@Openwall oss-security mailing list thread summaries, currently maintained by @solardiz. Originally setup and maintained as an automated feed by @eugeneteo.
X.Org Security Advisory: June 2, 2026 https://t.co/2PL48XWMnw
8 issues in X server and Xwayland, all with ZDI-CAN identifiers, one also already has a CVE
BIRD/BIRD2: Stack buffer overflow in BGP AS_PATH mask matching https://t.co/6qUl1f3iNC
The confirmed impact is remote BGP peer-triggered DoS. Memory corruption was observed under ASan. Remote code execution has not been demonstrated.
7 CVEs in GPAC/MP4Box https://t.co/GZEdqJty9j and https://t.co/z0YAlAmgSM
Most are NULL Pointer Dereference, but 2 are worse:
CVE-2025-55664: Heap-based Buffer Overflow via m2tsdmx_send_packet on crafted MPEG-2 TS file
CVE-2025-60486: Use-After-Free via dasher_process on [ditto]
CVE-2026-35563: Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname https://t.co/IVL6mdTdwQ
Severity: important
CVE-2025-70103: JPEG XL: Heap-based Buffer Overflow in libjxl/cjxl via jxl::extras::DecodeImagePNM on crafted PBM file https://t.co/0XIDgDfkUU
"WRITE of size 24"
Perl CPAN
CVE-2026-8594: Text::LineFold through 2019.001 duplicate the output based on the number of special break characters https://t.co/ULh114BGqS
CVE-2026-8796: Sereal::Decoder before 5.005 allow heap out-of-bounds read via crafted input https://t.co/lmbcSYzkbz
Perl CPAN
CVE-2026-46740: Mojolicious::Plugin::Statsd through 0.04 allowed metric injections https://t.co/ZAvEzH059g
CVE-2026-8647: Crypt::ScryptKDF through 0.010 uses insecure random number source when no CSPRNG module is available https://t.co/tkyFARtJBg
Perl CPAN
CVE-2026-9658: Plack::Middleware::Security::Common before 0.13.1 did not block header injections in request paths https://t.co/uueuOps8qV
CVE-2026-41565: CryptX before 0.088_001 have a stack buffer overflow in four AEAD decrypt_verify helpers https://t.co/tZrppTBXf8
CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git https://t.co/N00HgnX5f2
in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory
CVE-2026-48840: Exim: PROXY-protocol uninitialised-stack information disclosure https://t.co/Y3iCMLHhw2
The leaked bytes are confirmed to be live userspace VA pointers, making this an ASLR-defeat primitive usable as a chain component. Fixed in 4.99.4.