oss-sec: by thread
RSS Feed
About List
All Lists
Previous period
131 messages
starting Jan 07 20 and
ending Mar 30 20
Date index |
Thread index |
Author index
- [SECURITY ADVISORY] curl: SMB access smuggling via FILE URL on Windows (CVE-2019-15601) Daniel Stenberg (Jan 07)
- [SECURITY] CVE-2020-1925: Possible SSRF in AsyncResponseWrapperImpl mibo (Jan 08)
- linux-distros membership adjustment/vouching Kees Cook (Jan 10)
- Re: linux-distros membership adjustment/vouching Solar Designer (Jan 12)
- Re: linux-distros membership adjustment/vouching Jorge Lucangeli Obes (Jan 14)
- Re: linux-distros membership adjustment/vouching Solar Designer (Jan 12)
- CVE-2019-12399: Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint Randall Hauch (Jan 13)
- [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI Ash Berlin-Taylor (Jan 14)
- Xen Security Advisory 312 v1 - arm: a CPU may speculate past the ERET instruction Xen . org security team (Jan 14)
- Multiple vulnerabilities in Jenkins plugins Daniel Beck (Jan 15)
- <Possible follow-ups>
- Multiple vulnerabilities in Jenkins plugins Daniel Beck (Feb 12)
- [CVE-2020-1929] Apache Beam MongoDB IO connector disables certificate trust verification Ismaël Mejía (Jan 15)
- [CVE-2019-17570] xmlrpc-common untrusted deserialization cert.cc (Jan 16)
- <Possible follow-ups>
- RE: [CVE-2019-17570] xmlrpc-common untrusted deserialization cert.cc (Jan 24)
- CVE-2020-7039 QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() P J P (Jan 16)
- [CVE-2019-12423] Apache CXF OpenId Connect JWK Keys service returns private/secret credentials if configured with a jwk keystore Colm O hEigeartaigh (Jan 16)
- [CVE-2019-17573] Apache CXF Reflected XSS in the services listing page Colm O hEigeartaigh (Jan 16)
- Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume Jeffrey Walton (Jan 16)
- Re: Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume Sven Schwedas (Jan 17)
- Re: Some AMD cpus with RDRAND fail to produce random numbers after suspend/resume Peter Kjellström (Jan 20)
- CVE-2020-7211 QEMU: Slirp: potential directory traversal using relative paths via tftp server on Windows host P J P (Jan 16)
- CVE-2020-2656, CVE-2020-2696 - Multiple vulnerabilities in Oracle Solaris Marco Ivaldi (Jan 20)
- CVE-2020-7040: storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock Matthias Gerstner (Jan 20)
- CVE-2020-5202: apt-cacher-ng: a local unprivileged user can impersonate the apt-cacher-ng daemon, possible credentials leak Matthias Gerstner (Jan 20)
- CVE-2019-18899: apt-cacher-ng: openSUSE packaging for apt-cacher-ng runs the daemon as root instead of as an unprivileged user Matthias Gerstner (Jan 20)
- CVE-2019-18932: sarg: insecure usage of /tmp/sarg allows privilege escalation / DoS attack vector Matthias Gerstner (Jan 20)
- Re: CVE-2019-18932: sarg: insecure usage of /tmp/sarg allows privilege escalation / DoS attack vector Matthias Gerstner (Jan 27)
- CVE-2019-20384: Portage insecure temporary location Michael Orlitzky (Jan 21)
- Plone security hotfix 20200121 Maurits van Rees (Jan 21)
- Re: Plone security hotfix 20200121 Maurits van Rees (Jan 24)
- WebKitGTK and WPE WebKit Security Advisory WSA-2020-0001 Carlos Alberto Lopez Perez (Jan 23)
- CVE-2020-1711 QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server P J P (Jan 23)
- [CVE-2020-1933] Apache NiFi Information Disclosure Nathan Gough (Jan 27)
- [CVE-2020-1933] Apache NiFi XSS Attack Nathan Gough (Jan 27)
- [CVE-2020-1932] Apache Incubator Superset user data leak vulnerability daniel gaspar (Jan 27)
- CVE-2020-1940: Apache Jackrabbit Oak sensitive information disclosure vulnerability Angela Schreiber (Jan 28)
- Linux kernel: user-triggerable read-after-free crash or 1-bit infoleak oracle in open(2) Solar Designer (Jan 28)
- Re: Linux kernel: user-triggerable read-after-free crash or 1-bit infoleak oracle in open(2) Solar Designer (Jan 28)
- LPE and RCE in OpenSMTPD (CVE-2020-7247) Qualys Security Advisory (Jan 28)
- Multiple vulnerabilities in Jenkins and Jenkins plugins Daniel Beck (Jan 29)
- <Possible follow-ups>
