oss-security mailing list - 2021/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	²
³	⁴ 8	⁵ 5	⁶ 1	⁷ 2	⁸ 1	⁹ 2
¹⁰ 5	¹¹ 17	¹² 3	¹³ 2	¹⁴ 5	¹⁵	¹⁶ 3
¹⁷ 7	¹⁸ 4	¹⁹ 2	²⁰	²¹ 1	²² 1	²³
²⁴	²⁵ 5	²⁶ 6	²⁷ 2	²⁸ 2	²⁹ 1	³⁰
³¹ 1

Messages by day:

May 1 (2 messages)

kopano-core 11.0.1.143: Remote DoS with resource exhaustion (Jan Engelhardt <jengelh@...i.de>)
CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL (Kaxil Naik <kaxilnaik@...che.org>)

May 4 (8 messages)

hivex CVE-2021-3504 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Multiple vulnerabilities in RPM (Demi Marie Obenour <demi@...isiblethingslab.com>)
Django 3.2.1, 3.1.9, and 2.2.21: CVE-2021-31542: Potential directory-traversal via uploaded files (Carlton Gibson <carlton.gibson@...il.com>)
[CVE-2021-31829] Linux kernel protection of stack pointer against speculative pointer arithmetic can be bypassed to leak cont… (Piotr Krysiuk <piotras@...il.com>)
Xen Security Advisory 370 v2 (CVE-2021-28689) - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests (Xen.org security team <security@....org…)
Exim 4.94.2 - security update released (Heiko Schlittermann <hs@...marc.schlittermann.de>)
21Nails: Multiple vulnerabilities in Exim (Qualys Security Advisory <qsa@...lys.com>)
[kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU ("Hausler, Micah" <mhausler@...zon.com>)

May 5 (5 messages)

[CVE-2021-22902] Possible Denial of Service vulnerability in Action Dispatch (Aaron Patterson <aaron.patterson@...il.com>)
[CVE-2021-22903] Possible Open Redirect Vulnerability in Action Pack (Aaron Patterson <aaron.patterson@...il.com>)
[CVE-2021-22885] Possible Information Disclosure / Unintended Method Execution in Action Pack (Aaron Patterson <aaron.patterson@...il.com>)
[CVE-2021-22904] Possible DoS Vulnerability in Action Controller Token Authentication (Aaron Patterson <aaron.patterson@...il.com>)
CVE-2021-3527 QEMU: usb: unbounded stack allocation in usbredir (Mauro Matteo Cascella <mcascell@...hat.com>)

May 6 (1 message)

Django: CVE-2021-32052: Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+ (Mariusz Felisiak <felisiak.mariusz@...il.c…)

May 7 (2 messages)

Re: CVE-2021-3527 QEMU: usb: unbounded stack allocation in usbredir (Mauro Matteo Cascella <mcascell@...hat.com>)
Re: Linux kernel: f2fs: out-of-bounds memory access bug (butt3rflyh4ck <butterflyhuangxx@...il.com>)

May 8 (1 message)

Re: Linux kernel: f2fs: out-of-bounds memory access bug (butt3rflyh4ck <butterflyhuangxx@...il.com>)

May 9 (2 messages)

[CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image (William Bowling <will@...wling.info>)
Code execution through Thunar (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

May 10 (5 messages)

Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets (Alex Murray <alex.murray@...onical.com>)
Re: CVE-2021-23133: Linux kernel: race condition in sctp sockets (Alex Murray <alex.murray@...onical.com>)
Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image (Jakub Wilk <jwilk@...lk.net>)

May 11 (17 messages)

[Kubernetes] CVE-2021-25736: Windows kube-proxy LoadBalancer contention (Swamy Shivaganga Nagaraju <gaswamy@...rosoft.com>)
CVE-2021-32399 Linux device detach race condition (Lin Horse <kylin.formalin@...il.com>)
Re: Code execution through Thunar (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)
CVE-2021-23134: Linux kernel: UAF in nfc sockets (Nadav Markus <nmarkus@...oaltonetworks.com>)
[CVE-2020-28018] Use-After-Free on Exim Question (null p0int3r <nullp0int3rx@...il.com>)
Re: [CVE-2020-28018] Use-After-Free on Exim Question (Solar Designer <solar@...nwall.com>)
Trovent Security Advisory 2103-01 / Authenticated SQL injection in ERPNext 13.0.0/12.18.0 (Stefan Pietsch <s.pietsch@...vent.io>)
Trovent Security Advisory 2103-02 / Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0 (Stefan Pietsch <s.pietsch@...vent.io>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2021-3489 - Linux kernel eBPF RINGBUF map oversized allocation (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2021-3490 - Linux kernel eBPF bitwise ops ALU32 bounds tracking (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
various 802.11 security issues - fragattacks.com (Johannes Berg <johannes@...solutions.net>)
CVE-2021-3491 - Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
Re: [CVE-2020-28018] Use-After-Free on Exim Question (Qualys Security Advisory <qsa@...lys.com>)
Re: [CVE-2020-28018] Use-After-Free on Exim Question (null p0int3r <nullp0int3rx@...il.com>)
Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Norbert Slusarek <nslusarek@....net>)
Re: [CVE-2020-28018] Use-After-Free on Exim Question (Qualys Security Advisory <qsa@...lys.com>)

May 12 (3 messages)

Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [CVE-2020-28018] Use-After-Free on Exim Question ("harris.johnson.x" <harris.johnson.x@...tonmail.com>)
Re: [CVE-2020-28018] Use-After-Free on Exim Question (Qualys Security Advisory <qsa@...lys.com>)

May 13 (2 messages)

Prosody XMPP server advisory 2021-05-12 (multiple vulnerabilities) (Matthew Wild <mwild1@...il.com>)
Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Norbert Slusarek <nslusarek@....net>)

May 14 (5 messages)

Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Solar Designer <solar@...nwall.com>)
Re: Prosody XMPP server advisory 2021-05-12 (multiple vulnerabilities) ("Robert G." <robert.groesser@...glemail.com>)
Re: Prosody XMPP server advisory 2021-05-12 (multiple vulnerabilities) (Matthew Wild <mwild1@...il.com>)
CVE-2021-3509: Ceph: Cross Site Scripting via token Cookie (Ana McTaggart <amctagga@...hat.com>)
CVE-2021-3531: Ceph: RGW unauthenticated denial of service (Ana McTaggart <amctagga@...hat.com>)

May 16 (3 messages)

Open Source WAF testing tools ("Martin O'Neil" <martinoneil.cyber@...il.com>)
Re: Open Source WAF testing tools (Brandon Perry <bperry.volatile@...il.com>)
Re: Open Source WAF testing tools (Ivan Novikov <in@...larm.com>)

May 17 (7 messages)

rxvt terminal (+bash) remoteish code execution 0day (def <def@...meet.info>)
Re: rxvt terminal (+bash) remoteish code execution 0day (def <def@...meet.info>)
Re: rxvt terminal (+bash) remoteish code execution 0day ("Priedhorsky, Reid" <reidpr@...l.gov>)
Re: Re: rxvt terminal (+bash) remoteish code execution 0day (def <def@...meet.info>)
Re: rxvt terminal (+bash) remoteish code execution 0day (Jakub Wilk <jwilk@...lk.net>)
Re: rxvt terminal (+bash) remoteish code execution 0day (Dan Yefihmov <dan@...htwave.net.ru>)
Re: CVE-2021-3531: Ceph: RGW unauthenticated denial of service (Ana McTaggart <amctagga@...hat.com>)

May 18 (4 messages)

please: CVE-2021-31153,CVE-2021-31154,CVE-2021-31155: local root exploit and further security issues in sudo-like utility (Matthias Gerstner <mgerstner@...e.de>)
libX11 security advisory: May 18, 2021 (Matthieu Herrb <matthieu@...rb.eu>)
libx11 API Protocol Command Injection (Unparalleled IT Security Research <info@...aralleled.eu>)
[kubernetes] CVE-2021-25737: Holes in EndpointSlice Validation Enable Host Network Hijack (CJ Cullen <cjcullen@...gle.com>)

May 19 (2 messages)

Prometheus 2.26.1-2.27.1 released to fix an Open Redirect security issue (Julien Pivotto <roidelapluie@...metheus.io>)
CVE-2021-30465: runc <1.0.0-rc95 vulnerable to symlink-exchange attack (Aleksa Sarai <cyphar@...har.com>)

May 21 (1 message)

Plone security hotfix 20210518 (Maurits van Rees <maurits@...rees.org>)

May 22 (1 message)

Re: Plone security hotfix 20210518 (Maurits van Rees <maurits@...rees.org>)

May 25 (5 messages)

CVE-2021-3564 Linux Bluetooth device initialization implementation bug (Mart111n <mmmart11nnnnn@...il.com>)
CVE-2021-23937: Apache Wicket: DNS proxy and possible amplification attack (Emond Papegaaij <papegaaij@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2021-22160 Apache Pulsar Information Disclosure (PengHui Li <penghui@...che.org>)
X41 D-Sec GmbH Security Advisory X41-2021-002: nginx DNS Resolver Off-by-One Heap Write Vulnerability (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)

May 26 (6 messages)

[SECURITY ADVISORY] curl: TELNET stack contents disclosure (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: TLS session caching disaster (Daniel Stenberg <daniel@...x.se>)
CVE-2021-22543 - /dev/kvm LPE ("Eduardo' Vela\" <Nava>" <evn@...gle.com>)
Re: CVE-2021-22543 - /dev/kvm LPE (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-22543 - /dev/kvm LPE (Paolo Bonzini <pbonzini@...hat.com>)
ISC has disclosed a vulnerability in ISC DHCP (CVE-2021-25217) (Michael McNally <mcnally@....org>)

May 27 (2 messages)

[CVE-2021-33200] Linux kernel enforcing incorrect limits for pointer arithmetic operations by BPF verifier can be abused to p… (Piotr Krysiuk <piotras@...il.com>)
CVE-2020-17514: Apache Fineract: Disabled hostname verification for HTTPS (James Dailey <jamespdailey@...il.com>)

May 28 (2 messages)

Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Oliver Hartkopp <socketcan@...tkopp.net>)
Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Marc Kleine-Budde <mkl@...gutronix.de>)

May 29 (1 message)

Re: Linux kernel: net/can/isotp: race condition leads to local privilege escalation (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)

May 31 (1 message)

QEMU: security issues in vhost-user-gpu (Mauro Matteo Cascella <mcascell@...hat.com>)

88 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.