oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 1	² 5	³	⁴ 3
⁵ 1	⁶ 3	⁷ 7	⁸ 7	⁹ 11	¹⁰ 1	¹¹ 1
¹²	¹³ 5	¹⁴ 12	¹⁵ 5	¹⁶ 5	¹⁷ 1	¹⁸ 1
¹⁹ 4	²⁰	²¹ 1	²² 8	²³ 6	²⁴ 3	²⁵ 11
²⁶ 6	²⁷ 4	²⁸ 7	²⁹ 9	³⁰ 9

Messages by day:

September 1 (1 message)

CVE request for bcfg2 (remote root) (Jonathan Wiltshire <jmw@...ian.org>)

September 2 (5 messages)

ffmpeg issues (Michael Gilbert <michael.s.gilbert@...il.com>)
Xen Security Advisory 4 (CVE-2011-2901) - Xen 3.3 vaddr validation (Xen.org security team <security@....org>)
Re: ffmpeg issues ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE request for OpenTTD (Michael Lutz <michi+openttd@...sahedron.de>)
Re: ffmpeg issues (Michael Gilbert <michael.s.gilbert@...il.com>)

September 4 (3 messages)

CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS) (David Hicks <d@...id.au>)
Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS) (David Hicks <d@...id.au>)
Please REJECT CVE-2011-2160 and CVE-2011-2162 in ffmpeg as duplicates (was: ffmpeg issues) (Michael Gilbert <michael.s.gilbert@...il.com>)

September 5 (1 message)

Re: [Pkg-xfce-devel] Bug#639151: Bug#639151: Bug#639151: Local privilege escalation (Solar Designer <solar@...nwall.com>)

September 6 (3 messages)

Re: CVE request for bcfg2 (remote root) (Josh Bressers <bressers@...hat.com>)
Re: CVE request for OpenTTD (Josh Bressers <bressers@...hat.com>)
CVE Request: OFED 1.5.2 /proc/net/sdpstats reading local denial of service/crash (Marcus Meissner <meissner@...e.de>)

September 7 (7 messages)

Re: CVE Request: OFED 1.5.2 /proc/net/sdpstats reading local denial of service/crash (Petr Matousek <pmatouse@...hat.com>)
Re: Re: lightdm issues (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request: OFED 1.5.2 /proc/net/sdpstats reading local denial of service/crash (Marcus Meissner <meissner@...e.de>)
CVE Request -- openvas-scanner -- Insecure temporary file use by generation of an OVAL system characteristics document, wh… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE id request: masqmail (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE Request -- openvas-scanner -- Insecure temporary file use by generation of an OVAL system characteristics docum… (Henri Doreau <henri.doreau@...enbone.ne…)
Re: CVE Request -- openvas-scanner -- Insecure temporary file use by generation of an OVAL system characteristics document, when ov… (Tim Brown <timb@...nvas.org>)

September 8 (7 messages)

CVE Request -- libfcgi-perl / perl-FCGI: Certain environment variables shared between first and subsequent HTTP requests (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- libfcgi-perl / perl-FCGI: Certain environment variables shared between first and subsequent HTTP reques… (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS) (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS) (Henri Salo <henri@...v.fi>)
CVE Request -- Zikula (v1.3.x) -- XSS flaw due improper sanitization of 'themename' parameter by setting default, modifyin… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request -- kernel: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Petr Matousek <pmatouse@...hat.com>)
CVE request: Quassel < 0.7.3 CTCP request core DoS (Alex Legler <a3li@...too.org>)

September 9 (11 messages)

CVE Request -- evolution -- Uses insecure (non-SSL) connection when storing the sent message into the Sent folder (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Re: lightdm issues (Josh Bressers <bressers@...hat.com>)
Re: CVE id request: masqmail (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- openvas-scanner -- Insecure temporary file use by generation of an OVAL system characteristics document… (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- Zikula (v1.3.x) -- XSS flaw due improper sanitization of 'themename' parameter by setting default, modi… (Josh Bressers <bressers@...hat.com>)
Re: CVE request -- kernel: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Josh Bressers <bressers@...hat.com>)
Re: CVE request: Quassel < 0.7.3 CTCP request core DoS (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- evolution -- Uses insecure (non-SSL) connection when storing the sent message into the Sent folder (Josh Bressers <bressers@...hat.com>)
Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS) (Josh Bressers <bressers@...hat.com>)
Re: [Openvas-devel] CVE Request -- openvas-scanner -- Insecure temporary file use by generation of an OVAL system charac… ("Jan-Oliver Wagner" <Jan-Oliver.Wagner@…)
Re: [Openvas-devel] CVE Request -- openvas-scanner -- Insecure temporary file use by generation of an OVAL system characteristics d… (Tim Brown <timb@...nvas.org>)

September 10 (1 message)

D-Link DCS-2121 Semicolon Vulnerability (Eren Türkay <eren@...dus.org.tr>)

September 11 (1 message)

CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws (Jan Lieskovsky <jlieskov@...hat.com>)

September 13 (5 messages)

CVE Request: Multiple issues fixed in wireshark 1.6.2 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws ("Thijs Kinkhorst" <thijs@...ian.org>)
CVE Request: BackupPC 3.2.1 fixes cross site scripting ("Thijs Kinkhorst" <thijs@...ian.org>)
CVE request: ffmpeg/libav insufficuent boundary check in CAVS decoding (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: heap overflow in tcptrack < 1.4.2 (Moritz Muehlenhoff <jmm@...ian.org>)

September 14 (12 messages)

CVE request -- kernel: b43: allocate receive buffers big enough for max frame len + offset (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- kernel: b43: allocate receive buffers big enough for max frame len + offset (Eugene Teo <eugene@...hat.com>)
CVE request -- kernel: cifs: always do is_path_accessible check in cifs_mount (Petr Matousek <pmatouse@...hat.com>)
Re: D-Link DCS-2121 Semicolon Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Multiple issues fixed in wireshark 1.6.2 (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: BackupPC 3.2.1 fixes cross site scripting (Josh Bressers <bressers@...hat.com>)
Re: CVE request: ffmpeg/libav insufficuent boundary check in CAVS decoding (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Multiple issues fixed in wireshark 1.6.2 ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request: Multiple issues fixed in wireshark 1.6.2 ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request: Multiple issues fixed in wireshark 1.6.2 (Josh Bressers <bressers@...hat.com>)
Re: CVE request -- kernel: cifs: always do is_path_accessible check in cifs_mount (Josh Bressers <bressers@...hat.com>)

September 15 (5 messages)

unauthorized deletion of file in Tahoe-LAFS ("Zooko O'Whielacronx" <zooko@...ko.com>)
CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws (Henri Salo <henri@...v.fi>)
Re: CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14) ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws (dave bl <db.pub.mail@...il.com>)

September 16 (5 messages)

Is there a maintainer for librsvg ? (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: Is there a maintainer for librsvg ? (Yves-Alexis Perez <corsac@...ian.org>)
closed-list membership transition (Kees Cook <kees@...ntu.com>)
Re: closed-list membership transition (Yves-Alexis Perez <corsac@...ian.org>)
Re: closed-list membership transition (Kees Cook <kees@...ntu.com>)

September 17 (1 message)

Re: closed-list membership transition (Solar Designer <solar@...nwall.com>)

September 18 (1 message)

CVE request: PunBB multiple XSS issues (Henri Salo <henri@...v.fi>)

September 19 (4 messages)

Re: closed-list membership transition (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE request: XSS in status.net before 0.9.9 and 1.0.0beta2 (Hanno Böck <hanno@...eck.de>)
Re: closed-list membership transition (Solar Designer <solar@...nwall.com>)
CVE Request? etherape remote crash (denial of service) (Marcus Meissner <meissner@...e.de>)

September 21 (1 message)

Re: CVE request: kernel: taskstats/procfs io infoleak (Vasiliy Kulikov <segoon@...nwall.com>)

September 22 (8 messages)

Re: CVE Request? etherape remote crash (denial of service) (Josh Bressers <bressers@...hat.com>)
Re: CVE request: XSS in status.net before 0.9.9 and 1.0.0beta2 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: PunBB multiple XSS issues (Josh Bressers <bressers@...hat.com>)
CVE Request -- drupal6-views_bulk_operations: XSS due improper escaping of a vocabulary help (SA-CONTRIB-2011-042) (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- apt (Jamie Strandboge <jamie@...onical.com>)
Re: CVE Request -- apt (Jamie Strandboge <jamie@...onical.com>)
CVE Request: Missing input sanitation in various X GLX calls (Marcus Meissner <meissner@...e.de>)
CVE Request: X.org ProcRenderGlyps input sanitation issue (Marcus Meissner <meissner@...e.de>)

