oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 10	² 11	³ 6	⁴ 14	⁵ 4	⁶ 4
⁷ 11	⁸ 11	⁹ 6	¹⁰ 4	¹¹ 6	¹² 2	¹³ 4
¹⁴ 6	¹⁵ 12	¹⁶ 2	¹⁷ 13	¹⁸ 8	¹⁹ 3	²⁰ 3
²¹ 30	²² 13	²³ 8	²⁴ 7	²⁵ 8	²⁶ 3	²⁷ 5
²⁸ 8	²⁹ 13	³⁰ 6

Messages by day:

November 1 (10 messages)

CVE request: kernel: oom: fix integer overflow of points in oom_badness (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: oom: fix integer overflow of points in oom_badness (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Squid v3.1.16 -- Invalid free by processing CNAME DNS record pointing to another CNAME record pointi… (Henrik Nordström <henrik@...riknordstr…)
libcap/capsh: does not chdir after chroot (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request for Django-piston and Tastypie (David Black <disclosure@....org>)
Re: CVE request for Django-piston and Tastypie (Kurt Seifried <kseifried@...hat.com>)
CVE request for wireshark flaws (Vincent Danen <vdanen@...hat.com>)
Re: CVE request for Django-piston and Tastypie (Vincent Danen <vdanen@...hat.com>)
Re: CVE request for wireshark flaws (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Django-piston and Tastypie (Kurt Seifried <kseifried@...hat.com>)

November 2 (11 messages)

Re: CVE request for Django-piston and Tastypie (David Black <disclosure@....org>)
CVE request for Calibre ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request for Calibre ("Jason A. Donenfeld" <Jason@...c4.com>)
kiwi shell meta char injection (Thomas Biege <thomas@...e.de>)
Re: kiwi shell meta char injection (Thomas Biege <thomas@...e.de>)
Re: [LightDM] Version 1.0.6 released (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: CVE request for Django-piston and Tastypie (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [LightDM] Version 1.0.6 released (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [LightDM] Version 1.0.6 released (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: [LightDM] Version 1.0.6 released (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [LightDM] Version 1.0.6 released (Guido Berhoerster <gber@...nsuse.org>)

November 3 (6 messages)

Re: Re: CVE request for Calibre (Dan Rosenberg <dan.j.rosenberg@...il.com>)
CVE request: wordpress plugin timthumb before 2.0 remote code execution (Hanno Böck <hanno@...eck.de>)
CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: wordpress plugin timthumb before 2.0 remote code execution (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request for Calibre (Kurt Seifried <kseifried@...hat.com>)

November 4 (14 messages)

CVE Request -- Drupal (v6.x based) Views module - SQL injection due improper escaping of database parameters for certain f… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: unsafe use of /tmp in multiple CPAN modules (John Lightsey <john@...nuts.net>)
Re: CVE Request -- Drupal (v6.x based) Views module - SQL injection due improper escaping of database parameters for certa… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: unsafe use of /tmp in multiple CPAN modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: unsafe use of /tmp in multiple CPAN modules (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- kernel: sysctl: restrict write access to dmesg_restrict (Solar Designer <solar@...nwall.com>)
CVE request: Mahara (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: unsafe use of /tmp in multiple CPAN modules (John Lightsey <john@...nuts.net>)
Re: CVE request: unsafe use of /tmp in multiple CPAN modules (John Lightsey <john@...nuts.net>)
Re: CVE request: Mahara (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request for Calibre ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Re: CVE request for Calibre ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Re: CVE request for Calibre ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: Re: CVE request for Calibre ("Jason A. Donenfeld" <Jason@...c4.com>)

November 5 (4 messages)

Re: CVE request: unsafe use of /tmp in multiple CPAN modules (Solar Designer <solar@...nwall.com>)
Re: CVE request: unsafe use of /tmp in multiple CPAN modules (Solar Designer <solar@...nwall.com>)
/proc/$PID/sched PoC: spy-gksu (Vasiliy Kulikov <segooon@...il.com>)
Re: Duplicate CVE assigned: CVE-2011-2708 CVE-2011-2710 (Henri Salo <henri@...v.fi>)

