oss-security mailing list - 2011/10

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	² 1
³ 4	⁴ 10	⁵ 11	⁶ 3	⁷ 11	⁸ 2	⁹ 5
¹⁰ 12	¹¹ 1	¹² 5	¹³ 3	¹⁴ 3	¹⁵ 2	¹⁶ 3
¹⁷ 7	¹⁸ 17	¹⁹ 8	²⁰ 16	²¹ 4	²² 3	²³
²⁴ 11	²⁵ 4	²⁶ 16	²⁷ 9	²⁸ 16	²⁹ 3	³⁰ 5
³¹ 6

Messages by day:

October 1 (2 messages)

libpurple vulnerability disclosure and fix (Ethan Blanton <elb@....com>)
Re: rpm/librpm/rpm-python memory corruption pre-verification (Solar Designer <solar@...nwall.com>)

October 2 (1 message)

CVE Request: Joomla! 1.7.0 | Multiple Cross Site Scripting (XSS) Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)

October 3 (4 messages)

CVE Request -- Polipo -- Assertion failure by processing certain HTTP POST / PUT requests (Jan Lieskovsky <jlieskov@...hat.com>)
KDE Security Advisory 20111003-1 published (Jeff Mitchell <mitchell@....org>)
Security issue in OpenStack (nova) (Jamie Strandboge <jamie@...onical.com>)
Request for CVE Identifier for perl code injection vulnerability in Digest->new() (Ramon de C Valle <rcvalle@...hat.com>)

October 4 (10 messages)

CVE Request -- phpPgAdmin -- Multiple XSS flaws fixed in v5.0.3 (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: vTiger CRM 5.2.x <= Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
CVE-2011-3979 being duplicate of CVE-2011-3352 (Jan Lieskovsky <jlieskov@...hat.com>)
Request for linux-distros list membership (Tyler Hicks <tyhicks@...onical.com>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: libpurple vulnerability disclosure and fix (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Joomla! 1.7.0 | Multiple Cross Site Scripting (XSS) Vulnerabilities (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- Polipo -- Assertion failure by processing certain HTTP POST / PUT requests (Josh Bressers <bressers@...hat.com>)
Re: Request for CVE Identifier for perl code injection vulnerability in Digest->new() (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- phpPgAdmin -- Multiple XSS flaws fixed in v5.0.3 (Josh Bressers <bressers@...hat.com>)

October 5 (11 messages)

kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request: vTiger CRM 5.2.x <= Blind SQL Injection Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: vTiger CRM 5.2.x <= Remote Code Execution Vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE Request: vTiger CRM 5.2.x <= Remote Code Execution Vulnerability (Tomas Hoger <thoger@...hat.com>)
CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images (akuster <akuster@...sta.com>)
Request for a CVE identifier: XML-RPC SAX Parser Information Exposure (Ramon de C Valle <rcvalle@...hat.com>)
Request for CVE identifier: Libvoikko NULL Character Improper Input Validation (Ramon de C Valle <rcvalle@...hat.com>)
Re: CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without… (Josh Bressers <bressers@...hat.com>)
Re: Request for a CVE identifier: XML-RPC SAX Parser Information Exposure (Josh Bressers <bressers@...hat.com>)
Re: Request for CVE identifier: Libvoikko NULL Character Improper Input Validation (Josh Bressers <bressers@...hat.com>)

October 6 (3 messages)

Re: CVE Request -- Polipo -- Assertion failure by processing certain HTTP POST / PUT requests (Juliusz Chroboczek <jch@....jussieu.fr>)
[CVE REQUEST] VLC media player: NULL dereference in HTTP server ("Rémi Denis-Courmont" <remi@...lab.net>)
radvd 1.8.2 released with security fixes (Solar Designer <solar@...nwall.com>)

October 7 (11 messages)

CVE Request -- Multiple security issues in various versions of AWStats (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Multiple security issues in various versions of AWStats (Jan Lieskovsky <jlieskov@...hat.com>)
Re: kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: radvd 1.8.2 released with security fixes (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: radvd 1.8.2 released with security fixes (Robert Święcki <robert@...ecki.net>)
Re: radvd 1.8.2 released with security fixes (John Haxby <john.haxby@...cle.com>)
Re: Re: CVE Request -- Polipo -- Assertion failure by processing certain HTTP POST / PUT requests (Vincent Danen <vdanen@...hat.com>)
Re: Re: CVE Request -- Polipo -- Assertion failure by processing certain HTTP POST / PUT requests (Julien Cristau <jcristau@...ian.org>)
Re: Re: CVE Request -- Polipo -- Assertion failure by processing certain HTTP POST / PUT requests (Julien Cristau <jcristau@...ian.org>)
Re: CVE Request -- Multiple security issues in various versions of AWStats ("MustLive" <mustlive@...security.com.ua>)
Re: CVE Request -- Multiple security issues in various versions of AWStats ("MustLive" <mustlive@...security.com.ua>)

October 8 (2 messages)

Re: radvd 1.8.2 released with security fixes (Vasiliy Kulikov <segoon@...nwall.com>)
CVE request: serendipity freetag plugin before 3.30 and probably others (Hanno Böck <hanno@...eck.de>)

October 9 (5 messages)

CVE request: CSRF and file inclusion in usebb before 1.0.12 (Hanno Böck <hanno@...eck.de>)
CVE request: vanilla forums cookie theft, plugin access control (Hanno Böck <hanno@...eck.de>)
CVE request: simple machines forum before 2.0.1 and 1.1.15 (Hanno Böck <hanno@...eck.de>)
CVE Request -- Conky 1.8.1 "/tmp/.cesf" Insecure Temporary File Security Issue (Sean Amoss <failedtosync@...il.com>)
CVE requests: Tahoe-LAFS and atop (Moritz Muehlenhoff <jmm@...ian.org>)

October 10 (12 messages)

CVE ASSIGNMENT CORRECTION -- USE CVE-2011-3590 instead of CVE-2011-2390 [was: Re: kexec-tools: Multiple security flaws by … (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Multiple security issues in various versions of AWStats (Petr Lautrbach <plautrba@...hat.com>)
Re: CVE request: serendipity freetag plugin before 3.30 and probably others (Josh Bressers <bressers@...hat.com>)
Re: CVE request: CSRF and file inclusion in usebb before 1.0.12 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: vanilla forums cookie theft, plugin access control (Josh Bressers <bressers@...hat.com>)
Re: CVE request: simple machines forum before 2.0.1 and 1.1.15 (Josh Bressers <bressers@...hat.com>)
CVE request: XSS in phorum before 5.2.18 (Hanno Böck <hanno@...eck.de>)
Re: CVE Request -- Conky 1.8.1 "/tmp/.cesf" Insecure Temporary File Security Issue (Josh Bressers <bressers@...hat.com>)
CVE request: fluxbb before 1.4.7 (Hanno Böck <hanno@...eck.de>)
Re: CVE requests: Tahoe-LAFS and atop (Josh Bressers <bressers@...hat.com>)
CVE requests: <media-video/vlc-1.0.2: Multiple stack-based buffer overflows in ASF, AVI, MP4 demuxers and https://bugs.g… (Michael Harrison <n0idx80@...il.com>)
Re: CVE Request -- Multiple security issues in various versions of AWStats ("MustLive" <mustlive@...security.com.ua>)

October 11 (1 message)

Please REJECT CVE-2011-1161 (Petr Matousek <pmatouse@...hat.com>)

October 12 (5 messages)

Re: radvd 1.8.2 released with security fixes (Reuben Hawkins <reubenhwk@...il.com>)
Re: radvd 1.8.2 released with security fixes (Vasiliy Kulikov <segoon@...nwall.com>)
Re: radvd 1.8.2 released with security fixes (Vasiliy Kulikov <segoon@...nwall.com>)
Ruby 3.0.10 WEBrick::HTTPRequest X-Forwarded-* (Kurt Seifried <kseifried@...hat.com>)
Ruby 1.9.2-p290 WEBrick::HTTPRequest X-Forwarded-* (Kurt Seifried <kseifried@...hat.com>)

October 13 (3 messages)

Re: radvd 1.8.2 released with security fixes (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request: fluxbb before 1.4.7 (Henri Salo <henri@...v.fi>)
Re: radvd 1.8.2 released with security fixes (Solar Designer <solar@...nwall.com>)

October 14 (3 messages)

CVE request: mplayer SAMI subtitle parsing buffer overflow (Tim Sammut <underling@...too.org>)
Re: radvd 1.8.2 released with security fixes (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: radvd 1.8.2 released with security fixes (Vasiliy Kulikov <segoon@...nwall.com>)

October 15 (2 messages)

Re: radvd 1.8.2 released with security fixes (Reuben Hawkins <reubenhwk@...il.com>)
hardlink(1) has buffer overflows, is unsafe on changing trees (Solar Designer <solar@...nwall.com>)

October 16 (3 messages)

Duplicate CVE assigned: CVE-2011-2708 CVE-2011-2710 (Henri Salo <henri@...v.fi>)
Wrong MLIST link in CVE-2011-3783 (Henri Salo <henri@...v.fi>)
Re: Wrong MLIST link in CVE-2011-3783 (Henri Salo <henri@...v.fi>)

October 17 (7 messages)

Re: Wrong MLIST link in CVE-2011-3783 (Eugene Teo <eugene@...hat.com>)
CVE request: double-free vulnerability in logsurfer (Timo Warns <Warns@...-Sense.DE>)
Re: CVE request: double-free vulnerability in logsurfer (Marcus Meissner <meissner@...e.de>)
Re: CVE request: double-free vulnerability in logsurfer (Timo Warns <warns@...-sense.de>)
CVE request: kernel/AppArmor local denial of service (Marcus Meissner <meissner@...e.de>)
Re: CVE request: kernel/AppArmor local denial of service (Petr Matousek <pmatouse@...hat.com>)
Re: Wrong MLIST link in CVE-2011-3783 ("Steven M. Christey" <coley@...-smtp.mitre.org>)

October 18 (17 messages)

CVE request: recursion level crash in clamav before 0.97.3 (Hanno Böck <hanno@...eck.de>)
Re: Ruby 1.9.2-p290 WEBrick::HTTPRequest X-Forwarded-* (Matthias Weckbecker <mweckbecker@...e.de>)
CVE Request: pam (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Ruby 1.9.2-p290 WEBrick::HTTPRequest X-Forwarded-* (Kurt Seifried <kseifried@...hat.com>)
CVE-request: Joomla 20111001 Core - Information Disclosure (Henri Salo <henri@...v.fi>)
Fwd: X.Org security advisory: xserver locking code issues (Matthieu Herrb <matthieu.herrb@...s.fr>)
MySQL executable comment execution on MySQL slave server (from 2009) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: fluxbb before 1.4.7 (Josh Bressers <bressers@...hat.com>)
Re: CVE request: XSS in phorum before 5.2.18 (Josh Bressers <bressers@...hat.com>)
Re: CVE requests: <media-video/vlc-1.0.2: Multiple stack-based buffer overflows in ASF, AVI, MP4 demuxers and https://bugs… (Josh Bressers <bressers@...hat.com>)
Re: Ruby 1.9.2-p290 WEBrick::HTTPRequest X-Forwarded-* (Josh Bressers <bressers@...hat.com>)
Re: CVE request: mplayer SAMI subtitle parsing buffer overflow (Josh Bressers <bressers@...hat.com>)
Re: CVE request: double-free vulnerability in logsurfer (Josh Bressers <bressers@...hat.com>)
Re: CVE request: recursion level crash in clamav before 0.97.3 (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: pam (Josh Bressers <bressers@...hat.com>)
Re: CVE-request: Joomla 20111001 Core - Information Disclosure (Josh Bressers <bressers@...hat.com>)
Re: MySQL executable comment execution on MySQL slave server (from 2009) (Josh Bressers <bressers@...hat.com>)

October 19 (8 messages)

CVE Request: mplayer RDT parsing integer underlow (Tim Sammut <underling@...too.org>)
CVE Request: FreeBSD kernel (Aurelien Jarno <aurel32@...ian.org>)
CVE request: piwik before 1.6 (Hanno Böck <hanno@...eck.de>)
CVE Request: apt (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE request: piwik before 1.6 ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE request: moodle 2.1.2, 2.0.5, 1.9.14 fixes (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: piwik before 1.6 (Anthon Pang <anthon.pang@...il.com>)
Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws (cve-assign@...re.org)

