oss-sec: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

274 messages starting Apr 01 24 and ending Jun 06 24
Date index | Thread index | Author index

• From xz to ibus: more questionable tarballs Jan Engelhardt (Apr 01)
  • Re: From xz to ibus: more questionable tarballs HW42 (Apr 01)
    • finding similar compromises (was Re: From xz to ibus: more questionable tarballs) Tavis Ormandy (Apr 02)
      • Re: finding similar compromises (was Re: From xz to ibus: more questionable tarballs) Tavis Ormandy (Apr 02)
      • Re: finding similar compromises (was Re: From xz to ibus: ... Hank Leininger (Apr 02)
      • Re: Re: finding similar compromises (was Re: From xz to ibus: more questionable tarballs) Ángel (Apr 08)
  • Re: From xz to ibus: more questionable tarballs Takao Fujiwara (Apr 01)
• Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jakub Wilk (Apr 01)
  • <Possible follow-ups>
  • Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jakub Wilk (Apr 12)
  • Re: backdoor in upstream xz/liblzma leading to ssh server compromise Solar Designer (Apr 16)
    • Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jacob Bachmeyer (Apr 17)
      • Re: backdoor in upstream xz/liblzma leading to ssh server compromise Loganaden Velvindron (Apr 17)
      • Re: backdoor in upstream xz/liblzma leading to ssh server compromise Matt Johnston (Apr 17)
      • Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jacob Bachmeyer (Apr 19)
  • Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jakub Wilk (Apr 17)
• CVE-2024-29834: Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints Lari Hotari (Apr 02)
• Fwd: Node.js security update for all active release lines Rafael Gonzaga (Apr 02)
  • <Possible follow-ups>
  • Fwd: Node.js security update for all active release lines midawson (Apr 03)
    • Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)
      • Re: Fwd: Node.js security update for all active release lines Michael Dawson (Apr 03)
      • Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)
      • Re: Fwd: Node.js security update for all active release lines Michael Dawson (Apr 03)
• CVE-2024-1597: PostgreSQL pgjdbc: SQL injection in non-default configuration daniel (Apr 02)
• escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Matthew Fernandez (Apr 02)
  • Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Solar Designer (Apr 03)
    • Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Sam James (May 02)
      • Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Steffen Nurpmeso (May 03)
      • Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Steffen Nurpmeso (May 03)
• Detecting code injections in packages through debug infos Adrien Nader (Apr 03)
• xz backdoor prevention using hosts.deny? Nick Sal (Apr 03)
  • Re: xz backdoor prevention using hosts.deny? Stuart D Gathman (Apr 03)
  • Re: xz backdoor prevention using hosts.deny? Stephen John Smoogen (Apr 03)
    • Re: xz backdoor prevention using hosts.deny? Pierre-Elliott Bécue (Apr 03)
  • Re: xz backdoor prevention using hosts.deny? Ángel (Apr 08)
    • Re: xz backdoor prevention using hosts.deny? Jacob Bachmeyer (Apr 09)
      • Re: xz backdoor prevention using hosts.deny? Andres Freund (Apr 09)
      • Re: xz backdoor prevention using hosts.deny? Christoph Anton Mitterer (Apr 09)
      • Re: xz backdoor prevention using hosts.deny? Jacob Bachmeyer (Apr 10)
• Looking for developers who know how to use Seccomp for a paid study Maysara Alhindi (Apr 03)
  • Re: Looking for developers who know how to use Seccomp for a paid study Solar Designer (Apr 03)
• dnf5daemon-server: Incomplete fix of CVE-2024-1929 (CVE-2024-2746) Matthias Gerstner (Apr 03)
• Fwd: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.12 and Xwayland prior to 23.2.5 Alan Coopersmith (Apr 03)
  • Re: Fwd: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.12 and Xwayland prior to 23.2.5 Alan Coopersmith (Apr 12)
• CERT/CC VU#421644: HTTP/2 CONTINUATION frames can be utilized for DoS attacks Alan Coopersmith (Apr 03)
  • Envoy security releases [1.29.3, 1.28.2, 1.27.4, 1.26.8] are now available Jan Schaumann (Apr 05)
  • Go 1.22.2 and 1.21.9 (CVE-2023-45288 HTTP/2 CONTINUATION issue) Jan Schaumann (Apr 05)
• Just a reminder to never run ldd or strings on untrusted binaries Markus Klyver (Apr 04)
  • Re: Just a reminder to never run ldd or strings on untrusted binaries Matthew Fernandez (Apr 04)
• opusfile by Xiph.Org Foundation, DoS vulnerability (SIGFPE) Alex Sarum (Apr 04)
• CVE-2023-38709: Apache HTTP Server: HTTP response splitting Eric Covener (Apr 04)
• CVE-2024-27316: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames Eric Covener (Apr 04)
• CVE-2024-24795: Apache HTTP Server: HTTP Response Splitting in multiple modules Eric Covener (Apr 04)
• YSA-2024-01: YubiKey Manager Privilege Escalation Matthew Fernandez (Apr 04)
• Fwd: Node.js security update for all active relesae lines, April 9 2024 Rafael Gonzaga (Apr 04)
  • <Possible follow-ups>
  • Fwd: Node.js security update for all active relesae lines, April 9 2024 Rafael Gonzaga (Apr 10)
    • NodeJS Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) Jan Schaumann (Apr 10)
• minor problem on detect_sh.bin Lam Bruce (Apr 05)
• CVE-2024-24746: Apache NimBLE: Denial of service in NimBLE Bluetooth stack Szymon Janc (Apr 05)
• HTTP::Body before 1.23 for Perl is still vulnerable to CVE-2013-4407 Stig Palmquist (Apr 07)
• Is CVE-2024-30203 bogus? (Emacs) Sean Whitton (Apr 08)
  • Re: Is CVE-2024-30203 bogus? (Emacs) Eli Zaretskii (Apr 08)
    • Re: Is CVE-2024-30203 bogus? (Emacs) Max Nikulin (Apr 08)
  • Re: Is CVE-2024-30203 bogus? (Emacs) Ihor Radchenko (Apr 08)
    • Re: Is CVE-2024-30203 bogus? (Emacs) Sean Whitton (Apr 10)
      • Re: Is CVE-2024-30203 bogus? (Emacs) Ihor Radchenko (Apr 10)
      • Re: Re: Is CVE-2024-30203 bogus? (Emacs) Salvatore Bonaccorso (Apr 10)
      • Re: Is CVE-2024-30203 bogus? (Emacs) Max Nikulin (Apr 10)
      • Re: Is CVE-2024-30203 bogus? (Emacs) Sean Whitton (Apr 11)
      • Re: Re: Is CVE-2024-30203 bogus? (Emacs) Sean Whitton (Apr 11)
      • Re: Is CVE-2024-30203 bogus? (Emacs) Max Nikulin (Apr 11)
• OpenSSL Security Advisory Tomas Mraz (Apr 08)
  • <Possible follow-ups>
  • OpenSSL Security Advisory Tomas Mraz (May 16)
• PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass Fay Stegerman (Apr 08)
  • Re: PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass Jeffrey Walton (Apr 21)
• Xen Security Advisory 454 v2 (CVE-2023-46842) - x86 HVM hypercalls may trigger Xen bug check Xen . org security team (Apr 09)
• CVE-2024-31860: Apache Zeppelin: Path traversal vulnerability Jongyoul Lee (Apr 09)
• CVE-2021-28656: Apache Zeppelin: CSRF vulnerability in the Credentials page Jongyoul Lee (Apr 09)
• CVE-2022-47894: Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE Jongyoul Lee (Apr 09)
• CVE-2024-31862: Apache Zeppelin: Denial of service with invalid notebook name Jongyoul Lee (Apr 09)
• CVE-2024-31863: Apache Zeppelin: Replacing other users notebook, bypassing any permissions Jongyoul Lee (Apr 09)
• CVE-2024-31864: Apache Zeppelin: Remote code execution by adding malicious JDBC connection string Jongyoul Lee (Apr 09)
• CVE-2024-31865: Apache Zeppelin: Cron arbitrary user impersonation with improper privileges Jongyoul Lee (Apr 09)
• CVE-2024-31866: Apache Zeppelin: Interpreter download command does not escape malicious code injection Jongyoul Lee (Apr 09)
• CVE-2024-31868: Apache Zeppelin: XSS vulnerability in the helium module Jongyoul Lee (Apr 09)
• CVE-2024-31867: Apache Zeppelin: LDAP search filter query Injection Vulnerability Jongyoul Lee (Apr 09)
• CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 09)
  • <Possible follow-ups>
  • Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Tianyu Chen (Apr 11)
    • Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 11)
      • Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 11)
• Xen Security Advisory 455 v4 (CVE-2024-31142) - x86: Incorrect logic for BTC/SRSO mitigations Xen . org security team (Apr 09)
• Xen Security Advisory 456 v2 (CVE-2024-2201) - x86: Native Branch History Injection Xen . org security team (Apr 09)
• CVE-2024-24576: Rust 1.77.1 and earlier did not properly escape arguments of batch files on Windows Pietro Albini (Apr 09)
• CVE-2024-31309: Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack Bryan Call (Apr 10)
• CVE-2024-31861: Apache Zeppelin: Code injection by Shell interpreter Jongyoul Lee (Apr 10)
• Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar (Apr 10)
  • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar (Apr 10)
  • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Joey Hess (Apr 10)
    • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar (Apr 10)
      • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Vegard Nossum (Apr 10)
  • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Solar Designer (Apr 10)
    • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Jacob Bachmeyer (Apr 11)
      • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar (Apr 11)
      • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Jacob Bachmeyer (Apr 12)
      • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar (Apr 12)
      • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Jacob Bachmeyer (Apr 13)
  • Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Chris Down (Apr 10)
• CERT VU#123335: Multiple Programming Languages Fail to Escape Arguments Properly in Microsoft Windows Alan Coopersmith (Apr 10)
  • Re: CERT VU#123335: Multiple Programming Languages Fail to Escape Arguments Properly in Microsoft Windows Steffen Nurpmeso (Apr 10)
• New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 10)
  • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 10)
    • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 16)
      • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Greg KH (Apr 16)
      • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 17)
  • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Donald Buczek (Apr 11)
  • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 11)
    • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 11)
      • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 11)
      • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Kyle Zeng (Apr 11)
      • Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Kyle Zeng (Apr 11)
• CVE-2024-1086: Linux: nf_tables: use-after-free vulnerability in the nft_verdict_init() function Solar Designer (Apr 10)
  • Re: CVE-2024-1086: Linux: nf_tables: use-after-free vulnerability in the nft_verdict_init() function Jonathan Wright (Apr 10)
• [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm Ben Hutchings (Apr 11)
  • Buildroot: incorrect permissons on /dev/shm Ben Hutchings (Apr 11)
    • Re: Buildroot: incorrect permissons on /dev/shm Ben Hutchings (May 06)
      • Re: [Buildroot] Buildroot: incorrect permissons on /dev/shm Yann E. MORIN (May 06)
      • Re: Buildroot: incorrect permissons on /dev/shm Peter Korsgaard (May 07)
  • Re: [Buildroot] [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm Yann E. MORIN (Apr 11)
  • Re: [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm Peter Korsgaard (May 06)
• CVE-2024-27309: Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode Colin McCabe (Apr 11)
• less(1) with LESSOPEN mishandles \n in paths Jakub Wilk (Apr 12)
  • Re: less(1) with LESSOPEN mishandles \n in paths Sam James (Apr 12)
  • Re: less(1) with LESSOPEN mishandles \n in paths Jakub Wilk (Apr 15)
  • <Possible follow-ups>
  • Re: less(1) with LESSOPEN mishandles \n in paths Tobias Powalowski (Apr 13)
• CVE-2024-31391: Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials Jason Gerlowski (Apr 12)
• PHP security releases 8.1.28, 8.2.18, & 8.3.6 Alan Coopersmith (Apr 12)
• Linux: Disabling network namespaces Solar Designer (Apr 14)
  • Re: Linux: Disabling network namespaces Demi Marie Obenour (Apr 15)
    • Re: Linux: Disabling network namespaces Solar Designer (Apr 15)
      • Re: Linux: Disabling network namespaces Simon McVittie (Apr 15)
      • Re: Linux: Disabling network namespaces Jordan Glover (Apr 16)
      • Re: Linux: Disabling network namespaces Mickaël Salaün (May 17)
  • Re: Linux: Disabling network namespaces Simon McVittie (Apr 15)
  • Re: Linux: Disabling network namespaces Georgia Garcia (Apr 17)
    • Re: Linux: Disabling network namespaces Solar Designer (Apr 19)
      • Re: Linux: Disabling network namespaces Simon McVittie (Apr 19)
      • Re: Linux: Disabling network namespaces Solar Designer (Apr 20)
      • Re: Linux: Disabling network namespaces Jordan Glover (Apr 20)
      • Re: Linux: Disabling network namespaces Simon McVittie (Apr 21)
      • Re: Linux: Disabling network namespaces Priedhorsky, Reid (Apr 22)
      • Re: Linux: Disabling network namespaces Solar Designer (Apr 21)
      • Re: Linux: Disabling network namespaces Jordan Glover (Apr 22)
      • Re: Linux: Disabling network namespaces Demi Marie Obenour (Apr 23)
      • Re: Linux: Disabling network namespaces Simon McVittie (Apr 23)
      • Re: Linux: Disabling network namespaces John Johansen (Apr 29)
      • Re: Linux: Disabling network namespaces Simon McVittie (Apr 21)
      • Re: Linux: Disabling network namespaces Solar Designer (Apr 21)
    • Re: Linux: Disabling network namespaces nightmare . yeah27 (Apr 19)
      • Re: Re: Linux: Disabling network namespaces John Johansen (Apr 29)
  • <Possible follow-ups>
  • Re: Linux: Disabling network namespaces Philippe Cerfon (Apr 16)
    • Re: Linux: Disabling network namespaces Demi Marie Obenour (Apr 16)
• CVE-2024-31497: Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client Fabian Bäumer (Apr 15)
• [kubernetes] CVE-2024-3177: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin Rita Zhang (Apr 16)
• Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config Vegard Nossum (Apr 17)
  • Re: Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config Jacob Bachmeyer (Apr 18)
• Terrapin vulnerability in Jenkins CLI client Daniel Beck (Apr 17)
• The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Adhemerval Zanella Netto (Apr 17)
  • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Solar Designer (Apr 18)
    • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Charles Fol (May 27)
      • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Florian Weimer (May 27)
      • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Erik Auerswald (May 27)
      • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Florian Weimer (May 27)
      • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Solar Designer (May 27)
      • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Charles Fol (May 27)
  • Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Florian Weimer (Apr 24)
• CVE-2024-31869: Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used Ephraim Anierobi (Apr 17)
• libreswan: IKEv1 default AH/ESP responder can crash and restart David Morel (Apr 18)
• flatpak CVE-2024-32462 : Sandbox escape via RequestBackground portal and CWE-88 Simon McVittie (Apr 18)
• CVE-2024-29217: Apache Answer: XSS vulnerability when changing personal website Enxin Xie (Apr 19)
• CVE-2024-29733: Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context Elad Kalif (Apr 19)
• [Update] PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass Fay Stegerman (Apr 20)
• Wordpress Responsive theme: arbitrary HTML content injection (CVE-2024-2848) Hanno Böck (Apr 22)
• CVE-2024-27347: Apache HugeGraph-Hubble: SSRF in Hubble connection page Imba Jin (Apr 22)
• CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlin Imba Jin (Apr 22)
• CVE-2024-27349: Apache HugeGraph-Server: Bypass whitelist in Auth mode Imba Jin (Apr 22)
• 83 bogus CVEs assigned to Robot Operating System (ROS) Mark Esler (Apr 23)