September 23 (6 messages)

Re: CVE Request -- drupal6-views_bulk_operations: XSS due improper escaping of a vocabulary help (SA-CONTRIB-2011-042) (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- apt (Josh Bressers <bressers@...hat.com>)
Re: CVE request -- kernel: cifs: always do is_path_accessible check in cifs_mount (akuster <akuster@...sta.com>)
Re: CVE Request: Missing input sanitation in various X GLX calls (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: X.org ProcRenderGlyps input sanitation issue (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Missing input sanitation in various X GLX calls (Vincent Danen <vdanen@...hat.com>)

September 24 (3 messages)

Re: CVE-request: clamav floating point exception in OLE2 scanner DoS (Henri Salo <henri@...v.fi>)
CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Vincent Danen <vdanen@...hat.com>)
CVE request: heap-based buffer overflow in ldns (Vincent Danen <vdanen@...hat.com>)

September 25 (11 messages)

Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Stas Malyshev <smalyshev@...arcrm.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Stas Malyshev <smalyshev@...arcrm.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Stas Malyshev <smalyshev@...arcrm.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)
RE: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Zeev Suraski <zeev@...d.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Rasmus Lerdorf <rasmus@....net>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)

September 26 (6 messages)

Re: CVE request -- kernel: cifs: always do is_path_accessible check in cifs_mount (Eugene Teo <eugene@...hat.com>)
CVE Request: Advanced Electron Forums (AEF) 1.0.9 <= Cross Site Request Forgery (CSRF) Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Vincent Danen <vdanen@...hat.com>)
CVE requests: Typo3 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Johannes Schlüter <johannes@...lueters.de>)
Re: Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Pierre Joye <pierre.php@...il.com>)

September 27 (4 messages)

CVE Request: samba, cifs-utils (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 (Josh Bressers <bressers@...hat.com>)
rpm/librpm/rpm-python memory corruption pre-verification (Tavis Ormandy <taviso@...xchg8b.com>)
CVE Request: ffmpeg/libav (Marc Deslauriers <marc.deslauriers@...onical.com>)

September 28 (7 messages)

Re: rpm/librpm/rpm-python memory corruption pre-verification (yersinia <yersinia.spiros@...il.com>)
Re: LZW decompression issues (Solar Designer <solar@...nwall.com>)
Re: LZW decompression issues (Solar Designer <solar@...nwall.com>)
Re: LZW decompression issues (Colin Percival <cperciva@...ebsd.org>)
Re: LZW decompression issues (Tomas Hoger <thoger@...hat.com>)
Re: LZW decompression issues (Tavis Ormandy <taviso@...xchg8b.com>)
Re: LZW decompression issues (Florian Weimer <fw@...eb.enyo.de>)

September 29 (9 messages)

Re: LZW decompression issues (Solar Designer <solar@...nwall.com>)
Re: LZW decompression issues (Solar Designer <solar@...nwall.com>)
Re: LZW decompression issues (Tomas Hoger <thoger@...hat.com>)
Re: LZW decompression issues (Tim Zingelman <tez@...bsd.org>)
Re: rpm/librpm/rpm-python memory corruption pre-verification (nicolas vigier <boklm@...s-attacks.org>)
Re: LZW decompression issues (Joerg Sonnenberger <joerg@...tannica.bec.de>)
Re: LZW decompression issues (Solar Designer <solar@...nwall.com>)
Re: LZW decompression issues (Tavis Ormandy <taviso@...xchg8b.com>)
CVE Request -- Zope/Plone -- Unspecified vulnerability in Zope v2.12.x and Zope v2.13.x allowing arbitrary code execution (Jan Lieskovsky <jlieskov@...hat.com>)

September 30 (9 messages)

Firefox: CVE-2011-3867 a dupe of CVE-2011-2998 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: heap-based buffer overflow in ldns (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Advanced Electron Forums (AEF) 1.0.9 <= Cross Site Request Forgery (CSRF) Vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE requests: Typo3 (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: samba, cifs-utils (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: ffmpeg/libav (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- Zope/Plone -- Unspecified vulnerability in Zope v2.12.x and Zope v2.13.x allowing arbitrary code executio… (Josh Bressers <bressers@...hat.com>)
Re: CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14) (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: ffmpeg/libav (Marc Deslauriers <marc.deslauriers@...onical.com>)

137 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.