oss-sec: by date
RSS Feed
About List
All Lists
Previous period
247 messages
starting Apr 01 24 and
ending May 17 24
Date index |
Thread index |
Author index
Monday, 01 April
From xz to ibus: more questionable tarballs Jan Engelhardt
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jakub Wilk
Re: From xz to ibus: more questionable tarballs HW42
Re: From xz to ibus: more questionable tarballs Takao Fujiwara
Tuesday, 02 April
finding similar compromises (was Re: From xz to ibus: more questionable tarballs) Tavis Ormandy
CVE-2024-29834: Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints Lari Hotari
Fwd: Node.js security update for all active release lines Rafael Gonzaga
Re: finding similar compromises (was Re: From xz to ibus: more questionable tarballs) Tavis Ormandy
Re: finding similar compromises (was Re: From xz to ibus: ... Hank Leininger
CVE-2024-1597: PostgreSQL pgjdbc: SQL injection in non-default configuration daniel
escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Matthew Fernandez
Wednesday, 03 April
Detecting code injections in packages through debug infos Adrien Nader
xz backdoor prevention using hosts.deny? Nick Sal
Looking for developers who know how to use Seccomp for a paid study Maysara Alhindi
dnf5daemon-server: Incomplete fix of CVE-2024-1929 (CVE-2024-2746) Matthias Gerstner
Re: xz backdoor prevention using hosts.deny? Stuart D Gathman
Re: xz backdoor prevention using hosts.deny? Stephen John Smoogen
Re: xz backdoor prevention using hosts.deny? Pierre-Elliott Bécue
Fwd: Node.js security update for all active release lines midawson
Re: Fwd: Node.js security update for all active release lines Solar Designer
Re: Looking for developers who know how to use Seccomp for a paid study Solar Designer
Re: Fwd: Node.js security update for all active release lines Michael Dawson
Fwd: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.12 and Xwayland prior to 23.2.5 Alan Coopersmith
Re: Fwd: Node.js security update for all active release lines Solar Designer
Re: Fwd: Node.js security update for all active release lines Michael Dawson
CERT/CC VU#421644: HTTP/2 CONTINUATION frames can be utilized for DoS attacks Alan Coopersmith
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Solar Designer
Thursday, 04 April
Just a reminder to never run ldd or strings on untrusted binaries Markus Klyver
opusfile by Xiph.Org Foundation, DoS vulnerability (SIGFPE) Alex Sarum
CVE-2023-38709: Apache HTTP Server: HTTP response splitting Eric Covener
CVE-2024-27316: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames Eric Covener
CVE-2024-24795: Apache HTTP Server: HTTP Response Splitting in multiple modules Eric Covener
Re: Just a reminder to never run ldd or strings on untrusted binaries Matthew Fernandez
YSA-2024-01: YubiKey Manager Privilege Escalation Matthew Fernandez
Fwd: Node.js security update for all active relesae lines, April 9 2024 Rafael Gonzaga
Friday, 05 April
minor problem on detect_sh.bin Lam Bruce
CVE-2024-24746: Apache NimBLE: Denial of service in NimBLE Bluetooth stack Szymon Janc
Envoy security releases [1.29.3, 1.28.2, 1.27.4, 1.26.8] are now available Jan Schaumann
Go 1.22.2 and 1.21.9 (CVE-2023-45288 HTTP/2 CONTINUATION issue) Jan Schaumann
Sunday, 07 April
HTTP::Body before 1.23 for Perl is still vulnerable to CVE-2013-4407 Stig Palmquist
Monday, 08 April
Re: xz backdoor prevention using hosts.deny? Ángel
Re: Re: finding similar compromises (was Re: From xz to ibus: more questionable tarballs) Ángel
Is CVE-2024-30203 bogus? (Emacs) Sean Whitton
Re: Is CVE-2024-30203 bogus? (Emacs) Eli Zaretskii
OpenSSL Security Advisory Tomas Mraz
Re: Is CVE-2024-30203 bogus? (Emacs) Max Nikulin
Re: Is CVE-2024-30203 bogus? (Emacs) Ihor Radchenko
PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass Fay Stegerman
Tuesday, 09 April
Xen Security Advisory 454 v2 (CVE-2023-46842) - x86 HVM hypercalls may trigger Xen bug check Xen . org security team
CVE-2024-31860: Apache Zeppelin: Path traversal vulnerability Jongyoul Lee
CVE-2021-28656: Apache Zeppelin: CSRF vulnerability in the Credentials page Jongyoul Lee
CVE-2022-47894: Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE Jongyoul Lee
CVE-2024-31862: Apache Zeppelin: Denial of service with invalid notebook name Jongyoul Lee
CVE-2024-31863: Apache Zeppelin: Replacing other users notebook, bypassing any permissions Jongyoul Lee
Re: xz backdoor prevention using hosts.deny? Jacob Bachmeyer
CVE-2024-31864: Apache Zeppelin: Remote code execution by adding malicious JDBC connection string Jongyoul Lee
CVE-2024-31865: Apache Zeppelin: Cron arbitrary user impersonation with improper privileges Jongyoul Lee
