Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by On Sun
Re: cloud computing provider disclosures
oss-sec mailing list archives From: Katie <katie () herricane ca> Date: Sun, 04 Oct 2026 22:25:45 -0400 On 2026-10-04 21:45, Aaron Rainbolt wrote: On Sun, 4 Oct 2026 18:56:44 -0400 Jan Schaumann <jschauma () netmeister org> wrote: Hello, I was wondering whether it might make sense to establish a disclosure list for cloud computing / virtual private server hosting providers.
Re: AI slops from Eve
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 13 Sep 2026 17:07:13 +0200 On Sun, Sep 13, 2026 at 10:33:41AM +0200, Jeroen Roovers wrote: On Thu, 10 Sep 2026 03:35:42 +0200 Solar Designer <solar () openwall com> wrote: These messages lack a Date header, but they arrived to the list server on September 9 starting 6am UTC and until 11am UTC.
AI slop "Combined chain advisory — fallback.efi/SBAT/memdisk bypass"
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Tue, 18 Aug 2026 07:19:30 +0200 Hi, trexnegr0 (Jeremy Erazo) and/or his AI assistant brought this to the distros list, to Red Hat security team, and to some others on June 21. There was some discussion (see excerpts below) and it appeared that there's no security relevance here.
Re: Some Changes to GNOME Security Tracking
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 2 Aug 2026 17:22:26 +0200 Hi, On Sun, Aug 02, 2026 at 07:39:04AM -0700, Russ Allbery wrote: Peter Gutmann <pgut001 () cs auckland ac nz> writes: Russ Allbery <eagle () eyrie org> writes: One solution that anyone in open source software communities has heard about for decades now is to turn open source software maintenance into a job with a paycheck.
Re: Coordinated Disclosure in the LLM Age
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 24 May 2026 19:04:44 +0200 On Sun, May 24, 2026 at 04:58:26AM -0700, ROI AI wrote: Confidential communication. No warranties or commitments unless in a signed agreement. If received in error, notify sender and delete. Unauthorized use prohibited. OK. As a moderator, I am getting feedback that "these posts are starting to repeat themselves", and I feel so too.
Re: root-project/root: Heap buffer overflow in TKey::Streamer / TBasket::ReadBasketBuffers
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 24 May 2026 18:54:49 +0200 Hi, On Sun, May 24, 2026 at 10:07:07PM +0700, Manopakorn Kooharueangrong wrote: I am requesting that you coordinate a CVE assignment. It's been many years since you could request CVE assignment from this list. I guess this somehow got into the training of some popular LLMs, since we started getting this sort of requests again lately.
Re: CVE-2026-31431: CopyFail: linux local privilege scalation
oss-sec mailing list archives From: nightmare.yeah27 () aceecat org Date: Sat, 2 May 2026 21:43:21 -0700 On Sun, May 03, 2026 at 07:43:56AM +1000, Brian May wrote: But I heard some enterprise kernels came with the code compiled into the kernel, and these required a kernel command line option and a reboot to fix. VPSs provided by Linode/Akamai have the "option" (see below) to boot their kernel, so that no kernel package needs even to be installed in the image.
Get Ready to Climb and Explore at These Free Big Truck Days
If your kids love to explore big trucks and vehicles, these upcoming Big Truck Days are a perfect weekend or weeknight outing. They'll get to climb on and explore fire trucks, police vehicles, bulldozers, bucket trucks, ambulances and lots more. All of the Big Truck events listed below are free and registration is not required.
Re: Telnetd Vulnerability Report
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 8 Mar 2026 11:02:22 +0100 On Sun, Mar 08, 2026 at 11:41:47AM +0200, Justin Swartz wrote: On 2026-03-08 10:05, Solar Designer wrote: On Sun, Mar 08, 2026 at 09:34:22AM +0200, Justin Swartz wrote: +is_env_var_allowed (const char *var, const char *val) +{ + const char * const *p; This second const here looks wrong as you're changing the value of this pointer.
Re: Telnetd Vulnerability Report
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 8 Mar 2026 09:05:57 +0100 On Sun, Mar 08, 2026 at 09:34:22AM +0200, Justin Swartz wrote: Based on the feedback provided, the third version of the patch set [1]: - Places the strings of the allowed environment variables array into the .rodata section. Actually, the strings would be in .rodata (or after linking, in .text) with your previous patch version as well.