- Multiple vulnerabilities in Jenkins and Jenkins plugins Daniel Beck (Mar 25)
- New Qt vulnerabilities Thiago Macieira (Jan 30)
- [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. Kevin A. McGrail (Jan 30)
- [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands Kevin A. McGrail (Jan 30)
- CVE-2019-3016: information leak within a KVM guest John Haxby (Jan 30)
- Linux kernel: arm64/KVM debug registers vulnerability Catalin Marinas (Jan 30)
- CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled Todd C. Miller (Jan 30)
- <Possible follow-ups>
- Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled Todd C. Miller (Jan 31)
- Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled William Bowling (Feb 05)
- Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled Todd C. Miller (Feb 05)
- Re: CVE-2019-18634: buffer overflow in sudo when pwfeedback is enabled William Bowling (Feb 05)
- CVE-2020-1700 ceph: connection leak in the RGW Beast front-end permits a DoS against the RGW server Hardik Vyas (Jan 31)
- multiple NULL pointer dereference vulnerabilities in newlib Dimitrios Glynos (Jan 31)
- Django 3.0.3, 2.2.10 and 1.11.28: CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)`` Carlton Gibson (Feb 03)
- CVE-2020-7221: mariadb: possible local mysql to root user exploit in mysql_install_db script setting permissions of /usr/lib64/mysql/plugin/auth_pam_tool_dir/auth_pam_tool Matthias Gerstner (Feb 04)
- CVE-2020-1712 systemd: use-after-free when asynchronous polkit queries are performed Riccardo Schirone (Feb 05)
- CVE-2019-18901: mariadb: possible symlink attack for the mysql user in the SUSE specific mysql-systemd-helper script Matthias Gerstner (Feb 05)
- CVE-2020-8608 QEMU: Slirp: potential OOB access due to unsafe snprintf() usages P J P (Feb 06)
- GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Solar Designer (Feb 06)
- Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Amadeusz Sławiński (Feb 06)
- Re: Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Cedric Buissart (Feb 24)
- Re: Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Cedric Buissart (Feb 24)
- Re: Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Cedric Buissart (Feb 24)
- Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Salvatore Bonaccorso (Feb 25)
- Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Amadeusz Sławiński (Feb 25)
- Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" Amadeusz Sławiński (Feb 06)
- [SECURITY] CVE-2019-12426 information disclosure vulnerability in Apache OFBiz Jacopo Cappellato (Feb 06)
- CVE-2020-1942: Apache NiFi 0.0.1 to 1.11.0 information disclosure in logs Andy LoPresto (Feb 10)
- Potential regression and/or incomplete fix for CVE-2017-12762 Ibrahim el-sayed (Feb 11)
- Re: Potential regression and/or incomplete fix for CVE-2017-12762 Brad Spengler (Feb 11)
- Re: Potential regression and/or incomplete fix for CVE-2017-12762 Ibrahim el-sayed (Feb 14)
- Re: Potential regression and/or incomplete fix for CVE-2017-12762 Brad Spengler (Feb 11)
- CVE-2020-7046: Dovecot: Truncated UTF-8 can be used to DoS submission-login and lmtp processes Aki Tuomi (Feb 12)
- CVE-2020-7957: Dovecot: Specially crafted mail can crash snippet generation Aki Tuomi (Feb 12)
- Announce: OpenSSH 8.2 released Damien Miller (Feb 13)
- CVE for program distributing vulnerable components ? security minded (Feb 14)
- Re: CVE for program distributing vulnerable components ? Simon McVittie (Feb 14)
- Re: CVE for program distributing vulnerable components ? Francis Perron (Feb 14)
- Re: CVE for program distributing vulnerable components ? Simon McVittie (Feb 14)
- WebKitGTK and WPE WebKit Security Advisory WSA-2020-0002 Carlos Alberto Lopez Perez (Feb 14)
- Wordpress themegrill-demo-importer: database reset/auth bypass, incomplete fix due to CSRF Hanno Böck (Feb 19)
- [OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543) Jeremy Stanley (Feb 19)
- [CVE-2020-1937] Apache Kylin SQL injection vulnerability George Ni (Feb 22)
- mailman 2.x: XSS via file attachments in list archives Hanno Böck (Feb 24)
