oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2024/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 2	² 7	³ 3	⁴	⁵
⁶ 6	⁷ 8	⁸ 4	⁹ 6	¹⁰ 1	¹¹ 3	¹²
¹³ 3	¹⁴ 2	¹⁵ 1	¹⁶ 3	¹⁷ 1	¹⁸	¹⁹
²⁰ 2	²¹ 2	²²	²³ 1	²⁴ 2	²⁵	²⁶ 1
²⁷ 6	²⁸ 2	²⁹ 2	³⁰ 4	³¹

Messages by day:

May 1 (2 messages)

CVE-2024-32114: Apache ActiveMQ: Jolokia and REST API were not secured with default configuration (Jean-Baptiste Onofré <jbonofre@...che.org>)
Re: CVEs issued by the Linux kernel CNA (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 2 (7 messages)

Re: Re: CVEs issued by the Linux kernel CNA (Greg KH <greg@...ah.com>)
CVE-2024-32638: Apache APISIX: Forward-Auth Request Smuggling (YuanSheng Wang <membphis@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2024-30251: DoS in aiohttp (Sam Bull <9m199i@...bull.org>)
Re: New SMTP smuggling attack (Steffen Nurpmeso <steffen@...oden.eu>)
Re: New SMTP smuggling attack (Solar Designer <solar@...nwall.com>)
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) (Sam James <sam@...too.org>)

May 3 (3 messages)

Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) (Steffen Nurpmeso <steffen@...oden.eu>)
Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise) (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2023-35701: Apache Hive: Arbitrary command execution via JDBC driver (Stamatis Zampetakis <zabetak@...che.org>)

May 6 (6 messages)

Fwd: uriparser 0.9.8 released, includes security fixes (Sebastian Pipping <sebastian@...ping.org>)
Re: Buildroot: incorrect permissons on /dev/shm (Ben Hutchings <ben.hutchings@...d.be>)
Re: Fwd: uriparser 0.9.8 released, includes security fixes (Solar Designer <solar@...nwall.com>)
Re: [Buildroot] Buildroot: incorrect permissons on /dev/shm ("Yann E. MORIN" <yann.morin.1998@...e.fr>)
The GNU C Library security advisories update for 2024-05-06 (Carlos O'Donell <carlos@...hat.com>)
Re: [PATCH] package/skeleton-init-sysv: Set sticky bit on /dev/shm (Peter Korsgaard <peter@...sgaard.com>)

May 7 (8 messages)

CVE-2023-49606, CVE-2023-40533: memory safety vulnerabilities in tinyproxy <=1.11.1 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2024-28148: Apache Superset: Incorrect datasource authorization on explore REST API (Daniel Gaspar <dpgaspar@...che.org>)
HNS-2024-07 - HN Security Advisory - Multiple vulnerabilities in RIOT OS (Marco Ivaldi <raptor@...eadbeef.info>)
Re: Buildroot: incorrect permissons on /dev/shm (Peter Korsgaard <peter@...sgaard.com>)
GLib (2.26.0+): GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing (Philip Withnall <philip@...nocode.co.uk>)
CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function (HexRabbit Chen <hexrabbit@...co.re>)
Xen Security Advisory 456 v3 (CVE-2024-2201) - x86: Native Branch History Injection (Xen.org security team <security@....org>)
Xen Security Advisory 457 v1 - Linux/xen-netback: Memory leak due to missing cleanup function (Xen.org security team <security@....org>)

May 8 (4 messages)

Xen Security Advisory 457 v2 - Linux/xen-netfront: Memory leak due to missing cleanup function (Xen.org security team <security@....org>)
Re: CVE-2024-26925: Linux: nf_tables: locking issue in the nf_tables_abort() function (Salvatore Bonaccorso <carnil@...ian.org>)
[security] Go 1.22.3 and Go 1.21.10 are released (Alan Coopersmith <alan.coopersmith@...cle.com>)
Xen Security Advisory 457 v3 (CVE-2024-27393) - Linux/xen-netfront: Memory leak due to missing cleanup function (Xen.org security team <security@....org>)

May 9 (6 messages)

CVE-2024-32113: Apache OFBiz: Path traversal leading to RCE (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-26579: Apache Inlong JDBC Vulnerability (Charles Zhang <dockerzhang@...che.org>)
Re: New SMTP smuggling attack (Mark Esler <mark.esler@...onical.com>)
[kubernetes] CVE-2024-3744: azure-file-csi-driver discloses service account tokens in logs (Rita Zhang <rita.z.zhang@...il.com>)
CVE-2024-34365: Apache Karaf Cave: Cave SSRF and arbitrary file access (Arnout Engelen <engelen@...che.org>)
Re: New SMTP smuggling attack (Erik Auerswald <auerswal@...x-ag.uni-kl.de>)

May 10 (1 message)

[vim-security] buffer-overlow in xxd with colored output < v9.1.0404 (Christian Brabandt <cb@...bit.org>)

May 11 (3 messages)

Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Corey Lopez <Corey.lopez09160587@...mail.com>)
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Solar Designer <solar@...nwall.com>)
Re: lsof "can't stat() fuse.${name} filesystem /run/user/1000/${dir}" (Simon McVittie <smcv@...ian.org>)

May 13 (3 messages)

PowerDNS Security Advisory 2024-03: Transfer requests received over DoH can lead to a denial of service in DNSdist (Remi Gacogne <remi.gacogne@...erdns.com>)
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Microsoft Device Firmware Configuration Interface (DFCI) in Linux efivars directory (Jacob Bachmeyer <jcb62281@...il.com>)

May 14 (2 messages)

CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance Log/Log Details (Ephraim Anierobi <ephraimanierobi@...che.org>)
git: 5 vulnerabilities fixed (Johannes Schindelin <Johannes.Schindelin@....de>)

May 15 (1 message)

CVE-2024-21823: Intel DSA and Intel IAA advisory (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 16 (3 messages)

OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
OpenSSL Security Advisory [corrected CVE id] (Tomas Mraz <tomas@...nssl.org>)
CVE-2024-34058: Nethserver 7 & 8 stored cross-site scripting (XSS) in WebTop package (Andrea Intilangelo <andrea@...ilangelo.it>)

May 17 (1 message)

Re: Linux: Disabling network namespaces (Mickaël Salaün <mic@...ikod.net>)

May 20 (2 messages)

Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
Re: Article: State of Sandboxing in Linux (Solar Designer <solar@...nwall.com>)

May 21 (2 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0003 (Adrian Perez de Castro <aperez@...lia.com>)
asterisk security releases 18.23.1, 20.8.1, & 21.3.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 23 (1 message)

Intel CPU Hardware Features and Behaviors Related to Speculative Execution (Alan Coopersmith <alan.coopersmith@...cle.com>)

May 24 (2 messages)

gnome-remote-desktop: D-Bus system service in GNOME release 46 local information leaks (CVE-2024-5148) (Matthias Gerstner <mgerstner@...e.de>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)

May 26 (1 message)

path traversal in tar extract in intel cve-bin-tool (houjingyi <houjingyi647@...il.com>)

May 27 (6 messages)

Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bo… (Charles Fol <c.fol@...fo.fr>)
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix ou… (Florian Weimer <fweimer@...hat.com>)
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix… (Erik Auerswald <auerswal@...x-ag.uni-kl…)
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-… (Solar Designer <solar@...nwall.com>)
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix ou… (Florian Weimer <fweimer@...hat.com>)
Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bo… (Charles Fol <c.fol@...fo.fr>)

May 28 (2 messages)

HNS-2024-06 - HN Security Advisory - Multiple vulnerabilities in Eclipse ThreadX (Marco Ivaldi <raptor@...eadbeef.info>)
OpenSSL Security Advisory (Matt Caswell <matt@...nssl.org>)

May 29 (2 messages)

List linux CVEs for a given stable release? (Dominique Martinet <asmadeus@...ewreck.org>)
Re: List linux CVEs for a given stable release? (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)

May 30 (4 messages)

Re: List linux CVEs for a given stable release? (Dominique Martinet <asmadeus@...ewreck.org>)
Re: List linux CVEs for a given stable release? (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)
Security vulnerability in fprintd (Yaron Shahrabani <sh.yaron@...il.com>)
nginx HTTP/3 security issues/fixes (Solar Designer <solar@...nwall.com>)

72 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.