oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 3	² 3	³ 9	⁴ 13	⁵ 2	⁶	⁷
⁸ 3	⁹ 8	¹⁰ 11	¹¹ 10	¹² 11	¹³ 2	¹⁴
¹⁵ 5	¹⁶ 2	¹⁷ 2	¹⁸ 8	¹⁹ 18	²⁰ 2	²¹
²² 14	²³ 4	²⁴ 10	²⁵ 2	²⁶ 9	²⁷	²⁸
²⁹ 2	³⁰ 10	³¹ 1

Messages by day:

August 1 (3 messages)

Re: CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications (Jeff Mitchell <mitchell@....org>)
Re: CFP open for ClubHack2011 (Thomas Biege <thomas@...e.de>)
Re: CVE Request: hplip/foomatic-filters (Tomas Hoger <thoger@...hat.com>)

August 2 (3 messages)

Re: CVE request: webkit ZDI-11-138 and ZDI-11-139 (Thomas Biege <thomas@...e.de>)
Re: CVE request: webkit ZDI-11-138 and ZDI-11-139 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request: GIF loader buffer overflow when initializing decompression tables (Thomas Biege <thomas@...e.de>)

August 3 (9 messages)

CVE request: Linux kernel af_packet information leak (Moritz Muehlenhoff <jmm@...ian.org>)
CVE Request: foomatic-gui (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE request: GIF loader buffer overflow when initializing decompression tables (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request: foomatic-gui (Tim Waugh <twaugh@...hat.com>)
CVE id request: shttpd/mongoose/yassl embedded webserver (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: Linux kernel af_packet information leak (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: foomatic-gui (Josh Bressers <bressers@...hat.com>)
Re: CVE id request: shttpd/mongoose/yassl embedded webserver (Josh Bressers <bressers@...hat.com>)

August 4 (13 messages)

cve request: xpdf: insecure tempfile usage in zxpdf script (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: cve id request: insecure xauth cookie handling in fglrx (ati catalyst) driver (Michael Gilbert <michael.s.gilbert@...il.com>)
CVE-request: clamav floating point exception in OLE2 scanner DoS (Henri Salo <henri@...v.fi>)
CVE request: coppermine gallery < 1.4.26 (Henri Salo <henri@...v.fi>)
Re: CVE Request: foomatic-gui (dave bl <db.pub.mail@...il.com>)
Re: CVE Request: foomatic-gui (Henri Salo <henri@...v.fi>)
CVE-request: KaiBB security vulnerabilities without CVE-IDs (Henri Salo <henri@...v.fi>)
Re: CVE Request: foomatic-gui (Tim Waugh <twaugh@...hat.com>)
Re: libxml security fix from apple ... any information? (Daniel Veillard <veillard@...hat.com>)
CVE-request: FreeBSD/NetBSD/OpenBSD(?) ftpd remote crash (2010) (Henri Salo <henri@...v.fi>)
CVE-request: pithos symlink vulnerability CWE-61 (Henri Salo <henri@...v.fi>)
Re: CVE Request: foomatic-gui (Josh Bressers <bressers@...hat.com>)
Re: CVE-request: FreeBSD/NetBSD/OpenBSD(?) ftpd remote crash (2010) ("Mike O'Connor" <mjo@...o.mi.org>)

August 5 (2 messages)

Re: CVE Request: foomatic-gui (Tim Waugh <twaugh@...hat.com>)
Re: CVE Request: foomatic-gui (dave bl <db.pub.mail@...il.com>)

August 8 (3 messages)

CVE request: heap overflow in tcptrack < 1.4.2 (Vincent Danen <vdanen@...hat.com>)
CVE request: zabbix XSS flaw (Vincent Danen <vdanen@...hat.com>)
CVE request: perf: may parse user-controlled config file (dann frazier <dannf@...ian.org>)

August 9 (8 messages)