Re: Many vulnerabilities in GnuPG
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 28 Dec 2025 05:36:44 +0100 On Sun, Dec 28, 2025 at 05:27:44AM +0100, Solar Designer wrote: 1. Multiple Plaintext Attack on Detached PGP Signatures in GnuPG 2. GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field 3. Cleartext Signature Plaintext Truncated for Hash Calculation 4. Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks 5.
Dailydave: Re: Defense ?
Dailydave mailing list archives From: Alfonso De Gregorio via Dailydave <dailydave () lists aitelfoundation org> Date: Sun, 16 Nov 2025 11:14:18 +0000 On Sun, Nov 16, 2025 at 10:16â¯AM Dave Aitel via Dailydave <dailydave () lists aitelfoundation org> wrote: How would one actually move the actual bar in defense? A big part of me thinks that you're just not going to patch your way out of the problem.
Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution
oss-sec mailing list archives From: lunbun <lunbun021 () gmail com> Date: Sun, 12 Oct 2025 15:59:27 -0700 Hi all, Does anyone know how might I get the CVSS score of this vulnerability (CVE-2025-55188) increased? I recently saw an advisory for CVE-2025-11001, a very similar arbitrary file write in 7-Zip due to symbolic links (https://www.zerodayinitiative.com/advisories/ZDI-25-949/).
Re: Linux kernel: HFS+ filesystem implementation, issues, exposure in distros
oss-sec mailing list archives From: nightmare.yeah27 () aceecat org Date: Sun, 5 Oct 2025 09:52:47 -0700 On Sun, Oct 05, 2025 at 08:23:21AM +0200, Greg KH wrote: That is the work we do to "triage" on a weekly basis. Again, not all bugfixes that go into the Linux kernel meet the cve.org definition of "vulnerability", and so, we do not mark all Linux bugfixes with a CVE.
Re: How to do secure coding and create secure software
oss-sec mailing list archives From: Amit <amitchoudhary0523 () gmail com> Date: Mon, 29 Sep 2025 09:01:26 +0530 On Mon, 29 Sept 2025 at 01:21, Jeffrey Walton <noloader () gmail com> wrote: On Sun, Sep 28, 2025 at 10:53 AM Amit <amitchoudhary0523 () gmail com> wrote: On Sun, 28 Sept 2025 at 03:11, Solar Designer <solar () openwall com> wrote: You claim that "If functions/methods are secure then the whole software is secure." If we talk C where main() is also a function, and limit the...
Re: How to do secure coding and create secure software
oss-sec mailing list archives From: Amit <amitchoudhary0523 () gmail com> Date: Sun, 28 Sep 2025 09:05:15 +0530 On Sun, 28 Sept 2025 at 03:11, Solar Designer <solar () openwall com> wrote: You claim that "If functions/methods are secure then the whole software is secure." If we talk C where main() is also a function, and limit the definition of "whole software" to one program, then I'd agree - your claim can as well directly say "if [all functions including] main() are secure then the whole...
Re: xterm terminal crash due to malicious character sequences in file name
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 17 Aug 2025 03:45:57 +0200 On Sun, Aug 17, 2025 at 03:09:58AM +0200, Vincent Lefevre wrote: Note: I didn't receive Erik's message. The logs of my mail server says that 193.110.157.244 was blacklisted by zen.spamhaus.org and dnsbl.ahbl.org. Rather annoying... I'm unsure we want a list admin topic in this same thread, but anyway: Sorry about this issue.
Linux kernel: HFS+ filesystem implementation issues, exposure in distros
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Tue, 3 Jun 2025 04:59:19 +0200 Hi, Muhammed Hüsam Alzeyya, CC'ed here, (kind of) brought an issue in the Linux kernel's HFS+ filesystem implementation to s@k.o and linux-distros at once. This is against both Linux kernel's and linux-distros' current instructions, which ask to "notify the kernel security team first, wait for the fix, and only then notify linux-distros or oss-security".
Microsoft Already Attacks the BSDs as Well (the E.E.E. Way, as Usual)
Microsoft Already Attacks the BSDs as Well (the E.E.E. Way, as Usual) posted by Roy Schestowitz on Apr 22, 2025, updated Apr 22, 2025 We genuinely hope readers who celebrate Easter had a pleasant break. On Easter Monday we kept as busy as usual and we'll soon have some good news as well.
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Mon, 7 Apr 2025 00:09:04 +0200 On Sun, Apr 06, 2025 at 10:37:49AM +0200, Hanno Böck wrote: On Fri, 04 Apr 2025 18:54:21 +0000 Elad Kalif <eladkal () apache org> wrote: https://github.com/apache/airflow/pull/48098 If I read this code correctly, the only thing this PR changes is to reject inputs with an ";" character. I am not familiar with the codebase, and also by no means an expert in SQL injections.
Atlantic Tropical Weather Discussion
000 AXNT20 KNHC 080521 TWDAT Tropical Weather Discussion NWS National Hurricane Center Miami FL 0615 UTC Sat Mar 8 2025 Tropical Weather Discussion for North America, Central America Gulf of America, Caribbean Sea, northern sections of South America, and Atlantic Ocean to the African coast from the Equator to 31N. The following information is based on satellite imagery, weather observations, radar and meteorological analysis.
Atlantic Tropical Weather Discussion
757 AXNT20 KNHC 072227 TWDAT Tropical Weather Discussion NWS National Hurricane Center Miami FL 0015 UTC Sat Mar 8 2025 Tropical Weather Discussion for North America, Central America Gulf of America, Caribbean Sea, northern sections of South America, and Atlantic Ocean to the Africa coast from the Equator to 31N. The following information is based on satellite imagery, weather observations, radar and meteorological analysis.
Re: CVE-2025-1094: PostgreSQL: Quoting APIs miss neutralizing quoting syntax in text that fails encoding validation, enabling psql SQL injection
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Thu, 20 Feb 2025 18:10:39 +0100 On Sun, Feb 16, 2025 at 06:22:30PM +0000, James Addison wrote: On Sun, Feb 16, 2025 at 4:22???PM Solar Designer <solar () openwall com> wrote: As announced on February 13 in: https://www.postgresql.org/about/news/postgresql-173-167-1511-1416-and-1319-released-3015/ https://www.postgresql.org/message-id/173945575457.197393.6175786842655230205%40wrigleys.postgresql.org The PostgreSQL...
Re: CVE-2025-1094: PostgreSQL: Quoting APIs miss neutralizing quoting syntax in text that fails encoding validation, enabling psql SQL injection
oss-sec mailing list archives From: James Addison <james () reciperadar com> Date: Sun, 16 Feb 2025 18:22:30 +0000 On Sun, Feb 16, 2025 at 4:22 PM Solar Designer <solar () openwall com> wrote: Hi, As announced on February 13 in: https://www.postgresql.org/about/news/postgresql-173-167-1511-1416-and-1319-released-3015/ https://www.postgresql.org/message-id/173945575457.197393.6175786842655230205%40wrigleys.postgresql.org The PostgreSQL Global Development Group has released an update to all...
Joseph A. Schiavone
With heavy hearts, we announce the passing of our beloved husband, father, grandfather “Papa” and great-grandfather “Poppy”, Joseph A. Schiavone who passed away peacefully December 29, 2024, age 92 at Hospice of Northwest Ohio, Perrysburg. A devoted husband to Joann B.
Re: Improper Authentication (CWE-287) CVE-2024-33897
Full Disclosure mailing list archives From: Jeffrey Walton <noloader () gmail com> Date: Sun, 18 Aug 2024 03:10:41 -0400 On Sun, Aug 18, 2024 at 2:39 AM Moritz Abrell via Fulldisclosure <fulldisclosure () seclists org> wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2024-043 Product: Ewon Cosy+ / Talk2M Remote Access Solution Manufacturer: HMS Industrial Networks AB Affected Version(s): N.A. Tested Version(s): N.A. Vulnerability Type: Improper Authentication (CWE-287)...
YMCA of Sandusky Co. to open new child development center
You are here Home » YMCA of Sandusky Co. to open new child development center Published by twalro@presspub... on Sun, 07/28/2024 - 5:34am The YMCA of Sandusky County announced the opening of its second Child Development Center which will be located inside Hayes Memorial United Methodist Church at 1441 Fangboner Rd., Fremont.
GPA: Hartigan selected for Ohio Student Safety Advisory Council
Published by twalro@presspub... on Sun, 07/28/2024 - 5:33am Oak Harbor High School sophomore Hannah Hartigan has been selected for the Ohio Student Safety Advisory Council (OSSAC), an esteemed group comprising only 16 students statewide. Appointed by Ohio Gov. Mike DeWine, OSSAC focuses on school safety and student well-being.
Penta honors class of 2024; 51 seniors recognized as outstanding
You are here Home » Penta honors class of 2024; 51 seniors recognized as outstanding Published by twalro@presspub... on Sun, 07/28/2024 - 5:29am By: Penta honors class of 2024; 51 seniors recognized as outstanding The 59th senior class at Penta Career Center was honored May 14-16 during Senior Recognition ceremonies on the school campus.
Owens utilizing VR Technology for law enforcement training
You are here Home » Owens utilizing VR Technology for law enforcement training Published by twalro@presspub... on Sun, 07/28/2024 - 5:29am Law enforcement officers training at Owens Community College’s Center for Emergency Preparedness will benefit from new virtual reality (VR) goggles provided by the Ohio Attorney General’s office.
A Week After a Worldwide Windows Outage Microsoft is 'Bricking' Windows All On Its Own, Cannot Blame Others Anymore
A Week After a Worldwide Windows Outage Microsoft is 'Bricking' Windows All On Its Own, Cannot Blame Others Anymore posted by Roy Schestowitz on Jul 26, 2024, updated Jul 26, 2024 A look back at a week of lousy press coverage, Microsoft deceit, and lessons to be learned A week ago the "world stopped" (the world increasingly depends on digitalised systems to operate properly) because Windows systems had broken down.
Re: CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Mon, 8 Jul 2024 18:21:06 +0200 Hi, Today is the coordinated release date to publicly disclose a related issue I found during review of Qualys' findings, with further analysis by Qualys.
Preventing pediatric injury during 100 Deadliest Days of Summer
By: Hannah Eberlein Pediatric Injury Prevention Specialist It’s not uncommon for kids to get scrapes and bruises periodically when growing up – it’s all part of being a kid. However, there are things that parents and caregivers can do to help prevent more serious injuries that could lead to disabilities or even death.
Survey: Parents of young athletes value health benefits of sports
You are here Home » Survey: Parents of young athletes value health benefits of sports Published by twalro@presspub... on Sun, 07/07/2024 - 7:00am Positive sports experiences can be a game changer for kids, with physical, social, emotional and mental health benefits that last a lifetime, according to a survey from The Kids Mental Health Foundation.
Danberry donates $400K to ProMedica Children's Hospital
You are here Home » Danberry donates $400K to ProMedica Children's Hospital Published by twalro@presspub... on Sun, 07/07/2024 - 6:58am On June 18, Danberry Realtors presented a check for $400,000 to ProMedica's Russell J. Ebeid Children’s Hospital Foundation to support local children and families in need. The proceeds presented to the foundation came directly from the Danberry Treasure Chest Fund, the company's in-house charity, which has been providing support for local families since 1994.
July Health Briefs
Published by twalro@presspub... on Sun, 07/07/2024 - 6:57am Clinic relocating PT Services Rehabilitation Inc.’s Genoa clinic, currently located at 22020 W. SR 51, Suite A, will be relocating to 1224 West St., Room 10, in Genoa, in the Brunner Grounds Building. The clinic will officially begin seeing patients at the new location on Monday, July 22. There will be no interruptions in patient care. The new location, which is closer to downtown, will feature an accessible layout with ground-level access.
Red Cross: Be a ‘powerful force for good’ this summer
You are here Home » Red Cross: Be a ‘powerful force for good’ this summer Published by twalro@presspub... on Sun, 07/07/2024 - 6:55am As summer gets into full swing, the American Red Cross is asking donors to be a powerful force for good by giving blood or platelets. Donors are critically needed right now after a sharp decrease in donations since late spring. All blood types are needed, especially donors giving type O blood and those giving platelets.
Tips for exercising in summer heat
Published by twalro@presspub... on Sun, 07/07/2024 - 6:54am By: Cleveland Clinic News Service The temperatures are heating up and that means staying hydrated is crucial, especially when playing a sport or exercising outside. “We can lose a large amount of fluid in our body – pounds of fluid just exercising for an hour in the heat – and we have to replace that, and that’s paramount,” said Collin Kitchell, MD, family medicine physician for Cleveland Clinic Florida.
Local public entities receive Bipartisan Safer Community Grant
You are here Home » Local public entities receive Bipartisan Safer Community Grant Published by twalro@presspub... on Sun, 07/07/2024 - 6:52am The Mental Health and Recovery Services Board of Seneca, Ottawa, Sandusky, and Wyandot Counties has been awarded $80,000 to enhance existing emergency preparedness and response plans to include emphasis on behavioral health response to violence and mass shootings events.
