷ 3	¹⁸	¹⁹	²⁰
²¹	²² 11	²³ 1	²⁴	²⁵	²⁶ 1	²⁷
²⁸ 3	²⁹ 3	³⁰ 7

Messages by day:

September 1 (4 messages)

Kamailio vulnerable to header smuggling possible due to bypass of remove_hf ("Sandro Gauci" <sandro@...blesecurity.com>)
Django Security Releases for CVE-2020-24583 & CVE-2020-24584: permissions on intermediate-level directories on Python 3… (Carlton Gibson <carlton.gibson@...il.co…)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2020-13946 Apache Cassandra RMI Rebind Vulnerability (Sam Tunnicliffe <sam@...bal.com>)

September 3 (5 messages)

Open Source Tool | vPrioritization | Risk Prioritization Framework (Pramod Rana <varchashva@...il.com>)
Re: Contributing Back (Solar Designer <solar@...nwall.com>)
CVE-2020-14386: Linux kernel: af_packet.c vulnerability (Or Cohen <orcohen@...oaltonetworks.com>)
GNUPG released with AEAD sec fix CVE-2020-25125 (Marcus Meissner <meissner@...e.de>)
CVE-2020-25125: gnupg2: buffer overflow when importing a key with AEAD preferences (Wolfgang Frisch <wolfgang.frisch@...e.com>)

September 4 (2 messages)

Re: Contributing Back (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2020-14386: Linux kernel: af_packet.c vulnerability (Solar Designer <solar@...nwall.com>)

September 5 (2 messages)

Re: Open Source Tool | vPrioritization | Risk Prioritization Framework ("Perry E. Metzger" <perry@...rmont.com>)
Risk and severity vectors (was: Open Source Tool | vPrioritization | Risk Prioritization Framework) (Jeremy Stanley <fungi@...goth.org>)

September 6 (2 messages)

Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Pramod Rana <varchashva@...il.com>)
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Amos Jeffries <squid3@...enet.co.nz>)

September 7 (4 messages)

Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Robert Watson <robertcwatson1@...il.com>)
[CVE-2020-11986] Opening a Gradle project with Apache NetBeans executes foreign script immediately (Matthias Bläsing <mblaesing@...pel-helix.eu>)
CVE-2020-15166: zeromq/libzmq: Denial-of-Service on CURVE/ZAP-protected servers by unauthenticated clients (Luca Boccassi <bluca@...ian.org>)
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework ("Perry E. Metzger" <perry@...rmont.com>)

September 8 (4 messages)

Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Jeffrey Walton <noloader@...il.com>)
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Kurt H Maier <khm@...ops.net>)
Re: Re: [FD] libcroco multiple vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE Request: Linux kernel vsyscall page refcounting error (Andy Lutomirski <luto@...nel.org>)

September 9 (4 messages)

Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Jeffrey Walton <noloader@...il.com>)
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework (Alex Gaynor <alex.gaynor@...il.com>)
Re: Open Source Tool | vPrioritization | Risk Prioritization Framework ("The Doctor [412/724/301/703/415/510]" <drwho@...tadpt.net>)
Re: Contributing Back (Vincent Batts <vbatts@...volk.io>)

September 10 (4 messages)

[CVE-2020-13920] ActiveMQ JMX vulenarable to MITM attack (Jean-Baptiste Onofre <jb@...thrax.net>)
Re: CVE-2020-14386: Linux kernel: af_packet.c vulnerability (Kai Lüke <kai@...volk.io>)
[CVE-2020-11998] Apache ActiveMQ JMX remote client could execute arbitrary code (Jean-Baptiste Onofre <jb@...thrax.net>)
Re: CVE Request: Linux kernel vsyscall page refcounting error (Salvatore Bonaccorso <carnil@...ian.org>)

September 11 (1 message)

[CVE-2020-11991] Apache Cocoon security vulnerability (Cédric Damioli <cdamioli@...che.org>)

September 14 (1 message)

[CVE-2020-11977] Apache Syncope: Remote Code Execution via Flowable workflow definition (Francesco Chicchiriccò <ilgrosso@...che.org>)

September 15 (3 messages)

Fwd: [CVE-2020-13928 ] Apache Atlas Multiple XSS Vulnerability (Keval Bhatt <kbhatt@...che.org>)
CVE-2020-14390: Linux kernel: slab-out-of-bounds in fbcon (Minh Yuan <yuanmingbuaa@...il.com>)
[CVE-2020-13948] Apache Superset Remote Code Execution Vulnerability (William Barrett <will@...set.io>)

September 16 (6 messages)

Linux Kernel: out-of-bounds reading in vgacon_scrolldelta (NopNop Nop <nopitydays@...il.com>)
[CVE-2020-13944] Apache Airflow Reflected XSS via Origin Parameter <= 1.10.12 (Kaxil Naik <kaxilnaik@...il.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: [CVE-2020-13944] Apache Airflow Reflected XSS via Origin Parameter <= 1.10.12 (Kaxil Naik <kaxilnaik@...il.com>)
CVE-2020-25084 QEMU: usb: use-after-free issue while setting up packet (P J P <ppandit@...hat.com>)
CVE-2020-25085 QEMU: sdhci: out-of-bounds access issue while doing multi block SDMA (P J P <ppandit@...hat.com>)

September 17 (3 messages)

CVE-2020-25625 QEMU: usb: hcd-ohci: infinite loop issue while processing transfer descriptors (P J P <ppandit@...hat.com>)
Samba and CVE-2020-1472 ("Zerologon") (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Apache + PHP <= 7.4.10 open_basedir bypass (Havijoori <havijoori@...tonmail.com>)

September 22 (11 messages)

Xen Security Advisory 333 v3 (CVE-2020-25602) - x86 pv: Crash when handling guest access to MSR_MISC_ENABLE (Xen.org security team <security@....org>)
Xen Security Advisory 336 v3 (CVE-2020-25604) - race when migrating timers between x86 HVM vCPU-s (Xen.org security team <security@....org>)
Xen Security Advisory 339 v3 (CVE-2020-25596) - x86 pv guest kernel DoS via SYSENTER (Xen.org security team <security@....org>)
Xen Security Advisory 334 v3 (CVE-2020-25598) - Missing unlock in XENMEM_acquire_resource error path (Xen.org security team <security@....org>)
Xen Security Advisory 338 v4 (CVE-2020-25597) - once valid event channels may not turn invalid (Xen.org security team <security@....org>)
Xen Security Advisory 337 v3 (CVE-2020-25595) - PCI passthrough code reading back hardware registers (Xen.org security team <security@....org>)
Xen Security Advisory 344 v4 (CVE-2020-25601) - lack of preemption in evtchn_reset() / evtchn_destroy() (Xen.org security team <security@....org>)
Xen Security Advisory 342 v3 (CVE-2020-25600) - out of bounds event channels available to 32-bit x86 domains (Xen.org security team <security@....org>)
Xen Security Advisory 340 v3 (CVE-2020-25603) - Missing memory barriers when accessing/allocating an event channel (Xen.org security team <security@....org>)
Xen Security Advisory 343 v4 (CVE-2020-25599) - races with evtchn_reset() (Xen.org security team <security@....org>)
[Fwd: [Pdns-announce] security advisories for Authoritative 4.3.1, 4.2.3, 4.1.14] (Peter van Dijk <peter.van.dijk@...erdns.com>)

September 23 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

September 26 (1 message)

[CVE-2020-13953] Apache Tapestry WEB-INF file download vulnerability ("Thiago H. de Paula Figueiredo" <thiagohp@...il.com>)

September 28 (3 messages)

CVE-2018-11765: Potential information disclosure in Hadoop Web interfaces (Akira Ajisaka <aajisaka@...che.org>)
[ANNOUNCE] CVE-2020-13951 - Apache Openmeetings: DoS via public web service (Maxim Solodovnik <solomax@...che.org>)
DPDK security advisory for multiple vhost crypto issues (Ferruh Yigit <ferruh.yigit@...el.com>)

September 29 (3 messages)

QEMU: NULL pointer derefrence issues (P J P <ppandit@...hat.com>)
libass ass_outline.c signed integer overflow (Fstark <f734222792@...il.com>)
[CVE-2020-13952] Apache Superset Information Disclosure Vulnerability (Will Barrett <barrett.william@...il.com>)

September 30 (7 messages)

CVE-2020-25641 kernel: soft lockup when submitting zero length bvecs. (Wade Mealing <wmealing@...hat.com>)
Re: CVE-2020-25641 kernel: soft lockup when submitting zero length bvecs. (Greg KH <greg@...ah.com>)
[CVE-2020-26149] NATS project vulnerabilities: nats.js, (nats.ws, nats.deno) (Phil Pennock <oss-security-phil@...dhuis.org>)
CVE-2020-10762 gluster-block: information disclosure through world-readable gluster-block log files (Hardik Vyas <hvyas@...hat.com>)
CVE-2020-10763 heketi: gluster-block volume password details available in logs (Hardik Vyas <hvyas@...hat.com>)
[CVE-2020-11979] Apache Ant insecure temporary file vulnerability (Stefan Bodewig <bodewig@...che.org>)
[cve-request@...re.org: Re: [scr966354] oniguruma regular expression library - fixed in devel version cbe9f8bd9cfc6c3c8… (Seth Arnold <seth.arnold@...onical.com>)

71 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.