- Re: mailman 2.x: XSS via file attachments in list archives Jim Popovitch (Feb 24)
- Local information disclosure in OpenSMTPD (CVE-2020-8793) Qualys Security Advisory (Feb 24)
- LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Qualys Security Advisory (Feb 24)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Alexander E. Patrakov (Feb 24)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Qualys Security Advisory (Feb 25)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Qualys Security Advisory (Feb 26)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Alexander E. Patrakov (Feb 29)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Florian Weimer (Mar 01)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Alexander E. Patrakov (Feb 29)
- Re: LPE and RCE in OpenSMTPD's default install (CVE-2020-8794) Alexander E. Patrakov (Feb 24)
- CVE-2020-2732: Nested VMX vulnerability Boris Ostrovsky (Feb 25)
- Re: CVE-2020-2732: Nested VMX vulnerability P J P (Feb 25)
- CVE-2020-9391: Ignoring the top byte of addresses in brk causes heap corruption (AArch64) Florian Weimer (Feb 25)
- Hostapd fails at seeding PRNGS, leading to insufficient entropy (CVE-2016-10743 and CVE-2019-10064) Jonathan Brossard (Feb 27)
- CoreOS leaving distros/linux-distros on May 26, handing off responsibilities Benjamin Gilbert (Mar 03)
- Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities Igor Seletskiy (Mar 04)
- Re: CoreOS leaving distros/linux-distros on May 26, handing off responsibilities John Haxby (Mar 04)
- Django: CVE-2020-9402: Potential SQL injection via tolerance parameter in GIS functions and aggregates on Oracle Mariusz Felisiak (Mar 04)
- CVE-2019-20382 QEMU: vnc: memory leakage upon disconnect P J P (Mar 05)
- BIND Operational Notification: An error in handling TCP client quota limits can exhaust TCP connections in BIND 9.16.0 ISC Security Officer (Mar 05)
- [CVE-2020-1943] Apache OFBiz XSS Vulnerability Jacopo Cappellato (Mar 06)
- CVE-2020-10174: timeshift: arbitrary local code execution due to unsafe usage of temporary directory in /tmp/timeshift Matthias Gerstner (Mar 06)
- Bluez <5.53 DoS/privilege escalation Matthew Garrett (Mar 13)
- Re: Bluez <5.53 DoS/privilege escalation Marc Deslauriers (Mar 13)
- [CVE-2020-1953] Uncontrolled class instantiation when loading YAML files in Apache Commons Configuration Oliver Heger (Mar 13)
- [CVE-2019-10091] Apache Geode SSL endpoint verification vulnerability Anthony Baker (Mar 14)
- Insecure implementation of OpenResty ngx.req.set_uri + memory content leak in nginx. Vladimir Dubrovin (Mar 18)
- Re: Insecure implementation of OpenResty ngx.req.set_uri + memory content leak in nginx. Vladimir Dubrovin (Mar 18)
- [CVE-2020-1950] Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser Tim Allison (Mar 18)
- [CVE-2020-1951] Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser Tim Allison (Mar 18)
- U-Boot verified boot improper signature verification Janushkevich, Dmitry (Mar 18)
- [CVE-2020-5267] Possible XSS vulnerability in ActionView Aaron Patterson (Mar 19)
- Serendipity XSS via update notification (minor, exploitable by s9y developers) Hanno Böck (Mar 23)
- [CVE-2020-1957] Apache Shiro 1.5.2 released Brian Demers (Mar 23)
- CVE-2020-8551, CVE-2020-8552: Kubernetes: Denial of service Tim Allclair (Mar 23)
- CVE-2020-1949: Apache Sling CMS Reflected XSS Vulnerability Daniel Klco (Mar 25)
- Stealing Videos from VLC-iOS (IDOR) Dhiraj Mishra (Mar 26)
- [CVE-2019-17560] "Apache NetBeans" autoupdate cert validation Matthias Bläsing (Mar 30)
- [CVE-2019-17561] "Apache NetBeans" autoupdate system does not fully validate code signatures. Matthias Bläsing (Mar 30)
- CVE-2020-8835: Linux kernel bpf incorrect verifier vulnerability Steve Beattie (Mar 30)
- pam-krb5 security advisory (4.9 and earlier) Russ Allbery (Mar 30)
- Re: pam-krb5 security advisory (4.9 and earlier) Russ Allbery (Mar 30)
- Re: pam-krb5 security advisory (4.9 and earlier) Russ Allbery (Mar 30)
- Re: pam-krb5 security advisory (4.9 and earlier) Russ Allbery (Mar 30)