CVE-2024-31866: Apache Zeppelin: Interpreter download command does not escape malicious code injection Jongyoul Lee
CVE-2024-31868: Apache Zeppelin: XSS vulnerability in the helium module Jongyoul Lee
CVE-2024-31867: Apache Zeppelin: LDAP search filter query Injection Vulnerability Jongyoul Lee
CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap
Xen Security Advisory 455 v4 (CVE-2024-31142) - x86: Incorrect logic for BTC/SRSO mitigations Xen . org security team
Xen Security Advisory 456 v2 (CVE-2024-2201) - x86: Native Branch History Injection Xen . org security team
CVE-2024-24576: Rust 1.77.1 and earlier did not properly escape arguments of batch files on Windows Pietro Albini
Re: xz backdoor prevention using hosts.deny? Andres Freund
Re: xz backdoor prevention using hosts.deny? Christoph Anton Mitterer
Wednesday, 10 April
Re: xz backdoor prevention using hosts.deny? Jacob Bachmeyer
Re: Is CVE-2024-30203 bogus? (Emacs) Sean Whitton
Re: Is CVE-2024-30203 bogus? (Emacs) Ihor Radchenko
Re: Re: Is CVE-2024-30203 bogus? (Emacs) Salvatore Bonaccorso
Re: Is CVE-2024-30203 bogus? (Emacs) Max Nikulin
CVE-2024-31309: Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack Bryan Call
CVE-2024-31861: Apache Zeppelin: Code injection by Shell interpreter Jongyoul Lee
Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Joey Hess
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Solar Designer
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Chris Down
Fwd: Node.js security update for all active relesae lines, April 9 2024 Rafael Gonzaga
NodeJS Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) Jan Schaumann
CERT VU#123335: Multiple Programming Languages Fail to Escape Arguments Properly in Microsoft Windows Alan Coopersmith
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar
New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Vegard Nossum
Re: CERT VU#123335: Multiple Programming Languages Fail to Escape Arguments Properly in Microsoft Windows Steffen Nurpmeso
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer
CVE-2024-1086: Linux: nf_tables: use-after-free vulnerability in the nft_verdict_init() function Solar Designer
Re: CVE-2024-1086: Linux: nf_tables: use-after-free vulnerability in the nft_verdict_init() function Jonathan Wright
Thursday, 11 April
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Jacob Bachmeyer
Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Tianyu Chen
Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap
Re: Is CVE-2024-30203 bogus? (Emacs) Sean Whitton
Re: Re: Is CVE-2024-30203 bogus? (Emacs) Sean Whitton
Re: Is CVE-2024-30203 bogus? (Emacs) Max Nikulin
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Donald Buczek
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer
Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz
[PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm Ben Hutchings
Buildroot: incorrect permissons on /dev/shm Ben Hutchings
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar
Re: [Buildroot] [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm Yann E. MORIN
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Kyle Zeng
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Kyle Zeng
CVE-2024-27309: Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode Colin McCabe
Friday, 12 April
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Jacob Bachmeyer
less(1) with LESSOPEN mishandles \n in paths Jakub Wilk
Re: less(1) with LESSOPEN mishandles \n in paths Sam James
CVE-2024-31391: Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials Jason Gerlowski
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Alejandro Colomar
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jakub Wilk
Re: Fwd: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.12 and Xwayland prior to 23.2.5 Alan Coopersmith
PHP security releases 8.1.28, 8.2.18, & 8.3.6 Alan Coopersmith
Saturday, 13 April
Re: Analysis on who is Jia Tan, and who he could work for, reading xz.git Jacob Bachmeyer
Re: less(1) with LESSOPEN mishandles \n in paths Tobias Powalowski
Sunday, 14 April
Linux: Disabling network namespaces Solar Designer
Monday, 15 April
Re: less(1) with LESSOPEN mishandles \n in paths Jakub Wilk
Re: Linux: Disabling network namespaces Demi Marie Obenour
Re: Linux: Disabling network namespaces Solar Designer
Re: Linux: Disabling network namespaces Simon McVittie
Re: Linux: Disabling network namespaces Simon McVittie
CVE-2024-31497: Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client Fabian Bäumer
Tuesday, 16 April
Re: Linux: Disabling network namespaces Jordan Glover
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer
Re: Linux: Disabling network namespaces Philippe Cerfon
[kubernetes] CVE-2024-3177: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin Rita Zhang
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Solar Designer
Re: Linux: Disabling network namespaces Demi Marie Obenour
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Greg KH
Wednesday, 17 April
Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz
Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config Vegard Nossum
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jacob Bachmeyer
Re: Linux: Disabling network namespaces Georgia Garcia
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jakub Wilk
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Loganaden Velvindron
Terrapin vulnerability in Jenkins CLI client Daniel Beck
The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Adhemerval Zanella Netto
CVE-2024-31869: Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used Ephraim Anierobi
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Matt Johnston
Thursday, 18 April
libreswan: IKEv1 default AH/ESP responder can crash and restart David Morel
Re: Make your own backdoor: CFLAGS code injection, Makefile injection, pkg-config Jacob Bachmeyer
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Solar Designer
flatpak CVE-2024-32462 : Sandbox escape via RequestBackground portal and CWE-88 Simon McVittie
Friday, 19 April
CVE-2024-29217: Apache Answer: XSS vulnerability when changing personal website Enxin Xie
Re: backdoor in upstream xz/liblzma leading to ssh server compromise Jacob Bachmeyer
CVE-2024-29733: Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context Elad Kalif
Re: Linux: Disabling network namespaces Solar Designer
Re: Linux: Disabling network namespaces Simon McVittie
Re: Linux: Disabling network namespaces nightmare . yeah27
Saturday, 20 April
Re: Linux: Disabling network namespaces Solar Designer
Re: Linux: Disabling network namespaces Jordan Glover
[Update] PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass Fay Stegerman
Sunday, 21 April
Re: Linux: Disabling network namespaces Simon McVittie
Re: Linux: Disabling network namespaces Simon McVittie
Re: PoC for fdroidserver AllowedAPKSigningKeys certificate pinning bypass Jeffrey Walton
Re: Linux: Disabling network namespaces Solar Designer
Re: Linux: Disabling network namespaces Solar Designer
Monday, 22 April
Wordpress Responsive theme: arbitrary HTML content injection (CVE-2024-2848) Hanno Böck
CVE-2024-27347: Apache HugeGraph-Hubble: SSRF in Hubble connection page Imba Jin
CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlin Imba Jin
CVE-2024-27349: Apache HugeGraph-Server: Bypass whitelist in Auth mode Imba Jin
Re: Linux: Disabling network namespaces Jordan Glover
Re: Linux: Disabling network namespaces Priedhorsky, Reid
Tuesday, 23 April
Re: Linux: Disabling network namespaces Demi Marie Obenour
83 bogus CVEs assigned to Robot Operating System (ROS) Mark Esler
Re: 83 bogus CVEs assigned to Robot Operating System (ROS) Yash Patel
Re: 83 bogus CVEs assigned to Robot Operating System (ROS) Mark Esler
Re: 83 bogus CVEs assigned to Robot Operating System (ROS) Yash Patel
Re: Linux: Disabling network namespaces Simon McVittie
Wednesday, 24 April
PowerDNS Recursor Security Advisory 2024-02: if recursive forwarding is configured, crafted responses can lead to a denial of service in Recursor Peter van Dijk
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence Florian Weimer
CVE-2024-0582 - Linux kernel use-after-free vulnerability in io_uring, writeup and exploit strategy Oriol Castejón
Security Issues and Abandonment of PHP ECC library (mdanter/ecc, phpecc/phpecc) Paragon Initiative Enterprises Security Team
Thursday, 25 April
libksieve (used by kmail/kontact) sent password as username Jonas Schäfer
Friday, 26 April
Update on the distro-backdoor-scanner effort Hank Leininger
Re: Update on the distro-backdoor-scanner effort Simon McVittie
Re: Update on the distro-backdoor-scanner effort Sam James
Saturday, 27 April
Re: Update on the distro-backdoor-scanner effort Jacob Bachmeyer
Re: Update on the distro-backdoor-scanner effort Morten Linderud
Sunday, 28 April
Re: Update on the distro-backdoor-scanner effort Hank Leininger
Re: Update on the distro-backdoor-scanner effort Hank Leininger
Suspicious hook-loading mechanism in hyprland Sam James
Telegram Web app XSS / Session Hijacking 1-click Pedro Batista
Monday, 29 April
Re: Update on the distro-backdoor-scanner effort Jacob Bachmeyer
Re: Update on the distro-backdoor-scanner effort Vegard Nossum
CVE-2024-27322: Deserialization vulnerability in R before 4.4.0 Alan Coopersmith
Re: Linux: Disabling network namespaces John Johansen
Re: Re: Linux: Disabling network namespaces John Johansen
Re: Update on the distro-backdoor-scanner effort Gabriel Ravier
Tuesday, 30 April
Re: libksieve (used by kmail/kontact) sent password as username Salvatore Bonaccorso
Re: Update on the distro-backdoor-scanner effort Jacob Bachmeyer
Re: New SMTP smuggling attack Mark Esler
Re: Telegram Web app XSS / Session Hijacking 1-click Pedro Batista
Re: New SMTP smuggling attack nightmare . yeah27
Re: New SMTP smuggling attack Erik Auerswald
Re: New SMTP smuggling attack Steffen Nurpmeso
Wednesday, 01 May
CVE-2024-32114: Apache ActiveMQ: Jolokia and REST API were not secured with default configuration Jean-Baptiste Onofré
Re: CVEs issued by the Linux kernel CNA Alan Coopersmith
Thursday, 02 May
Re: Re: CVEs issued by the Linux kernel CNA Greg KH
CVE-2024-32638: Apache APISIX: Forward-Auth Request Smuggling YuanSheng Wang
Multiple vulnerabilities in Jenkins plugins Daniel Beck
CVE-2024-30251: DoS in aiohttp Sam Bull
Re: New SMTP smuggling attack Steffen Nurpmeso
Re: New SMTP smuggling attack Solar Designer
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Sam James
Friday, 03 May
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Steffen Nurpmeso
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) Steffen Nurpmeso
CVE-2023-35701: Apache Hive: Arbitrary command execution via JDBC driver Stamatis Zampetakis
Monday, 06 May
Fwd: uriparser 0.9.8 released, includes security fixes Sebastian Pipping
Re: Buildroot: incorrect permissons on /dev/shm Ben Hutchings
Re: Fwd: uriparser 0.9.8 released, includes security fixes Solar Designer
Re: [Buildroot] Buildroot: incorrect permissons on /dev/shm Yann E. MORIN
The GNU C Library security advisories update for 2024-05-06 Carlos O'Donell
Re: [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm Peter Korsgaard
Tuesday, 07 May
CVE-2023-49606, CVE-2023-40533: memory safety vulnerabilities in tinyproxy <=1.11.1 Valtteri Vuorikoski
CVE-2024-28148: Apache Superset: Incorrect datasource authorization on explore REST API Daniel Gaspar
HNS-2024-07 - HN Security Advisory - Multiple vulnerabilities in RIOT OS Marco Ivaldi
Re: Buildroot: incorrect permissons on /dev/shm Peter Korsgaard
GLib (2.26.0+): GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing Philip Withnall
CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function HexRabbit Chen
Xen Security Advisory 456 v3 (CVE-2024-2201) - x86: Native Branch History Injection Xen . org security team
Xen Security Advisory 457 v1 - Linux/xen-netback: Memory leak due to missing cleanup function Xen . org security team
Wednesday, 08 May
Xen Security Advisory 457 v2 - Linux/xen-netfront: Memory leak due to missing cleanup function Xen . org security team
Re: CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function Salvatore Bonaccorso
[security] Go 1.22.3 and Go 1.21.10 are released Alan Coopersmith
Xen Security Advisory 457 v3 (CVE-2024-27393) - Linux/xen-netfront: Memory leak due to missing cleanup function Xen . org security team
Thursday, 09 May
CVE-2024-32113: Apache OFBiz: Path traversal leading to RCE Jacques Le Roux
CVE-2024-26579: Apache Inlong JDBC Vulnerability Charles Zhang
Re: New SMTP smuggling attack Mark Esler
[kubernetes] CVE-2024-3744: azure-file-csi-driver discloses service account tokens in logs Rita Zhang
CVE-2024-34365: Apache Karaf Cave: Cave SSRF and arbitrary file access Arnout Engelen
Re: New SMTP smuggling attack Erik Auerswald
Friday, 10 May
[vim-security] buffer-overlow in xxd with colored output < v9.1.0404 Christian Brabandt
Saturday, 11 May
Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Corey Lopez
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Solar Designer
Re: lsof "can't stat() fuse.${name} filesystem /run/user/1000/${dir}" Simon McVittie
Monday, 13 May
PowerDNS Security Advisory 2024-03: Transfer requests received over DoH can lead to a denial of service in DNSdist Remi Gacogne
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Jacob Bachmeyer
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory Jacob Bachmeyer
Tuesday, 14 May
CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance Log/Log Details Ephraim Anierobi
git: 5 vulnerabilities fixed Johannes Schindelin
Wednesday, 15 May
CVE-2024-21823: Intel DSA and Intel IAA advisory Alan Coopersmith
Thursday, 16 May
OpenSSL Security Advisory Tomas Mraz
OpenSSL Security Advisory [corrected CVE id] Tomas Mraz
CVE-2024-34058: Nethserver 7 & 8 stored cross-site scripting (XSS) in WebTop package Andrea Intilangelo
Friday, 17 May
Re: Linux: Disabling network namespaces Mickaël Salaün