  • Re: 83 bogus CVEs assigned to Robot Operating System (ROS) Yash Patel (Apr 23)
    • Re: 83 bogus CVEs assigned to Robot Operating System (ROS) Mark Esler (Apr 23)
      • Re: 83 bogus CVEs assigned to Robot Operating System (ROS) Yash Patel (Apr 23)
• PowerDNS Recursor Security Advisory 2024-02: if recursive forwarding is configured, crafted responses can lead to a denial of service in Recursor Peter van Dijk (Apr 24)
• CVE-2024-0582 - Linux kernel use-after-free vulnerability in io_uring, writeup and exploit strategy Oriol Castejón (Apr 24)
• Security Issues and Abandonment of PHP ECC library (mdanter/ecc, phpecc/phpecc) Paragon Initiative Enterprises Security Team (Apr 24)
• libksieve (used by kmail/kontact) sent password as username Jonas Schäfer (Apr 25)
  • Re: libksieve (used by kmail/kontact) sent password as username Salvatore Bonaccorso (Apr 30)
• Update on the distro-backdoor-scanner effort Hank Leininger (Apr 26)
  • Re: Update on the distro-backdoor-scanner effort Simon McVittie (Apr 26)
    • Re: Update on the distro-backdoor-scanner effort Sam James (Apr 26)
  • Re: Update on the distro-backdoor-scanner effort Jacob Bachmeyer (Apr 27)
  • Re: Update on the distro-backdoor-scanner effort Morten Linderud (Apr 27)
  • <Possible follow-ups>
  • Re: Update on the distro-backdoor-scanner effort Hank Leininger (Apr 28)
    • Re: Update on the distro-backdoor-scanner effort Jacob Bachmeyer (Apr 29)
    • Re: Update on the distro-backdoor-scanner effort Vegard Nossum (Apr 29)
      • Re: Update on the distro-backdoor-scanner effort Gabriel Ravier (Apr 29)
      • Re: Update on the distro-backdoor-scanner effort Jacob Bachmeyer (Apr 30)
  • Re: Update on the distro-backdoor-scanner effort Hank Leininger (Apr 28)
• Suspicious hook-loading mechanism in hyprland Sam James (Apr 28)
• Telegram Web app XSS / Session Hijacking 1-click Pedro Batista (Apr 28)
  • Re: Telegram Web app XSS / Session Hijacking 1-click Pedro Batista (Apr 30)
• CVE-2024-27322: Deserialization vulnerability in R before 4.4.0 Alan Coopersmith (Apr 29)
• Re: New SMTP smuggling attack Mark Esler (Apr 30)
  • Re: New SMTP smuggling attack nightmare . yeah27 (Apr 30)
  • Re: New SMTP smuggling attack Erik Auerswald (Apr 30)
  • Re: New SMTP smuggling attack Steffen Nurpmeso (Apr 30)
    • Re: New SMTP smuggling attack Steffen Nurpmeso (May 02)
      • Re: New SMTP smuggling attack Solar Designer (May 02)
      • Re: New SMTP smuggling attack Mark Esler (May 09)
      • Re: New SMTP smuggling attack Erik Auerswald (May 09)
• CVE-2024-32114: Apache ActiveMQ: Jolokia and REST API were not secured with default configuration Jean-Baptiste Onofré (May 01)
• Re: CVEs issued by the Linux kernel CNA Alan Coopersmith (May 01)
  • Re: Re: CVEs issued by the Linux kernel CNA Greg KH (May 02)
• CVE-2024-32638: Apache APISIX: Forward-Auth Request Smuggling YuanSheng Wang (May 02)
• Multiple vulnerabilities in Jenkins plugins Daniel Beck (May 02)
  • <Possible follow-ups>
  • Multiple vulnerabilities in Jenkins plugins Kevin Guerroudj (May 24)
• CVE-2024-30251: DoS in aiohttp Sam Bull (May 02)
• CVE-2023-35701: Apache Hive: Arbitrary command execution via JDBC driver Stamatis Zampetakis (May 03)
• Fwd: uriparser 0.9.8 released, includes security fixes Sebastian Pipping (May 06)
  • Re: Fwd: uriparser 0.9.8 released, includes security fixes Solar Designer (May 06)
• The GNU C Library security advisories update for 2024-05-06 Carlos O'Donell (May 06)
• CVE-2023-49606, CVE-2023-40533: memory safety vulnerabilities in tinyproxy <=1.11.1 Valtteri Vuorikoski (May 07)
• CVE-2024-28148: Apache Superset: Incorrect datasource authorization on explore REST API Daniel Gaspar (May 07)
• HNS-2024-07 - HN Security Advisory - Multiple vulnerabilities in RIOT OS Marco Ivaldi (May 07)
• GLib (2.26.0+): GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing Philip Withnall (May 07)
• CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function HexRabbit Chen (May 07)
