oss-security mailing list - 2024/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2024/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 2	² 7	³ 3	⁴	⁵
⁶ 6	⁷ 8	⁸ 4	⁹ 6	¹⁰ 1	¹¹ 3	¹²
¹³ 3	¹⁴ 2	¹⁵ 1	¹⁶ 3	¹⁷ 1	¹⁸	¹⁹
²⁰	²¹	²²	²³	²⁴	²⁵	²⁶
²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

May 1 (2 messages)

CVE-2024-32114: Apache ActiveMQ: Jolokia and REST API were not secured with default configuration (Jean-Baptiste Onofré <jbonofre@...che.org>)
Re: CVEs issued by the Linux kernel CNA (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 2 (7 messages)

Re: Re: CVEs issued by the Linux kernel CNA (Greg KH <greg@...ah.com>)
CVE-2024-32638: Apache APISIX: Forward-Auth Request Smuggling (YuanSheng Wang <membphis@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2024-30251: DoS in aiohttp (Sam Bull <9m199i@...bull.org>)
Re: New SMTP smuggling attack (Steffen Nurpmeso <steffen@...oden.eu>)
Re: New SMTP smuggling attack (Solar Designer <solar@...nwall.com>)
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) (Sam James <sam@...too.org>)

May 3 (3 messages)

Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) (Steffen Nurpmeso <steffen@...oden.eu>)
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2023-35701: Apache Hive: Arbitrary command execution via JDBC driver (Stamatis Zampetakis <zabetak@...che.org>)

May 6 (6 messages)

Fwd: uriparser 0.9.8 released, includes security fixes (Sebastian Pipping <sebastian@...ping.org>)
Re: Buildroot: incorrect permissons on /dev/shm (Ben Hutchings <ben.hutchings@...d.be>)
Re: Fwd: uriparser 0.9.8 released, includes security fixes (Solar Designer <solar@...nwall.com>)
Re: [Buildroot] Buildroot: incorrect permissons on /dev/shm ("Yann E. MORIN" <yann.morin.1998@...e.fr>)
The GNU C Library security advisories update for 2024-05-06 (Carlos O'Donell <carlos@...hat.com>)
Re: [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm (Peter Korsgaard <peter@...sgaard.com>)

May 7 (8 messages)

CVE-2023-49606, CVE-2023-40533: memory safety vulnerabilities in tinyproxy <=1.11.1 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2024-28148: Apache Superset: Incorrect datasource authorization on explore REST API (Daniel Gaspar <dpgaspar@...che.org>)
HNS-2024-07 - HN Security Advisory - Multiple vulnerabilities in RIOT OS (Marco Ivaldi <raptor@...eadbeef.info>)
Re: Buildroot: incorrect permissons on /dev/shm (Peter Korsgaard <peter@...sgaard.com>)
GLib (2.26.0+): GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing (Philip Withnall <philip@...nocode.co.uk>)
CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function (HexRabbit Chen <hexrabbit@...co.re>)
Xen Security Advisory 456 v3 (CVE-2024-2201) - x86: Native Branch History Injection (Xen.org security team <security@....org>)
Xen Security Advisory 457 v1 - Linux/xen-netback: Memory leak due to missing cleanup function (Xen.org security team <security@....org>)

May 8 (4 messages)

Xen Security Advisory 457 v2 - Linux/xen-netfront: Memory leak due to missing cleanup function (Xen.org security team <security@....org>)
Re: CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function (Salvatore Bonaccorso <carnil@...ian.org>)
[security] Go 1.22.3 and Go 1.21.10 are released (Alan Coopersmith <alan.coopersmith@...cle.com>)
Xen Security Advisory 457 v3 (CVE-2024-27393) - Linux/xen-netfront: Memory leak due to missing cleanup function (Xen.org security team <security@....org>)

May 9 (6 messages)

CVE-2024-32113: Apache OFBiz: Path traversal leading to RCE (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-26579: Apache Inlong JDBC Vulnerability (Charles Zhang <dockerzhang@...che.org>)
Re: New SMTP smuggling attack (Mark Esler <mark.esler@...onical.com>)
[kubernetes] CVE-2024-3744: azure-file-csi-driver discloses service account tokens in logs (Rita Zhang <rita.z.zhang@...il.com>)
CVE-2024-34365: Apache Karaf Cave: Cave SSRF and arbitrary file access (Arnout Engelen <engelen@...che.org>)
Re: New SMTP smuggling attack (Erik Auerswald <auerswal@...x-ag.uni-kl.de>)

May 10 (1 message)

[vim-security] buffer-overlow in xxd with colored output < v9.1.0404 (Christian Brabandt <cb@...bit.org>)

May 11 (3 messages)

Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Corey Lopez <Corey.lopez09160587@...mail.com>)
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Solar Designer <solar@...nwall.com>)
Re: lsof "can't stat() fuse.${name} filesystem /run/user/1000/${dir}" (Simon McVittie <smcv@...ian.org>)

May 13 (3 messages)

PowerDNS Security Advisory 2024-03: Transfer requests received over DoH can lead to a denial of service in DNSdist (Remi Gacogne <remi.gacogne@...erdns.com>)
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Jacob Bachmeyer <jcb62281@...il.com>)

May 14 (2 messages)

CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance Log/Log Details (Ephraim Anierobi <ephraimanierobi@...che.org>)
git: 5 vulnerabilities fixed (Johannes Schindelin <Johannes.Schindelin@....de>)

May 15 (1 message)

CVE-2024-21823: Intel DSA and Intel IAA advisory (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 16 (3 messages)

OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
OpenSSL Security Advisory [corrected CVE id] (Tomas Mraz <tomas@...nssl.org>)
CVE-2024-34058: Nethserver 7 & 8 stored cross-site scripting (XSS) in WebTop package (Andrea Intilangelo <andrea@...ilangelo.it>)

May 17 (1 message)

Re: Linux: Disabling network namespaces (Mickaël Salaün <mic@...ikod.net>)

50 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.