Re: vte 0.76.3 released with fix for CVE-2024-37535
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 9 Jun 2024 23:00:19 +0200 On Sun, Jun 09, 2024 at 11:26:33AM -0700, Alan Coopersmith wrote: https://www.cve.org/CVERecord?id=CVE-2024-37535 states: GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
British Intelligence, GCHQ, Oxford & Debian conspiracy theories, Edward & Una Brocklesby fact checking
Reprinted with permission from Daniel Pocock. At 21:00 UTC on 5 June 2024, I published the first disclosure about the secret expulsion of Edward Brocklesby from Debian. A few hours later and some of the rogue elements at Debian started spreading more defamation about me. It looks like the disclosure about Debian's lack of competence for security has struck a chord and people need to look more deeply at this particular case.
Re: Linux: Disabling network namespaces
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Sun, 21 Apr 2024 22:47:12 +0200 On Sun, Apr 21, 2024 at 01:30:49PM +0100, Simon McVittie wrote: On Sat, 20 Apr 2024 at 20:12:11 +0200, Solar Designer wrote: So with my idea/proposal, someone using these tools on a desktop system would need to set the max depth to 1.
Re: Linux: Disabling network namespaces
oss-sec mailing list archives From: Simon McVittie <smcv () debian org> Date: Mon, 15 Apr 2024 16:32:02 +0100 On Sun, 14 Apr 2024 at 21:08:55 +0200, Solar Designer forwarded: Some other container runtimes such as Docker and Podman do make use of network namespaces by default.
Re: Linux: Disabling network namespaces
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Mon, 15 Apr 2024 17:13:09 +0200 On Sun, Apr 14, 2024 at 06:47:26PM -0400, Demi Marie Obenour wrote: On Sun, Apr 14, 2024 at 09:08:55PM +0200, Solar Designer wrote: Fredrik Nystrom on Rocky Linux Mattermost channel Security pointed out that it is reasonable to disable just network namespaces with user.max_net_namespaces=0 instead, and that the negative effects of doing so and how to cope with them are...
Re: Linux: Disabling network namespaces
oss-sec mailing list archives From: Demi Marie Obenour <demi () invisiblethingslab com> Date: Sun, 14 Apr 2024 18:47:26 -0400 On Sun, Apr 14, 2024 at 09:08:55PM +0200, Solar Designer wrote: Hi, Many Linux kernel vulnerabilities including the recently exploited Netfilter CVE-2024-1086 require CAP_NET_ADMIN in a namespace, yet a typically recommended mitigation is to disable user namespaces (not just network namespaces).
In Wood County: Unison program aims to help those struggling with substance use
You are here Home » In Wood County: Unison program aims to help those struggling with substance use Published by twalro@presspub... on Sun, 04/07/2024 - 7:39am Unison Health, in partnership with the Wood County Alcohol, Drug Addiction, and Mental Health Services Board (ADAMHS), has launched the Substance Use Disorder (SUD) Navigation Program, a new initiative that works one-on- one with individuals in Wood County struggling with substance use.
Mercy Health offering online tool to evaluate joint pain impact
You are here Home » Mercy Health offering online tool to evaluate joint pain impact Published by twalro@presspub... on Sun, 04/07/2024 - 7:37am For many, joint pain is a fact of life. Often these conditions create significant hurdles in the enjoyment of ever day living. In fact, studies show 90% of Americans with osteoarthritis end up suffering with joint pain for extended periods when a knee replacement could vastly improve their quality of life.
Aortic aneurysms can be detected before they cause symptoms
You are here Home » Aortic aneurysms can be detected before they cause symptoms Published by twalro@presspub... on Sun, 04/07/2024 - 7:36am By: By Brett Aplin, MD ProMedica Physicians Jobst Vascular Many people have heard of the aorta, which is the main and largest blood vessel in the human body. It carries blood away from the heart to supply blood to the brain, muscles and other cells.
Health briefs: Donations welcome to help Genoa man facing liver transplant
You are here Home » Health briefs: Donations welcome to help Genoa man facing liver transplant Published by twalro@presspub... on Sun, 04/07/2024 - 7:34am Donations are being accepted to help with medical expenses for Mark Valentine, 64, of Genoa, who has recently been added to the recipient list for a liver transplant. Valentine grew up in Genoa and graduated from Genoa High School in 1977.
How to prepare for viewing the solar eclipse
You are here Home » How to prepare for viewing the solar eclipse Published by twalro@presspub... on Sun, 04/07/2024 - 7:30am Do you have your eclipse glasses ready? As we get closer to the total solar eclipse on April 8, here’s what to look for when picking out protective glasses to view this rare event.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with On
Contact On, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack