Open Source Security Mailing List

Discussion of security flaws, concepts, and practices in the Open Source community

List Archives

Latest Posts

Re: libmspack: heap buffer overflow in make_decode_table() (Huffman decode table construction) -- CVE requested Sam James (Aug 19)
Sumit Chakraborty <sumit.ch2004 () gmail com> writes:

Thanks for sharing and bringing it to the list.

I'm not sure if I follow the purpose of the email. If you'd like to
handle disclosure to distros, you can use the linux-distros@ or distros@
mailing list as appropriate, provided you're able & willing to follow
the rules at...

Fwd: [pfx] Postfix stable release 3.11.6 and legacy releases 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, 3.5.27 Sam James (Aug 19)
The first round Wietse fixed was a few months ago in
https://www.openwall.com/lists/oss-security/2026/05/04/25.

See his summary below for details, but they're all at most DoS.

-------------------- Start of forwarded message --------------------
To: Postfix announce <postfix-announce () postfix org>
Date: Mon, 10 Aug 2026 11:50:35 -0400 (EDT)
CC: Postfix users <postfix-users () postfix org>
Subject: [pfx] Postfix stable release...

Multiple vulnerabilities fixed in libgit2-1.9.5, 1.9.7 Sam James (Aug 19)
Hi,

libgit2-1.9.5 fixes several vulnerabilities [0]:
"""
Fix for blame error handling on hunk creation failures

Fix for potential PCRE memory access: 1-byte heap-buffer-overflow WRITE in bundled PCRE 8.45 reachable via revspec

🔒 This is a security release with multiple changes.

This vulnerability was identified by @DavidKorczynski.

hunk_from_entry can return NULL on error; handle that and
return an...

GNU Emacs vulnerability upon opening arbitrary file Sam James (Aug 19)
Eshel Yaron has shared an arbitrary code execution bug in GNU Emacs
exploitable upon opening an file. It affects >= Emacs 28.1.

The reporter has a writeup at
https://eshelyaron.com/posts/2026-08-06-emacs-arbitrary-code-execution-returns.html.
It's from the same reporter as CVE-2024-53920 [0].

Thread on emacs-devel:
* https://lists.gnu.org/archive/html/emacs-devel/2026-07/msg00453.html
*...

uutils coreutils 'stdbuf' uses LD_PRELOAD on a world-writable temporary file Collin Funk (Aug 19)
GNU coreutils distributes a 'stdbuf' program that executes another
program with modified buffering characteristics for its standard
streams. It does this by setting environment variables and then setting
LD_PRELOAD (or the platform-specific equivalent) to a shared library
named "libstdbuf.so". This shared library uses .init and .init_array (or
the platform-specific equivalent) sections that alter the standard
stream...

CVE-2026-75628: Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter Timothy Legge (Aug 19)
========================================================================
CVE-2026-75628 CPAN Security Group
========================================================================

CVE ID: CVE-2026-75628
Distribution: Punk-OAuth2
Versions: before 0.03

MetaCPAN: https://metacpan.org/dist/Punk-OAuth2

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen
off-site...

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005 Adrian Perez de Castro (Aug 19)
------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005
------------------------------------------------------------------------

Date reported : August 20, 2026
Advisory ID : WSA-2026-0005
WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2026-0005.html
WPE WebKit Advisory URL :...

[OSSA-2026-008] ERRATA 2: Ironic Command Injection in IPMI Console Implementations Jay Faulkner (Aug 19)
=======================================================================
OSSA-2026-008: Command Injection in Ironic IPMI Console Implementations
=======================================================================

:Date: April 27, 2026
:CVE: CVE-2026-42510

Affects
~~~~~~~
- Ironic: >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0
<35.0.1

Description
~~~~~~~~~~~
Dmitry Tantsur and Tuomo Tanskanen from the...

[OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass (CVE-2026-pending) Goutham Pacha Ravi (Aug 19)
============================================================================================
OSSA-2026-036: Aodh cross-project alarm enumeration and Watcher webhook
authorization bypass
============================================================================================

:Date: August 19, 2026
:CVE: CVE-2026-pending

Affects
~~~~~~~
- Aodh: >=10.0.0 <20.0.1, ==21.0.0, ==22.0.0
- Watcher: >=4.0.0 <14.1.2, >=15.0.0...

Ceph 20.2.4 and Ceph 19.2.6 are released with 4 security fixes. Sage McTaggart (Aug 19)
Today, August 19th 2026, the Ceph project has released Tentacle
20.2.4<https://github.com/ceph/ceph/releases/tag/v20.2.4> and Squid
19.2.6<https://github.com/ceph/ceph/releases/tag/v19.2.6>.

These releases include 4 security fixes.

*CVE-2025-30156 AES-CBC misuse in CephX facilitating authentication bypass

CVE-2025-30156[1][2] stems from a broken cryptographic implementation in CephX, similar to the vulnerability class
described...

CVE-2026-75589: Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify Robert Rothenberg (Aug 19)
========================================================================
CVE-2026-75589                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-75589
  Distribution:  Net-OAuth
      Versions:  before 0.33

      MetaCPAN:  https://metacpan.org/dist/Net-OAuth
      VCS Repo: ...

CVE-2026-72889: Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify Robert Rothenberg (Aug 19)
========================================================================
CVE-2026-72889                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-72889
  Distribution:  Net-OAuth
      Versions:  before 0.33

      MetaCPAN:  https://metacpan.org/dist/Net-OAuth
      VCS Repo: ...

Re: GNU Inetutils talkd buffer overflow with long DNS names. Tristan (Aug 18)
Hi Collin,

Thank you very much for the smooth and professional collaboration on this
issue, and glad to see CVE-2026-19720 assigned.

Best regards,

Tristan Madani
*// Talence Security*

Le sam. 15 août 2026 à 05:16, Collin Funk <collin.funk1 () gmail com> a écrit :

CPython [CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme Alan Coopersmith (Aug 18)
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent
over another scheme
Date: Tue, 18 Aug 2026 15:38:30 +0000
From: Kirill Podoprigora via Security-announce <security-announce () python org>
Reply-To: security-sig () python org
To: security-announce () python org
CC: Kirill Podoprigora <kirill.bast () gmail com>...

CPython [CVE-2026-17084] StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 Alan Coopersmith (Aug 18)
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-17084] StringPrep algorithm considered
Unicode codepoint attributes outside Unicode 3.2.0
Date: Tue, 18 Aug 2026 13:55:39 +0000
From: Seth Larson <seth () python org>
Reply-To: security-sig () python org
To: security-announce () python org

There is a MEDIUM severity vulnerability affecting CPython.

The "stringprep" module didn't...

More Lists

Dozens of other network security lists are archived at SecLists.Org.