oss-security mailing list - 2010/08

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2010/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 3
² 17	³ 8	⁴ 2	⁵	⁶ 5	⁷	⁸
⁹ 8	¹⁰ 4	¹¹ 6	¹² 5	¹³ 2	¹⁴ 4	¹⁵
¹⁶ 4	¹⁷ 2	¹⁸ 3	¹⁹ 8	²⁰ 15	²¹	²²
²³ 3	²⁴ 7	²⁵ 10	²⁶ 5	²⁷ 1	²⁸ 1	²⁹ 4
³⁰ 9	³¹ 8

Messages by day:

August 1 (3 messages)

CVE Request -- OpenConnect < v2.25 did not verify SSL server certificates (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: cmsmadesimple < 1.8.1 (Hanno Böck <hanno@...eck.de>)
CVE request: joomla < 1.5.20 (Hanno Böck <hanno@...eck.de>)

August 2 (17 messages)

CVE request: kernel: gfs2: rename cases kernel panic (Eugene Teo <eugene@...hat.com>)
CVE-2010-2524 kernel: dns_resolver upcall security issue (Eugene Teo <eugeneteo@...nel.sg>)
CVE Request -- Socat -- Stack overflow by lexical scanning of nested character patterns (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around (cra… (Jan Lieskovsky <jlieskov@...hat.com>)
RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs (Thomas Biege <thomas@...e.de>)
Re: CVE-2008-id Request -- ssmtp -- standardise() -- Buffer overflow ("Steven M. Christey" <coley@...us.mitre.org>)
Re: CVE Request -- OpenConnect < v2.25 did not verify SSL server certificates (Josh Bressers <bressers@...hat.com>)
Re: CVE request: cmsmadesimple < 1.8.1 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: joomla < 1.5.20 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: gfs2: rename cases kernel panic (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- Socat -- Stack overflow by lexical scanning of nested character patterns (Josh Bressers <bressers@...hat.com>)
Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around … (Josh Bressers <bressers@...hat.com>)
Re: CVE-2010-2524 kernel: dns_resolver upcall security issue (akuster <akuster@...sta.com>)
Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-aro… (Dan Rosenberg <dan.j.rosenberg@...il.co…)
Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around… (Josh Bressers <bressers@...hat.com>)
CVE request: Attachment XSS in mantis < 1.2.2 (Hanno Böck <hanno@...eck.de>)
CVE 2009 request: twiki before 4.3.2 CSRF (Hanno Böck <hanno@...eck.de>)

August 3 (8 messages)

kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Eugene Teo <eugeneteo@...nel.sg>)
Re: CVE-2010-2524 kernel: dns_resolver upcall security issue (Eugene Teo <eugeneteo@...nel.sg>)
Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Moritz Muehlenhoff <jmm@...til.org>)
CVE request - kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Eugene Teo <eugene@...hat.com>)
2 vulnerabilties in phpCAS (Joachim Fritschi <fritschi@....tu-darmstadt.de>)
Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Josh Bressers <bressers@...hat.com>)
Re: CVE request: Attachment XSS in mantis < 1.2.2 (Josh Bressers <bressers@...hat.com>)
Re: CVE 2009 request: twiki before 4.3.2 CSRF (Josh Bressers <bressers@...hat.com>)

August 4 (2 messages)

Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-aro… ("Steven M. Christey" <coley@...us.mitre…)
Re: CVE-2010-2791: mod_proxy information leak affecting 2.2.9 only ("Steven M. Christey" <coley@...us.mitre.org>)

August 6 (5 messages)

CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: uzbl before 2010.08.05: User-assisted execution of arbitrary commands caused by faulty default config (Alex Legler <a3li@...too.org>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Josh Bressers <bressers@...hat.com>)
Re: CVE request: uzbl before 2010.08.05: User-assisted execution of arbitrary commands caused by faulty default config (Josh Bressers <bressers@...hat.com>)

August 9 (8 messages)

CVE request: Lynx (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Braden Thomas <bthomas@...le.com>)
Re: CVE request: Lynx (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Werner LEMBERG <wl@....org>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Robert Święcki <robert@...ecki.net>)
CVE Request - ZNC (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request - ZNC (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Werner LEMBERG <wl@....org>)

August 10 (4 messages)

Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Hui Zhu <hui.zhu@...driver.com>)
CVE ID Request For 2Wire Broadband Router Session Hijacking Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE ID Request For 2Wire Broadband Router Session Hijacking Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: Re: CVE Request - ZNC (Josh Bressers <bressers@...hat.com>)

August 11 (6 messages)

CVE Request -- OpenOffice.org [two ids]: 1, integer truncation error 2, short integer overflow (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: openssl double free (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE request: VideoLAN advisory 1004 ("Rémi Denis-Courmont" <rem@...eolan.org>)
Re: CVE Request -- OpenOffice.org [two ids]: 1, integer truncation error 2, short integer overflow (Josh Bressers <bressers@...hat.com>)
Re: CVE request: VideoLAN advisory 1004 (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: openssl double free (Solar Designer <solar@...nwall.com>)

August 12 (5 messages)

opera 10.61 fixes 3 security bugs (Thomas Biege <thomas@...e.de>)
Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more (Robert Święcki <robert@...ecki.net>)
Re: opera 10.61 fixes 3 security bugs ("Carsten H. Eiram" <che@...unia.com>)
Re: CVE Request: openssl double free (Josh Bressers <bressers@...hat.com>)
Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs (Josh Bressers <bressers@...hat.com>)

August 13 (2 messages)

Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs (Thomas Biege <thomas@...e.de>)
Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs (Henrik Nordström <henrik@...riknordstrom.net>)

August 14 (4 messages)

Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (dann frazier <dannf@...ian.org>)
Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Eugene Teo <eugene@...hat.com>)
Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Ben Hutchings <ben@...adent.org.uk>)
Re: kernel: [PARISC] led.c - fix potential stack overflow in led_proc_write() (Eugene Teo <eugene@...hat.com>)

August 16 (4 messages)

CVE request - kernel: integer overflow in ext4_ext_get_blocks() (Eugene Teo <eugeneteo@...nel.sg>)
Minor security flaw with pam_xauth (Tim Brown <timb@...-dimension.org.uk>)
Re: CVE request - kernel: integer overflow in ext4_ext_get_blocks() ("Steven M. Christey" <coley@...us.mitre.org>)
Re: Minor security flaw with pam_xauth ("Steven M. Christey" <coley@...us.mitre.org>)

August 17 (2 messages)

Re: CVE request - kernel: integer overflow in ext4_ext_get_blocks() (Eugene Teo <eugene@...hat.com>)
Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability (Solar Designer <solar@...nwall.com>)

August 18 (3 messages)

CVE request - kernel: net sched memleak (Eugene Teo <eugene@...hat.com>)
CVE request - kernel: xfs: stale data exposure (Eugene Teo <eugene@...hat.com>)
CVE request: zope-ldapuser (Sébastien Delafond <seb@...ian.org>)

August 19 (8 messages)

Re: CVE request: PHP MOPS-2010-56..60 (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: PHP MOPS-2010-56..60 ("pierre.php@...il.com" <pierre.php@...il.com>)
Re: CVE request - kernel: net sched memleak (Josh Bressers <bressers@...hat.com>)
Re: CVE request - kernel: xfs: stale data exposure (Josh Bressers <bressers@...hat.com>)
Re: CVE-2008-id Request -- ssmtp -- standardise() -- Buffer overflow ("Steven M. Christey" <coley@...us.mitre.org>)
Re: CVE request: zope-ldapuser (Josh Bressers <bressers@...hat.com>)
CVE Request: SLiM insecure PATH assignment (Niels Heinen <niels@...eBSD.org>)

August 20 (15 messages)

CVE request - kernel: jfs: don't allow os2 xattr namespace overlap with others (Eugene Teo <eugeneteo@...nel.sg>)
CVE-2010-2959 kernel: can: add limit for nframes and clean up signed/unsigned variables (Eugene Teo <eugeneteo@...nel.sg>)
Re: CVE request: PHP MOPS-2010-56..60 (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Pierre Joye <pierre.php@...il.com>)
CVE Request: heap-based buffer overflow in libHX (Thomas Biege <thomas@...e.de>)
Re: CVE request: PHP MOPS-2010-56..60 (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: PHP MOPS-2010-56..60 ("Steven M. Christey" <coley@...us.mitre.org>)
Re: CVE Request: SLiM insecure PATH assignment (Josh Bressers <bressers@...hat.com>)
Re: CVE request - kernel: jfs: don't allow os2 xattr namespace overlap with others (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: heap-based buffer overflow in libHX (Josh Bressers <bressers@...hat.com>)
Re: CVE request: lxr ("Steven M. Christey" <coley@...us.mitre.org>)
Re: Qt SSL endless loop ("Steven M. Christey" <coley@...us.mitre.org>)
Re: Qt SSL endless loop (Vincent Danen <vdanen@...hat.com>)

August 23 (3 messages)

Re: CVE request: PHP MOPS-2010-56..60 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: PHP MOPS-2010-56..60 (Pierre Joye <pierre.php@...il.com>)

August 24 (7 messages)

Re: CVE request: PHP MOPS-2010-56..60 (Thomas Biege <thomas@...e.de>)
Re: CVE request: PHP MOPS-2010-56..60 (Pierre Joye <pierre.php@...il.com>)
CVE Request -- Quagga (bgpd) [two ids] -- 1, Stack buffer overflow by processing crafted Refresh-Route msgs 2, NULL ptr de… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: PHP MOPS-2010-56..60 ("Steven M. Christey" <coley@...us.mitre.org>)
CVE Request -- Squid v3.1.6 -- DoS (crash) while processing large DNS replies with no IPv6 resolver present (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Squid v3.1.6 -- DoS (crash) while processing large DNS replies with no IPv6 resolver present (Stephen Thorne <stephen@...rne.id.au>)

August 25 (10 messages)

Re: CVE request: ghostscript and gv (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request -- Squid v3.1.6 -- DoS (crash) while processing large DNS replies with no IPv6 resolver present (Amos Jeffries <squid3@...enet.co.nz>)
Re: CVE request: ghostscript and gv (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE Request -- Quagga (bgpd) [two ids] -- 1, Stack buffer overflow by processing crafted Refresh-Route msgs 2, NULL ptr… (Josh Bressers <bressers@...hat.com>)
Re: CVE request: PHP MOPS-2010-56..60 (Josh Bressers <bressers@...hat.com>)
Re: Re: CVE Request -- Squid v3.1.6 -- DoS (crash) while processing large DNS replies with no IPv6 resolver present (Josh Bressers <bressers@...hat.com>)
CVE request: CouchDB insecure library loading (Debian/Ubuntu only) (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE id request: libc fortify source information disclosure (Nico Golde <oss-security+ml@...lde.de>)
CVE request: VLC media player - DLL preloading vulnerability (Geoffroy Couprie <geal@...eolan.org>)
Re: CVE request: VLC media player - DLL preloading vulnerability ("Steven M. Christey" <coley@...us.mitre.org>)

August 26 (5 messages)

Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only) (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: VLC media player - DLL preloading vulnerability (Geoffroy Couprie <geal@...eolan.org>)
Re: CVE request: ghostscript and gv (Tomas Hoger <thoger@...hat.com>)
[HITB-Announce] HITB2010 SIGNINT Sessions (Hafez Kamal <aphesz@...kinthebox.org>)
Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only) (Josh Bressers <bressers@...hat.com>)

August 27 (1 message)

[PATCH] exec argument expansion can inappropriately trigger OOM-killer (Kees Cook <kees.cook@...onical.com>)

August 28 (1 message)

CVE Request: BGP protocol vulnerability (Florian Weimer <fw@...eb.enyo.de>)

August 29 (4 messages)

Re: CVE Request: BGP protocol vulnerability (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request: BGP protocol vulnerability (Florian Weimer <fw@...eb.enyo.de>)
CVE request: serendipity < 1.5.4 xss (Hanno Böck <hanno@...eck.de>)
Hardening the linker (was Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only)) (Tim Brown <timb@...-dimension.org.uk>)

August 30 (9 messages)

Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Roland McGrath <roland@...hat.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Solar Designer <solar@...nwall.com>)
Re: CVE Request: BGP protocol vulnerability (Josh Bressers <bressers@...hat.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Roland McGrath <roland@...hat.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Solar Designer <solar@...nwall.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Solar Designer <solar@...nwall.com>)
CVE Request -- MySQL v5.1.49 -- multiple DoS flaws (Jan Lieskovsky <jlieskov@...hat.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Brad Spengler <spender@...ecurity.net>)

August 31 (8 messages)

CVE-2010-2955 kernel: wireless: fix 64K kernel heap content leak via ioctl (Eugene Teo <eugene@...hat.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Roland McGrath <roland@...hat.com>)
Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer (Solar Designer <solar@...nwall.com>)
Re: [PATCH] exec argument expansion can inappropriately triggerOOM-killer (Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>)
Re: CVE request: serendipity < 1.5.4 xss (Josh Bressers <bressers@...hat.com>)
Re: CVE id request: libc fortify source information disclosure (Josh Bressers <bressers@...hat.com>)
Re: CVE id request: libc fortify source information disclosure ("Steven M. Christey" <coley@...us.mitre.org>)
Re: CVE Request: BGP protocol vulnerability ("Steven M. Christey" <coley@...us.mitre.org>)

144 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.