oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2025/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 6	² 5	³ 3	⁴ 4	⁵	⁶ 3
⁷ 6	⁸ 5	⁹ 7	¹⁰ 6	¹¹ 1	¹² 2	¹³ 5
¹⁴	¹⁵	¹⁶ 6	¹⁷ 5	¹⁸ 6	¹⁹ 1	²⁰
²¹ 7	²² 1	²³ 6	²⁴ 9	²⁵ 7	²⁶	²⁷
²⁸ 3	²⁹ 1	³⁰

Messages by day:

April 1 (6 messages)

CVE-2025-30065: Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet… (Gang Wu <gangwu@...che.org>)
CVE-2025-29868: Apache Answer: Using externally referenced images can leak user privacy. (Enxin Xie <linkinstar@...che.org>)
Linux kernel: CVE-2024-57882 fix did not prevent data stream corruption in the MPTCP protocol (Arthur Mongodin <amongodin@...dorisec.fr>)
CVE-2025-30177: Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering (Andrea Cosentino <acosentino@...che.org>)
CVE-2025-30676: Apache OFBiz: Stored XSS Vulnerability (Jacques Le Roux <jleroux@...che.org>)
Re: Linux kernel: CVE-2024-57882 fix did not prevent data stream corruption in the MPTCP protocol (Solar Designer <solar@...nwall.com>)

April 2 (5 messages)

Re: CVE-2025-29868: Apache Answer: Using externally referenced images can leak user privacy. (Jacob Bachmeyer <jcb62281@...il.com>)
CVE-2025-27556: Django: Potential DoS in LoginView, LogoutView, and set_language() on Windows (Natalia Bidart <nataliabidart@...ngoproject.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
[ANNOUNCE] ATS is vulnerable to request smuggling via chunked messages (Masakazu Kitajo <maskit@...che.org>)
CVE-2025-2704 - OpenVPN 2.6.1 through 2.6.13 with possible DoS (David Sommerseth <dazo@...ephia.org>)

April 3 (3 messages)

XZ Utils: Threaded decoder frees memory too early (CVE-2025-31115) (Sam James <sam@...too.org>)
Re: XZ Utils: Threaded decoder frees memory too early (CVE-2025-31115) (Sam James <sam@...too.org>)
Re: XZ Utils: Threaded decoder frees memory too early (CVE-2025-31115) (Sam James <sam@...too.org>)

April 4 (4 messages)

CVE-2025-3155 GNOME Yelp: Arbitrary file read by abusing ghelp scheme (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection (Elad Kalif <eladkal@...che.org>)
pgAdmin 4 v9.2 fixes CVE-2025-2945 & CVE-2025-2946 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-22871 : Go net/http: request smuggling through invalid chunked data (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 6 (3 messages)

Re: CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection (Hanno Böck <hanno@...eck.de>)
Re: CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection (Jeffrey Walton <noloader@...il.com>)

April 7 (6 messages)

PowerDNS Recursor Security Advisory 2025-01 regarding PowerDNS Recusor 5.2.0 (Otto Moerbeek <otto.moerbeek@...erdns.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0003 (Adrian Perez de Castro <aperez@...lia.com>)
CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (李亚杰 <liyajie@...neuler.sh>)
Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (Mingcong Bai <jeffbai@...c.io>)
Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (Hanno Böck <hanno@...eck.de>)
Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (Bernhard Rosenkränzer <bero@...dev.ch>)

April 8 (5 messages)

Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (李亚杰 <liyajie@...neuler.sh>)
CVE-2025-31672: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying … (PJ Fanning <fanningpj@...che.org>)
CVE-2025-31498: c-ares use-after-free (Brad House <brad@...d-house.com>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Andrew Cooper <andrew.cooper3@...rix.com>)
CVE-2025-30215: nats-server: Missing access controls for JS API (Phil Pennock <oss-security-phil@...dhuis.org>)

April 9 (7 messages)