  • Re: CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function Salvatore Bonaccorso (May 08)
• Xen Security Advisory 456 v3 (CVE-2024-2201) - x86: Native Branch History Injection Xen . org security team (May 07)
• Xen Security Advisory 457 v1 - Linux/xen-netback: Memory leak due to missing cleanup function Xen . org security team (May 07)
• Xen Security Advisory 457 v2 - Linux/xen-netfront: Memory leak due to missing cleanup function Xen . org security team (May 08)
• [security] Go 1.22.3 and Go 1.21.10 are released Alan Coopersmith (May 08)
• Xen Security Advisory 457 v3 (CVE-2024-27393) - Linux/xen-netfront: Memory leak due to missing cleanup function Xen . org security team (May 08)
• CVE-2024-32113: Apache OFBiz: Path traversal leading to RCE Jacques Le Roux (May 09)
• CVE-2024-26579: Apache Inlong JDBC Vulnerability Charles Zhang (May 09)
• [kubernetes] CVE-2024-3744: azure-file-csi-driver discloses service account tokens in logs Rita Zhang (May 09)
• CVE-2024-34365: Apache Karaf Cave: Cave SSRF and arbitrary file access Arnout Engelen (May 09)
• [vim-security] buffer-overlow in xxd with colored output < v9.1.0404 Christian Brabandt (May 10)
• Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Corey Lopez (May 11)
  • Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Solar Designer (May 11)
    • Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Jacob Bachmeyer (May 13)
  • Re: lsof "can't stat() fuse.${name} filesystem /run/user/1000/${dir}" Simon McVittie (May 11)
  • Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Jacob Bachmeyer (May 13)
• PowerDNS Security Advisory 2024-03: Transfer requests received over DoH can lead to a denial of service in DNSdist Remi Gacogne (May 13)
• CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance Log/Log Details Ephraim Anierobi (May 14)
• git: 5 vulnerabilities fixed Johannes Schindelin (May 14)
• CVE-2024-21823: Intel DSA and Intel IAA advisory Alan Coopersmith (May 15)
• OpenSSL Security Advisory [corrected CVE id] Tomas Mraz (May 16)
• CVE-2024-34058: Nethserver 7 & 8 stored cross-site scripting (XSS) in WebTop package Andrea Intilangelo (May 16)
• Article: State of Sandboxing in Linux Ali Polatel (May 20)
  • Re: Article: State of Sandboxing in Linux Solar Designer (May 20)
• WebKitGTK and WPE WebKit Security Advisory WSA-2024-0003 Adrian Perez de Castro (May 21)
• asterisk security releases 18.23.1, 20.8.1, & 21.3.1 Alan Coopersmith (May 21)
• Intel CPU Hardware Features and Behaviors Related to Speculative Execution Alan Coopersmith (May 23)
• gnome-remote-desktop: D-Bus system service in GNOME release 46 local information leaks (CVE-2024-5148) Matthias Gerstner (May 24)
• path traversal in tar extract in intel cve-bin-tool houjingyi (May 26)
• List linux CVEs for a given stable release? Dominique Martinet (May 29)
  • Re: List linux CVEs for a given stable release? Greg Kroah-Hartman (May 29)
    • Re: List linux CVEs for a given stable release? Dominique Martinet (May 30)
      • Re: List linux CVEs for a given stable release? Greg Kroah-Hartman (May 30)
• Security vulnerability in fprintd Yaron Shahrabani (May 30)
• nginx HTTP/3 security issues/fixes Solar Designer (May 30)
• CVE-2024-36104: Apache OFBiz: Path traversal leading to a RCE Jacques Le Roux (Jun 03)
• Go 1.22.4 and Go 1.21.11 released with 2 security fixes (CVE-2024-24789, CVE-2024-24790) Alan Coopersmith (Jun 04)
• libarchive 3.7.4 released with 2 security fixes Alan Coopersmith (Jun 04)
  • Re: libarchive 3.7.4 released with 2 security fixes Tavis Ormandy (Jun 05)
• [SBA-ADV-20240202-01] CVE-2024-5657: CraftCMS Plugin - Two-Factor Authentication 3.3.1 to 3.3.3 - Password Hash Disclosure SBA Research Security Advisory (Jun 06)
• [SBA-ADV-20240202-02] CVE-2024-5658: CraftCMS Plugin - Two-Factor Authentication through 3.3.3 - TOTP Token Stays Valid After Use SBA Research Security Advisory (Jun 06)
• PHP security releases 8.3.8, 8.2.20, and 8.1.29 Alan Coopersmith (Jun 06)

Previous period

Next period