oss-security mailing list - 2011/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 15	² 5	³ 18	⁴ 33	⁵ 9	⁶ 7
⁷ 13	⁸ 23	⁹ 3	¹⁰ 7	¹¹ 8	¹² 2	¹³ 12
¹⁴ 28	¹⁵ 16	¹⁶ 12	¹⁷ 7	¹⁸ 19	¹⁹ 1	²⁰ 5
²¹ 16	²² 13	²³ 11	²⁴ 7	²⁵ 3	²⁶	²⁷
²⁸ 7	²⁹ 4	³⁰ 9	³¹ 5

Messages by day:

March 1 (15 messages)

Re: CVE request: kernel: OOM-killer via argv expansion (Nelson Elhage <nelhage@...lice.com>)
Re: CVE request: kernel: OOM-killer via argv expansion (Eugene Teo <eugene@...hat.com>)
Re: CVE request - kernel: xfs infoleak (Eugene Teo <eugene@...hat.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Pierre Joye <pierre.php@...il.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Helgi Þormar Þorbjörnsson <helgith@...il.com>)
CVE request: Atlassian JIRA Parameter-Based Redirection Vulnerability (henri@...v.fi)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Pierre Joye <pierre.php@...il.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Helgi Þormar Þorbjörnsson <helgith@...il.com>)
Re: CVE request: kernel: two bluetooth and one ebtables infoleaks/DoSes (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- OpenLDAP -- two issues (Ralf Haferkamp <rhafer@...e.de>)
cve request for smoothwall & openfiler (dave b <db.pub.mail@...il.com>)
Re: CVE Request -- OpenLDAP -- two issues (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: Atlassian JIRA Parameter-Based Redirection Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- OpenLDAP -- two issues (Josh Bressers <bressers@...hat.com>)

March 2 (5 messages)

CVE request: kernel: Multiple DoS issues in epoll (Nelson Elhage <nelhage@...lice.com>)
Re: CVE request: kernel: Multiple DoS issues in epoll (Petr Matousek <pmatouse@...hat.com>)
CVE request: VLC bookmark buffer overflow (henri@...v.fi)
Re: CVE request: simple machines forum before 1.1.13 ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE requests: freebsd kernel/tesseract/xinha/proftpd ("Steven M. Christey" <coley@...-smtp.mitre.org>)

March 3 (18 messages)

CVE request: gri < 2.12.18 insecure temp file generation (henri@...v.fi)
CVE-2011-1023 kernel: rds: prevent BUG_ON triggering on congestion map updates (Eugene Teo <eugene@...hat.com>)
Vendor-sec hosting and future of closed lists (Marcus Meissner <meissner@...e.de>)
Re: Vendor-sec hosting and future of closed lists (Mark J Cox <mjc@...hat.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Vincent Danen <vdanen@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Josh Bressers <bressers@...hat.com>)
Re: cve request for smoothwall & openfiler (Josh Bressers <bressers@...hat.com>)
Re: CVE request: VLC bookmark buffer overflow (Josh Bressers <bressers@...hat.com>)
Re: CVE request: VLC bookmark buffer overflow (Josh Bressers <bressers@...hat.com>)
Re: CVE request: gri < 2.12.18 insecure temp file generation (Josh Bressers <bressers@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Kees Cook <kees@...ntu.com>)
Re: Vendor-sec hosting and future of closed lists (Kees Cook <kees@...ntu.com>)
Re: Vendor-sec hosting and future of closed lists ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)
Re: Vendor-sec hosting and future of closed lists (Solar Designer <solar@...nwall.com>)
Re: Vendor-sec hosting and future of closed lists (Kees Cook <kees@...ntu.com>)
Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)
Re: Vendor-sec hosting and future of closed lists (Dan Rosenberg <dan.j.rosenberg@...il.com>)

March 4 (33 messages)

Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)
Re: Vendor-sec hosting and future of closed lists (Marcus Meissner <meissner@...e.de>)
Re: Vendor-sec hosting and future of closed lists (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)
Re: Vendor-sec hosting and future of closed lists (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: Vendor-sec hosting and future of closed lists (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)
Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)
Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE ("Dmitry V. Levin" <ldv@...linux.org>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE-2011-1076 kernel: DNS: Fix a NULL pointer deref when trying to read an error key (Eugene Teo <eugene@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Mark J Cox <mjc@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (David Hicks <hickseydr@...usnet.com.au>)
CVE Request -- logrotate -- nine issues (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues (Florian Zumbiehl <florz@...rz.de>)
Re: CVE Request -- logrotate -- nine issues (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Nelson Elhage <nelhage@...lice.com>)
Re: Re: CVE request: More Evince overflows (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: Vendor-sec hosting and future of closed lists ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- logrotate -- nine issues ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- logrotate -- nine issues (Florian Zumbiehl <florz@...rz.de>)
Re: CVE Request -- logrotate -- nine issues (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request -- logrotate -- nine issues (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Pavel Labushev <p.labushev@...il.com>)

March 5 (9 messages)

kernel: modules_disabled policy (Vasiliy Kulikov <segoon@...nwall.com>)
Re: kernel: modules_disabled policy (Kees Cook <kees@...ntu.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: Vendor-sec hosting and future of closed lists ("S.P.Zeidler" <spz@...BSD.org>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Kees Cook <kees@...ntu.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: Vendor-sec hosting and future of closed lists (Greg KH <greg@...ah.com>)

March 6 (7 messages)

Re: Vendor-sec hosting and future of closed lists (Matthieu Herrb <matthieu.herrb@...s.fr>)
Re: Vendor-sec hosting and future of closed lists ("S.P.Zeidler" <spz@...BSD.org>)
Re: CVE Request -- logrotate -- nine issues (Pavel Labushev <p.labushev@...il.com>)
Re: CVE Request -- logrotate -- nine issues (Florian Zumbiehl <florz@...rz.de>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues (Pavel Labushev <p.labushev@...il.com>)
Re: kernel: modules_disabled policy (Steve Grubb <sgrubb@...hat.com>)

March 7 (13 messages)

Re: Vendor-sec hosting and future of closed lists (Eugene Teo <eugene@...hat.com>)
CVE request - kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (Eugene Teo <eugene@...hat.com>)
cgit convert_query_hexchar infinite loop (CVE-2011-1027) (Tomas Hoger <thoger@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Andrea Barisani <lcars@...rt.org>)
Re: CVE Request -- logrotate -- nine issues (Jan Kaluža <jkaluza@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Paul Martin <pm@...ian.org>)
Re: CVE Request -- logrotate -- nine issues (Steve Grubb <sgrubb@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Willy Tarreau <w@....eu>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Josh Bressers <bressers@...hat.com>)
Re: CVE request - kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (Josh Bressers <bressers@...hat.com>)
ldd can execute an app unexpectedly (Steve Grubb <sgrubb@...hat.com>)

March 8 (23 messages)

Re: ldd can execute an app unexpectedly ("Dmitry V. Levin" <ldv@...linux.org>)
Re: ldd can execute an app unexpectedly (Steve Grubb <sgrubb@...hat.com>)
Re: ldd can execute an app unexpectedly (Tim Brown <tmb@...35.com>)
CVE request: kernel: dccp: fix oops on Reset after close (Eugene Teo <eugene@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Ludwig Nussel <ludwig.nussel@...e.de>)
Buffer overflows in fsck may become security issues (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: ldd can execute an app unexpectedly (Tomas Hoger <thoger@...hat.com>)
glibc locale escaping issue (Tomas Hoger <thoger@...hat.com>)
CVE request, php's shm (Pierre Joye <pierre.php@...il.com>)
Re: ldd can execute an app unexpectedly (Steve Grubb <sgrubb@...hat.com>)
Re: CVE request, php's shm (Josh Bressers <bressers@...hat.com>)
Re: CVE request, php's shm (Tomas Hoger <thoger@...hat.com>)
KDE SSL name check issue (Tomas Hoger <thoger@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Josh Bressers <bressers@...hat.com>)
Vendor-sec hosting and future of closed lists (R P Herrold <herrold@...river.com>)
Re: Vendor-sec hosting and future of closed lists (akuster <akuster@...sta.com>)
CVE-2011-0714 kernel: deficiency in handling of invalid data packets in lockd (Petr Matousek <pmatouse@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Andrea Barisani <lcars@...rt.org>)
Re: CVE request: kernel: dccp: fix oops on Reset after close (Josh Bressers <bressers@...hat.com>)
Re: KDE SSL name check issue (Josh Bressers <bressers@...hat.com>)
Re: glibc locale escaping issue (Josh Bressers <bressers@...hat.com>)
Re: glibc locale escaping issue ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Helgi Þormar Þorbjörnsson <helgith@...il.com>)

March 9 (3 messages)

Re: CVE-2011-0714 kernel: deficiency in handling of invalid data packets in lockd (Eugene Teo <eugene@...hat.com>)
CVE request: buffer overflow in unixODBC's SQLDriverConnect() (Felipe Pena <felipensp@...il.com>)
CVE request: libvirt: several API calls do not honour read-only connection (Petr Matousek <pmatouse@...hat.com>)

March 10 (7 messages)

nss-pam-ldapd security advisory (CVE-2011-0438) (Arthur de Jong <arthur@...hurdejong.org>)
Re: CVE Request -- logrotate -- nine issues (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Florian Zumbiehl <florz@...rz.de>)
Re: CVE request: buffer overflow in unixODBC's SQLDriverConnect() (Josh Bressers <bressers@...hat.com>)
Re: CVE request: libvirt: several API calls do not honour read-only connection (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues (Florian Zumbiehl <florz@...rz.de>)

March 11 (8 messages)

CVE-2011-0695 kernel: panic in ib_cm:cm_work_handler (Eugene Teo <eugene@...hat.com>)
CVE Request -- Asterisk AST-2011-002 / Multiple array overflow and crash vulnerabilities in UDPTL code (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Solar Designer <solar@...nwall.com>)
Re: CVE request: kernel: CAP_SYS_MODULE bypass via CAP_NET_ADMIN (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE Request -- logrotate -- nine issues (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE Request -- Asterisk AST-2011-002 / Multiple array overflow and crash vulnerabilities in UDPTL code (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: PEAR Installer 1.9.1 <= - Symlink Attack (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request -- Asterisk AST-2011-002 / Multiple array overflow and crash vulnerabilities in UDPTL code (Matthew Nicholson <mnicholson@...ium.com>)

March 12 (2 messages)

announcing libwipe (Andrew Clausen <clausen@...n.upenn.edu>)
Untrusted fs and invalid filenames (Vasiliy Kulikov <segoon@...nwall.com>)

March 13 (12 messages)

CVE Request: bbPress 1.0.2 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE request: PHP substr_replace() use-after-free (Felipe Pena <felipensp@...il.com>)
Re: CVE request: PHP substr_replace() use-after-free (Eugene Teo <eugene@...hat.com>)
Please REJECT CVE-2008-2956 (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: announcing libwipe (Kees Cook <kees@...ntu.com>)
Re: CVE request: PHP substr_replace() use-after-free (Oden Eriksson <oeriksson@...driva.com>)
CVE Request: Joomla! 1.6.0 | SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: Joomla! 1.6.0 | Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE request: PHP substr_replace() use-after-free (Felipe Pena <felipensp@...il.com>)
Re: Untrusted fs and invalid filenames (Steve Grubb <sgrubb@...hat.com>)
Re: Untrusted fs and invalid filenames (Eitan Adler <lists@...anadler.com>)
Re: announcing libwipe (Pierre Joye <pierre.php@...il.com>)

March 14 (28 messages)

Re: Please REJECT CVE-2008-2956 (Eugene Teo <eugene@...hat.com>)
CVE requests - kernel: tpm infoleaks (Eugene Teo <eugene@...hat.com>)
Re: announcing libwipe (Andrew Clausen <clausen@...n.upenn.edu>)
Re: announcing libwipe (Andrew Clausen <clausen@...n.upenn.edu>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: Untrusted fs and invalid filenames (Stephan Mueller <stephan.mueller@...ec.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Untrusted fs and invalid filenames (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Untrusted fs and invalid filenames (Stephan Mueller <stephan.mueller@...ec.com>)
Re: Untrusted fs and invalid filenames (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: Untrusted fs and invalid filenames (Steve Grubb <sgrubb@...hat.com>)
Re: Untrusted fs and invalid filenames (Steve Grubb <sgrubb@...hat.com>)
CVE request: format-string vulnerability in PHP Phar extension (Felipe Pena <felipensp@...il.com>)
Re: CVE request: format-string vulnerability in PHP Phar extension (Felipe Pena <felipensp@...il.com>)
CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable from e… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Untrusted fs and invalid filenames (Vasiliy Kulikov <segoon@...nwall.com>)
CVE request for python-feedparser (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable fr… (David King <amigadave@...gadave.com>)
Re: CVE Request: bbPress 1.0.2 <= Cross Site Scripting Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Joomla! 1.6.0 | SQL Injection Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Joomla! 1.6.0 | Cross Site Scripting (XSS) Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE requests - kernel: tpm infoleaks (Josh Bressers <bressers@...hat.com>)
Re: CVE request: format-string vulnerability in PHP Phar extension (Josh Bressers <bressers@...hat.com>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable fro… (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- logrotate -- nine issues (Josh Bressers <bressers@...hat.com>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable f… (David Woodhouse <dwmw2@...radead.org>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable… ("Steven M. Christey" <coley@...-smtp.mi…)

March 15 (16 messages)

Re: CVE requests - kernel: tpm infoleaks (Eugene Teo <eugene@...hat.com>)
Re: Vendor-sec hosting and future of closed lists ("Mike O'Connor" <mjo@...o.mi.org>)
Re: Vendor-sec hosting and future of closed lists ("Mike O'Connor" <mjo@...o.mi.org>)
Re: Vendor-sec hosting and future of closed lists (Eugene Teo <eugene@...hat.com>)
gksu-polkit (Sebastian Krahmer <krahmer@...e.de>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: 2 acpid flaws (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: gksu-polkit (Josh Bressers <bressers@...hat.com>)
CVE Request: kernel: fs/partitions: Corrupted OSF partition table can cause information disclosure (Timo Warns <warns@...-sense.de>)
Re: Vendor-sec hosting and future of closed lists ("Mike O'Connor" <mjo@...o.mi.org>)
Re: CVE request for python-feedparser (Josh Bressers <bressers@...hat.com>)
Re: 2 acpid flaws (Josh Bressers <bressers@...hat.com>)
Re: CVE requests - kernel: tpm infoleaks (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: kernel: fs/partitions: Corrupted OSF partition table can cause information disclosure (Josh Bressers <bressers@...hat.com>)
Re: Vendor-sec hosting and future of closed lists (Art Manion <amanion@...t.org>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable fro… (Josh Bressers <bressers@...hat.com>)

March 16 (12 messages)

RE: Vendor-sec hosting and future of closed lists ("Menkhus, Mark (GSE Security HP SSRT)" <mark.menkhus@...com>)
Re: Vendor-sec hosting and future of closed lists (Eugene Teo <eugene@...hat.com>)
RE: Vendor-sec hosting and future of closed lists (Mark J Cox <mjc@...hat.com>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable fr… (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: Vendor-sec hosting and future of closed lists (Andrea Barisani <lcars@...rt.org>)
Re: CVE request for python-feedparser (Jonathan Wiltshire <jmw@...ian.org>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable fro… (Josh Bressers <bressers@...hat.com>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable fr… (David King <amigadave@...gadave.com>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable f… (David Woodhouse <dwmw2@...radead.org>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable f… (David Woodhouse <dwmw2@...radead.org>)
Re: CVE Request / Discussion -- vino -- reports the desktop being reachable only over the local network, when reachable f… (David Woodhouse <dwmw2@...radead.org>)
RE: Vendor-sec hosting and future of closed lists ("Menkhus, Mark (GSE Security HP SSRT)" <mark.menkhus@...com>)

March 17 (7 messages)

Re: Vendor-sec hosting and future of closed lists (Eugene Teo <eugene@...hat.com>)
Re: Vendor-sec hosting and future of closed lists ("Mike O'Connor" <mjo@...o.mi.org>)
CVE Request: xen DoS (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE Request: xen DoS (Eugene Teo <eugene@...hat.com>)
CVE request for Asterisk flaws (Vincent Danen <vdanen@...hat.com>)
The risks of cleaning /tmp (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: The risks of cleaning /tmp (Nelson Elhage <nelhage@...lice.com>)

March 18 (19 messages)

CVE request: kernel: AudioScience HPI driver (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request: kernel: AudioScience HPI driver (Eugene Teo <eugene@...hat.com>)
Re: CVE Request: Joomla! 1.6.0 | Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: Joomla! 1.5.21 <= SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: Joomla! 1.5.20 <= Cross Site Scripting (XSS) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: MyBB 1.6 <= SQL Injection (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: MyBB 1.6 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: Geeklog 1.7.1 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: 2Wire Broadband Router Session Hijacking Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: PHP Support Ticket 2.2 <= Multiple Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: HP System Management Homepage(SMH) | Open URL Redirection (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: XOOPS 2.5.0 <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE request: PHP substr_replace() use-after-free (Vincent Danen <vdanen@...hat.com>)
CVE request: kernel: netfilter & econet infoleaks (Vasiliy Kulikov <segoon@...nwall.com>)
Re: MaraDNS 1.4.06 and 1.3.07.11 released (Vincent Danen <vdanen@...hat.com>)
Re: MaraDNS 1.4.06 and 1.3.07.11 released (Raphael Geissert <geissert@...ian.org>)
Re: MaraDNS 1.4.06 and 1.3.07.11 released (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: HP System Management Homepage(SMH) | Open URL Redirection ("Mike O'Connor" <mjo@...o.mi.org>)

March 19 (1 message)

RE: CVE Request: HP System Management Homepage(SMH) | Open URL Redirection ("Menkhus, Mark (GSE Security HP SSRT)" <mark.menkhus@...com>)

March 20 (5 messages)

CVE request: MPM-ITK module for Apache HTTPD (Stefan Fritsch <sf@...itsch.de>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Vasiliy Kulikov <segoon@...nwall.com>)
CVE request: kernel: heap corruption in IrDA (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE request: kernel: multiple issues in ROSE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Dan Rosenberg <dan.j.rosenberg@...il.com>)

March 21 (16 messages)

Re: CVE request: kernel: netfilter & econet infoleaks (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: multiple issues in ROSE (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: heap corruption in IrDA (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: netfilter & econet infoleaks (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: a collection of world-writable debugfs bugs (Vasiliy Kulikov <segoon@...nwall.com>)
CVE Request (minor) -- Pidgin / libpurple -- Cipher API information disclosure (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE UnRequest (minor) -- Pidgin / libpurple -- Cipher API information disclosure (Jan Lieskovsky <jlieskov@...hat.com>)
Local memory disclosure (was: libpurple CVE UnRequest) ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE request: kernel: a collection ofworld-writable debugfs bugs (dan.j.rosenberg@...il.com)
Re: Local memory disclosure (was: libpurple CVE UnRequest) (Steve Grubb <sgrubb@...hat.com>)
Re: Re: CVE request for python-feedparser (Josh Bressers <bressers@...hat.com>)
Re: CVE request for Asterisk flaws (Josh Bressers <bressers@...hat.com>)
Re: CVE request: MPM-ITK module for Apache HTTPD (Josh Bressers <bressers@...hat.com>)
Re: CVE request: MPM-ITK module for Apache HTTPD ("Steinar H. Gunderson" <sgunderson@...foot.com>)
Security advisory: local DOS attack affecting non updated PaX patched kernels. (klondike <klondike@...cosoft.es>)
Re: CVE request: kernel: heap corruption in IrDA (Dan Rosenberg <dan.j.rosenberg@...il.com>)

March 22 (13 messages)

Possible security fixes in 5.05? (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: kernel: heap corruption in IrDA (Eugene Teo <eugene@...hat.com>)
CVE requests - kernel: irda/decnet issues (Eugene Teo <eugene@...hat.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Tomas Hoger <thoger@...hat.com>)
Re: CVE requests - kernel: irda/decnet issues (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE Request: libpng memory leak (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: Security advisory: local DOS attack affecting non updated PaX patched kernels. ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: Security advisory: local DOS attack affecting non updated PaX patched kernels. (klondike <klondike@...cosoft.es>)
Re: Security advisory: local DOS attack affecting non updated PaX patched kernels. (klondike <klondike@...cosoft.es>)
Re: CVE requests - kernel: irda/decnet issues (Josh Bressers <bressers@...hat.com>)
Re: CVE requests - kernel: irda/decnet issues (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Linux kernel signal spoofing vulnerability (CVE request) (Julien Tinnes <jt@....org>)

March 23 (11 messages)

Re: Linux kernel proactive security hardening (Solar Designer <solar@...nwall.com>)
Re: Linux kernel signal spoofing vulnerability (CVE request) (Eugene Teo <eugene@...hat.com>)
oss-security is on twitter (Eugene Teo <eugene@...hat.com>)
CVE Request: perl: regex causes assertion fail (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE Request -- Asterisk Security Vulnerability (Matthew Nicholson <mnicholson@...ium.com>)
Re: CVE Request -- Asterisk Security Vulnerability ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE Request: PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE request: kernel: two OSS fixes (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request -- logrotate -- nine issues (Ludwig Nussel <ludwig.nussel@...e.de>)

March 24 (7 messages)

RE: oss-security is on twitter ("Menkhus, Mark (GSE Security HP SSRT)" <mark.menkhus@...com>)
Re: oss-security is on twitter (Eugene Teo <eugene@...hat.com>)
CVE request: roundcube < 0.5.1 CSRF (Hanno Böck <hanno@...eck.de>)
Re: CVE request: roundcube < 0.5.1 CSRF (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: VLC bookmark buffer overflow (Henri Salo <fgeek@....fgeek.fi>)
CVE-2011-0728: Loggerhead 1.18.1 security release (William Grant <william.grant@...onical.com>)

March 25 (3 messages)

Re: CVE request: kernel: two OSS fixes (Eugene Teo <eugene@...hat.com>)
CVE Request -- php-doctrine-Doctrine -- SQL injection flaw (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- Nagios -- XSS in the network status map CGI script (Jan Lieskovsky <jlieskov@...hat.com>)

March 28 (7 messages)

CVE-2011-1478 kernel: gro: reset dev and skb_iff on skb reuse (Eugene Teo <eugene@...hat.com>)
Re: CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- php-doctrine-Doctrine -- SQL injection flaw ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- Nagios -- XSS in the network status map CGI script ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request: perl: regex causes assertion fail ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request: libpng memory leak ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE request: VLC bookmark buffer overflow ("Steven M. Christey" <coley@...-smtp.mitre.org>)

March 29 (4 messages)

CVE requests : Liferay 6.0.6 (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
CVE request: cmsmadesimple before 1.9.1 (Hanno Böck <hanno@...eck.de>)
CVE Request: rsyslogd memory leaks (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: Linux kernel signal spoofing vulnerability (CVE request) (Julien Tinnes <jt@....org>)

March 30 (9 messages)

tiff CVE-2011-0192 patch broken (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP R14B02 -- multiple security fixes (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP R14B02 -- multiple security fixes ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE request: kernel: multiple issues in ROSE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP R14B02 -- multiple security fixes (<pan@...ang.org>)
Re: CVE Request: PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE request: cmsmadesimple before 1.9.1 (Josh Bressers <bressers@...hat.com>)

March 31 (5 messages)

Re: CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP R14B02 -- multiple security fixes (Raimo Niskanen <raimo@...x.ericsson.se>)
Re: CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP R14B02 -- multiple security fixes (Sverker Eriksson <sverker@...x.ericsson.se>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: Suid mount helpers fail to anticipate RLIMIT_FSIZE ("Patrick J. Volkerding" <security@...ckware.com>)
Re: CVE Request -- Erlang/OTP R14, Erlang/OTP R14B01, Erlang/OTP R14B02 -- multiple security fixes (Rickard Green <rickard@...ang.org>)

318 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.