Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list - 2011/07

Messages by day:

July 1 (9 messages)

• Re: CVE request: Joomla unspecified information disclosure vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
• Please reject CVE-2011-0705 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• CVE request: kernel: nl80211: missing check for valid SSID size in scan operations (Petr Matousek <pmatouse@...hat.com>)
• Re: CVE request: kernel: nl80211: missing check for valid SSID size in scan operations (Eugene Teo <eugene@...hat.com>)
• Re: CVE request: kernel: tomoyo: oops in tomoyo_mount_acl() (Eugene Teo <eugene@...hat.com>)
• php ZipArchive::addGlob() crashes on invalid flags (Tomas Hoger <thoger@...hat.com>)
• Re: php ZipArchive::addGlob() crashes on invalid flags (Maksymilian Arciemowicz <cxib@...urityreason.com>)
• Re: Re: php ZipArchive::addGlob() crashes on invalid flags (Tomas Hoger <thoger@...hat.com>)
• Re: Closed list (Oracle Security Alerts <secalert_us@...cle.com>)

• vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: CVE request: openssl timing attack (Solar Designer <solar@...nwall.com>)

• Re: CVE request: openssl timing attack (Tomas Hoger <thoger@...hat.com>)
• Re: CVE requests; issues fixed in MySQL 5.1.52 (Ludwig Nussel <ludwig.nussel@...e.de>)
• Re: vsftpd download backdoored (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: Closed list (Tomas Hoger <thoger@...hat.com>)
• CVE request: plone privilege escalation flaw (Vincent Danen <vdanen@...hat.com>)
• FreeBSD 4.x OpenSSH/libopie remote root hole (Solar Designer <solar@...nwall.com>)

• Re: vsftpd download backdoored (Eugene Teo <eugene@...hat.com>)
• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: vsftpd download backdoored (HD Moore <hdm@...italoffense.net>)
• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: vsftpd download backdoored (HD Moore <hdm@...italoffense.net>)
• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: FreeBSD 4.x OpenSSH/libopie remote root hole (Colin Percival <cperciva@...ebsd.org>)
• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: vsftpd download backdoored (HD Moore <hdm@...italoffense.net>)
• R: Re: vsftpd download backdoored ("pinto.elia@...il.com" <pinto.elia@...il.com>)
• Re: FreeBSD 4.x OpenSSH/libopie remote root hole (Solar Designer <solar@...nwall.com>)
• Re: FreeBSD 4.x OpenSSH/libopie remote root hole (Sebastian Krahmer <krahmer@...e.de>)
• Re: vsftpd download backdoored (Matthias Andree <matthias.andree@....de>)
• The Bind incident (Eugene Teo <eugene@...hat.com>)
• Re: The Bind incident (Eugene Teo <eugene@...hat.com>)
• Re: vsftpd download backdoored (Eugene Teo <eugene@...hat.com>)

• Re: vsftpd download backdoored (Solar Designer <solar@...nwall.com>)
• Re: The Bind incident (Solar Designer <solar@...nwall.com>)
• CVE request: kernel: perf, x86: fix Intel fixed counters base initialization (Eugene Teo <eugene@...hat.com>)
• Re: CVE request: kernel: perf, x86: fix Intel fixed counters base initialization (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: CVE request: openssl timing attack (Solar Designer <solar@...nwall.com>)
• Re: The Bind incident ("Mike O'Connor" <mjo@...o.mi.org>)
• Re: CVE request: openssl timing attack (Tomas Hoger <thoger@...hat.com>)
• Security issue in reseed (Jamie Strandboge <jamie@...onical.com>)
• CVE Request: reseed (Jamie Strandboge <jamie@...onical.com>)
• CVE Request: foo2zjs (Marc Deslauriers <marc.deslauriers@...onical.com>)
• Re: The Bind incident (Florian Weimer <fw@...eb.enyo.de>)
• Re: The Bind incident (Barry Greene <bgreene@....org>)
• libreoffice/openoffice.org CVE id request (Nico Golde <oss-security+ml@...lde.de>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: FreeBSD 4.x OpenSSH/libopie remote root hole (Markus Friedl <mfriedl@...il.com>)

• Re: vsftpd download backdoored (Chris Evans <scarybeasts@...il.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
• CVE-2011-1780, CVE-2011-1936, kernel/xen issues (Eugene Teo <eugene@...hat.com>)
• Re: The Bind incident (Eugene Teo <eugene@...hat.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
• Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by s… (Jamie Strandboge <jamie@...onical.com>)
• oCERT name change due to trademark claims (Andrea Barisani <lcars@...rt.org>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)

• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• SSL renegotiation DoS CVE-2011-1473 (Tomas Hoger <thoger@...hat.com>)

• Re: CVE request: openssl timing attack (Solar Designer <solar@...nwall.com>)

• CVE Request: ruby PRNG fixes (Ludwig Nussel <ludwig.nussel@...e.de>)
• CVE Request -- Drupal 7 -- Access bypass in node listings (SA-CORE-2011-002) (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: vsftpd download backdoored (Josh Bressers <bressers@...hat.com>)

• CVE-2011-2525 kernel: kernel: net_sched: fix qdisc_notify() (Eugene Teo <eugene@...hat.com>)
• Apache symlink issue: can documented behavior be a security problem and hence get a CVE? (halfdog <me@...fdog.net>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
• [Announcement] ClubHack Magazine Issue 18-July2011 Released (Abhijeet Patil <getabhijeetpatil@...il.com>)
• CVE Request: qemu -runas does not clear supplementary groups (Michael Tokarev <mjt@....msk.ru>)
• Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? ("Mike O'Connor" <mjo@...o.mi.org>)
• Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? (Josh Bressers <bressers@...hat.com>)
• Re: CVE requests; issues fixed in MySQL 5.1.52 (Josh Bressers <bressers@...hat.com>)
• Re: CVE request: plone privilege escalation flaw (Josh Bressers <bressers@...hat.com>)
• CVE id request: apache mod-auth-external (Nico Golde <oss-security+ml@...lde.de>)
• Re: CVE Request: reseed (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request: foo2zjs (Josh Bressers <bressers@...hat.com>)
• Re: libreoffice/openoffice.org CVE id request (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request: ruby PRNG fixes (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request: qemu -runas does not clear supplementary groups (Vincent Danen <vdanen@...hat.com>)
• Re: CVE Request -- Drupal 7 -- Access bypass in node listings (SA-CORE-2011-002) (Josh Bressers <bressers@...hat.com>)
• Re: CVE id request: apache mod-auth-external (Josh Bressers <bressers@...hat.com>)
• Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo (William Cohen <wcohen@...hat.com>)

• CVE-2011-2689 kernel: gfs2: make sure fallocate bytes is a multiple of blksize (Eugene Teo <eugene@...hat.com>)
• Security issues fixed in libpng 1.5.4 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• CVE Request: hplip/foomatic-filters (Sebastian Krahmer <krahmer@...e.de>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
• [oCERT-2011-001] Chyrp input sanitization errors (Andrea Barisani <lcars@...rt.org>)
• Re: [oCERT-2011-001] Chyrp input sanitization errors ("Steven M. Christey" <coley@...-smtp.mitre.org>)
• Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? ("Steven M. Christey" <coley@...-smtp.mitre.org>)

• CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Erik de Castro Lopo <erikd@...a-nerd.com>)
• Re: Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
• CVE request: webkit ZDI-11-138 and ZDI-11-139 (Thomas Biege <thomas@...e.de>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)

• Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Erik de Castro Lopo <erikd@...a-nerd.com>)
• CVE-2009-4067 kernel: usb: buffer overflow in auerswald_probe() (Eugene Teo <eugene@...hat.com>)
• Re: Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• CVE-2011-1764 Exim: DKIM Format String (Djalal Harouni <tixxdz@...ndz.org>)
• CVE request: vulnerability in FreeRADIUS (OCSP) (dfncert@...-cert.de)
• CVE Request -- kernel: ext4: kernel panic when writing data to the last block of sparse file (Petr Matousek <pmatouse@...hat.com>)
• Re: CVE Request -- kernel: ext4: kernel panic when writing data to the last block of sparse file (Josh Bressers <bressers@...hat.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Vincent Danen <vdanen@...hat.com>)

• Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? (halfdog <me@...fdog.net>)
• CVE request and info: freetype flaw to jailbreak iphone (Vincent Danen <vdanen@...hat.com>)
• Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? (Stefan Fritsch <sf@...itsch.de>)

• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
• Re: CVE request and info: freetype flaw to jailbreak iphone (Geoffrey Keating <geoffk@...le.com>)

• Re: CVE Request -- libsndfile -- Integer overflow by processing certain PAF files (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (dfncert@...-cert.de)
• Re: CVE Request: hplip/foomatic-filters (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Ludwig Nussel <ludwig.nussel@...e.de>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (dfncert@...-cert.de)
• CVE-2011-2520: flaw in system-config-firewall's usage of pickle allows privilege escalation (Vincent Danen <vdanen@...hat.com>)
• CVE id request: (e)glibc (Nico Golde <nico@...lde.de>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Stefan Behte <craig@...too.org>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Solar Designer <solar@...nwall.com>)

• cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver (Michael Gilbert <michael.s.gilbert@...il.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Tim Zingelman <tez@...bsd.org>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (dfncert@...-cert.de)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Solar Designer <solar@...nwall.com>)
• CVE Request -- Wireshark: Infinite loop in the ANSI A Interface (IS-634/IOS) dissector (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Tomas Hoger <thoger@...hat.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Solar Designer <solar@...nwall.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (dfncert@...-cert.de)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Tim Zingelman <tez@...bsd.org>)
• *BSD security contacts (was: CVE request: vulnerability in FreeRADIUS (OCSP)) (Solar Designer <solar@...nwall.com>)
• CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support. (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support. (Even Rouault <even.rouault@...es-paris.org>)
• Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support. (Alan Boudreault <aboudreault@...gears.com>)
• CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OGC fi… (Jan Lieskovsky <jlieskov@...hat.com>)

• Re: CVE Request: ruby PRNG fixes (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: CVE Request -- Wireshark: Infinite loop in the ANSI A Interface (IS-634/IOS) dissector (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• CVE request: kernel: ipv6: make fragment identifications less predictable (Eugene Teo <eugene@...hat.com>)
• CVE request: kernel: si4713-i2c: avoid potential buffer overflow on si4713 (Eugene Teo <eugene@...hat.com>)
• Re: CVE request: kernel: ipv6: make fragment identifications less predictable (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: CVE request: kernel: si4713-i2c: avoid potential buffer overflow on si4713 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• CVE request: sNews 1.7.1 XSS in reorder (Henri Salo <henri@...v.fi>)
• CVE request: kernel: arbitrary kernel read in xtensa (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• Re: CVE request: vulnerability in FreeRADIUS (OCSP) (Josh Bressers <bressers@...hat.com>)
• Fwd: Joomla! Security News (Henri Salo <henri@...v.fi>)
• Re: CVE requests; issues fixed in MySQL 5.1.52 (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in … (Alan Boudreault <aboudreault@...gears.c…)
• New IcedTea and IcedTea-Web releases (Tomas Hoger <thoger@...hat.com>)
• Re: CVE id request: (e)glibc (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request -- MapServer -- Stack based buffer overflow [was: Re: Re: CVE Request -- MapServer -- SQL injections in OG… (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request: ruby PRNG fixes (Josh Bressers <bressers@...hat.com>)
• Re: CVE request: sNews 1.7.1 XSS in reorder (Josh Bressers <bressers@...hat.com>)
• Re: CVE request: kernel: arbitrary kernel read in xtensa (Josh Bressers <bressers@...hat.com>)
• Re: Fwd: Joomla! Security News (Josh Bressers <bressers@...hat.com>)

• Re: *BSD security contacts (was: CVE request: vulnerability in FreeRADIUS (OCSP)) (Tim Zingelman <tez@...bsd.org>)
• Re: Closed list (Steve Kemp <steve@...ve.org.uk>)
• CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and thei… (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: Closed list (Solar Designer <solar@...nwall.com>)
• Re: *BSD security contacts (Solar Designer <solar@...nwall.com>)
• Re: cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver ("Mike O'Connor" <mjo@...o.mi.org>)
• Re: Closed list (Steffen Joeris <steffen.joeris@...lelinux.de>)

• CVE Request: Joomla! 1.7.0-RC and lower | Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
• CVE Request -- cGit -- XSS flaw in rename hint (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver (Michael Gilbert <michael.s.gilbert@...il.com>)
• Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and t… (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request: Joomla! 1.7.0-RC and lower | Cross Site Scripting Vulnerabilities (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request -- cGit -- XSS flaw in rename hint (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request -- cGit -- XSS flaw in rename hint (Lukas Fleischer <cgit@...ptocrack.de>)
• Re: Closed list (Solar Designer <solar@...nwall.com>)

• CVE request: PyForum backdoor BMSA-2009-07 (Henri Salo <henri@...v.fi>)
• Re: CVE request: silverstripe before 2.4.4 (Henri Salo <henri@...v.fi>)
• Re: Re: CVE Request -- cGit -- XSS flaw in rename hint (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: Re: CVE Request -- cGit -- XSS flaw in rename hint (Lukas Fleischer <cgit@...ptocrack.de>)
• CVE request: Drupal Data-module multiple vulnerabilities (Henri Salo <henri@...v.fi>)
• Squirrelmail CVE duplicates (Moritz Muehlenhoff <jmm@...ian.org>)

• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Solar Designer <solar@...nwall.com>)
• Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and th… (Sebastian Krahmer <krahmer@...e.de>)
• CVE request - dhcp clients (Tomas Hoger <thoger@...hat.com>)
• CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12 (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: Squirrelmail CVE duplicates (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: Squirrelmail CVE duplicates (Moritz Mühlenhoff <jmm@...til.org>)
• CVE Request -- GLPI -- Properly blacklist some sensitive fields (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Vasiliy Kulikov <segoon@...nwall.com>)
• CVE Request: Ark path traversal (Jeff Mitchell <mitchell@....org>)
• CVE Request: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications (Jeff Mitchell <mitchell@....org>)
• CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications (Jeff Mitchell <mitchell@....org>)
• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Jeff Johnson <n3npq@....com>)
• Re: CVE Request: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications (Tim Brown <timb@...-dimension.org.uk>)
• two systemtap flaws: CVE-2011-2502 and CVE-2011-2503 (Vincent Danen <vdanen@...hat.com>)
• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Solar Designer <solar@...nwall.com>)
• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Solar Designer <solar@...nwall.com>)

• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Jeff Johnson <n3npq@....com>)
• Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) (Jeff Johnson <n3npq@....com>)
• CVE Request -- Clam AntiVirus -- v0.97.2 -- Off-by-one error by scanning message hashes (Jan Lieskovsky <jlieskov@...hat.com>)
• CVE request: hplip: insecure tmp file handling (Matthias Weckbecker <mweckbecker@...e.de>)
• Information on CVE-2011-2300/CVE-2011-2305 for VirtualBox ? (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Information on CVE-2011-2300/CVE-2011-2305 for VirtualBox ? (Dan Rosenberg <dan.j.rosenberg@...il.com>)
• Re: CVE request: PyForum backdoor BMSA-2009-07 (Josh Bressers <bressers@...hat.com>)
• Re: CVE request: Drupal Data-module multiple vulnerabilities (Josh Bressers <bressers@...hat.com>)
• Re: CVE request - dhcp clients (Josh Bressers <bressers@...hat.com>)
• Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12 (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request -- GLPI -- Properly blacklist some sensitive fields (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request: Ark path traversal (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request -- Clam AntiVirus -- v0.97.2 -- Off-by-one error by scanning message hashes (Josh Bressers <bressers@...hat.com>)
• Re: CVE request: hplip: insecure tmp file handling (Josh Bressers <bressers@...hat.com>)
• Re: Information on CVE-2011-2300/CVE-2011-2305 for VirtualBox ? (Moritz Mühlenhoff <jmm@...til.org>)
• Re: CVE Request: Ark path traversal (Jeff Mitchell <mitchell@....org>)
• Re: Symlinks and filesystem recursion vulnerabilities: Action needed or ignore? (Solar Designer <solar@...nwall.com>)
• iputils ping6 -s buffer overflow (Solar Designer <solar@...nwall.com>)

• CFP SecurityByte India ("Papers, Call For" <cfpt@...uritybyte.org>)
• Re: CFP SecurityByte India (Solar Designer <solar@...nwall.com>)
• Re: CVE request: multiple libraries getenv() misuse (Solar Designer <solar@...nwall.com>)
• Re: CVE request - dhcp clients (Tomas Hoger <thoger@...hat.com>)
• Re: CVE request - dhcp clients (Sebastian Krahmer <krahmer@...e.de>)
• Re: CVE request - dhcp clients (Tomas Hoger <thoger@...hat.com>)
• Re: CVE request - dhcp clients (Sebastian Krahmer <krahmer@...e.de>)
• Re: CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications ("Steven M. Christey" <coley@...-smtp.mitre.…)
• CVE request: drupal7 SA-CORE-2011-003 (access restriction bypass) (Vincent Danen <vdanen@...hat.com>)

• Re: CVE Request: hplip/foomatic-filters (Tomas Hoger <thoger@...hat.com>)
• Re: two systemtap flaws: CVE-2011-2502 and CVE-2011-2503 (Tavis Ormandy <taviso@...xchg8b.com>)
• Re: Re: two systemtap flaws: CVE-2011-2502 and CVE-2011-2503 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: Re: two systemtap flaws: CVE-2011-2502 and CVE-2011-2503 (Tavis Ormandy <taviso@...xchg8b.com>)
• Re: CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications (Jeff Mitchell <mitchell@....org>)
• Re: CVE request: gri < 2.12.18 insecure temp file generation (Henri Salo <henri@...v.fi>)
• CVE-request Tribiq CMS path disclosure HTB22857 (Henri Salo <henri@...v.fi>)
• libxml security fix from apple ... any information? (Marcus Meissner <meissner@...e.de>)
• CVE Request -- foomatic (foomatic-filters): foomatic-rip (debug mode) insecure temporary file use in renderer command line… (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: CVE request: gri < 2.12.18 insecure temp file generation ("Steven M. Christey" <coley@...-smtp.mitre.org>)
• CVE-2011-2524: libsoup's SoupServer directory traversal flaw (Vincent Danen <vdanen@...hat.com>)
• multiple flaws in minissdpd (Kees Cook <kees@...ntu.com>)
• CVE request: kernel: gro: Only reset frag0 when skb can be pulled (Kees Cook <kees@...ntu.com>)

• Re: CVE request: kernel: gro: Only reset frag0 when skb can be pulled (Eugene Teo <eugene@...hat.com>)
• Re: libxml security fix from apple ... any information? (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: libxml security fix from apple ... any information? (Billy Rios <billy.rios@...il.com>)
• Re: Re: libxml security fix from apple ... any information? (Thomas Biege <thomas@...e.de>)
• Re: multiple flaws in minissdpd (miniupnp <miniupnp@...e.fr>)
• Re: CVE Request -- vsftpd -- Do not create network namespace per connection (Eugene Teo <eugene@...hat.com>)
• Re: Re: libxml security fix from apple ... any information? (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: CVE Request -- vsftpd -- Do not create network namespace per connection (Jan Lieskovsky <jlieskov@...hat.com>)
• CVE-2011-2724 assignment notification -- samba -- incomplete fix for CVE-2010-0547 issue (Jan Lieskovsky <jlieskov@...hat.com>)
• Re: Closed list (Tomas Hoger <thoger@...hat.com>)
• Re: Closed list (Solar Designer <solar@...nwall.com>)
• CVE mistake in libsoup release notes (Vincent Danen <vdanen@...hat.com>)
• Re: CVE request: drupal7 SA-CORE-2011-003 (access restriction bypass) (Josh Bressers <bressers@...hat.com>)
• Re: CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications (Josh Bressers <bressers@...hat.com>)
• Re: CVE-request Tribiq CMS path disclosure HTB22857 (Josh Bressers <bressers@...hat.com>)
• Re: CVE Request -- foomatic (foomatic-filters): foomatic-rip (debug mode) insecure temporary file use in renderer command … (Josh Bressers <bressers@...hat.com>)

• CVE Request: Elgg 1.7.9 <= | Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
• CFP open for ClubHack2011 (Abhijeet Patil <getabhijeetpatil@...il.com>)
• Re: CFP open for ClubHack2011 (Solar Designer <solar@...nwall.com>)
• Re: Re: libxml security fix from apple ... any information? (Jeffrey Czerniak <jeffcz@...le.com>)
• Re: libxml security fix from apple ... any information? (Solar Designer <solar@...nwall.com>)

258 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.