Announce: OpenSSH 10.0 released (Damien Miller <djm@....openbsd.org>)
CVE-2025-30677: Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Puls… (Lari Hotari <lhotari@...che.org>)
CVE-2025-27391: Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log (Domenico Francesco Bruscino <brusdev@...che.org>)
xmlrpc-c bundles a (very old and) vulnerable copy of libexpat (Sebastian Pipping <sebastian@...ping.org>)
Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (Sebastian Pipping <sebastian@...ping.org>)
Re: Announce: OpenSSH 10.0 released (Damien Miller <djm@....openbsd.org>)
Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (Bernhard Rosenkränzer <bero@...dev.ch>)

April 10 (6 messages)

Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer overflow vulnerability. (Sebastian Pipping <sebastian@...ping.org>)
Vulnerabilities in Jenkins Docker images (Daniel Beck <ml@...kweb.net>)
Re: CVE-2025-29868: Apache Answer: Using externally referenced images can leak user privacy. (LinkinStar <linkinstar@...che.org>)
CVE-2024-50217: Linux kernel: btrfs: Use-after-free of block device file in __btrfs_free_extra_devids() ("akendo@...ndo.eu" <akendo@...ndo.eu>)
Re: CVE-2024-50217: Linux kernel: btrfs: Use-after-free of block device file in __btrfs_free_extra_devids() (Greg KH <gregkh@...uxfoundation.org>)
Re: CVE-2024-50217: Linux kernel: btrfs: Use-after-free of block device file in __btrfs_free_extra_devids() (Demi Marie Obenour <demiobenour@...il.com>)

April 11 (1 message)

CVE-2025-24859: Apache Roller: Insufficient Session Expiration on Password Change ("David M. Johnson" <snoopdave@...che.org>)

April 12 (2 messages)

CVE-2025-32896: Apache SeaTunnel: Unauthenticated insecure access (Hailin Wang <wanghailin@...che.org>)
Security audit of PHP (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 13 (5 messages)

Re: CVE-2025-0395: Buffer overflow in the GNU C Library's assert() (Solar Designer <solar@...nwall.com>)
Re: Security audit of PHP (Solar Designer <solar@...nwall.com>)
CVE-2024-56406: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (Stig Palmquist <stig@...g.io>)
Re: CVE-2024-56406: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII b… (Solar Designer <solar@...nwall.com>)
Re: CVE-2024-56406: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (Stig Palmquist <stig@...g.io>)

April 16 (6 messages)

CVE-2024-56736: Apache HertzBeat (incubating): Server-Side Request Forgery (SSRF) in Api Config Oss (Chao Gong <gongchao@...che.org>)
CVE-2025-32433: Unauthenticated Remote Code Execution in Erlang/OTP SSH (Fabian Bäumer <fabian.baeumer@....de>)
CVE program averts swift end (Rolf Reintjes <rolf.reintjes@....de>)
Re: CVE program averts swift end (Marco Moock <mm@...fdsl.de>)
Re: CVE program averts swift end (Brian Behlendorf <brian@...lendorf.com>)
Re: CVE program averts swift end (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 17 (5 messages)

Re: CVE program averts swift end ("Olle E. Johansson" <oej@...ina.net>)
Re: CVE program averts swift end (Jan Klopper <janklopper@...erheight.com>)
Multiple vulnerabilities in libxml2 (Nick Wellnhofer <wellnhofer@...um.de>)
Re: Multiple vulnerabilities in libxml2 (Solar Designer <solar@...nwall.com>)
Re: Multiple vulnerabilities in libxml2 (Nick Wellnhofer <wellnhofer@...um.de>)

April 18 (6 messages)

Re: CVE-2025-32433: Unauthenticated Remote Code Execution in Erlang/OTP SSH (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-32433: Unauthenticated Remote Code Execution in Erlang/OTP SSH (Fabian Bäumer <fabian.baeumer@....de>)
CVE-2025-29953: Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass (Arnout Engelen <engelen@...che.org>)
A bowlful of bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)
libarchive 3.7.8 fixed CVE-2024-57970, CVE-2025-1632, & CVE-2025-25724 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2025-32433: Unauthenticated Remote Code Execution in Erlang/OTP SSH (Solar Designer <solar@...nwall.com>)

April 19 (1 message)

Re: CVE-2025-32433: Unauthenticated Remote Code Execution in Erlang/OTP SSH (Fabian Bäumer <fabian.baeumer@....de>)

April 21 (7 messages)

3 new CVE's in old branch of GNU mailman (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: 3 new CVE's in old branch of GNU mailman (Valtteri Vuorikoski <vuori@...com.org>)
Re: 3 new CVE's in old branch of GNU mailman (Thomas Ward <teward@...mas-ward.net>)
Re: 3 new CVE's in old branch of GNU mailman (Mats Wichmann <mats@...hmann.us>)
Re: 3 new CVE's in old branch of GNU mailman (Valtteri Vuorikoski <vuori@...com.org>)
Re: 3 new CVE's in old branch of GNU mailman (Russ Allbery <eagle@...ie.org>)
Re: 3 new CVE's in old branch of GNU mailman ("Jim P." <oss-security@....email>)

April 22 (1 message)

CVE-2025-26413: Apache Kvrocks: The server was crashed by the negative offset (Hulk Lin <hulk@...che.org>)

April 23 (6 messages)

vulnerabilities in busybox tar and cpio tools (Ian Norton <Ian.Norton@...rust.com>)
Re: vulnerabilities in busybox tar and cpio tools (Ricardo Branco <rbranco@...e.de>)
Re: vulnerabilities in busybox tar and cpio tools (Jakub Wilk <jwilk@...lk.net>)
CVE-2025-23016: Integer & buffer overflow in fastcgi < 2.4.5 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: vulnerabilities in busybox tar and cpio tools (Salvatore Bonaccorso <carnil@...ian.org>)
Re: vulnerabilities in busybox tar and cpio tools (Salvatore Bonaccorso <carnil@...ian.org>)

April 24 (9 messages)

Re: vulnerabilities in busybox tar and cpio tools (Albert Veli <albert.veli@...il.com>)
Re: [EXTERNAL] Re: vulnerabilities in busybox tar and cpio tools (Ian Norton <Ian.Norton@...rust.com>)
Re: [EXTERNAL] Re: vulnerabilities in busybox tar and cpio tools (Ian Norton <Ian.Norton@...rust.com>)
CVE-2025-3512: Qt Base QTextMarkdownImporter Front Matter Buffer Overflow ("田世林" <tianshilin@...pin.org>)
Re: CVE-2025-3512: Qt Base QTextMarkdownImporter Front Matter Buffer Overflow (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-3512: Qt Base QTextMarkdownImporter Front Matter Buffer Overflow (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2025-0395: Buffer overflow in the GNU C Library's assert() (Qualys Security Advisory <qsa@...lys.com>)
Re: vulnerabilities in busybox tar and cpio tools (Demi Marie Obenour <demiobenour@...il.com>)
Re: vulnerabilities in busybox tar and cpio tools (Solar Designer <solar@...nwall.com>)

April 25 (7 messages)

Re: CVE-2025-3512: Qt Base QTextMarkdownImporter Front Matter Buffer Overflow (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-3512: Qt Base QTextMarkdownImporter Front Matter Buffer Overflow (Jacob Bachmeyer <jcb62281@...il.com>)
CVE-2024-56430: openfhe: OpenFHE through 1.2.3 has a NULL pointer dereference bug ("xiaolin" <dongxiaolin@...pin.org>)
CVE-2024-56431: libtheora: incorrect bitwise shift in huffdec.c ("xiaolin" <dongxiaolin@...pin.org>)
Re: Trailing dot in Cygwin filenames [was: failed to clone iptables,ipset,nftables] (Jan Engelhardt <ej@...i.de>)
Re: CVE-2024-56431: libtheora: incorrect bitwise shift in huffdec.c (Solar Designer <solar@...nwall.com>)
Re: vulnerabilities in busybox tar and cpio tools (Demi Marie Obenour <demiobenour@...il.com>)

April 28 (3 messages)

Re: Re: Trailing dot in Cygwin filenames [was: failed to clone iptables,ipset,nftables] (Werner Koch <wk@...pg.org>)
CVE-2025-31650: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (Mark Thomas <markt@...che.org>)
CVE-2025-31651: Apache Tomcat: Bypass of rules in Rewrite Valve (Mark Thomas <markt@...che.org>)

April 29 (1 message)

PowerDNS Security Advisory 2025-02: Denial of service via crafted DoH exchange (Remi Gacogne <remi.gacogne@...erdns.com>)

105 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.