oss-security mailing list - 2025/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2025/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	² 1
³ 2	⁴	⁵ 3	⁶ 14	⁷ 2	⁸ 1	⁹ 1
¹⁰ 6	¹¹ 2	¹² 4	¹³ 12	¹⁴ 7	¹⁵	¹⁶
¹⁷	¹⁸	¹⁹	²⁰	²¹	²²	²³
²⁴	²⁵	²⁶	²⁷	²⁸	²⁹	³⁰
³¹

Messages by day:

March 1 (2 messages)

Re: Re: GNU Emacs 30.1 released with 2 CVE fixes (Henrik Ahlgren <pablo@...stieto.com>)
Re: Re: GNU Emacs 30.1 released with 2 CVE fixes (Max Nikulin <manikulin@...il.com>)

March 2 (1 message)

[vim-security] potential code execution with tar.vim and special crafted tar files (Christian Brabandt <cb@...bit.org>)

March 3 (2 messages)

CVE-2024-24778: Apache StreamPipes: Resources Permission Escalation (Philipp Zehnder <zehnder@...che.org>)
CVE-2024-55532: Apache Ranger: Improper Neutralization of Formula Elements in a CSV File (Velmurugan Periasamy <vel@...che.org>)

March 5 (3 messages)

[ANNOUNCE] ATS is vulnerable to malformed requests, and also has ACL issues (Masakazu Kitajo <maskit@...che.org>)
Multiple vulnerabilities in Jenkins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)

March 6 (14 messages)

Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Jacob Bachmeyer <jcb62281@...il.com>)
Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Jacob Bachmeyer <jcb62281@...il.com>)
Re: AMD Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Bastian Blank <bblank@...nkmo.de>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: AMD Microcode Signature Verification Vulnerability (Taylor R Campbell <campbell+oss-security@...ble.net>)
CVE-2025-26699: Django: Potential denial-of-service in django.utils.text.wrap() (Sarah Boyce <sarahboyce@...ngoproject.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Buherátor <buherator@...il.com>)

March 7 (2 messages)

CVE-2025-26865: Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE (Jacques Le Roux <jleroux@...che.org>)
Go CVE-2025-22870: proxy bypass using IPv6 zone IDs (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 8 (1 message)

Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)

March 9 (1 message)

CVE-2025-27636: Apache Camel: Camel Message Header Injection via Improper Filtering (Andrea Cosentino <acosentino@...che.org>)

March 10 (6 messages)

Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (Qualys Security Advisory <qsa@...lys.com>)
CVE-2025-1937+more: Numerous memory-safety issues in Firefox & Thunderbird (Valtteri Vuorikoski <vuori@...com.org>)
[SBA-ADV-20241209-01] CVE-2024-13918: Laravel 11.9.0-11.35.1 Reflected XSS via Request Parameter in Debug-Mode Error Pa… (SBA Research Security Advisory <advisor…)
[SBA-ADV-20241209-02] CVE-2024-13919: Laravel 11.9.0-11.35.1 Reflected XSS via Route Parameter in Debug-Mode Error Page (SBA Research Security Advisory <advisor…)
CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (Mark Thomas <markt@...che.org>)
Re: CVE-2025-1937+more: Numerous memory-safety issues in Firefox & Thunderbird (Jacob Bachmeyer <jcb62281@...il.com>)

March 11 (2 messages)

CVE-2025-27017: Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record (Pierre Villard <pvillard@...che.org>)
Re: CVE-2025-1937+more: Numerous memory-safety issues in Firefox & Thunderbird (Moritz Mühlenhoff <jmm@...til.org>)

March 12 (4 messages)

Below: World Writable Directory in /var/log/below Allows Local Privilege Escalation (CVE-2025-27591) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2025-29891: Apache Camel: Camel Message Header Injection through request parameters (Andrea Cosentino <acosentino@...che.org>)
FELIX-6753: CVE-2025-27867: Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin (Carsten Ziegeler <cziegeler@...che.org>)
[vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Christian Brabandt <cb@...bit.org>)

March 13 (12 messages)

CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Michel Lind <michel@...hel-slm.name>)
CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Jonathan Wright <jonathan@...alinux.org>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Solar Designer <solar@...nwall.com>)
Re: [vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Solar Designer <solar@...nwall.com>)
Re: [vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Eli Schwartz <eschwartz@...too.org>)
Re: [vim-security] potential data loss with zip.vim and special crafted zip files in Vim < v9.1.1198 (Christian Brabandt <cb@...bit.org>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Marc Deslauriers <marc.deslauriers@...onical.com>)
[kubernetes] CVE-2025-1767: GitRepo Volume Inadvertent Local Repository Access ("Vellore Rajakumar, Sri Saran Balaji" <srajakum@...zon.com>)
Triton Product Security announcement: Debian 12 LX image from 2024-07 has static SSH keys (Dan McDonald <danmcd@....io>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Vulnerability Disclosure <vulns@...a.com>)

March 14 (7 messages)

Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Michel Lind <michel@...hel-slm.name>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 ("Michel Lind" <michel@...hel-slm.name>)
[CVE-2024-8176] Long linear chains of entities crash Expat with stack overflow due to use of unlimited recursion (Alan Coopersmith <alan.coopersmith@...cle.com…)
PHP security releases 8.4.5, 8.3.19, 8.2.28, 8.1.32 (Alan Coopersmith <alan.coopersmith@...cle.com>)
expat vulnerability CVE-2024-8176 / impact of recursion stack overflow vulnerabilities (Hanno Böck <hanno@...eck.de>)

57 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.