November 6 (4 messages)

Re: Request for CVE Identifier: bzexe insecure temporary file (vladz <vladz@...zero.fr>)
caml-light insecure temporary files (David Holland <dholland-oss-security@...bsd.org>)
Re: Duplicate CVE assigned: CVE-2011-2708 CVE-2011-2710 (Marcus Meissner <meissner@...e.de>)
Re: caml-light insecure temporary files (Florian Weimer <fw@...eb.enyo.de>)

November 7 (11 messages)

Re: Re: CVE request for Calibre (Kurt Seifried <kseifried@...hat.com>)
Re: caml-light insecure temporary files (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request for Calibre ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: caml-light insecure temporary files (Eitan Adler <lists@...anadler.com>)
CVE Request -- pam_yubico -- Authentication bypass via NULL password (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- pam_yubico -- Authentication bypass via NULL password (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- Ruby (OpenSSL extension) -- Insecure way of creation exponent value by private RSA key generation (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Ruby (OpenSSL extension) -- Insecure way of creation exponent value by private RSA key generation (Kurt Seifried <kseifried@...hat.com>)
/proc/interrupts PoC: spy-interrupts (Vasiliy Kulikov <segoon@...nwall.com>)
Fwd: DSA 2338-1 moodle security update (Henri Salo <henri@...v.fi>)
Re: Fwd: DSA 2338-1 moodle security update (jmm@...ian.org)

November 8 (11 messages)

CVE request: kernel: multiple flaws allowing to sniff keystrokes timings (Vasiliy Kulikov <segoon@...nwall.com>)
Re: caml-light insecure temporary files (David Holland <dholland-oss-security@...bsd.org>)
CVE request: Android: vold stack buffer overflow (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request: Android: vold stack buffer overflow (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request: kernel: multiple flaws allowing to sniff keystrokes timings (Eugene Teo <eugene@...hat.com>)
Re: Duplicate CVE assigned: CVE-2011-2708 CVE-2011-2710 (Henri Salo <henri@...v.fi>)
Re: /proc/interrupts PoC: spy-interrupts (David Hicks <d@...id.au>)
potential OpenPAM vulnerability (Sebastian Krahmer <krahmer@...e.de>)
Re: potential OpenPAM vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request: Android: vold stack buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request for Calibre (Kurt Seifried <kseifried@...hat.com>)

November 9 (6 messages)

Re: CVE request: kernel: multiple flaws allowing to sniff keystrokes timings (Eugene Teo <eugene@...hat.com>)
CVE request: gnutls possible DoS (GNUTLS-SA-2011-2) (Vincent Danen <vdanen@...hat.com>)
CVE Request -- libsocialweb -- Untrusted connection opened to Twitter social service without user's approval upon service … (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: gnutls possible DoS (GNUTLS-SA-2011-2) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- libsocialweb -- Untrusted connection opened to Twitter social service without user's approval upon serv… (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [LightDM] Version 1.0.6 released (Marc Deslauriers <marc.deslauriers@...onical.com>)

November 10 (4 messages)

Re: Re: CVE request: Android: vold stack buffer overflow (Nick Kralevich <nnk@...gle.com>)
Re: Re: [LightDM] Version 1.0.6 released (Guido Berhoerster <gber@...nsuse.org>)
CVE Request -- ProFTPD -- Response pool use-after-free flaw (ZDI-CAN-1420) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- ProFTPD -- Response pool use-after-free flaw (ZDI-CAN-1420) (Kurt Seifried <kseifried@...hat.com>)

November 11 (6 messages)

Re: Re: [LightDM] Version 1.0.6 released (Robert Ancell <robert.ancell@...onical.com>)
Re: Re: [LightDM] Version 1.0.6 released (Guido Berhoerster <gber@...nsuse.org>)
Re: Re: [LightDM] Version 1.0.6 released (John Haxby <john.haxby@...cle.com>)
CVE Request -- kernel: nfs4_getfacl decoding kernel oops (Petr Matousek <pmatouse@...hat.com>)
Re: Re: [LightDM] Version 1.0.6 released (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE Request -- kernel: jbd/jbd2: invalid value of first log block leads to oops (Petr Matousek <pmatouse@...hat.com>)

November 12 (2 messages)

Re: CVE Request -- kernel: nfs4_getfacl decoding kernel oops (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: nfs4_getfacl decoding kernel oops (Kurt Seifried <kseifried@...hat.com>)

November 13 (4 messages)

CVE request: cmsmadesimple before 1.9.4.3 - remote database corruption (Hanno Böck <hanno@...eck.de>)
CVE request: ResourceSpace before 4.2.2833 insufficient access check (Hanno Böck <hanno@...eck.de>)
Re: CVE Request -- kernel: nfs4_getfacl decoding kernel oops (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: jbd/jbd2: invalid value of first log block leads to oops (Kurt Seifried <kseifried@...hat.com>)

November 14 (6 messages)

Re: Fwd: DSA 2338-1 moodle security update (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: cmsmadesimple before 1.9.4.3 - remote database corruption (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ResourceSpace before 4.2.2833 insufficient access check (Kurt Seifried <kseifried@...hat.com>)
Did this ArchLinux/shaman thing ever get a CVE? (Kurt Seifried <kseifried@...hat.com>)
Arch Linux Shaman issue (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request -- Squid v3.1.16 -- Invalid free by processing CNAME DNS record pointing to another CNAME record pointi… ("Steven M. Christey" <coley@...-smtp.mi…)

November 15 (12 messages)

glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Solar Designer <solar@...nwall.com>)
weird crypt-sha* in DragonFly BSD (Solar Designer <solar@...nwall.com>)
OpenBSD bcrypt error return (Solar Designer <solar@...nwall.com>)
Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Solar Designer <solar@...nwall.com>)
*BSD's DES-based crypt(3) treats all invalid salt chars as '.' (Solar Designer <solar@...nwall.com>)
Re: *BSD's DES-based crypt(3) treats all invalid salt chars as '.' (Solar Designer <solar@...nwall.com>)
Re: OpenBSD bcrypt error return (Solar Designer <solar@...nwall.com>)
CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting system (diff viewer and screenshot pages components) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting system (diff viewer and screenshot pages componen… (Kurt Seifried <kseifried@...hat.com>)
Re: weird crypt-sha* in DragonFly BSD (Solar Designer <solar@...nwall.com>)
Re: CVE-2011-3368 suggested patch incomplete for apache2 < 2.2.18 (Vincent Danen <vdanen@...hat.com>)
Re: CVE-2011-3368 suggested patch incomplete for apache2 < 2.2.18 (Kurt Seifried <kseifried@...hat.com>)

November 16 (2 messages)

CVE Request: openid4java not properly verifying the signature of Attribute Exchange (AX) information (David Jorm <djorm@...hat.com>)
CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (Solar Designer <solar@...nwall.com>)

November 17 (13 messages)

Re: CVE Request: openid4java not properly verifying the signature of Attribute Exchange (AX) information (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (Solar Designer <solar@...nwall.com>)
Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (Solar Designer <solar@...nwall.com>)
Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Solar Designer <solar@...nwall.com>)
Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Steve Grubb <sgrubb@...hat.com>)
Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (The Fungi <fungi@...goth.org>)
Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Henri Salo <henri@...v.fi>)
CVE Request: nginx resolver heap overflow (Ben Hawkes <hawkes@...a.gen.nz>)
Re: CVE Request: nginx resolver heap overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: nginx resolver heap overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (Vincent Danen <vdanen@...hat.com>)
Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (Solar Designer <solar@...nwall.com>)
Re: CVE-2011-4313: BIND 9 Resolver crashes after logging an error in query.c (Solar Designer <solar@...nwall.com>)

November 18 (8 messages)

linux-distros list setup update (Solar Designer <solar@...nwall.com>)
non-Linux advance notification list (Solar Designer <solar@...nwall.com>)
Re: non-Linux advance notification list (Tim Zingelman <tez@...src.org>)
CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying (Timo Sirainen <tss@....fi>)
CVE Request -- Ruby on Rails / rubygem-actionpack -- XSS in the 'translate' helper method (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Ruby on Rails / rubygem-actionpack -- XSS in the 'translate' helper method (Kurt Seifried <kseifried@...hat.com>)

November 19 (3 messages)

CVE request: ejabberd before 2.1.9 (Hanno Böck <hanno@...eck.de>)
Re: CVE request: ejabberd before 2.1.9 (Kurt Seifried <kseifried@...hat.com>)
Re: closed-list membership transition (Solar Designer <solar@...nwall.com>)

November 20 (3 messages)

CVE request: joomla 1.5 before 1.5.25 password change vulnerability (Hanno Böck <hanno@...eck.de>)
CVE request: websitebaker 2.8.1 and earlier: authentication error in backup module (Hanno Böck <hanno@...eck.de>)
CVE request: drupal before 7.5 access bypass (Hanno Böck <hanno@...eck.de>)

November 21 (30 messages)

Re: CVE request: joomla 1.5 before 1.5.25 password change vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: websitebaker 2.8.1 and earlier: authentication error in backup module (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: drupal before 7.5 access bypass (Kurt Seifried <kseifried@...hat.com>)
CVE-2011-4112 kernel: null ptr deref at dev_queue_xmit+0x35/0x4d0 (Eugene Teo <eugene@...hat.com>)
kernel: hfs: add sanity check for file name length (Eugene Teo <eugene@...hat.com>)
Fwd: Multiple Cross-Site-Scripting vulnerabilities in Dolibarr 3.1.0 (Henri Salo <henri@...v.fi>)
CVE Request (minor) -- gnash -- Unsafe management of HTTP cookies (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: openssh 5.8p2 (Marcus Meissner <meissner@...e.de>)
CVE Request -- kernel: wrong headroom check in udp6_ufo_fragment() (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- kernel: wrong headroom check in udp6_ufo_fragment() (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request: openssh 5.8p2 (Kurt Seifried <kurt@...fried.org>)
Re: CVE Request (minor) -- gnash -- Unsafe management of HTTP cookies (Kurt Seifried <kurt@...fried.org>)
Fwd: Fwd: Multiple Cross-Site-Scripting vulnerabilities in Dolibarr 3.1.0 (Kurt Seifried <kurt@...fried.org>)
Re: kernel: hfs: add sanity check for file name length (Kurt Seifried <kurt@...fried.org>)
Fwd: Support Incident Tracker <= 3.65 (translate.php) Remote Code Execution Vulnerability (Henri Salo <henri@...v.fi>)
CVE-request: LabWiki <= 1.1 Multiple Vulnerabilities (Henri Salo <henri@...v.fi>)
Re: CVE request: drupal before 7.5 access bypass (Moritz Muehlenhoff <jmm@...ian.org>)
Fwd: XSS vulnerability in Joomla 1.6.3 (Henri Salo <henri@...v.fi>)
CVE-2011-4110 kernel: keys: NULL pointer deref in the user-defined key type (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request: drupal before 7.5 access bypass (Kurt Seifried <kseifried@...hat.com>)
Re: Fwd: XSS vulnerability in Joomla 1.6.3 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: LabWiki <= 1.1 Multiple Vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2011-4110 kernel: keys: NULL pointer deref in the user-defined key type (Kurt Seifried <kseifried@...hat.com>)
CVE-request: XSS in Tiki Wiki CMS Groupware (HTB23027) (Henri Salo <henri@...v.fi>)
Re: CVE-request: LabWiki <= 1.1 Multiple Vulnerabilities (Henri Salo <henri@...v.fi>)
Re: Fwd: XSS vulnerability in Joomla 1.6.3 (Henri Salo <henri@...v.fi>)
Re: Fwd: XSS vulnerability in Joomla 1.6.3 - CVE-2011-2710 / CVE-2011-2708 issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: LabWiki <= 1.1 Multiple Vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: Fwd: XSS vulnerability in Joomla 1.6.3 (Kurt Seifried <kseifried@...hat.com>)
CVE-request: Contao 2.10.1 Cross-site scripting vulnerability (Henri Salo <henri@...v.fi>)

November 22 (13 messages)

Re: CVE-request: Contao 2.10.1 Cross-site scripting vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: XSS in Tiki Wiki CMS Groupware (HTB23027) (Kurt Seifried <kseifried@...hat.com>)
Re: Fwd: Support Incident Tracker <= 3.65 (translate.php) Remote Code Execution Vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: Did this ArchLinux/shaman thing ever get a CVE? (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2011-4110 kernel: keys: NULL pointer deref in the user-defined key type (Eugene Teo <eugene@...hat.com>)
Re: CVE-2011-4110 kernel: keys: NULL pointer deref in the user-defined key type (Kurt Seifried <kseifried@...hat.com>)
Fwd: Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003 (Henri Salo <henri@...v.fi>)
CVE-request: Symphony CMS Multiple Cross-Site Scripting and SQL Injection Vulnerabilities (NS-11-008) (Henri Salo <henri@...v.fi>)
Re: CVE-request: Symphony CMS Multiple Cross-Site Scripting and SQL Injection Vulnerabilities (NS-11-008) (Kurt Seifried <kseifried@...hat.com>)
Re: Fwd: Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003 (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [LightDM] Version 1.0.6 released (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: [LightDM] Version 1.0.6 released (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Re: [LightDM] Version 1.0.6 released (Guido Berhoerster <gber@...nsuse.org>)

November 23 (8 messages)

Re: Fwd: XSS vulnerability in Joomla 1.6.3 - CVE-2011-2710 / CVE-2011-2708 issue ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE Request -- 1) Namazu v2.0.21: XSS flaw by processing HTTP cookies 2) Namazu v2.0.20: Stack-based buffer overflow by r… (Jan Lieskovsky <jlieskov@...hat.com>)
Typo in description of CVE-2011-2708 and CVE-2011-4331? [was: Re: Fwd: XSS vulnerability in Joomla 1.6.3 - CVE-2011-2710 /… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: ffmpeg before 0.7.8 and 0.8.7 2 buffer overflows and out-of-bounds read (Hanno Böck <hanno@...eck.de>)
CVE request: jenkins (Jamie Strandboge <jamie@...onical.com>)
Re: CVE request: jenkins (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ffmpeg before 0.7.8 and 0.8.7 2 buffer overflows and out-of-bounds read (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- 1) Namazu v2.0.21: XSS flaw by processing HTTP cookies 2) Namazu v2.0.20: Stack-based buffer overflow … (Kurt Seifried <kseifried@...hat.com>)

November 24 (7 messages)

CVE-2011-4324 kernel: nfsv4: mknod(2) DoS (Eugene Teo <eugene@...hat.com>)
Re: CVE request: ffmpeg before 0.7.8 and 0.8.7 2 buffer overflows and out-of-bounds read (Hanno Böck <hanno@...eck.de>)
Please REJECT CVE-2011-4112 (Petr Matousek <pmatouse@...hat.com>)
Re: Please REJECT CVE-2011-4112 (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Re: Please REJECT CVE-2011-4112 (Petr Matousek <pmatouse@...hat.com>)
CVE request -- kernel: kvm: device assignment DoS (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- kernel: kvm: device assignment DoS (Kurt Seifried <kseifried@...hat.com>)

November 25 (8 messages)

CVE Request: colord sql injections (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE Request: colord sql injections (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request: colord sql injections (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE Request: colord sql injections (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- yaws -- Directory traversal flaw (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- yaws -- Directory traversal flaw (Rob Keith <rkeith@...urityfocus.com>)
Re: CVE Request -- yaws -- Directory traversal flaw (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ffmpeg before 0.7.8 and 0.8.7 2 buffer overflows and out-of-bounds read (Kurt Seifried <kseifried@...hat.com>)

November 26 (3 messages)

Re: non-Linux advance notification list (Solar Designer <solar@...nwall.com>)
Re: non-Linux advance notification list (Joost Hoogendoorn <joost@...ced.nl>)
Re: non-Linux advance notification list (Solar Designer <solar@...nwall.com>)

November 27 (5 messages)

CVE Request -- ClearSilver (neo_cgi) -- Format string flaw by processing CGI error messages in Python module (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- ClearSilver (neo_cgi) -- Format string flaw by processing CGI error messages in Python module (Colin Watson <cjwatson@...ian.org>)
Re: non-Linux advance notification list (Michael Harrison <n0idx80@...il.com>)
Re: non-Linux advance notification list (Solar Designer <solar@...nwall.com>)
Re: non-Linux advance notification list (Solar Designer <solar@...nwall.com>)

November 28 (8 messages)

CVE Request -- python-celery / Celery v2.4 -- Privilege escalation due improper sanitization of --uid and --gid arguments … (Jan Lieskovsky <jlieskov@...hat.com>)
Re: non-Linux advance notification list (Michael Harrison <n0idx80@...il.com>)
Re: non-Linux advance notification list (Alex Legler <a3li@...too.org>)
linux-distros Slackware membership ("Patrick J. Volkerding" <security@...ckware.com>)
Re: CVE Request -- python-celery / Celery v2.4 -- Privilege escalation due improper sanitization of --uid and --gid argume… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- ClearSilver (neo_cgi) -- Format string flaw by processing CGI error messages in Python module (Kurt Seifried <kseifried@...hat.com>)
Re: linux-distros Slackware membership (Solar Designer <solar@...nwall.com>)
CVE assigned for gdb: arbitrary code execution via .debug_gdb_scripts (Kurt Seifried <kseifried@...hat.com>)

November 29 (13 messages)

CVE request: includeViewParameters re-evaluates param/model values as EL expressions on Mojarra/MyFaces (David Jorm <djorm@...hat.com>)
Re: CVE request: includeViewParameters re-evaluates param/model values as EL expressions on Mojarra/MyFaces (Kurt Seifried <kseifried@...hat.com>)
Fwd: Bug script install slackware (Raphael Bastos <tecnologia@...tosservice.com.br>)
Re: Fwd: Bug script install slackware (Kurt Seifried <kseifried@...hat.com>)
Re: Fwd: Bug script install slackware (Solar Designer <solar@...nwall.com>)
CVE request: mediawiki before 1.17.1 (Hanno Böck <hanno@...eck.de>)
Re: Fwd: Bug script install slackware ("Patrick J. Volkerding" <security@...ckware.com>)
CVE Request: lighttpd/mod_auth out-of-bounds read due to signedness error (Stefan Bühler <stbuehler@...httpd.net>)
Re: Fwd: Bug script install slackware (Raphael Bastos <tecnologia@...tosservice.com.br>)
Re: Fwd: Bug script install slackware (Raphael Bastos <tecnologia@...tosservice.com.br>)
Re: Fwd: Bug script install slackware (Solar Designer <solar@...nwall.com>)
Re: CVE request: mediawiki before 1.17.1 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: lighttpd/mod_auth out-of-bounds read due to signedness error (Kurt Seifried <kseifried@...hat.com>)

November 30 (6 messages)

CVE id request: ffmpeg (Nico Golde <oss-security+ml@...lde.de>)
CVE request: Proc::ProcessTable perl module (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: Proc::ProcessTable perl module (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: ffmpeg (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: ffmpeg (Kurt Seifried <kseifried@...hat.com>)
XSSer v1.6 -beta- aka "Grey Swarm!" released. (psy <root@...depsylon.net>)

241 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.