oss-security mailing list - 2023/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2023/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 8	² 1	³ 1	⁴	⁵
⁶ 1	⁷ 2	⁸ 3	⁹ 2	¹⁰ 1	¹¹	¹²
¹³ 2	¹⁴ 11	¹⁵ 8	¹⁶ 2	¹⁷ 5	¹⁸ 3	¹⁹ 4
²⁰ 7	²¹ 5	²² 2	²³ 1	²⁴	²⁵	²⁶
²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

March 1 (8 messages)

Re: sudo: double free with per-command chroot sudoers rules (John Helmert III <ajak@...too.org>)
Re: sudo: double free with per-command chroot sudoers rules (Noryungi <noryungi@...il.com>)
Re: sudo: double free with per-command chroot sudoers rules ("Todd C. Miller" <Todd.Miller@...o.ws>)
CVE-2023-1079: Linux Kernel: Use-After-Free in asus_kbd_backlight_set() (Pietro Borrello <borrello@...g.uniroma1.it>)
CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket UID to root (Pietro Borrello <borrello@...g.uniroma1.it>)
CVE-2023-1075 - Linux Kernel: Type Confusion in tls_is_tx_ready() (Pietro Borrello <borrello@...g.uniroma1.it>)
CVE-2023-1077: Linux kernel: Type confusion in pick_next_rt_entity() (Pietro Borrello <borrello@...g.uniroma1.it>)
Re: sudo: double free with per-command chroot sudoers rules (Marc Deslauriers <marc.deslauriers@...onical.com>)

March 2 (1 message)

Linux kernel: CVE-2023-1118: UAF vulnerabilities in "drivers/media/rc" directory (duoming@....edu.cn)

March 3 (1 message)

UAF in OpenSSL up to 3.0.7 (Octavio Galland <octavio.galland@...il.com>)

March 6 (1 message)

Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Georgi Guninski <gguninski@...il.com>)

March 7 (2 messages)

CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy (Eric Covener <covener@...che.org>)
CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting (Eric Covener <covener@...che.org>)

March 8 (3 messages)

CVE-2023-23638: Apache Dubbo Deserialization Vulnerability Gadgets Bypass (Albumen Kevin <albumenj@...che.org>)
Shell command and Emacs Lisp code injection in emacsclient-mail.desktop (Gabriel Corona <gabriel.corona@...e.fr>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)

March 9 (2 messages)

Re: Shell command and Emacs Lisp code injection in emacsclient-mail.desktop (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) (Qualys Security Advisory <qsa@...lys.com>)

March 10 (1 message)

CVE-2023-26464: Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender (Arnout Engelen <engelen@...che.org>)

March 13 (2 messages)

A USB-accessible slab-out-of-bounds read in Linux kernel driver (Jisoo Jang <jisoo.jang@...sei.ac.kr>)
CVE-2023-1032 - Linux kernel io_uring IORING_OP_SOCKET double free (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

March 14 (11 messages)

Re: A USB-accessible slab-out-of-bounds read in Linux kernel driver (Jisoo Jang <jisoo.jang@...sei.ac.kr>)
TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Peter Bex <peter@...e-magic.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Peter Bex <peter@...e-magic.net>)
Re: sox: patches for old vulnerabilities (Helmut Grohne <helmut@...divi.de>)
Security issue in Hotspot elevate_perf_privileges.sh (CVE-2023-28144) (Matthias Gerstner <mgerstner@...e.de>)
Re: Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Re: sox: patches for old vulnerabilities (Steffen Nurpmeso <steffen@...oden.eu>)
Re: TTY pushback vulnerabilities / TIOCSTI (Shawn Webb <shawn.webb@...denedbsd.org>)

March 15 (8 messages)

Re: TTY pushback vulnerabilities / TIOCSTI (Fabian Keil <freebsd-listen@...iankeil.de>)
CVE-2023-25695: Information disclosure in Apache Airflow (Jarek Potiuk <potiuk@...che.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Dave Horsfall <dave@...sfall.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Casper Dik <casper.dik@...cle.com>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jan Engelhardt <jengelh@...i.de>)
Minor stack-based buffer overflow in OpenBSD's libskey (Qualys Security Advisory <qsa@...lys.com>)
Announce: OpenSSH 9.3 released (Damien Miller <djm@....openbsd.org>)

March 16 (2 messages)

CVE-2023-24278 - Reflected XSS vulnerabilities in Squidex "/squid.svg" endpoint (Giannis Christodoulakos <gchristodoulakos@...sus-labs.com>)
CVE-2023-24278 - Reflected XSS vulnerabilities in Squidex "/squid.svg" endpoint (Giannis Christodoulakos <gchristodoulakos@...sus-labs.com>)

March 17 (5 messages)

flatpak: CVE-2023-28100: TIOCLINUX can send commands outside sandbox if running on a virtual console (Simon McVittie <smcv@...ian.org>)
flatpak: CVE-2023-28101: escape characters in metadata can hide app permissions in terminal (Simon McVittie <smcv@...ian.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
Re: TTY pushback vulnerabilities / TIOCSTI (Ed Maste <emaste@...ebsd.org>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)

March 18 (3 messages)

Re: TTY pushback vulnerabilities / TIOCSTI ("Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>)
Re: TTY pushback vulnerabilities / TIOCSTI (Christos Zoulas <christos@...las.com>)
Re: TTY pushback vulnerabilities / TIOCSTI (Eric Ashley <eric@...data.us>)

March 19 (4 messages)

Re: TTY pushback vulnerabilities / TIOCSTI (Hanno Böck <hanno@...eck.de>)
First result on google promotes insecure coding (XSS) (Georgi Guninski <gguninski@...il.com>)
Re: First result on google promotes insecure coding (XSS) (Solar Designer <solar@...nwall.com>)
Re: First result on google promotes insecure coding (XSS) (Georgi Guninski <gguninski@...il.com>)

March 20 (7 messages)

[SECURITY ADVISORY] curl: CVE-2023-27533: TELNET option IAC injection (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27534: SFTP path ~ resolving discrepancy (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27535: FTP too eager connection reuse (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27536: GSS delegation too eager connection re-use (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27537: HSTS double-free (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-27538: SSH connection too eager reuse still (Daniel Stenberg <daniel@...x.se>)
CVE-2023-26513: Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to … (Radu Cotescu <radu@...che.org>)

March 21 (5 messages)

Xen Security Advisory 427 v2 (CVE-2022-42332) - x86 shadow plus log-dirty mode use-after-free (Xen.org security team <security@....org>)
Xen Security Advisory 428 v3 (CVE-2022-42333,CVE-2022-42334) - x86/HVM pinned cache attributes mis-handling (Xen.org security team <security@....org>)
Xen Security Advisory 429 v3 (CVE-2022-42331) - x86: speculative vulnerability in 32bit SYSCALL path (Xen.org security team <security@....org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: TTY pushback vulnerabilities / TIOCSTI (Jakub Wilk <jwilk@...lk.net>)

March 22 (2 messages)

CVE-2023-28708: Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations (Mark Thomas <markt@...che.org>)
CVE-2023-0464: OpenSSL: Excessive Resource Usage Verifying X.509 Policy Constraints (Solar Designer <solar@...nwall.com>)

March 23 (1 message)

[CVE-2023-28686] Insufficient message sender validation in Dino (Dino Team <team@...o.im>)

69 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.