oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	² 1	³ 1	⁴
⁵ 2	⁶ 3	⁷ 2	⁸ 3	⁹ 2	¹⁰	¹¹
¹²	¹³ 3	¹⁴ 9	¹⁵ 4	¹⁶ 3	¹⁷ 1	¹⁸
¹⁹	²⁰ 4	²¹ 10	²² 12	²³ 14	²⁴	²⁵ 1
²⁶ 1	²⁷ 3	²⁸ 11	²⁹ 8	³⁰ 4	³¹ 5

Messages by day:

December 1 (1 message)

Re: Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) (Qualys Security Advisory <qsa@...lys.com>)

December 2 (1 message)

CVE-2022-46366: Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input (Arnout Engelen <engelen@...che.org>)

December 3 (1 message)

CVE-2021-37533: Apache Commons Net's FTP client trusts the host from PASV response by default ("Gary D. Gregory" <ggregory@...che.org>)

December 5 (2 messages)

CVE-2022-4170: rxvt-unicode code execution via background OSC (David Leadbeater <dgl@....cx>)
CVE-2022-45046: Apache Camel: LDAP Injection in Camel-LDAP (Andrea Cosentino <acosentino@...che.org>)

December 6 (3 messages)

Xen Security Advisory 423 v1 (CVE-2022-3643) - Guests can trigger NIC interface reset/abort/crash via netback (Xen.org security team <security@....org>)
Xen Security Advisory 424 v1 (CVE-2022-42328,CVE-2022-42329) - Guests can trigger deadlock in Linux netback driver (Xen.org security team <security@....org>)
CVE-2022-45910: Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities (Markus Schuch <schuch@...che.org>)

December 7 (2 messages)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Xen Security Advisory 423 v2 (CVE-2022-3643) - Guests can trigger NIC interface reset/abort/crash via netback (Xen.org security team <security@....org>)

December 8 (3 messages)

Re: CVE-2022-4170: rxvt-unicode code execution via background OSC (John Helmert III <ajak@...too.org>)
Re: Xen Security Advisory 424 v1 (CVE-2022-42328,CVE-2022-42329) - Guests can trigger deadlock in Linux netback driver (Pratyush Yadav <ptyadav@...zon.de>)
Re: Xen Security Advisory 424 v1 (CVE-2022-42328,CVE-2022-42329) - Guests can trigger deadlock in Linux netback driver (Juergen Gross <jgross@...e.com>)

December 9 (2 messages)

CVE-2022-4378: Linux kernel stack-based buffer overflow (Kyle Zeng <zengyhkyle@...il.com>)
Re: Xen Security Advisory 424 v1 (CVE-2022-42328,CVE-2022-42329) - Guests can trigger deadlock in Linux netback driver (Ross Lagerwall <ross.lagerwall@...ud.co…)

December 13 (3 messages)

Linux Kernel: usb: A use-after-free Write in put_dev (Gerald Lee <sundaywind2004@...il.com>)
CVE-2022-46363: Apache CXF directory listing / code exfiltration (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2022-46364: Apache CXF SSRF Vulnerability (Colm O hEigeartaigh <coheigea@...che.org>)

December 14 (9 messages)

CVE-2022-34271: Apache Atlas: zip path traversal in import functionality (Madhan Neethiraj <madhan@...che.org>)
X.Org Security Advisory: multiple security issues in X server extensions (Peter Hutterer <peter.hutterer@...hat.com>)
CVE-2022-4379: Linux kernel: use-after-free in __nfs42_ssc_open (Xingyuan Mo <hdthky0@...il.com>)
Re: X.Org Security Advisory: multiple security issues in X server extensions (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Linux Kernel: usb: A use-after-free Write in put_dev (Gerald Lee <sundaywind2004@...il.com>)
Linux Kernel: Infoleak in Bluetooth L2CAP Handling (Rafael Correa De Ysasi <rcorreadeysasi@...omium.org>)
Linux Kernel: UAF in Bluetooth L2CAP Handshake (Rafael Correa De Ysasi <rcorreadeysasi@...omium.org>)
Re: Linux Kernel: Infoleak in Bluetooth L2CAP Handling (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux Kernel: UAF in Bluetooth L2CAP Handshake (Salvatore Bonaccorso <carnil@...ian.org>)

December 15 (4 messages)

CVE-2022-32531: Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification (Enrico Olivelli <eolivelli@...che.org>)
Re: Linux Kernel: Infoleak in Bluetooth L2CAP Handling (Rafael Correa De Ysasi <rcorreadeysasi@...omium.org>)
Re: Linux Kernel: UAF in Bluetooth L2CAP Handshake (Rafael Correa De Ysasi <rcorreadeysasi@...omium.org>)
Re: Linux Kernel: UAF in Bluetooth L2CAP Handshake (John Helmert III <ajak@...too.org>)

December 16 (3 messages)

CVE-2021-28655: Apache Zeppelin: Arbitrary file deletion vulnerability (Arnout Engelen <engelen@...che.org>)
CVE-2022-46870: Apache Zeppelin: Stored XSS in note permissions (Arnout Engelen <engelen@...che.org>)
CVE-2022-4543: KASLR Leakage Achievable even with KPTI through Prefetch Side-Channel (Will <willsroot@...tonmail.com>)

December 17 (1 message)

CVE-2022-47500: Apache Helix: Open redirect (Junkai Xue <jxue@...che.org>)

December 20 (4 messages)

CVE-2022-46421: Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params (Jarek Potiuk <potiuk@...che.org>)
[ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV (Open vSwitch) (Ilya Maximets <i.maximets@....org>)
Re: [ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV (Open vSwitch) (John Helmert III <ajak@...too.org>)
Re: [ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV (Open vSwitch) (Ilya Maximets <i.maximets@....org>)

