oss-security mailing list - 2025/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2025/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	² 2	³	⁴
⁵	⁶ 3	⁷ 1	⁸ 4	⁹ 4	¹⁰	¹¹
¹² 6	¹³ 16	¹⁴ 10	¹⁵ 4	¹⁶ 7	¹⁷ 5	¹⁸ 1
¹⁹ 2	²⁰ 2	²¹ 1	²² 2	²³ 2	²⁴	²⁵
²⁶	²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

May 2 (2 messages)

CVE-2025-46762: Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when readi… (Gang Wu <gangwu@...che.org>)
CVE-2025-47153: out-of-bounds access in some 32-bit builds of Node.js (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 6 (3 messages)

CVE-2025-27533: Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation ("Christopher L. Shannon" <cshannon@...che.org>)
Go 1.24.3 fixes CVE-2025-22873: os: Root permits access to parent directory (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2025-27363: out of bounds write in FreeType <= 2.13.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 7 (1 message)

CVE-2025-32873: Django: Denial-of-service possibility in strip_tags() (Natalia Bidart <nataliabidart@...ngoproject.com>)

May 8 (4 messages)

OSSA-2025-001 / CVE-2025-44021: OpenStack Ironic fails to restrict paths used for file:// image URLs (Jay Faulkner <jay@....cc>)
Re: 3 new CVE's in old branch of GNU mailman (Jeremy Reeder <jeremy.reeder@...pros.com>)
Fwd: Node.js security updates for all active release lines, May 2025 (Rafael Gonzaga <work@...aelgss.dev>)
Re: Fwd: Node.js security updates for all active release lines, May 2025 (Solar Designer <solar@...nwall.com>)

May 9 (4 messages)

CVE-2025-1948 & CVE-2024-13009: DoS and infoleak in Jetty (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2025-46392: Apache Commons Configuration: StackOverflowError loading untrusted configuration (Arnout Engelen <engelen@...che.org>)
CVE-2025-4207: PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails vali… (Alan Coopersmith <alan.coopersmith@...c…)
Dropbear SSH 2025.88 fixes CVE-2025-47203 (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 12 (6 messages)

screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools (VMware PSIRT <vmware.psirt@...adcom.com>)
CVE-2025-27696: Apache Superset: Improper authorization leading to resource ownership takeover (Daniel Gaspar <dpgaspar@...che.org>)
Xen Security Advisory 469 v1 - x86: Indirect Target Selection (Xen.org security team <security@....org>)
Xen Security Advisory 469 v2 (CVE-2024-28956) - x86: Indirect Target Selection (Xen.org security team <security@....org>)
Re: Dropbear SSH 2025.88 fixes CVE-2025-47203 (Albert Veli <albert.veli@...il.com>)

May 13 (16 messages)

Re: Dropbear SSH 2025.88 fixes CVE-2025-47203 (Matt Johnston <matt@....asn.au>)
Re: CVE-2025-22247 - Insecure file handling vulnerability in open-vm-tools (Solar Designer <solar@...nwall.com>)
Re: Dropbear SSH 2025.88 fixes CVE-2025-47203 (Albert Veli <albert.veli@...il.com>)
CVE-2025-47436: Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression (Dongjoon Hyun <dongjoon@...che.org>)
VSV00016: Varnish Cache 6.0, 7.6, 7.7 - Request Smuggling Attack (Asad Ahmed <asadsa@...nish-software.com>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Xen Security Notice 3 (CVE-2024-45332) Intel Branch Privilege Injection (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: VSV00016: Varnish Cache 6.0, 7.6, 7.7 - Request Smuggling Attack (Marco Benatto <mbenatto@...hat.com>)
Re: Dropbear SSH 2025.88 fixes CVE-2025-47203 (Dave Hart <davehart@...il.com>)
EU Vulnerability Database (Graeme Fowler <graeme@...emef.net>)
Re: EU Vulnerability Database (Stuart Henderson <stu@...cehopper.org>)
Re: EU Vulnerability Database (Stuart Henderson <stu@...cehopper.org>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Simon McVittie <smcv@...ian.org>)
Re: EU Vulnerability Database (Rolf Reintjes <rolf.reintjes@....de>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Mark Esler <mark.esler@...inguard.dev>)

May 14 (10 messages)

Re: EU Vulnerability Database (Solar Designer <solar@...nwall.com>)
CVE-2024-24780: Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function (Haonan Hou <haonan@...che.org>)
CVE-2025-26795: Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver (Haonan Hou <haonan@...che.org>)
CVE-2025-26864: Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication (Haonan Hou <haonan@...che.org>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Matthias Gerstner <mgerstner@...e.de>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Matthias Gerstner <mgerstner@...e.de>)
Re: EU Vulnerability Database ("gmane.io" <wwd.smartmachine.stp@...teo.org>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Fwd: Node.js security updates for all active release lines, May 2025 (Rafael Gonzaga <work@...aelgss.dev>)
Re: Fwd: Node.js security updates for all active release lines, May 2025 (Solar Designer <solar@...nwall.com>)

May 15 (4 messages)

Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Stuart Henderson <stu@...cehopper.org>)
Re: VSV00016: Varnish Cache 6.0, 7.6, 7.7 - Request Smuggling Attack (Asad Ahmed <asadsa@...nish-software.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0004 (Adrian Perez de Castro <aperez@...lia.com>)
Re: Fwd: Node.js security updates for all active release lines, May 2025 (Yogesh Mittal <ymittal@...hat.com>)

May 16 (7 messages)

Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Matthias Gerstner <mgerstner@...e.de>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Jan Schaumann <jschauma@...meister.org>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Eli Schwartz <eschwartz@...too.org>)
CPython CVE-2025-4516: Use-after-free crash using bytes.decode("unicode_escape", error="ignore|replace") (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Taylor R Campbell <riastradh@...BSD.org>)
Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Eli Schwartz <eschwartz@...too.org>)
The GNU C Library security advisories update for 2025-05-16 (Carlos O'Donell <carlos@...hat.com>)

May 17 (5 messages)

Re: describing affected systems (was: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setui… (Jacob Bachmeyer <jcb62281@...il.com>)
Re: The GNU C Library security advisories update for 2025-05-16 (Solar Designer <solar@...nwall.com>)
RE: The GNU C Library security advisories update for 2025-05-16 ("Caveney, Seamus G" <sgcaveney@...ttleschools.org>)
Re: describing affected systems (was: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and s… (Jan Schaumann <jschauma@...meister.org>)
Re: describing affected systems (was: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and se… (Taylor R Campbell <riastradh@...BSD.org…)

May 18 (1 message)

Re: describing affected systems (Eli Schwartz <eschwartz@...too.org>)

May 19 (2 messages)

Re: CPython CVE-2025-4516: Use-after-free crash using bytes.decode("unicode_escape", error="ignore|replace") (Hanno Böck <hanno@...eck.de>)
Landlock news #5 (Mickaël Salaün <mic@...ikod.net>)

May 20 (2 messages)

Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2025-3908: OpenVPN 3 Linux v24.1 released (David Sommerseth <dazo@...ephia.org>)

May 21 (1 message)

CVE-2025-40775: BIND 9: DNS message with invalid TSIG causes an assertion failure (Nicki Křížek <nicki@....org>)

May 22 (2 messages)

CVE-2025-4575: OpenSSL: The x509 application adds trusted use instead of rejected use (Tomas Mraz <tomas@...nssl.org>)
Perl 5.40 dir dup bug with threading: security consequences (Vincent Lefevre <vincent@...c17.net>)

May 23 (2 messages)

Re: Perl 5.40 dir dup bug with threading: security consequences (Stig Palmquist <stig@...g.io>)
CVE-2025-48708: ghostscript can embed plaintext password in encrypted PDFs (Alan Coopersmith <alan.coopersmith@...cle.com>)

72 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.