Re: CVE request: perf: may parse user-controlled config file (Steve Grubb <sgrubb@...hat.com>)
Re: CVE request: perf: may parse user-controlled config file (Yves-Alexis Perez <corsac@...ian.org>)
Re: cve request: xpdf: insecure tempfile usage in zxpdf script (Josh Bressers <bressers@...hat.com>)
Re: CVE request: heap overflow in tcptrack < 1.4.2 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: zabbix XSS flaw (Josh Bressers <bressers@...hat.com>)
Re: CVE request: perf: may parse user-controlled config file (Josh Bressers <bressers@...hat.com>)
CVE requests: Two kernel issues (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE requests: Two kernel issues (Eugene Teo <eugene@...hat.com>)

August 10 (11 messages)

Re: CVE requests: Two kernel issues (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE requests: Two kernel issues (Eugene Teo <eugene@...hat.com>)
CVE request (and disclosure): ax25d missing setuid return code check (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3 (Thomas Biege <thomas@...e.de>)
[oCERT-2011-002] libavcodec insufficient boundary check (Daniele Bianco <danbia@...rt.org>)
Re: CVE request: perf: may parse user-controlled config file (Steve Grubb <sgrubb@...hat.com>)
Re: [oCERT-2011-002] libavcodec insufficient boundary check (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: [oCERT-2011-002] libavcodec insufficient boundary check (Daniele Bianco <danbia@...rt.org>)
Re: CVE requests: Two kernel issues (Moritz Muehlenhoff <jmm@...ian.org>)
LZW decompression issues (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3 (Tomas Hoger <thoger@...hat.com>)

August 11 (10 messages)

CVE-2011-2907: authentication bypass in torque (Vincent Danen <vdanen@...hat.com>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Eren Türkay <eren@...dus.org.tr>)
Re: CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3 (Thomas Biege <thomas@...e.de>)
Re: CVE request: perf: may parse user-controlled config file (dann frazier <dannf@...nf.org>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Thomas Osterried <thomas@...erried.de>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Ralf Baechle <ralf@...ux-mips.org>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Jon Oberheide <jon@...rheide.org>)
CVE request: improper permissions on ~/.qtnx/*.nxml (Vincent Danen <vdanen@...hat.com>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Solar Designer <solar@...nwall.com>)
CVE Request: Mambo CMS 4.6.x (4.6.5) | SQL Injection (YGN Ethical Hacker Group <lists@...g.net>)

August 12 (11 messages)

Re: CVE requests: Two kernel issues (Eugene Teo <eugene@...hat.com>)
Re: CVE Request: foomatic-gui (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Josh Bressers <bressers@...hat.com>)
Re: CVE request: libmodplug: multiple vulnerabilities reported in <= 0.8.8.3 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: improper permissions on ~/.qtnx/*.nxml (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Mambo CMS 4.6.x (4.6.5) | SQL Injection (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and their… (Tomas Hoger <thoger@...hat.com>)
CVE request: multiple vulnerabilities in dtc (Jonathan Wiltshire <jmw@...ian.org>)
Re: CVE request: multiple vulnerabilities in dtc (Jonathan Wiltshire <jmw@...ian.org>)
Re: CVE Request -- libgssapi, libgssglue -- Ability to load untrusted configuration file, when loading GSS mechanisms and the… (Marcus Meissner <meissner@...e.de>)
Re: CVE requests: Two kernel issues (Yves-Alexis Perez <corsac@...ian.org>)

August 13 (2 messages)

Re: CVE request: multiple vulnerabilities in dtc (Thomas Goirand <thomas@...rand.fr>)
CVE request: two vulnerabilities in ktsuss 1.4 and earlier (John Lightsey <lightsey@...ian.org>)

August 15 (5 messages)

Re: CVE requests: Two kernel issues (Eugene Teo <eugene@...hat.com>)
Re: CVE Request -- foomatic (foomatic-filters): foomatic-rip (debug mode) insecure temporary file use in renderer comma… (Huzaifa Sidhpurwala <huzaifas@...hat.co…)
kernel: ext3/4: ext3/4_symlink lock oops (Eugene Teo <eugene@...hat.com>)
CVE request -- kernel: perf: fix software event overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- foomatic (foomatic-filters): foomatic-rip (debug mode) insecure temporary file use in renderer comma… ("Steven M. Christey" <coley@...-smtp.mi…)

August 16 (2 messages)

Re: CVE request -- kernel: perf: fix software event overflow (Eugene Teo <eugene@...hat.com>)
Re: CVE request: two vulnerabilities in ktsuss 1.4 and earlier (Josh Bressers <bressers@...hat.com>)

August 17 (2 messages)

CVE request: ruby on rails flaws (4) (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request -- foomatic (foomatic-filters): foomatic-rip (debug mode) insecure temporary file use in renderer command … (Josh Bressers <bressers@...hat.com>)

August 18 (8 messages)

CVE Request: WebsiteBaker 2.8.1 <= Arbitrary File Upload Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: WebsiteBaker 2.8.1 <= Cross Site Request Forgery (CSRF) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: Elgg 1.7.10 <= | Multiple Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE request (and disclosure): ax25d missing setuid return code check (Thomas Osterried <thomas@...erried.de>)
CVE request: roundcube XSS before 0.5.4 (Hanno Böck <hanno@...eck.de>)
Start(up) API project security (Sergey Chernyshev <sergey.chernyshev@...il.com>)
CVE request: MantisBT <1.2.7 search.php multiple XSS vulnerabilities (David Hicks <d@...id.au>)
CVE request: heap overflow in perl while decoding Unicode string (Vincent Danen <vdanen@...hat.com>)

August 19 (18 messages)

CVE request: Linux: ZERO_SIZE_PTR dereference for long symlinks in Be FS (Timo Warns <warns@...-sense.de>)
Re: CVE request: GIF loader buffer overflow when initializing decompression tables (Tomas Hoger <thoger@...hat.com>)
CVE request: BusyBox unpack_Z_stream() buffer underflow (Alex Legler <a3li@...too.org>)
Re: CVE request: BusyBox unpack_Z_stream() buffer underflow (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: Linux: ZERO_SIZE_PTR dereference for long symlinks in Be FS (Eugene Teo <eugene@...hat.com>)
CVE request: stunnel 4.4x heap overflow flaw (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: coppermine gallery < 1.4.26 (Josh Bressers <bressers@...hat.com>)
Re: CVE-request: KaiBB security vulnerabilities without CVE-IDs (Josh Bressers <bressers@...hat.com>)
Re: CVE-request: FreeBSD/NetBSD/OpenBSD(?) ftpd remote crash (2010) (Josh Bressers <bressers@...hat.com>)
Re: CVE-request: pithos symlink vulnerability CWE-61 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: ruby on rails flaws (4) (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: WebsiteBaker 2.8.1 <= Arbitrary File Upload Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: WebsiteBaker 2.8.1 <= Cross Site Request Forgery (CSRF) Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Elgg 1.7.10 <= | Multiple Vulnerabilities (Josh Bressers <bressers@...hat.com>)
Re: CVE request: roundcube XSS before 0.5.4 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: MantisBT <1.2.7 search.php multiple XSS vulnerabilities (Josh Bressers <bressers@...hat.com>)
Re: CVE request: heap overflow in perl while decoding Unicode string (Josh Bressers <bressers@...hat.com>)
Re: CVE request: stunnel 4.4x heap overflow flaw (Josh Bressers <bressers@...hat.com>)

August 20 (2 messages)

Re: CVE request: ruby on rails flaws (4) (Vincent Danen <vdanen@...hat.com>)
CVE request: Pidgin crash (Mark Doliner <mark@...gant.net>)

August 22 (14 messages)

Re: CVE request: Pidgin crash (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request: Pidgin crash (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request: Pidgin crash (Mark Doliner <mark@...gant.net>)
Re: CVE request: Pidgin crash (Mark Doliner <mark@...gant.net>)
Re: CVE request: ruby on rails flaws (4) (Matthias Weckbecker <mweckbecker@...e.de>)
CVE request: libqt4: two memory issues (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: Pidgin crash (Moritz Mühlenhoff <jmm@...til.org>)
CVE Request: Concrete CMS 5.4.1.1 <= Cross Site Scripting (YGN Ethical Hacker Group <lists@...g.net>)
CVE assignment php NULL pointer dereference - CVE-2011-3182 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: Pidgin crash (Mark Doliner <mark@...gant.net>)
Re: CVE Request: Concrete CMS 5.4.1.1 <= Cross Site Scripting (Josh Bressers <bressers@...hat.com>)
Re: CVE request: Pidgin crash (Josh Bressers <bressers@...hat.com>)
Re: CVE request: ruby on rails flaws (4) (Josh Bressers <bressers@...hat.com>)
Re: CVE request: ruby on rails flaws (4) (Josh Bressers <bressers@...hat.com>)

August 23 (4 messages)

CVE request: kernel: change in how tcp seq numbers are generated (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: change in how tcp seq numbers are generated (Petr Matousek <pmatouse@...hat.com>)
lxc + fscaps (Sebastian Krahmer <krahmer@...e.de>)
CVE assignment - PHP salt flaw CVE-2011-3189 (Josh Bressers <bressers@...hat.com>)

August 24 (10 messages)

CVE request: kernel: cifs: singedness issue in CIFSFindNext() (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: cifs: singedness issue in CIFSFindNext() (Eugene Teo <eugene@...hat.com>)
CVE assignment Apache httpd multiple-range DoS ("Apache Killer") - CVE-2011-3192 (Mark J Cox <mjc@...hat.com>)
Re: CVE request: multiple vulnerabilities in dtc (Jonathan Wiltshire <jmw@...ian.org>)
Re: CVE request: libqt4: two memory issues (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: kernel: cifs: singedness issue in CIFSFindNext() (David Jorm <djorm@...hat.com>)
lightdm issues (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE request: libqt4: two memory issues (Josh Bressers <bressers@...hat.com>)
Re: Re: CVE request: multiple vulnerabilities in dtc (Josh Bressers <bressers@...hat.com>)
Re: Re: CVE request: multiple vulnerabilities in dtc (Josh Bressers <bressers@...hat.com>)

August 25 (2 messages)

Re: CVE request: libqt4: two memory issues (Tomas Hoger <thoger@...hat.com>)
Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Yves-Alexis Perez <corsac@...ian.org>)

August 26 (9 messages)

Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Sebastian Krahmer <krahmer@...e.de>)
Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Yves-Alexis Perez <corsac@...ian.org>)
Re: lightdm issues (Robert Ancell <robert.ancell@...onical.com>)
CVE Assignment - evolution CVE-2011-3201 (Josh Bressers <bressers@...hat.com>)
CVE Request: Jcow CMS 4.2 <= | Cross Site Scripting (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution (YGN Ethical Hacker Group <lists@...g.net>)
Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Solar Designer <solar@...nwall.com>)
Security issue in hammerhead (Jamie Strandboge <jamie@...onical.com>)

August 29 (2 messages)

Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Yves-Alexis Perez <corsac@...ian.org>)
CVE-request(?): squid: buffer overflow in Gopher reply parser (Matthias Weckbecker <mweckbecker@...e.de>)

August 30 (10 messages)

kernel: CVE-2011-2482/2519 (Eugene Teo <eugene@...hat.com>)
kernel: xen: CVE-2011-2901 (Petr Matousek <pmatouse@...hat.com>)
Closed List (John Haxby <john.haxby@...cle.com>)
Re: CVE-request(?): squid: buffer overflow in Gopher reply parser (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: Jcow CMS 4.2 <= | Cross Site Scripting (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution (Josh Bressers <bressers@...hat.com>)
Re: Security issue in hammerhead (Josh Bressers <bressers@...hat.com>)
Re: CVE-request(?): squid: buffer overflow in Gopher reply parser (Josh Bressers <bressers@...hat.com>)
Re: Closed List (Solar Designer <solar@...nwall.com>)
Re: Closed List (John Haxby <john.haxby@...cle.com>)

August 31 (1 message)

Re: CVE request: heap overflow in tcptrack < 1.4.2 ("Steven M. Christey" <coley@...-smtp.mitre.org>)

164 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.