oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 6	² 5	³ 8	⁴ 10	⁵ 5	⁶	⁷
⁸ 3	⁹ 1	¹⁰ 7	¹¹ 7	¹² 5	¹³	¹⁴ 2
¹⁵ 1	¹⁶ 4	¹⁷ 3	¹⁸ 3	¹⁹ 1	²⁰ 2	²¹
²²	²³	²⁴	²⁵	²⁶ 2	²⁷ 2	²⁸ 11
²⁹ 24	³⁰ 16	³¹ 12

Messages by day:

December 1 (6 messages)

CVE-2025-59789: Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser (Wang Weibing <wwbmmm@...che.org>)
CVE-2025-64775: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - S2-068 (Lukasz Lenart <lukaszlenart@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0008 (Adrian Perez de Castro <aperez@...lia.com>)
[kubernetes] CVE-2025-13281: Portworx Half-Blind SSRF in kube-controller-manager (Nathan Herz <nathan.herz97@...il.com>)
CVE-2025-12183 in lz4-java, fixed in new fork (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: 5 CVE's fixed in Fluent Bit (Christian Brabandt <cb@...bit.org>)

December 2 (5 messages)

expat looking for help with another unfixed non-public denial-of-service vulnerability [CVE-2025-66382] (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: 5 CVE's fixed in Fluent Bit (Christian Fischer <christian.fischer@...enbone.net>)
Django CVE-2025-13372 and CVE-2025-64460 (Natalia Bidart <nataliabidart@...ngoproject.com>)
Re: 5 CVE's fixed in Fluent Bit (Christian Brabandt <cb@...bit.org>)
[vim-security] A Windows uncontrolled search path vulnerability affects Vim < 9.1.1947 (Christian Brabandt <cb@...bit.org>)

December 3 (8 messages)

FW: X.Org Security Advisory: multiple security issues in xkbcomp (Peter Hutterer <peter.hutterer@...-t.net>)
Re: Questionable CVE's reported against dnsmasq (Christian Fischer <christian.fischer@...enbone.net>)
Re: 5 CVE's fixed in Fluent Bit (Christian Fischer <christian.fischer@...enbone.net>)
CVE-2025-55182: RCE in React Server Components (Jan Schaumann <jschauma@...meister.org>)
libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Cosmin Truta <ctruta@...il.com>)
Re: libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Cosmin Truta <ctruta@...il.com>)
Re: libpng 1.6.52: Out-of-bounds vulnerability fixed: CVE-2025-66293 (Greg Roelofs <roelofs@...ix.com>)

December 4 (10 messages)

CVE-2025-53960: Apache StreamPark: Use the user’s password as the secret key Vulnerability (Huajie Wang <benjobs@...che.org>)
CVE-2025-66516: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scop… (Tim Allison <tallison@...che.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0009 (Adrian Perez de Castro <aperez@...lia.com>)
CVE-2025-55753: Apache HTTP Server: mod_md (ACME), unintended retry intervals (Eric Covener <covener@...che.org>)
CVE-2025-58098: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (Eric Covener <covener@...che.org>)
CVE-2025-59775: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (Eric Covener <covener@...che.org>)
CVE-2025-65082: Apache HTTP Server: CGI environment variable override (Eric Covener <covener@...che.org>)
CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (Eric Covener <covener@...che.org>)
Re: [webkit-gtk] WebKitGTK and WPE WebKit Security Advisory WSA-2025-0009 (Adrian Perez de Castro <aperez@...lia.com>)
React2Shell (CVE-2025-55182/CVE-2025-66478) (Jeffrey Walton <noloader@...il.com>)

December 5 (5 messages)

Island: Sandboxing tool powered by Landlock (Mickaël Salaün <mic@...ikod.net>)
CVE-2025-66566 fixed in lz4-java 1.10.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Go 1.25.5 and Go 1.24.11 are released - fix CVE-2025-61729 & CVE-2025-61727 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-66418 & CVE-2025-66471 fixed in urllib3 2.6.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CPython vulnerable to CVE-2025-13836, CVE-2025-13837, & CVE-2025-12084 (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 8 (3 messages)

PowerDNS Security Announcement 2025-07 and 2025-08 regarding PowerDNS Recursor (Otto Moerbeek <otto.moerbeek@...erdns.com>)
CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (Brad House <brad@...d-house.com>)
Re: CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (Demi Marie Obenour <demiobenour@...il.com>)

December 9 (1 message)

CVE-2025-26866: Apache HugeGraph-Server: RAFT and deserialization vulnerability (VGalaxies <vgalaxies@...che.org>)

December 10 (7 messages)

EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption (Heiko Schlittermann <hs@...marc.schlittermann.de>)
CVE-2025-66675: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges … (Lukasz Lenart <lukaszlenart@...che.org>)
LibreOffice puts searched text into the PRIMARY selection (Linux, X11) (Vincent Lefevre <vincent@...c17.net>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Re: LibreOffice puts searched text into the PRIMARY selection (Linux, X11) (Marco Moock <mm@...fdsl.de>)
smb4k: Major Vulnerabilities in KAuth Helper (CVE-2025-66002, CVE-2025-66003) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2025-8110 in Gogs self-hosted git service (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 11 (7 messages)

Re: LibreOffice puts searched text into the PRIMARY selection (Linux, X11) (Vincent Lefevre <vincent@...c17.net>)
Update: EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2025-8110 in Gogs self-hosted git service (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2025-8110 in Gogs self-hosted git service (Martin Weinelt <martin@...uxlounge.net>)
CVE-2025-23408: Apache Fineract: weak password policy (Adam Monsen <meonkeys@...che.org>)
CVE-2025-58130: Apache Fineract: Server Key not masked (Adam Monsen <meonkeys@...che.org>)
CVE-2025-58137: Apache Fineract: IDOR via self-service API (Adam Monsen <meonkeys@...che.org>)

December 12 (5 messages)

CVE-2025-66388: Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2025-65995: Apache Airflow: Disclosure of secrets to UI via kwargs (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2025-54947: Apache StreamPark: Use hard-coded key vulnerability (Huajie Wang <benjobs@...che.org>)
CVE-2025-54981: Apache StreamPark: Weak Encryption Algorithm in StreamPark (Huajie Wang <benjobs@...che.org>)
Re: CVE-2025-54947: Apache StreamPark: Use hard-coded key vulnerability (Solar Designer <solar@...nwall.com>)

December 14 (2 messages)

Re: Update: CVE-2025-67896: EXIM-Security-2025-12-09.1: Exim 4.99: Remote heap corruption (Heiko Schlittermann <hs@...marc.schlittermann.de>)
additional React vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779) (Jan Schaumann <jschauma@...meister.org>)

December 15 (1 message)

uriparser 1.0.0 fixes CVE-2025-67899 (DoS, CWE-674) (Sebastian Pipping <sebastian@...ping.org>)

December 16 (4 messages)

XXE vulnerabilities in electronic invoicing software (Kivitendo, peppol-py, ZUV) (Hanno Böck <hanno@...eck.de>)
Dropbear 2025.89 fixes privilege escalation, CVE-2025-14282 (Matt Johnston <matt@....asn.au>)
CVE-2025-67895: Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2 (Jarek Potiuk <potiuk@...che.org>)
[CVE-2025-14282] dropbear: privilege escalation via unix domain socket forwardings (turistu@...il.com)

December 17 (3 messages)

Re: [CVE-2025-14282] dropbear: privilege escalation via unix domain socket forwardings (Jacob Bachmeyer <jcb62281@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2025-0010 (Adrian Perez de Castro <aperez@...lia.com>)
[kubernetes] CVE-2025-14269: Credential caching in Headlamp with Helm enabled (Craig Ingram <cjingram@...gle.com>)

December 18 (3 messages)

CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2025-66524: Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor (David Handermann <exceptionfactory@...che.org>)
Release: CVE-2025-67896: EXIM-Security-2025-12-09.1: Exim 4.99.1 released (Heiko Schlittermann <hs@...marc.schlittermann.de>)

December 19 (1 message)

Avahi simple protocol server accepts unlimited connections [CVE-2025-59529] (Alan Coopersmith <alan.coopersmith@...cle.com>)

December 20 (2 messages)

Re: A couple of security issues? (Greg KH <greg@...ah.com>)
A couple of security issues? ("Artem S. Tashkinov" <aros@....com>)

December 26 (2 messages)

CVE-2018-25153 against GNU barcode seems bogus (Collin Funk <collin.funk1@...il.com>)
[Advisory] WebKit/iOS 26.2: Gigacage Boundary Violation via Logic Flaw enabling OOB Access (Joseph Goydish II <newt0ns_law@...ton.me>)

December 27 (2 messages)

CVE-2025-68460/CVE-2025-68461: Roundcube XSS + I-D prior to 1.5.12/1.6.12 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2025-68637: : Insecure SSL Configuration in Uniffle HTTP Client (roryqi <jerqi1242949407@...il.com>)

December 28 (11 messages)

Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Solar Designer <solar@...nwall.com>)
Re: Many vulnerabilities in GnuPG (Solar Designer <solar@...nwall.com>)
Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Many vulnerabilities in GnuPG (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Many vulnerabilities in GnuPG (Stephan Verbücheln <stephan@...buecheln.ch>)
Re: Many vulnerabilities in GnuPG (Sam James <sam@...too.org>)
Re: Many vulnerabilities in GnuPG (Sam James <sam@...too.org>)
Re: Systemd vsock sshd (yen-mummify-yeah@...k.com)
Re: Systemd vsock sshd (Sam James <sam@...too.org>)
Re: Systemd vsock sshd (Sam James <sam@...too.org>)

December 29 (24 messages)

Re: Many vulnerabilities in GnuPG (Jeffrey Walton <noloader@...il.com>)
Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Systemd vsock sshd (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Many vulnerabilities in GnuPG (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Best practices for signature verifcation (kf503bla@...k.com)
Re: Many vulnerabilities in GnuPG (Stephan Verbücheln <stephan@...buecheln.ch>)
Re: Many vulnerabilities in GnuPG (Werner Koch <wk@...pg.org>)
Re: Many vulnerabilities in GnuPG (Neal Gompa <ngompa13@...il.com>)
Re: Many vulnerabilities in GnuPG (Andreas Metzler <ametzler@...t.de>)
Re: Systemd vsock sshd (Benjamin McMahon <benjamin.mcmahon@...pros.com>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
CVE-2025-47411: Apache StreamPipes: Leverage of User ID for Privilege Escalation (Philipp Zehnder <zehnder@...che.org>)
Re: Many vulnerabilities in GnuPG ("Lexi Groves (49016)" <contact@....fail>)
Re: Best practices for signature verifcation (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Best practices for signature verifcation (Max Jonas Werner <max@....dev>)
BSDiff (bspatch): remotely triggerable out-of-bound memory access (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Systemd vsock sshd (Pat Gunn <pgunn01@...il.com>)
"MongoBleed" CVE-2025-14847 in many versions of MongoDB (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Many vulnerabilities in GnuPG (Henrik Ahlgren <pablo@...stieto.com>)
Re: Many vulnerabilities in GnuPG (Sam James <sam@...too.org>)

December 30 (16 messages)

Re: Many vulnerabilities in GnuPG (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Systemd vsock sshd (Jacob Bachmeyer <jcb62281@...il.com>)
Systemd vsock sshd (wish42offcl98@...teo.org)
Re: safe use of cleartext signatures? (was: Many vulnerabilities in GnuPG) (Jacob Bachmeyer <jcb62281@...il.com>)
Re: safe use of cleartext signatures? (Werner Koch <wk@...pg.org>)
Re: Many vulnerabilities in GnuPG (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: safe use of cleartext signatures? (Demi Marie Obenour <demiobenour@...il.com>)
Re: Systemd vsock sshd (Demi Marie Obenour <demiobenour@...il.com>)
Re: Many vulnerabilities in GnuPG (Sam James <sam@...too.org>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Many vulnerabilities in GnuPG (Henrik Ahlgren <pablo@...stieto.com>)

December 31 (12 messages)

Re: Many vulnerabilities in GnuPG (Collin Funk <collin.funk1@...il.com>)
Re: Best practices for signature verifcation (Ali Polatel <alip@...sys.org>)
Re: Re: Best practices for signature verifcation (Eli Schwartz <eschwartz@...too.org>)
Re: Re: Best practices for signature verifcation (Eli Schwartz <eschwartz@...too.org>)
Re: Many vulnerabilities in GnuPG (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Many vulnerabilities in GnuPG (Jeffrey Walton <noloader@...il.com>)
Re: Many vulnerabilities in GnuPG (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: safe use of cleartext signatures? (Werner Koch <wk@...pg.org>)
Re: Best practices for signature verifcation (Simon Josefsson <simon@...efsson.org>)
CVE-2025-48768: Apache NuttX RTOS: fs/inode: fs_inoderemove root inode removal (Tomasz Cedro <cederom@...che.org>)
CVE-2025-48769: Apache NuttX RTOS: fs/vfs/fs_rename: use after free (Tomasz Cedro <cederom@...che.org>)
Re: Best practices for signature verifcation (Steffen Nurpmeso <steffen@...oden.eu>)

140 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.