Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jan Engelhardt
Re: CVE-2026-46242 ("Bad Epoll") local privilege escalation on Linux, including Android
oss-sec mailing list archives From: Jan Engelhardt <ej () inai de> Date: Thu, 9 Jul 2026 00:40:46 +0200 (CEST) On Wednesday 2026-07-08 23:20, Jan Schaumann wrote: No kill-switch. Copy Fail and its variants can be neutralized by unloading their vulnerable modules, but epoll has no such option. It is a core kernel feature that the operating system, network services, and browsers all rely on. The only way to fix it is to apply the patch.
Re: Re: zlib security audit by 7asecurity
oss-sec mailing list archives From: Jan Engelhardt <ej () inai de> Date: Wed, 18 Feb 2026 00:14:01 +0100 (CET) On Tuesday 2026-02-17 22:21, Simon Josefsson wrote: Sam James <sam () gentoo org> writes: * ZLB-01-001 WP2: Heap Buffer Overflow via Legacy gzprintf Implementation (High) That vulnerability seems to require that zlib was built with -DNO_vsnprintf -DNO_snprintf, targetting a system lacking 'snprintf'. Does anyone know of a real-world environment using that configuration?
Re: Null Pointer Dereference in HarfBuzz
oss-sec mailing list archives From: Jan Engelhardt <ej () inai de> Date: Mon, 12 Jan 2026 10:42:33 +0100 (CET) On Monday 2026-01-12 04:09, Jacob Bachmeyer wrote: In short, this is a crash bug, but not a security issue. This is different from (for example) a parser bug that results in NULL being dereferenced if crafted input is processed. Are we now using CVE IDs as some kind of global bug tracker?
Multiomics Reveal Associations Between CpG Methylation, Histone Modifications and Transcription in a Species That has Lost DNMT3, the Colorado Potato Beetle
1 Introduction The remarkable evolutionary success of insects is largely due to their exceptional ability to generate phenotypic diversity. The basis for such plasticity is partially provided by epigenetic modifications, which facilitate differential gene expression. This is achieved through reversible chemical modifications on histones or DNA bases (Aliaga et al. 2019). While epigenetic modifications as such are well conserved, their functions and interconnections might be evolutionarily flexible.
Re: Trailing dot in Cygwin filenames [was: failed to clone iptables,ipset,nftables]
oss-sec mailing list archives From: Jan Engelhardt <ej () inai de> Date: Fri, 25 Apr 2025 09:46:15 +0200 (CEST) On Friday 2025-04-25 08:22, Florian Westphal wrote: Sunny73Cr <Sunny73Cr () protonmail com> wrote: error: invalid path 'src/json.' There is indeed a bogus file of that name, no idea why its there or why cygwin git chokes on it.
Multiomics reveal associations between CpG methylation, histone modifications and transcription in a species that has lost DNMT3, the Colorado potato beetle
Abstract Insects display exceptional phenotypic plasticity, which can be mediated by epigenetic modifications, including CpG methylation and histone modifications. In vertebrates, both are interlinked and CpG methylation is associated with gene repression. However, little is known about these regulatory systems in invertebrates, where CpG methylation is mainly restricted to gene bodies of transcriptionally active genes.
Experimental Investigation of a Distributed Architecture for EV Chargers Performing Frequency Control
All articles published by MDPI are made immediately available worldwide under an open access license. No special permission is required to reuse all or part of the article published by MDPI, including figures and tables. For articles published under an open access Creative Common CC BY license, any part of the article may be reused without permission provided that the original article is clearly cited. For more information, please refer to https://www.mdpi.com/openaccess.
Re: feedback requested regarding deprecation of TLS 1.0/1.1
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Wed, 7 Aug 2024 07:49:18 +0200 (CEST) On Tuesday 2024-08-06 11:02, Neil Horman wrote: 3) If the deprecated protocols are re-enabled, what would constitute a reasonable warning mechanism to inform users that these protocols are going away at some point in the future to pressure users to update to a newer, more secure protocol?
Arabica coffee: New database to better identify more climate-resilient plants
Visit Website work Haus 1, T-Trakt Jahnallee 59 04109 Leipzig Visit Website work Haus 5 Marschnerstraße 29d/e 04109 Leipzig Visit Website work Institutsgebäude Schillerstraße 6 04109 Leipzig Visit Website work Institutsgebäude Beethovenstraße 25 04107 Leipzig Visit Website work Haus E Liebigstraße 27 04103 Leipzig Phone: work +49 341 97-15500 Fax: fax +49 341 97-15509 Visit Website work Haus E Liebigstraße 27 04103 Leipzig Phone: work +49 341 97-15500 Fax: fax +49 341 97-15509 Visit Website...
From xz to ibus: more questionable tarballs
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Mon, 1 Apr 2024 14:58:30 +0200 (CEST) In the ibus repository at https://github.com/ibus/ibus , commit 0ad8e77bd36545974ad8acd0a5283cf72bc7c8ad was tagged as refs/tags/1.5.29-rc2 (+signed) on 2023-11-09, and a disted tarball was made available (but unsigned), and Linux distros have imported it (file checksums all line up).
Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Sun, 31 Mar 2024 01:23:28 +0100 (CET) On Saturday 2024-03-30 21:43, Mats Wichmann wrote: On 3/30/24 09:32, Jeffrey Walton wrote: Someone asked what would become of xz as a project. I do hope in light of this event, some people step in to help.
Re: with firefox on X11, any page can pastejack you anytime
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Thu, 19 Oct 2023 02:42:01 +0200 (CEST) On Thursday 2023-10-19 00:31, Grant Taylor wrote: Aside: The thread in question brought up some interesting idea, including altering how things that start with unsafe characters -- though I wonder why not all files -- with `./` so the `-bob` file becomes `./-bob` when expanded.
Re: "Linux Kernel security demistified"
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Mon, 2 Oct 2023 04:11:15 +0200 (CEST) On Sunday 2023-10-01 21:13, Solar Designer wrote: Here are the slides: https://git.sr.ht/~gregkh/presentation-security https://git.sr.ht/~gregkh/presentation-security/blob/3547183843399d693c35b502cf4a313e256d0dd8/security-stuff.pdf Had a little chuckle.
Re: TTY pushback vulnerabilities / TIOCSTI
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Wed, 15 Mar 2023 10:44:37 +0100 (CET) On Wednesday 2023-03-15 10:03, Dave Horsfall wrote: But also: "Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away", and it would appear TIOCSTI does not have https://xkcd.com/2347/ -criticality.
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Wed, 28 Dec 2022 18:09:21 +0100 (CET) On Wednesday 2022-12-28 17:47, Demi Marie Obenour wrote: So like EBML?
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Fri, 23 Dec 2022 01:21:42 +0100 (CET) On Thursday 2022-12-22 23:03, Dominique Martinet wrote: strrchr does not concern itself with "lines". If your input buffer contains the complete content of /proc/X/stat (and not just a "line" thereof), the strrchr approach appears quite workable.
Re: Is third party javascript on a login page considered dangerous?
oss-sec mailing list archives From: Jan Engelhardt <jengelh () inai de> Date: Tue, 1 Nov 2022 12:53:36 +0100 (CET) On Monday 2022-10-31 10:16, Georgi Guninski wrote: Any code should be treated as potentially dangerous. The less you have overall, the better. I do not see why a login page of all things needs code. Input form, fields for username / password / other authentication tokens, a submit button. Boom, done.
Re: Trojan Source Attacks
oss-sec mailing list archives By Date By Thread Re: Trojan Source Attacks From: Jan Engelhardt <jengelh () inai de> Date: Tue, 2 Nov 2021 02:21:58 +0100 (CET) On Tuesday 2021-11-02 00:50, Perry E. Metzger wrote: On 11/1/21 16:51, Jan Engelhardt wrote: We have identified an issue affecting all compilers and interpreters that support Unicode. [...] The attached paper describes an attack paradigm -- which we believe to be novel -- discovered by security researchers at the University of Cambridge.
Re: Trojan Source Attacks
oss-sec mailing list archives By Date By Thread Re: Trojan Source Attacks From: Jan Engelhardt <jengelh () inai de> Date: Mon, 1 Nov 2021 21:51:38 +0100 (CET) On Monday 2021-11-01 18:27, Nicholas Boucher wrote: We have identified an issue affecting all compilers and interpreters that support Unicode. [...] The attached paper describes an attack paradigm -- which we believe to be novel -- discovered by security researchers at the University of Cambridge. Not so novel.
Remote authenticated DoS with unhandled exception
oss-sec mailing list archives By Date By Thread kopano-core 11.0.2.43: Remote authenticated DoS with unhandled exception From: Jan Engelhardt <jengelh () inai de> Date: Fri, 13 Aug 2021 14:21:03 +0200 (CEST) To the best of my knowledge, this is the initial publication, and there is no CVE number as of this time. == Affected versions == * kopano-core 11.0.2.43 and presumably all prior versions == Issue == The ical parser in kopano-ical's "iCal::HrHandleIcalPost" function is very memory hungry.
Remote DoS with resource exhaustion
oss-sec mailing list archives By Date By Thread kopano-core 11.0.1.143: Remote DoS with resource exhaustion From: Jan Engelhardt <jengelh () inai de> Date: Sat, 1 May 2021 17:07:37 +0200 (CEST) To the best of my knowledge, this is the initial publication, and there is no CVE number as of this time. # Affected versions * kopano-core 8.5 to 11.0.1.143 The "kopano-gateway" program implements a network service for IMAP.
Malicious commits to Linux kernel as part of university study
oss-sec mailing list archives By Date By Thread Re: Malicious commits to Linux kernel as part of university study From: Jan Engelhardt <jengelh () inai de> Date: Fri, 23 Apr 2021 01:02:36 +0200 (CEST) On Thursday 2021-04-22 17:02, David A.
Risk of local privilege escalation in GNU Guix
oss-sec mailing list archives By Date By Thread Re: Risk of local privilege escalation in GNU Guix From: Jan Engelhardt <jengelh () inai de> Date: Mon, 5 Apr 2021 20:31:29 +0200 (CEST) On Monday 2021-04-05 19:55, Henri Salo wrote: On Mon, Apr 05, 2021 at 12:43:15PM -0400, Leo Famulari wrote: We applied for a CVE ID via MITRE's web form [0] on March 18, 2021. We have not yet received a reply. Does anybody know if that is expected? This is not normal. Maybe it is?
Remote DoS with out-of-bounds access
oss-sec mailing list archives By Date By Thread kopano-core 11.0.1.77: Remote DoS with out-of-bounds access From: Jan Engelhardt <jengelh () inai de> Date: Fri, 2 Apr 2021 10:26:29 +0200 (CEST) Initial publication, no CVE number yet. # Affected versions * kopano-core 11.0.1 * kopano-core 8.7.20 * it is believed this affects all other versions too, including 10.0.7, 9.1.0, and zarafa 7.2.6. The "kopano-ical" program implements a network service/trivial HTTP server.
Remote DoS by memory exhaustion
oss-sec mailing list archives By Date By Thread Re: kopano-core 11.0.1: Remote DoS by memory exhaustion From: Jan Engelhardt <jengelh () inai de> Date: Thu, 1 Apr 2021 01:20:24 +0200 (CEST) On Friday 2021-03-19 13:44, Jan Engelhardt wrote: Initial publication, no CVE number yet (will request). […] The "kopano-ical" program implements a network service/trivial HTTP server. It imposes no length restrictions on HTTP headers, which can be exploited to memory-exhaust the process and have it terminate.
Remote DoS by memory exhaustion
oss-sec mailing list archives By Date By Thread kopano-core 11.0.1: Remote DoS by memory exhaustion From: Jan Engelhardt <jengelh () inai de> Date: Fri, 19 Mar 2021 13:44:24 +0100 (CET) Initial publication, no CVE number yet (will request).
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jan
Contact Jan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack