oss-security mailing list - 2023/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	²	³	⁴
⁵ 1	⁶ 5	⁷ 2	⁸ 2	⁹	¹⁰ 2	¹¹
¹² 3	¹³ 1	¹⁴ 8	¹⁵ 3	¹⁶	¹⁷ 2	¹⁸ 1
¹⁹	²⁰ 6	²¹ 13	²² 7	²³ 11	²⁴ 5	²⁵
²⁶ 4	²⁷	²⁸	²⁹ 1	³⁰

Messages by day:

June 1 (1 message)

[vs] CVE-2023-32324 heap buffer overflow in cupsd (Zdenek Dohnal <zdohnal@...hat.com>)

June 5 (1 message)

RE: Update CVE-2021-3610 (cpe_dictionary <cpe_dictionary@...t.gov>)

June 6 (5 messages)

[SECURITY] CVE-2023-30575: Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths (Michael Jumper <mjumper@...che.org>)
[SECURITY] CVE-2023-30576: Apache Guacamole: Use-after-free in handling of RDP audio input buffer (Michael Jumper <mjumper@...che.org>)
LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863 (Qualys Security Advisory <qsa@...lys.com>)
Re: [SECURITY] CVE-2023-30576: Apache Guacamole: Use-after-free in handling of RDP audio input buffer (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: [SECURITY] CVE-2023-30576: Apache Guacamole: Use-after-free in handling of RDP audio input buffer (Michael Jumper <mjumper@...che.org>)

June 7 (2 messages)

Linux kernel: off-by-one in fl_set_geneve_opt (Hangyu Hua <hbh25y@...il.com>)
Re: Linux kernel: off-by-one in fl_set_geneve_opt (Hangyu Hua <hbh25y@...il.com>)

June 8 (2 messages)

Re: Linux kernel: off-by-one in fl_set_geneve_opt (Hangyu Hua <hbh25y@...il.com>)
Re: Linux kernel: off-by-one in fl_set_geneve_opt (Solar Designer <solar@...nwall.com>)

June 10 (2 messages)

Solar Designer talk about 15 years of oss-security at SSTIC conference (Yves-Alexis Perez <corsac@...ian.org>)
Re: Solar Designer talk about 15 years of oss-security at SSTIC conference (Katherine Mcmillan <kmcmi046@...tawa.ca>)

June 12 (3 messages)

Re: Linux kernel: off-by-one in fl_set_geneve_opt (Hangyu Hua <hbh25y@...il.com>)
CVE-2023-34212: Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components (David Handermann <exceptionfactory@...che.org>)
CVE-2023-34468: Apache NiFi: Potential Code Injection with Database Services using H2 (David Handermann <exceptionfactory@...che.org>)

June 13 (1 message)

Re: Solar Designer talk about 15 years of oss-security at SSTIC conference (Georgi Guninski <gguninski@...il.com>)

June 14 (8 messages)

Re: Stack overflow in imagemagick coders/tiff.c (Salvatore Bonaccorso <carnil@...ian.org>)
S2-063: CVE-2023-34149: Apache Struts: DoS via OOM owing to not properly checking of list bounds (Yasser Zamani <yasserzamani@...che.org>)
S2-064: CVE-2023-34396: Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms (Yasser Zamani <yasserzamani@...che.org>)
Fwd: Node.js security updates for all active release lines, June 2023 (Rafael Silva <rafael.silva@...rform.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Stack overflow in imagemagick coders/tiff.c (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
CVE-2023-34095: cpdb-libs: Buffer overflows via scanf (Till Kamppeter <till.kamppeter@...il.com>)
RCE in acme.sh < 3.0.6 (Jan Schaumann <jschauma@...meister.org>)

June 15 (3 messages)

CVE-2023-1672: race condition in Tang exposes private keys to other processes (Brian McDermott <bmcdermott@...sus-labs.com>)
Fwd: [ANNOUNCE] X.Org Security Advisory: Sub-object overflows in libX11 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: distros list archive (Solar Designer <solar@...nwall.com>)

June 17 (2 messages)

Re: Linux kernel: off-by-one in fl_set_geneve_opt (Salvatore Bonaccorso <carnil@...ian.org>)
Our learnings from 42 Linux kernel exploits, we are limiting io_uring (Tamás Koczka <poprdi@...omium.org>)

June 18 (1 message)

CVE-2023-35005: Apache Airflow: Information disclosure on configuration view (Elad Kalif <eladkal@...che.org>)

June 20 (6 messages)

The AI chatgpt writes insecure code (Georgi Guninski <gguninski@...il.com>)
Re: The AI chatgpt writes insecure code (Petr Štetiar <ynezz@...e.cz>)
Re: The AI chatgpt writes insecure code (Georgi Guninski <gguninski@...il.com>)
CVE-2023-34340: Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentials (Christopher Tubbs <ctubbsii@...che.org>)
Re: The AI chatgpt writes insecure code (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2023-31975: memory leak in yasm (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 21 (13 messages)

Re: The AI chatgpt writes insecure code (Travis Biehn <tbiehn@...il.com>)
Re: CVE-2023-31975: memory leak in yasm (Jeffrey Walton <noloader@...il.com>)
PAM/Kerberos issue on NetBSD (Alistair Crooks <agc@...src.org>)
Re: Solar Designer talk about 15 years of oss-security at SSTIC conference (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-31975: memory leak in yasm (Dave Horsfall <dave@...sfall.org>)
ISC has disclosed two vulnerabilities in BIND 9 (CVE-2023-2828, CVE-2023-2911) (Michał Kępień <michal@....org>)
Re: CVE-2023-31975: memory leak in yasm (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2023-31975: memory leak in yasm (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Re: CVE-2023-31975: memory leak in yasm (Jeffrey Walton <noloader@...il.com>)
Re: CVE-2023-31975: memory leak in yasm (Jeffrey Walton <noloader@...il.com>)
[kubernetes/kops] CVE-2023-1943: Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode (CJ Cullen <cjcullen@...gle.com>)
Re: PAM/Kerberos issue on NetBSD (Taylor R Campbell <riastradh@...BSD.org>)
Re: CVE-2023-31975: memory leak in yasm (Demi Marie Obenour <demi@...isiblethingslab.com>)

June 22 (7 messages)

Re: CVE-2023-31975: memory leak in yasm (Steve Grubb <sgrubb@...hat.com>)
Re: Re: PAM/Kerberos issue on NetBSD (Russ Allbery <eagle@...ie.org>)
Re: CVE-2023-31975: memory leak in yasm (Jeffrey Walton <noloader@...il.com>)
CVE-2023-34241: CUPS: use-after-free in cupsdAcceptClient() (Zdenek Dohnal <zdohnal@...hat.com>)
Open Source Tool | MPT: Pentest In Action! (Jyoti Raval <jenyraval@...il.com>)
Re: CVE-2023-31975: memory leak in yasm (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2023-31469: Apache StreamPipes: Privilege escalation through non-admin user (Dominik Riemer <riemer@...che.org>)

June 23 (11 messages)

Re: CVE-2023-31975: memory leak in yasm ("Smith, Stewart" <trawets@...zon.com>)
Re: CVE-2023-31975: memory leak in yasm (Stuart Henderson <stu@...cehopper.org>)
Opinion: Governments don't want IT security, they want to have cyber weapons (Georgi Guninski <gguninski@...il.com>)
Re: CVE-2023-31975: memory leak in yasm (Hanno Böck <hanno@...eck.de>)
Re: Opinion: Governments don't want IT security, they want to have cyber weapons (Solar Designer <solar@...nwall.com>)
Re: Open Source Tool | MPT: Pentest In Action! (Solar Designer <solar@...nwall.com>)
Re: Open Source Tool | MPT: Pentest In Action! (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-31975: memory leak in yasm (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Re: CVE-2023-31975: memory leak in yasm (Marcus Meissner <meissner@...e.de>)
Re: CVE-2023-34241: CUPS: use-after-free in cupsdAcceptClient() (Solar Designer <solar@...nwall.com>)
Re: Opinion: Governments don't want IT security, they want to have cyber weapons ("David A. Wheeler" <dwheeler@...eeler.com>)

June 24 (5 messages)

Re: CVE-2023-31975: memory leak in yasm (Jakub Wilk <jwilk@...lk.net>)
Re: Opinion: Governments don't want IT security, they want to have cyber weapons (cbf0001@...ton.me)
CVE-2023-3338: Linux Kernel NULL Pointer Dereference in DECnet (Ornaghi Davide - Betrusted <davide.ornaghi@...rusted.it>)
Re: CVE-2023-3338: Linux Kernel NULL Pointer Dereference in DECnet (Peter Philip Pettersson <philip.pettersson@...il.com>)
Re: Opinion: Governments don't want IT security, they want to have cyber weapons (Solar Designer <solar@...nwall.com>)

June 26 (4 messages)

Re: CVE-2023-34241: CUPS: use-after-free in cupsdAcceptClient() (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2023-34395: Apache Airflow ODBC Provider: Remote code execution vulnerability (Elad Kalif <eladkal@...che.org>)
CVE-2023-22886: Apache Airflow JDBC Provider: RCE Vulnerability (Elad Kalif <eladkal@...che.org>)
CVE-2023-35798: Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability (Elad Kalif <eladkal@...che.org>)

June 29 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

78 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.