December 21 (10 messages)

curl: CVE-2022-43551: Another HSTS bypass via IDN (Daniel Stenberg <daniel@...x.se>)
curl: CVE-2022-43552: HTTP Proxy deny use-after-free (Daniel Stenberg <daniel@...x.se>)
systemd-coredump: CVE-2022-4415: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel se… (Matthias Gerstner <mgerstner@...e.de>)
Re: [ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV (Open vSwitch) (Ilya Maximets <i.maximets@....org>)
CVE-2022-40145: Apache Karaf: JDBC JAAS LDAP injection (Jean-Baptiste Onofré <jbonofre@...che.org>)
[Linux] /proc/pid/stat parsing bugs (Dmitry Vyukov <dvyukov@...gle.com>)
Re: [Linux] /proc/pid/stat parsing bugs (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: [Linux] /proc/pid/stat parsing bugs ("Yann Droneaud" <ydroneaud@...eya.com>)
Directory traversal in sharutils/uudecode and python uu module (Hanno Böck <hanno@...eck.de>)
Re: [Linux] /proc/pid/stat parsing bugs (Shawn Webb <shawn.webb@...denedbsd.org>)

December 22 (12 messages)

Re: [Linux] /proc/pid/stat parsing bugs (Dmitry Vyukov <dvyukov@...gle.com>)
Linux kernel: use-after-free in io_sqpoll_wait_sq (Xingyuan Mo <hdthky0@...il.com>)
CVE-2022-45347: Apache ShardingSphere-Proxy: ShardingSphere-Proxy MySQL authentication bypass (Weijie Wu <wuweijie@...che.org>)
Re: [Linux] /proc/pid/stat parsing bugs (Shawn Webb <shawn.webb@...denedbsd.org>)
Re: [Linux] /proc/pid/stat parsing bugs (Jakub Wilk <jwilk@...lk.net>)
Re: [Linux] /proc/pid/stat parsing bugs (Shawn Webb <shawn.webb@...denedbsd.org>)
[patch] proc.5: tell how to parse /proc/*/stat correctly (Alexey Dobriyan <adobriyan@...il.com>)
Details on this supposed Linux Kernel ksmbd RCE (Josh Bressers <josh@...ss.net>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Jan Schaumann <jschauma@...meister.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Dominique Martinet <asmadeus@...ewreck.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Steffen Nurpmeso <steffen@...oden.eu>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Solar Designer <solar@...nwall.com>)

December 23 (14 messages)

Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Jan Engelhardt <jengelh@...i.de>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Dominique Martinet <asmadeus@...ewreck.org>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Greg KH <greg@...ah.com>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Marcus Meissner <meissner@...e.de>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Eric Biggers <ebiggers@...nel.org>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Sasha Levin <sashal@...nel.org>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Greg KH <greg@...ah.com>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Jeffrey Walton <noloader@...il.com>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Marcus Meissner <meissner@...e.de>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Marcus Meissner <meissner@...e.de>)
Re: [Linux] /proc/pid/stat parsing bugs (Simon McVittie <smcv@...ian.org>)
Re: Details on this supposed Linux Kernel ksmbd RCE (John Helmert III <ajak@...too.org>)
Re: Details on this supposed Linux Kernel ksmbd RCE (John Helmert III <ajak@...too.org>)
Multiple vulnerabilities in Snipe-IT (Charalampos Maraziaris <cmaraziaris@...sus-labs.com>)

December 25 (1 message)

Re: [Linux] /proc/pid/stat parsing bugs (Dominik Czarnota <dominik.b.czarnota@...il.com>)

December 26 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2022-0011 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

December 27 (3 messages)

Re: Linux kernel: use-after-free in io_sqpoll_wait_sq (Xingyuan Mo <hdthky0@...il.com>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Marcus Meissner <meissner@...e.de>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Marcus Meissner <meissner@...e.de>)

December 28 (11 messages)

Re: [patch] proc.5: tell how to parse /proc/*/stat correctly ("Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Shawn Webb <shawn.webb@...denedbsd.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Shawn Webb <shawn.webb@...denedbsd.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Jan Engelhardt <jengelh@...i.de>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Shawn Webb <shawn.webb@...denedbsd.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Steffen Nurpmeso <steffen@...oden.eu>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (John Helmert III <ajak@...too.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Shawn Webb <shawn.webb@...denedbsd.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Alejandro Colomar <alx.manpages@...il.com>)

December 29 (8 messages)

Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly ("Theodore Ts'o" <tytso@....edu>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Steffen Nurpmeso <steffen@...oden.eu>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Jeffrey Walton <noloader@...il.com>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Steffen Nurpmeso <steffen@...oden.eu>)

December 30 (4 messages)

CVE-2022-43396: Apache Kylin: Command injection by Useless configuration (Xiaoxiang Yu <xxyu@...che.org>)
CVE-2022-44621: Apache Kylin: Command injection by Diagnosis Controller (Xiaoxiang Yu <xxyu@...che.org>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (John Helmert III <ajak@...too.org>)

December 31 (5 messages)

Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (Arnout Engelen <engelen@...che.org>)
Re: Details on this supposed Linux Kernel ksmbd RCE (Marcus Meissner <meissner@...e.de>)
RE: [patch] proc.5: tell how to parse /proc/*/stat correctly (David Laight <David.Laight@...LAB.COM>)
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly (Solar Designer <solar@...nwall.com>)
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption (John Helmert III <ajak@...too.org>)

108 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.