Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Seth Arnold
Blue Men Moving on Navigating Columbus Stairs, Permits and Older Buildings
Blue Men Moving explains how Columbus stairwells, historic streets and loading permits reshape apartment, home and office moves across the metro. In Columbus the building decides the move more than the miles do.
Blue Men Moving Columbus Launches New Website to Better Serve Ohio Customers
Columbus moving company Blue Men Moving unveils a redesigned website built to reflect their devoted local team and commitment to Columbus, OH and nearby areas. COLUMBUS, OH, UNITED STATES, June 3, 2026 / EINPresswire.com/ -- Blue Men Moving Columbus, a trusted Columbus moving company serving the greater Columbus, Ohio area, is proud to announce the launch of its fully redesigned website at bluemenmovingcolumbus.com.
CVE-2025-13350 for Ubuntu Linux kernel
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 5 Mar 2026 19:03:36 +0000 Hello, today the Ubuntu Security Team published CVE-2025-13350 for the Ubuntu packaging of the Linux kernel. The issue comes from an incorrectly backported patch that caused us to mix an old-style with a new-style garbage collector for Unix Domain Sockets. Upstream kernels weren't affected because they did not cherry-pick pieces of the transition.
Re: linux-distros list policy and Linux kernel, again
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Sat, 26 Aug 2023 02:31:29 +0000 On Sat, Aug 26, 2023 at 12:23:59AM +0200, Solar Designer wrote: I'd appreciate any well-reasoned votes and constructive suggestions. Maybe there are good ideas that didn't cross my mind yet. I think we'd all be better served to wait until next year before we try to make changes. Some additional space would probably do everyone some good.
Re: CVE-2023-40272: Apache Airflow Spark Provider Arbitrary File Read via JDBC
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Fri, 18 Aug 2023 00:20:43 +0000 On Thu, Aug 17, 2023 at 01:07:16PM +0000, Elad Kalif wrote: https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-40272 hello Elad, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-3772: Linux kernel: xfrm_update_ae_params NULL pointer dereference
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 10 Aug 2023 18:09:37 +0000 On Thu, Aug 10, 2023 at 10:13:54AM +0800, Lin Ma wrote: Hello there, we found a NPD bug in Linux kernel XFRM submodule.
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Wed, 19 Apr 2023 01:29:30 +0000 On Tue, Apr 18, 2023 at 11:15:52AM +0200, Jacques Le Roux wrote: Hello Jacques, thanks for the reply.
Re: CVE-2022-45064: Apache Sling Engine: Include-based XSS
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:28:33 +0000 On Wed, Apr 12, 2023 at 03:39:15PM +0000, Angela Schreiber wrote: Hello Angela, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-25504: Apache Superset: Possible SSRF on import datasets
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:29:42 +0000 On Mon, Apr 17, 2023 at 09:57:11AM +0000, Daniel Gaspar wrote: Hello Daniel, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-26269: Apache James server: Privilege escalation through unauthenticated JMX
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:26:15 +0000 On Fri, Mar 31, 2023 at 05:28:03AM +0000, Benoit Tellier wrote: Hello Benoit, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:26:59 +0000 On Mon, Apr 10, 2023 at 06:14:37AM +0000, Heping Wang wrote: Hello Heping, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:27:52 +0000 On Mon, Apr 10, 2023 at 09:21:11AM +0000, Jacques Le Roux wrote: Hello Jacques, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-30771: Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:29:10 +0000 On Sun, Apr 16, 2023 at 02:48:14AM +0000, Jialin Qiao wrote: Hello Jialin, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-28158: Apache Archiva privilege escalation
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 18 Apr 2023 01:25:13 +0000 On Wed, Mar 29, 2023 at 11:29:40AM +0000, Olivier Lamy wrote: Hello Olivier, thanks for contacting the oss-security mail list about this security issue in an Apache project.
Re: CVE-2023-28464: Linux: Bluetooth: hci_conn_cleanup function has double free
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 28 Mar 2023 20:22:30 +0000 On Tue, Mar 28, 2023 at 04:00:22PM +0200, Solar Designer wrote: I've not seen K_F online in any capacity in years. It is time to ask if we should remove him from the list, beyond just the assignment of this task. (If you're around Kristian, and we're just in different circles these days, hello.
snap-confine must_mkdir_and_open_with_perms() Race Condition
snap-confine must_mkdir_and_open_with_perms() Race Condition Authored by Qualys Security Advisory Qualys discovered a race condition (CVE-2022-3328) in snap-confine, a SUID-root program installed by default on Ubuntu.
Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)
Full Disclosure mailing list archives From: Qualys Security Advisory via Fulldisclosure <fulldisclosure () seclists org> Date: Wed, 30 Nov 2022 23:32:12 +0000 Qualys Security Advisory Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) ======================================================================== Contents ======================================================================== Summary Background Exploitation Acknowledgments Timeline I can't help but...
Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328)
oss-sec mailing list archives From: Qualys Security Advisory <qsa () qualys com> Date: Wed, 30 Nov 2022 23:28:27 +0000 Qualys Security Advisory Race condition in snap-confine's must_mkdir_and_open_with_perms() (CVE-2022-3328) ======================================================================== Contents ======================================================================== Summary Background Exploitation Acknowledgments Timeline I can't help but feel a missed opportunity to integrate...
Re: sagemath denial of service with abort() in gmp: overflow in mpz type
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Wed, 7 Sep 2022 01:30:17 +0000 On Tue, Sep 06, 2022 at 08:45:28AM -0400, Jeffrey Walton wrote: Could an application that handles secrets and uses GMP use prctl(2)'s PR_SET_DUMPABLE command to prevent dumping the core file? It'd also prevent using ptrace-based debugging, so it's not without costs, but if it handles secrets, that's probably also a good idea.
Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons
oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Fri, 2 Sep 2022 20:43:01 +0000 On Fri, Sep 02, 2022 at 03:55:07AM +0000, Jedidiah Cunningham wrote: Hello Jedidiah, Thanks for contributing to the oss-security list; I believe your contributions would be far more valuable if they included some further details -- providing links to issues and commits is common, but you could also include the details in the email if that's easier for whatever reason.
Re: snowflakedb security contacts
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Mon, 25 Jul 2022 22:27:31 +0000 On Sun, Jul 24, 2022 at 11:10:35AM -0700, Roxana Bradescu wrote: Hello Roxana, thank you, yes, I did hear from Snowflake, perhaps via the efforts of list readers who helped make connections.
snowflakedb security contacts
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 19 Jul 2022 00:18:48 +0000 Hello, if anyone has friends or acquaintances at snowflakedb, please direct their attention to: https://github.com/snowflakedb/gosnowflake/issues/619 "Please add a SECURITY.md file and security policy" I don't know if what I found is actually an issue but I'd like to give them a chance to see...
Re: linux-distros list policy and Linux kernel
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 17 May 2022 03:30:33 +0000 On Mon, May 16, 2022 at 03:12:20PM +0200, Jason A. Donenfeld wrote: I have seen some kernel developers say that the "security bugs" that get attention are no different from dozens of other bugfixes that are committed to the kernel every cycle.
Re: CVE-2022-21449 and version reporting
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 28 Apr 2022 20:10:03 +0000 On Thu, Apr 28, 2022 at 02:12:04PM +0000, Seaman, Chad wrote: A large part of software maintenance is managing technical debt -- and being able to walk away from no-longer-supported products is an important part of that.
[morningman () 163 com: [oss-security] CVE-2022-23942: Apache Doris(incubating) hardcoded cryptography initialization]
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 26 Apr 2022 23:18:25 +0000 Hello, the Apache Doris project recently switched away from using hard-coded credentials; they apaprently copy-and-pasted code from the Kylin project: https://www.openwall.com/lists/oss-security/2022/04/26/2 https://github.com/apache/incubator-doris/pull/7862/files...
Re: SpringShell and recent OpenJDK updates
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Seth Arnold <seth.arnold () canonical com> Date: Wed, 30 Mar 2022 20:11:36 +0000 On Wed, Mar 30, 2022 at 02:31:41PM -0400, Jeffrey Walton wrote: I saw Ubuntu patched OpenJDK 11 recently. [1] Was that due to SpringShell? [2] Or stepping back a bit, did the SpringShell folks work with distros? Or did they really drop a 0-day?
Re: Trojan Source Attacks
oss-sec mailing list archives Re: Trojan Source Attacks From: Seth Arnold Date: Tue, 2 Nov 2021 23:25:54 +0000 On Tue, Nov 02, 2021 at 04:43:48PM -0400, Stuart D Gathman wrote: Having some sample source files to test your code editor/viewer on would be helpful.
oss-sec: Re: Bugs found by Cryptofuzz
oss-sec mailing list archives By Date By Thread Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 8 Dec 2020 22:35:58 +0000 On Tue, Dec 08, 2020 at 05:18:04PM -0500, Robert Watson wrote: Question from a retired programmer but security novice... Since fuzzing is used to find bugs in other programs, doesn't it need to be held to a bit higher standard in order to maintain credibility?
Buffer Overflow in raptor widely unfixed in Linux distros
oss-sec mailing list archives Re: Buffer Overflow in raptor widely unfixed in Linux distros From: Seth Arnold Date: Mon, 16 Nov 2020 23:11:42 +0000 On Mon, Nov 16, 2020 at 08:06:15PM +0100, Marius Bakke wrote: I tried following the CVE assignment RSS feed initially, but it was not suitable for human consumption.
/home/loser is with permissions 755, default umask 0022
oss-sec mailing list archives By Date By Thread Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 8 Oct 2020 21:02:13 +0000 On Thu, Oct 08, 2020 at 08:29:39AM -0500, Bob Friesenhahn wrote: It seems that the issue we encountered is due to 'USERGROUPS_ENAB yes' in /etc/login.defs. I am not sure if this is specific to Ubuntu.
/home/loser is with permissions 755, default umask 0022
oss-sec mailing list archives By Date By Thread Re: Debian FEATURE: /home/loser is with permissions 755, default umask 0022 From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 8 Oct 2020 00:30:01 +0000 On Wed, Oct 07, 2020 at 04:09:59PM -0500, Bob Friesenhahn wrote: Ubuntu Linux (a Debian derivative) has changed the default. However, we found that the Ubuntu default caused problems for us while building our software, and so we changed them back.
oss-sec: [cve-request () mitre org: Re: [scr966354] oniguruma regular expression library
oss-sec mailing list archives By Date By Thread [cve-request () mitre org: Re: [scr966354] oniguruma regular expression library - fixed in devel version cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0] From: Seth Arnold <seth.arnold () canonical com> Date: Wed, 30 Sep 2020 19:42:34 +0000 Hello, Eduardo Barretto discovered a one-byte buffer overflow in the oniguruma regular expression library while doing a coverity scan.
Re: Contributing Back
oss-sec mailing list archives Re: Contributing Back From: Seth Arnold Date: Fri, 4 Sep 2020 02:27:19 +0000 On Thu, Sep 03, 2020 at 06:14:27PM +0200, Solar Designer wrote: I primarily want to publicly acknowledge and thank Seth Arnold of Ubuntu, Anthony Liguori of Amazon Linux, and Srivatsa S.
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow
oss-sec mailing list archives Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow From: Seth Arnold Date: Mon, 10 Aug 2020 22:29:35 +0000 On Sat, Aug 08, 2020 at 07:21:35AM -0500, Daniel Ruggeri wrote: You're correct. That was an error on our part.
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow
oss-sec mailing list archives By Date By Thread Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow From: Seth Arnold <seth.arnold () canonical com> Date: Sat, 8 Aug 2020 01:20:29 +0000 On Fri, Aug 07, 2020 at 06:31:38AM -0500, Daniel Ruggeri wrote: CVE-2020-11984: mod_uwsgi buffer overlow Versions Affected: httpd 2.4.32 to 2.4.44 Description: Apache HTTP Server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE References:...
oss-sec: [cve-request () mitre org: Re: [scr916814] net-snmp
oss-sec mailing list archives By Date By Thread [cve-request () mitre org: Re: [scr916814] net-snmp - Perhaps only unreleased development versions; fix appears to be in v5.8.1.pre1] From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 25 Jun 2020 19:06:21 +0000 Hello, I'd lke to share a cve assigned to net-snmp for an issue that may not have affected any released versions of net-snmp but affected various distro versions of net-snmp.
Re: Deficient engineering processes
oss-sec mailing list archives By Date By Thread Re: Deficient engineering processes From: Seth Arnold <seth.arnold () canonical com> Date: Thu, 2 Apr 2020 02:46:11 +0000 On Wed, Apr 01, 2020 at 07:42:38PM -0400, Jeffrey Walton wrote: My question is, how to convince someone that following standard project management procedures is a good thing?
Re: Contributing Back
oss-sec mailing list archives By Date By Thread Re: Contributing Back From: Seth Arnold <seth.arnold () canonical com> Date: Tue, 5 Nov 2019 22:43:11 +0000 On Tue, Nov 05, 2019 at 07:42:28PM +0100, Solar Designer wrote: I am not seeing this "inform the list either way" stuff actually happening. Without it, no other distro has a way to know the work is I'm sorry. I will endeavour to do better on this in the future.
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
oss-sec mailing list archives By Date By Thread Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz From: Seth Arnold <seth.arnold () canonical com> Date: Mon, 24 Jun 2019 17:53:41 -0700 On Mon, Jun 24, 2019 at 07:15:20PM -0400, Alex Gaynor wrote: sounds very hard to me, at least without requiring more user involvement than ASAN requires right now. This seems like a very cool area for academic research though! Have you tried the gdb exploitable plugin yet?
Privilege escalation by taking control of the KVM hypervisor
oss-sec mailing list archives Re: arm64 Linux kernel: Privilege escalation by taking control of the KVM hypervisor From: Seth Arnold <seth.arnold () canonical com> Date: Wed, 3 Oct 2018 13:21:40 -0700 On Wed, Oct 03, 2018 at 08:57:05AM +0200, Florian Weimer wrote: On Tue, Oct 02, 2018 at 05:07:14PM +0100, Will Deacon wrote: There has not yet been a CVE requested for this (mainly because I don't know how to do it). Please use https://cveform.mitre.org/ thanks. Would DFW work as well?
allows complete machine takeover for Microsoft
From: Seth Arnold Date: Fri, 28 Sep 2018 11:18:25 -0700 On Tue, Sep 25, 2018 at 07:04:18PM +0200, Enrico Weigelt, metux IT consult wrote: Operator's workaround: [..] c) use apt pinning to restrict the Microsoft repo to only the package 'skypeforlinux' Please note that the Debian package pre/post inst/rm scripts run with full root privileges without any constraints on what they can do.
CVE for PyYAML RCE-factory API
Re: CVE for PyYAML RCE-factory API Seth Arnold (Jun 26)
Intel hyper-threading security issues
oss-sec mailing list archives Re: Intel hyper-threading security issues From: Seth Arnold <seth.arnold () canonical com> Date: Fri, 22 Jun 2018 12:26:07 -0700 On Fri, Jun 22, 2018 at 02:08:03PM +1000, Michael Ellerman wrote: See the script below for example, which shows CPUs grouped by core.
Re: Updated distros statistics
Re: Updated distros statistics Seth Arnold (Apr 12)
oss-sec: [cve-request () mitre org: Re: [scr479280] sqlite3
[cve-request () mitre org: Re: [scr479280] sqlite3 - all; fix is in source control but not yet released] From: Seth Arnold Date: Fri, 16 Mar 2018 17:41:50 -0700 Hello, our friends at MITRE have assigned CVE-2018-8740 to an issue in SQLite3 that was discovered by OSS-Fuzz working on GDAL. Thanks to Even Rouault for passing along the issue and D. Richard Hipp for the fix.
Security risk of vim swap files
oss-sec mailing list archives Re: Fw: Security risk of vim swap files From: Seth Arnold <seth.arnold () canonical com> Date: Mon, 6 Nov 2017 15:09:20 -0800 On Sun, Nov 05, 2017 at 07:03:07PM -0700, Kurt Seifried wrote: Also you're all still ignoring umask =(. Please, when you create a new file, check the umask and subtract it to make sure you're abiding by the user's wishes. Is it not the kernel's responsibility to enforce umask(2) is properly applied?
Unsafe symlinks not filtered in Debian mirror script ftpsync
I'm not sure what 'script' vs 'not-script' has to do with anything. 'Script' really just means "interpreted programming language" and says nothing about the threat model in use. This ftpsync script and similar scripts are the primary tool for mirroring Debian, Ubuntu, and other derived Linux distributions, to the mirror networks that support many millions of computers.
Unsafe symlinks not filtered in Debian mirror script ftpsync
Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync
fixed bug in net/core/flow_dissector.c
From: Seth Arnold Date: Thu, 24 Aug 2017 11:03:14 -0700 I was asked to investigate a suspicious kernel crash on some Linux server. It is at least a remote DoS (and maybe RCE): Linux is crashed by receiving a single special MPLS packet. I bisected and found out that the bug was introduced in commit b3baa0fbd02a1a9d493d8cb92ae4a4491b9e9d13 And was later fixed it in commit a6e544b0a88b53114bfa5a57e21b7be7a8dfc9d0 Is it worth requesting a CVE ID for that issue?
Command injection vulnerability in CBT handler
Re: CVE-2017-1000083: evince: Command injection vulnerability in CBT handler
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Seth
Contact Seth, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack