oss-security mailing list - 2011/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 4	² 3	³ 5	⁴ 2	⁵ 2	⁶
⁷ 1	⁸ 7	⁹ 14	¹⁰ 1	¹¹	¹²	¹³
¹⁴ 2	¹⁵ 1	¹⁶ 14	¹⁷ 7	¹⁸ 4	¹⁹ 1	²⁰
²¹ 5	²² 17	²³ 28	²⁴ 18	²⁵ 14	²⁶ 3	²⁷
²⁸ 16

Messages by day:

February 1 (4 messages)

CVE Request: Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: possible flaw in widely used strtod.c implementation (Pierre Joye <pierre.php@...il.com>)
CVE request: glibc CVE-2010-3847 fix regression (Tomas Hoger <thoger@...hat.com>)
CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1 (Reed Loden <reed@...dloden.com>)

February 2 (3 messages)

Re: CVE request: xpdf (Michael Gilbert <michael.s.gilbert@...il.com>)
CVE request: fuse (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request for phpMyAdmin 3.4.x, 3.4.0 beta 2 <= Stored Cross Site Scripting (XSS) Vulnerability ("Steven M. Christey" <coley@...-smtp.mitre.org>)

February 3 (5 messages)

Re: CVE Request: Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE request: glibc CVE-2010-3847 fix regression (Josh Bressers <bressers@...hat.com>)
Re: CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: fuse (Josh Bressers <bressers@...hat.com>)
Re: CVE request: fuse (Marc Deslauriers <marc.deslauriers@...onical.com>)

February 4 (2 messages)

Wireshark: Freeing uninitialized pointer (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: [vendor-sec] OpenSSH security advisory: legacy certificate signing in 5.6/5.7 (Josh Bressers <bressers@...hat.com>)

February 5 (2 messages)

Webkit Roundup (Michael Gilbert <michael.s.gilbert@...il.com>)
Webkit Dupes (Michael Gilbert <michael.s.gilbert@...il.com>)

February 7 (1 message)

CVE request: phpbb before 3.0.8 (Hanno Böck <hanno@...eck.de>)

February 8 (7 messages)

Re: CVE request: xpdf (Thomas Biege <thomas@...e.de>)
Re: CVE request: xpdf (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: xpdf (Thomas Biege <thomas@...e.de>)
Re: CVE request: fuse (Josh Bressers <bressers@...hat.com>)
Re: CVE request: phpbb before 3.0.8 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: phpbb before 3.0.8 (Hanno Böck <hanno@...eck.de>)
CVE request: wordpress before 3.0.5 (Hanno Böck <hanno@...eck.de>)

February 9 (14 messages)

CVE request for feh (Stefan Behte <craig@...too.org>)
CVE request: kernel: btrfs heap overflow (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request: kernel: btrfs heap overflow (Eugene Teo <eugene@...hat.com>)
Re: CVE assignments for Wireshark (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: btrfs heap overflow (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Django multiple flaws (CVEs inside) (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: btrfs heap overflow (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: btrfs heap overflow (Eugene Teo <eugene@...hat.com>)
[HITB-Announce] HITB Magazine Issue 005 Released (Hafez Kamal <aphesz@...kinthebox.org>)
Re: CVE request: kernel: btrfs heap overflow (Stéphane Gaudreault <stephane@...hlinux.org>)
Re: CVE request: kernel: btrfs heap overflow (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: kernel: btrfs heap overflow (Greg KH <greg@...ah.com>)
Re: CVE request: wordpress before 3.0.5 (Josh Bressers <bressers@...hat.com>)
Re: CVE request for feh (Josh Bressers <bressers@...hat.com>)

February 10 (1 message)

Re: CVE request: kernel: btrfs heap overflow ("Steven M. Christey" <coley@...-smtp.mitre.org>)

February 14 (2 messages)

PHP Exif 64bit Casting Vulnerability, CVE request (Pierre Joye <pierre.php@...il.com>)
CVE request: aircrack-ng (Marc Deslauriers <marc.deslauriers@...onical.com>)

February 15 (1 message)

Re: CVE request: aircrack-ng (Nico Golde <oss-security+ml@...lde.de>)

February 16 (14 messages)

CVE request - kernel: bridge br_multicast NULL pointer dereference (Eugene Teo <eugene@...hat.com>)
Re: PHP Exif 64bit Casting Vulnerability, CVE request (Pierre Joye <pierre.php@...il.com>)
CVE request - kernel: s390 task_show_regs infoleak (Eugene Teo <eugene@...hat.com>)
CVE request - kernel: xfs infoleak (Eugene Teo <eugene@...hat.com>)
kernel: ALSA: caiaq - Fix possible string-buffer overflow (Eugene Teo <eugene@...hat.com>)
Re: Re: PHP Exif 64bit Casting Vulnerability, CVE request (Pierre Joye <pierre.php@...il.com>)
Re: Re: PHP Exif 64bit Casting Vulnerability, CVE request (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request - kernel: bridge br_multicast NULL pointer dereference (Josh Bressers <bressers@...hat.com>)
Re: CVE request - kernel: s390 task_show_regs infoleak (Josh Bressers <bressers@...hat.com>)
Re: CVE request - kernel: xfs infoleak (Josh Bressers <bressers@...hat.com>)
Re: kernel: ALSA: caiaq - Fix possible string-buffer overflow (Josh Bressers <bressers@...hat.com>)
Re: kernel: ALSA: caiaq - Fix possible string-buffer overflow (Eugene Teo <eugene@...hat.com>)
wireshark dct3trace buffer overflow (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request - kernel: bridge br_multicast NULL pointer dereference (Moritz Muehlenhoff <jmm@...ian.org>)

February 17 (7 messages)

CVE request -- kernel: deficiency in processing igmp host membership reports in br_multicast (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- kernel: deficiency in processing igmp host membership reports in br_multicast (Eugene Teo <eugene@...hat.com>)
CVE request - kernel: thp: prevent hugepages during args/env copying into the user stack (Eugene Teo <eugene@...hat.com>)
CVE id request: telepathy-gabble (Nico Golde <oss-security+ml@...lde.de>)
Re: Webkit Dupes ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE request - kernel: thp: prevent hugepages during args/env copying into the user stack (Josh Bressers <bressers@...hat.com>)
Re: CVE id request: telepathy-gabble (Josh Bressers <bressers@...hat.com>)

February 18 (4 messages)

CVE request: avahi daemon remote denial of service by sending NULL UDP (Thomas Biege <thomas@...e.de>)
Re: CVE request: patch directory traversal flaw (Vasiliy Kulikov <segoon@...nwall.com>)
Re: Webkit Dupes (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: CVE request: avahi daemon remote denial of service by sending NULL UDP (Josh Bressers <bressers@...hat.com>)

February 19 (1 message)

Re: CVE request: More Evince overflows (Raphael Geissert <geissert@...ian.org>)

February 21 (5 messages)

clamav 0.97 (Hanno Böck <hanno@...eck.de>)
CVE request: ruby: FileUtils is vulnerable to symlink race attacks + Exception methods can bypass $SAFE (Thomas Biege <thomas@...e.de>)
CVE requests: freebsd kernel/tesseract/xinha/proftpd (Moritz Muehlenhoff <jmm@...ian.org>)
Re: clamav 0.97 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: ruby: FileUtils is vulnerable to symlink race attacks + Exception methods can bypass $SAFE (Josh Bressers <bressers@...hat.com>)

February 22 (17 messages)

CVE-2011-0436: dtc sends password of new users to site admin by unencrypted email (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: kernel: btrfs heap overflow (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: fs/partitions: validate map_count in mac partition tables (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: a collection of world-writable debugfs bugs (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Josh Bressers <bressers@...hat.com>)
CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries inform… (Jan Lieskovsky <jlieskov@...hat.com>)
gdm PostLogin script executes scripts as user gdm (Thomas Biege <thomas@...e.de>)
CVE Request: Vanilla Forums 2.0.17.1 ~ 2.0.17.5 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE request: avahi daemon remote denial of service by sending NULL UDP ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE request: kernel: fs/partitions: validate map_count in mac partition tables (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: fs/partitions: validate map_count in mac partition tables (Greg KH <greg@...ah.com>)
Re: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries in… (Josh Bressers <bressers@...hat.com>)
Re: gdm PostLogin script executes scripts as user gdm (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Vanilla Forums 2.0.17.1 ~ 2.0.17.5 <= Cross Site Scripting Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: fs/partitions: validate map_count in mac partition tables (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries i… (Thomas Sibley <trs@...tpractical.com>)
CVE request: simple machines forum before 1.1.13 (Hanno Böck <hanno@...eck.de>)

February 23 (28 messages)

CVE Request (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: Corrupted LDM partition table issues (Eugene Teo <eugene@...hat.com>)
Physical access vulnerabilities and auto-mounting (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Physical access vulnerabilities and auto-mounting (Eugene Teo <eugene@...hat.com>)
Re: Physical access vulnerabilities and auto-mounting (Eugene Teo <eugene@...hat.com>)
Re: Physical access vulnerabilities and auto-mounting (Nelson Elhage <nelhage@...lice.com>)
Re: Physical access vulnerabilities and auto-mounting (Solar Designer <solar@...nwall.com>)
Re: Physical access vulnerabilities and auto-mounting (Sebastian Krahmer <krahmer@...e.de>)
Re: Physical access vulnerabilities and auto-mounting (Michael Tokarev <mjt@....msk.ru>)
Re: gdm PostLogin script executes scripts as user gdm (Thomas Biege <thomas@...e.de>)
Re: Physical access vulnerabilities and auto-mounting (Hanno Böck <hanno@...eck.de>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Vasiliy Kulikov <segoon@...nwall.com>)
Re: Physical access vulnerabilities and auto-mounting (Steve Grubb <sgrubb@...hat.com>)
CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Timo Warns <warns@...-sense.de>)
Re: Physical access vulnerabilities and auto-mounting (Timo Warns <warns@...-sense.de>)
CVE request: pmwiki before 2.2.21 (Hanno Böck <hanno@...eck.de>)
Re: Physical access vulnerabilities and auto-mounting (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: simple machines forum before 1.1.13 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: Corrupted LDM partition table issues (Josh Bressers <bressers@...hat.com>)
Re: Re: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL querie… (Josh Bressers <bressers@...hat.com>)
Re: CVE request: pmwiki before 2.2.21 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Josh Bressers <bressers@...hat.com>)
Re: Physical access vulnerabilities and auto-mounting ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE requests: freebsd kernel/tesseract/xinha/proftpd (Josh Bressers <bressers@...hat.com>)
CVE request: Information disclosure in CGIHTTPServer from Python (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Josh Bressers <bressers@...hat.com>)

February 24 (18 messages)

Pattern lock bypass on SE X10 with Android 1.6 (Tim Brown <timb@...-dimension.org.uk>)
Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: drm/radeon/kms: check AA resolve registers on r300 (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Jon Oberheide <jon@...rheide.org>)
Re: Pattern lock bypass on SE X10 with Android 1.6 (Josh Bressers <bressers@...hat.com>)
XSSer v1.5 -beta- aka "Swarm Edition!" released. (psy <root@...depsylon.net>)
Re: Re: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries … (Vincent Danen <vdanen@...hat.com>)
Re: Re: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL querie… (Ralf Corsepius <rc040203@...enet.de>)
Re: Re: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries … (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: Information disclosure in CGIHTTPServer from Python (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: drm/radeon/kms: check AA resolve registers on r300 (Josh Bressers <bressers@...hat.com>)
CVE Request -- OpenLDAP -- two issues (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- logwatch: Privilege escalation due improper sanitization of special characters in log file names (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- logwatch: Privilege escalation due improper sanitization of special characters in log file names (Josh Bressers <bressers@...hat.com>)
CVE Request -- Smarty -- {smarty.template} && {smarty.currentdir} security bypass (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: kernel: CAP_SYS_MODULE bypass via CAP_NET_ADMIN (Kees Cook <kees@...ntu.com>)
CVE request: kernel: /proc/$pid/ leaks contents across setuid exec (Kees Cook <kees@...ntu.com>)

February 25 (14 messages)

Re: CVE request: kernel: CAP_SYS_MODULE bypass via CAP_NET_ADMIN (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: /proc/$pid/ leaks contents across setuid exec (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions (Kees Cook <kees@...ntu.com>)
Re: CVE request: kernel: drm/radeon/kms: check AA resolve registers on r300 (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions (Eugene Teo <eugene@...hat.com>)
CVE request: libcgroup: Failure to verify netlink messages (Nelson Elhage <nelhage@...lice.com>)
CVE Request: PHPShop 0.8.1 <= | Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE Request for phpMyAdmin 3.4.x, 3.4.0 beta 2 <= Stored Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE request: libcgroup: Failure to verify netlink messages (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE request: libcgroup: Failure to verify netlink messages (Steve Grubb <sgrubb@...hat.com>)
Re: CVE request: libcgroup: Failure to verify netlink messages (Nelson Elhage <nelhage@...lice.com>)
Re: CVE Request -- OpenLDAP -- two issues (Josh Bressers <bressers@...hat.com>)
Re: CVE request: libcgroup: Failure to verify netlink messages (Steve Grubb <sgrubb@...hat.com>)

February 26 (3 messages)

CVE request: v86d: Failure to validate netlink message sender (Nelson Elhage <nelhage@...lice.com>)
Re: CVE request: kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions (Kees Cook <kees@...ntu.com>)
cve request: eglibc memory corruption (Michael Gilbert <michael.s.gilbert@...il.com>)

February 28 (16 messages)

Re: CVE Request -- OpenLDAP -- two issues (Thomas Biege <thomas@...e.de>)
Re: CVE Request -- OpenLDAP -- two issues (Vincent Danen <vdanen@...hat.com>)
CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Helgi Þormar Þorbjörnsson <helgi@....net>)
CVE request: kernel: two bluetooth and one ebtables infoleaks/DoSes (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE request: FreeBSD/OS X crontab information leakage (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE request: kernel: OOM-killer via argv expansion (Kees Cook <kees@...ntu.com>)
Re: CVE Request -- Smarty -- {smarty.template} && {smarty.currentdir} security bypass (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: PHPShop 0.8.1 <= | Cross Site Scripting Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE request: v86d: Failure to validate netlink message sender (Josh Bressers <bressers@...hat.com>)
Re: cve request: eglibc memory corruption (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: OOM-killer via argv expansion (Kees Cook <kees@...ntu.com>)
Re: CVE request: FreeBSD/OS X crontab information leakage (Josh Bressers <bressers@...hat.com>)
Re: cve request: eglibc memory corruption (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: CVE request: kernel: OOM-killer via argv expansion (Kees Cook <kees@...ntu.com>)

169 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.