October 20 (16 messages)

Re: CVE request: piwik before 1.6 (Anthon Pang <anthon.pang@...il.com>)
qemu: CVE-2011-3346 (Petr Matousek <pmatouse@...hat.com>)
PR attack against XML Encryption (Florian Weimer <fw@...eb.enyo.de>)
Re: PR attack against XML Encryption (Jan Lieskovsky <jlieskov@...hat.com>)
Re: PR attack against XML Encryption (Yves-Alexis Perez <corsac@...ian.org>)
Re: hardlink(1) has buffer overflows, is unsafe on changing trees (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: mplayer RDT parsing integer underlow (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: FreeBSD kernel (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: FreeBSD kernel (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: piwik before 1.6 (Josh Bressers <bressers@...hat.com>)
Re: radvd 1.8.2 released with security fixes (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request: apt (Josh Bressers <bressers@...hat.com>)
Re: CVE request: moodle 2.1.2, 2.0.5, 1.9.14 fixes (Josh Bressers <bressers@...hat.com>)
Re: CVE request: moodle 2.1.2, 2.0.5, 1.9.14 fixes (Hanno Böck <hanno@...eck.de>)
Re: CVE Request: mplayer RDT parsing integer underlow (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: moodle 2.1.2, 2.0.5, 1.9.14 fixes (Moritz Mühlenhoff <jmm@...til.org>)

October 21 (4 messages)

Re: hardlink(1) has buffer overflows, is unsafe on changing trees (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: radvd 1.8.2 released with security fixes (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: PR attack against XML Encryption (Florian Weimer <fw@...eb.enyo.de>)
CVE Request -- kernel: ext4: ext4_ext_insert_extent() kernel oops (Petr Matousek <pmatouse@...hat.com>)

October 22 (3 messages)

Re: hardlink(1) has buffer overflows, is unsafe on changing trees (Solar Designer <solar@...nwall.com>)
Re: hardlink(1) has buffer overflows, is unsafe on changing trees (Solar Designer <solar@...nwall.com>)
Re: hardlink(1) has buffer overflows, is unsafe on changing trees (Solar Designer <solar@...nwall.com>)

October 24 (11 messages)

Re: hardlink(1) has buffer overflows, is unsafe on changing trees (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE Request -- kernel: ext4: ext4_ext_insert_extent() kernel oops (Eugene Teo <eugene@...hat.com>)
kernel; CVE-2011-2942 and CVE-2011-3209 (Eugene Teo <eugene@...hat.com>)
CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization (Reed Loden <reed@...dloden.com>)
Re: CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization (Robert Relyea <rrelyea@...hat.com>)
Re: CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization (Elio Maldonado <emaldona@...hat.com>)
CVE request: phpldapadmin <= 1.2.1.1 XSS and and code injection flaws (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: FreeBSD kernel (Eitan Adler <eadler@...ebsd.org>)
Re: CVE Request: FreeBSD kernel (Colin Percival <cperciva@...ebsd.org>)

October 25 (4 messages)

Re: CVE Request -- nss: Did honour /pkcs11.txt and /secmod.db files by initialization (Josh Bressers <bressers@...hat.com>)
Re: CVE request: phpldapadmin <= 1.2.1.1 XSS and and code injection flaws (Kurt Seifried <kseifried@...hat.com>)
CVE request: nova (Jamie Strandboge <jamie@...onical.com>)
Re: CVE request: nova (Kurt Seifried <kseifried@...hat.com>)

October 26 (16 messages)

CVE Request -- kernel: xfs: potential buffer overflow in xfs_readlink() (Petr Matousek <pmatouse@...hat.com>)
CVE Request -- Round Cube Webmail -- DoS (unavailability to access user's INBOX) after receiving an email message with the… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- kernel: xfs: potential buffer overflow in xfs_readlink() (Kurt Seifried <kseifried@...hat.com>)
CVE Request: slapd off by one (Sebastian Krahmer <krahmer@...e.de>)
CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow (Marcus Meissner <meissner@...e.de>)
Re: CVE Request -- Round Cube Webmail -- DoS (unavailability to access user's INBOX) after receiving an email message with… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow (Marcus Meissner <meissner@...e.de>)
CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Vasiliy Kulikov <segoon@...nwall.com>)
CVE-2011-3368 suggested patch incomplete for apache2 < 2.2.18 (Marcus Meissner <meissner@...e.de>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Dan Rosenberg <dan.j.rosenberg@...il.com>)

October 27 (9 messages)

CVE request: kernel: crypto: ghash: null pointer deref if no key is set (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: crypto: ghash: null pointer deref if no key is set (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request -- phpLDAPadmin -- Local file inclusion flaw in "common.php" via "Accept-Language" HTTP header leading to DoS (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- phpLDAPadmin -- Local file inclusion flaw in "common.php" via "Accept-Language" HTTP header leading to … (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE Request: Security issue in backuppc (Jamie Strandboge <jamie@...onical.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Kurt Seifried <kseifried@...hat.com>)

October 28 (16 messages)

Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: CVE request: piwik before 1.6 (Henri Salo <henri@...v.fi>)
Re: CVE request: piwik before 1.6 (Henri Salo <henri@...v.fi>)
CVE request: serendipity before 1.6 backend XSS in karma plugin (Hanno Böck <hanno@...eck.de>)
CVE Request: Multiple remote denial of service in Linux bridge networking code 2.6.37-3.0 (Marcus Meissner <meissner@...e.de>)
CVE Request -- Opera Manipulating fonts in SVG can allow execution of arbitrary code (Sean Amoss <failedtosync@...il.com>)
Re: CVE Request -- Opera Manipulating fonts in SVG can allow execution of arbitrary code (Yves-Alexis Perez <corsac@...ian.org>)
Request for CVE Identifier: bzexe insecure temporary file (Ramon de C Valle <rcvalle@...hat.com>)
Re: Request for CVE Identifier: bzexe insecure temporary file (Hanno Böck <hanno@...eck.de>)
Re: Request for CVE Identifier: bzexe insecure temporary file (Ramon de C Valle <rcvalle@...hat.com>)
Re: Request for CVE Identifier: bzexe insecure temporary file (Benjamin Renaut <benml@...idev.fr>)
Re: Request for CVE Identifier: bzexe insecure temporary file (vladz <vladz@...zero.fr>)
Re: CVE request: serendipity before 1.6 backend XSS in karma plugin (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Multiple remote denial of service in Linux bridge networking code 2.6.37-3.0 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: openldap2 UTF8StringNormalize() can cause a (one-byte) buffer overflow (Ramon de C Valle <rcvalle@...hat.com>)
Re: Request for CVE Identifier: bzexe insecure temporary file (Kurt Seifried <kseifried@...hat.com>)

October 29 (3 messages)

Re: CVE request: serendipity before 1.6 backend XSS in karma plugin (Hanno Böck <hanno@...eck.de>)
Re: CVE request: ffmpeg/libav insufficuent boundary check in CAVS decoding (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE request: ffmpeg/libav insufficuent boundary check in CAVS decoding (Yves-Alexis Perez <corsac@...ian.org>)

October 30 (5 messages)

Re: CVE request: serendipity before 1.6 backend XSS in karma plugin (Kurt Seifried <kseifried@...hat.com>)
Jara 1.6 SQL injection and XSS (Henri Salo <henri@...v.fi>)
CVE request: 3 flaws in libobby and libnet6 (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE request: 3 flaws in libobby and libnet6 (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE request: 3 flaws in libobby and libnet6 (Armin Burgmeier <armin@...ur.net>)

October 31 (6 messages)

Re: CVE request: 3 flaws in libobby and libnet6 (Kurt Seifried <kseifried@...hat.com>)
Re: Jara 1.6 SQL injection and XSS (Kurt Seifried <kseifried@...hat.com>)
Re: Jara 1.6 SQL injection and XSS (Henri Salo <henri@...v.fi>)
Re: Jara 1.6 SQL injection and XSS (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- Squid v3.1.16 -- Invalid free by processing CNAME DNS record pointing to another CNAME record pointing to a… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Squid v3.1.16 -- Invalid free by processing CNAME DNS record pointing to another CNAME record pointing … (Kurt Seifried <kseifried@...hat.com>)

203 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.