oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 3	² 3	³ 2	⁴ 3	⁵ 3
⁶ 2	⁷ 2	⁸ 1	⁹ 2	¹⁰ 2	¹¹ 1	¹² 2
¹³ 6	¹⁴ 13	¹⁵ 4	¹⁶ 7	¹⁷ 4	¹⁸ 4	¹⁹
²⁰ 1	²¹ 3	²² 1	²³ 1	²⁴ 1	²⁵	²⁶ 1
²⁷ 14	²⁸ 8	²⁹ 8	³⁰ 5	³¹ 5

Messages by day:

October 1 (3 messages)

Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH ("Mike O'Connor" <mjo@...o.mi.org>)
Re: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH (Emilio Pozuelo Monfort <pochu27@...il.com>)
Django CVE-2025-59681 and CVE-2025-59682 (Jacob Walls <jwalls@...ngoproject.com>)

October 2 (3 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)

October 3 (2 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
fetchmail-SA-2025-01: SMTP AUTH denial of service (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 4 (3 messages)

Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Attila Szasz <szasza.contact@...il.com>)
Re: Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: fetchmail-SA-2025-01: SMTP AUTH denial of service now called CVE-2025-61962. (Matthias Andree <matthias.andree@....de>)

October 5 (3 messages)

Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (nightmare.yeah27@...ecat.org)
Re: Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (Greg KH <greg@...ah.com>)
Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros (nightmare.yeah27@...ecat.org)

October 6 (2 messages)

Announce: OpenSSH 10.1 released (Damien Miller <djm@....openbsd.org>)
Resource consumption weakness in Postgres-using applications & frameworks (Peter Bex <peter@...e-magic.net>)

October 7 (2 messages)

Re: Announce: OpenSSH 10.1 released (David Leadbeater <dgl@....cx>)
redis: CVE-2025-49844: Lua Use-After-Free may lead to remote code execution (Jan Schaumann <jschauma@...meister.org>)

October 8 (1 message)

several vulnerabilities fixed in Go 1.25.2 and Go 1.24.8 (Jan Schaumann <jschauma@...meister.org>)

October 9 (2 messages)

Fwd: Heads-up: Upcoming Samba security releases (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
CVE-2025-62228: Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via mal… (Leonard Xu <leonard@...che.org>)

October 10 (2 messages)

Announce: OpenSSH 10.2 released (Damien Miller <djm@....openbsd.org>)
Go 1.25.2 and Go 1.24.8 fix 10 vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 11 (1 message)

Linux kernel: KASAN: out-of-bounds Read in proc_pid_stack on RISC-V (许佳凯 <xujiakai24@...ls.ucas.ac.cn>)

October 12 (2 messages)

Re: Announce: OpenSSH 10.1 released (Demi Marie Obenour <demiobenour@...il.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (lunbun <lunbun021@...il.com>)

October 13 (6 messages)

BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
GHSL-2025-042: Use After Free (UAF) in Poppler - CVE-2025-52885 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: BoringSSL private key loading is not constant time (Jeffrey Walton <noloader@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0007 (Adrian Perez de Castro <aperez@...lia.com>)
Re: BoringSSL private key loading is not constant time (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Announce: OpenSSH 10.1 released (David Leadbeater <dgl@....cx>)

October 14 (13 messages)

Re: BoringSSL private key loading is not constant time (Alex Gaynor <alex.gaynor@...il.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: BoringSSL private key loading is not constant time (Demi Marie Obenour <demiobenour@...il.com>)
CVE-2024-44088: Apache Geode: Reflected XSS (William Hodges <whodges@...che.org>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (David Benjamin <davidben@...gle.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: BoringSSL private key loading is not constant time (Hanno Böck <hanno@...eck.de>)
CVE-2025-55039: Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext … (Holden Karau <holden@...che.org>)
Re: BoringSSL private key loading is not constant time (Alex Gaynor <alex.gaynor@...il.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)

October 15 (4 messages)

Re: BoringSSL private key loading is not constant time (Jacob Bachmeyer <jcb62281@...il.com>)
Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
CVE-2025-54539: Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data (Krzysztof Porębski <havret@...che.org>)
RE: Samba security releases for CVE-2025-10230 and CVE-2025-9640 ("Caveney, Seamus G" <sgcaveney@...ttleschools.org>)

October 16 (7 messages)

Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
CVE-2025-61581: Apache Traffic Control: ReDoS issue in Traffic Router configuration (Arnout Engelen <engelen@...che.org>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Demi Marie Obenour <demiobenour@...il.com>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: Linux kernel: KASAN: out-of-bounds Read in proc_pid_stack on RISC-V (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution (Solar Designer <solar@...nwall.com>)

October 17 (4 messages)

Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2025-47410: Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute … (William Hodges <whodges@...che.org>)
rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Vincent Lefevre <vincent@...c17.net>)
Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Solar Designer <solar@...nwall.com>)

October 18 (4 messages)

Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Vincent Lefevre <vincent@...c17.net>)
Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Jacob Bachmeyer <jcb62281@...il.com>)
Re: BoringSSL private key loading is not constant time (Billy Brumley <bbb@....fi>)
Re: rplay (Mark R. Boyns) potential security issues (unsanitized data, unchecked malloc...) (Fabio Degrigis <degrigis@...il.com>)

October 20 (1 message)

CVE-2025-57738: Apache Syncope: Remote Code Execution by delegated administrators (Francesco Chicchiriccò <ilgrosso@...che.org>)

October 21 (3 messages)

Xen Security Advisory 475 v2 (CVE-2025-58147,CVE-2025-58148) - x86: Incorrect input sanitisation in Viridian hypercalls (Xen.org security team <security@....org…)
Re: BoringSSL private key loading is not constant time (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Samba security releases for CVE-2025-10230 and CVE-2025-9640 (Demi Marie Obenour <demiobenour@...il.com>)

October 22 (1 message)

ISC has disclosed three vulnerabilities in BIND 9 (CVE-2025-8677, CVE-2025-40778, CVE-2025-40780) (Michał Kępień <michal@....org>)

October 23 (1 message)

PowerDNS Security Advisory 2025-06: Crafted delegations or IP fragments can poison cached delegations in Recursor (Otto Moerbeek <otto.moerbeek@...erdns.com>)

October 24 (1 message)

Xen Security Advisory 476 v1 (CVE-2025-58149) - Incorrect removal of permissions on PCI device unplug (Xen.org security team <security@....org>)

October 26 (1 message)

OOB read / segfault and endless loop in courier mail server 1.5.0 (Hanno Böck <hanno@...eck.de>)

October 27 (14 messages)

Questionable CVE's reported against dnsmasq (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Questionable CVE's reported against dnsmasq (Jeremy Stanley <fungi@...goth.org>)
Re: Questionable CVE's reported against dnsmasq (Andrew Latham <lathama@...il.com>)
CVE-2025-55752: Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled (Mark Thomas <markt@...che.org>)
CVE-2025-55754: Apache Tomcat: console manipulation via escape sequences in log messages (Mark Thomas <markt@...che.org>)
CVE-2025-61795: Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS (Mark Thomas <markt@...che.org>)
Re: Questionable CVE's reported against dnsmasq (Sebastian Pipping <sebastian@...ping.org>)
Re: Questionable CVE's reported against dnsmasq (Moritz Mühlenhoff <jmm@...til.org>)
Re: Questionable CVE's reported against dnsmasq (Stuart Henderson <stu@...cehopper.org>)
Re: Questionable CVE's reported against dnsmasq (Jeffrey Walton <noloader@...il.com>)
Re: Questionable CVE's reported against dnsmasq (Sebastian Pipping <sebastian@...ping.org>)
Re: Questionable CVE's reported against dnsmasq (Collin Funk <collin.funk1@...il.com>)
Re: Questionable CVE's reported against dnsmasq (Michael Orlitzky <michael@...itzky.com>)
Re: Questionable CVE's reported against dnsmasq (Matthew Fernandez <matthew.fernandez@...il.com>)

October 28 (8 messages)

Re: Questionable CVE's reported against dnsmasq (Hank Leininger <hlein@...elogic.com>)
Re: Questionable CVE's reported against dnsmasq (Demi Marie Obenour <demiobenour@...il.com>)
Re: Questionable CVE's reported against dnsmasq (Solar Designer <solar@...nwall.com>)
Re: Questionable CVE's reported against dnsmasq (nightmare.yeah27@...ecat.org)
Re: Questionable CVE's reported against dnsmasq (Eli Schwartz <eschwartz@...too.org>)
Re: Questionable CVE's reported against dnsmasq (Simon McVittie <smcv@...ian.org>)
Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Olivier Fourdan <ofourdan@...hat.com>)
Re: Questionable CVE's reported against dnsmasq (Stuart Henderson <stu@...cehopper.org>)

October 29 (8 messages)

Re: Questionable CVE's reported against dnsmasq (Demi Marie Obenour <demiobenour@...il.com>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins plugins (Sebastian Pipping <sebastian@...ping.org>)
CVE-2025-30189: Dovecot IMAP Server: Using auth caching causes the first lookup to be cached for all lookups (Camelia Lavender <cam@...elia.dev>)
ISC has disclosed one vulnerability in Kea (CVE-2025-11232) (Wlodek Wencel <wlodek@....org>)
CVE-2025-54941: Apache Airflow: Command injection in "example_dag_decorator" (Kaxil Naik <kaxilnaik@...il.com>)
CVE-2025-62402: Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API (Kaxil Naik <kaxilnaik@...il.com>)
CVE-2025-62503: Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Va… (Kaxil Naik <kaxilnaik@...il.com>)

October 30 (5 messages)

Re: Questionable CVE's reported against dnsmasq (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Questionable CVE's reported against dnsmasq (Douglas Bagnall <douglas.bagnall@...alyst.net.nz>)
Re: Questionable CVE's reported against dnsmasq (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2025-62232: Apache APISIX: APISIX basic-auth logs plaintext credentials at info level (Ashish Tiwari <ashishtiwari@...che.org>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (Eddie Chapman <eddie@...k.net>)

October 31 (5 messages)

Re: Questionable CVE's reported against dnsmasq (Petr Menšík <pemensik@...hat.com>)
Re: Questionable CVE's reported against dnsmasq (Sebastian Pipping <sebastian@...ping.org>)
OpenSMTPD: Trivial Local Denial-of-Service via UNIX Domain Socket (CVE-2025-62875) (Matthias Gerstner <mgerstner@...e.de>)
Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature Verification Vulnerability (nightmare.yeah27@...ecat.org)
Re: Questionable CVE's reported against dnsmasq (Art Manion <zmanion@...tonmail.com>)

112 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.