oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 11	² 3	³ 1	⁴ 5
⁵ 2	⁶ 4	⁷ 7	⁸ 9	⁹ 5	¹⁰ 4	¹¹ 1
¹² 5	¹³ 2	¹⁴	¹⁵ 8	¹⁶ 3	¹⁷	¹⁸ 1
¹⁹ 6	²⁰ 4	²¹ 7	²² 7	²³ 8	²⁴ 5	²⁵ 10
²⁶ 3	²⁷ 3	²⁸ 6	²⁹ 8	³⁰ 4	³¹ 4

Messages by day:

December 1 (11 messages)

Re: XSSer v1.6 -beta- aka "Grey Swarm!" released. (Solar Designer <solar@...nwall.com>)
Re: XSSer v1.6 -beta- aka "Grey Swarm!" released. (Kurt Seifried <kseifried@...hat.com>)
Re: XSSer v1.6 -beta- aka "Grey Swarm!" released. (Henri Salo <henri@...v.fi>)
CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Henri Salo <henri@...v.fi>)
CVE-2011-4354 OpenSSL 0.9.8g (32-bit builds) bug leaks ECC private keys (Billy Brumley <billy.brumley@...to.fi>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Kurt Seifried <kseifried@...hat.com>)

December 2 (3 messages)

RE: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability ("Secunia Research" <vuln@...unia.com>)
DOM based XSS in the JBoss AS 7 administration console - CVE-2011-3606 (David Jorm <djorm@...hat.com>)
CSRF in the JBoss AS 7 administration console & HTTP management API - CVE-2011-3609 (David Jorm <djorm@...hat.com>)

December 3 (1 message)

CVE request: CSRF in xt:commerce 3.04 SP2.1 (dishix <dishix@...glemail.com>)

December 4 (5 messages)

CVE Request: ffmpeg (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: ffmpeg (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: CSRF in xt:commerce 3.04 SP2.1 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Hanno Böck <hanno@...eck.de>)
Re: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability (Kurt Seifried <kseifried@...hat.com>)

December 5 (2 messages)

CVE request: glibc: timezone integer overflow (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE Request: ffmpeg (Marc Deslauriers <marc.deslauriers@...onical.com>)

December 6 (4 messages)

C|Net Download.Com is now bundling Nmap with malware! (Henri Salo <henri@...v.fi>)
CVE request: acpid (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: acpid (Kurt Seifried <kseifried@...hat.com>)
acpid - possible issue in socket handling (Kurt Seifried <kseifried@...hat.com>)

December 7 (7 messages)

Re: CVE Request: ffmpeg (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: includeViewParameters re-evaluates param/model values as EL expressions on Mojarra/MyFaces (Kurt Seifried <kseifried@...hat.com>)
Disputing CVE-2011-4122 (Jeff Mitchell <mitchell@....org>)
Re: Disputing CVE-2011-4122 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: glibc: timezone integer overflow (Kurt Seifried <kseifried@...hat.com>)
CVE request: Moodle 1.9.15/2.0.6/2.1.3 releases (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: Moodle 1.9.15/2.0.6/2.1.3 releases (Kurt Seifried <kseifried@...hat.com>)

December 8 (9 messages)

CVE-request WordPress pretty-link plugin 1.5.2 XSS (Henri Salo <henri@...v.fi>)
Re: Disputing CVE-2011-4122 (Jeff Mitchell <mitchell@....org>)
CVE Request -- kernel: send(m)msg: user pointer dereferences (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- kernel: send(m)msg: user pointer dereferences (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request WordPress pretty-link plugin 1.5.2 XSS (Kurt Seifried <kseifried@...hat.com>)
Re: Disputing CVE-2011-4122 (Kurt Seifried <kseifried@...hat.com>)
Re: Disputing CVE-2011-4122 (Jeff Mitchell <mitchell@....org>)
Re: Disputing CVE-2011-4122 (Kurt Seifried <kseifried@...hat.com>)
Re: Disputing CVE-2011-4122 (Jeff Mitchell <mitchell@....org>)

December 9 (5 messages)

Re: non-Linux advance notification list (Solar Designer <solar@...nwall.com>)
CVE Request: icu out of bounds access (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014 (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: icu out of bounds access (Kurt Seifried <kseifried@...hat.com>)

December 10 (4 messages)

CVE request: Pidgin crash (Mark Doliner <mark@...gant.net>)
Re: CVE request: Pidgin crash (Kurt Seifried <kseifried@...hat.com>)
cve request: bat_socket_read memory corruption (Paul <pawlkt@...il.com>)
Re: cve request: bat_socket_read memory corruption (Kurt Seifried <kseifried@...hat.com>)

December 11 (1 message)

Re: cve request: bat_socket_read memory corruption (Paul <pawlkt@...il.com>)

December 12 (5 messages)

Fwd: Re: cve request: bat_socket_read memory corruption (Kurt Seifried <kseifried@...hat.com>)
CVE request: rocksndiamonds world-writable working/config directory (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: rocksndiamonds world-writable working/config directory (Kurt Seifried <kseifried@...hat.com>)
CVE request: putty does not wipe keyboard-interactive replies from memory after authentication (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: putty does not wipe keyboard-interactive replies from memory after authentication (Kurt Seifried <kseifried@...hat.com>)

December 13 (2 messages)

OpenIPMI: IPMI event daemon creates PID file with world writeable permissions (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: linux-distros list setup update (Solar Designer <solar@...nwall.com>)

December 15 (8 messages)

CVE request - kernel: perf, powerpc: Handle events that raise an exception without overflowing (Eugene Teo <eugene@...hat.com>)
Re: CVE request - kernel: perf, powerpc: Handle events that raise an exception without overflowing (Kurt Seifried <kseifried@...hat.com>)
CVE request: bypass default security level of the X wrapper (xserver-xorg <= 1:7.5+8) (vladz <vladz@...zero.fr>)
Security issue in icecast (Jamie Strandboge <jamie@...onical.com>)
RE: [Icecast-dev] Security issue in icecast (<Thomas.Rucker@...to.com>)
Re: RE: [Icecast-dev] Security issue in icecast (Jamie Strandboge <jamie@...onical.com>)
Re: Security issue in icecast (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: bypass default security level of the X wrapper (xserver-xorg <= 1:7.5+8) (Kurt Seifried <kseifried@...hat.com>)

December 16 (3 messages)

TYPO3 typo3-core-sa-2011-004 (Kurt Seifried <kseifried@...hat.com>)
CVE request: zabbix persistent XSS flaw (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: zabbix persistent XSS flaw (Kurt Seifried <kseifried@...hat.com>)

December 18 (1 message)

CVE-request: WordPress advanced-text-widget XSS advancedtext.php?page= (Henri Salo <henri@...v.fi>)

December 19 (6 messages)

CVE for HTML-Template-Pro 0.9506 XSS (Kurt Seifried <kseifried@...hat.com>)
CVE id request: python-virtualenv (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE id request: python-virtualenv (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: python-virtualenv (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE id request: python-virtualenv (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: WordPress advanced-text-widget XSS advancedtext.php?page= (Kurt Seifried <kseifried@...hat.com>)

December 20 (4 messages)

CVE assignment from previous years (Tim Sammut <underling@...too.org>)
CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI, ioctl (Kurt Seifried <kseifried@...hat.com>)
Re: CVE assignment from previous years (Kurt Seifried <kseifried@...hat.com>)
Re: CVE assignment from previous years ("Steven M. Christey" <coley@...-smtp.mitre.org>)

December 21 (7 messages)

Re: CVE assignment from previous years (Kurt Seifried <kseifried@...hat.com>)
plib ulSetError() buffer overflow - CVE-2011-4620 (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- kernel: tight loop and no preemption can cause system stall (Petr Matousek <pmatouse@...hat.com>)
kernel: kvm: pit timer with no irqchip crashes the system (Petr Matousek <pmatouse@...hat.com>)
Re: kernel: kvm: pit timer with no irqchip crashes the system (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- kernel: tight loop and no preemption can cause system stall (Kurt Seifried <kseifried@...hat.com>)
Re: kernel: kvm: pit timer with no irqchip crashes the system (Kurt Seifried <kseifried@...hat.com>)

December 22 (7 messages)

CVE Request -- rsyslog -- DoS due integer signedness error while extending rsyslog counted string buffer (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- rsyslog -- DoS due integer signedness error while extending rsyslog counted string buffer (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- rsyslog -- DoS due integer signedness error while extending rsyslog counted string buffer (Kyle Creyts <kyle.creyts@...il.com>)
Status of two Linux kernel issues w/o CVE assignments (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2011-4127 kernel: possible privilege escalation via SG_IO ioctl (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- rsyslog -- DoS due integer signedness error while extending rsyslog counted string buffer (Jan Lieskovsky <jlieskov@...hat.com>)
CVE-request: WordPress flash-album-gallery plugin facebook.php XSS (Henri Salo <henri@...v.fi>)

December 23 (8 messages)

CVE request: simplesamlphp / Typo3 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE-request: WordPress flash-album-gallery plugin facebook.php XSS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: simplesamlphp / Typo3 (Kurt Seifried <kseifried@...hat.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Kurt Seifried <kseifried@...hat.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Solar Designer <solar@...nwall.com>)
Re: CVE request: simplesamlphp / Typo3 (Moritz Mühlenhoff <jmm@...til.org>)
Re: Disputing CVE-2011-4122 (Solar Designer <solar@...nwall.com>)

December 24 (5 messages)

Re: CVE request: simplesamlphp / Typo3 (Kurt Seifried <kseifried@...hat.com>)
CVE-request 2006: Joomla Web Link Submission title Parameter SQL injection (Henri Salo <henri@...v.fi>)
Re: CVE-request 2006: Joomla Web Link Submission title Parameter SQL injection (Kurt Seifried <kseifried@...hat.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Eugene Teo <eteo@...hat.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Eugene Teo <eteo@...hat.com>)

December 25 (10 messages)

CVE-request for three 2009 Joomla issues (Henri Salo <henri@...v.fi>)
CVE Request for Apache ActiveMQ DoS (David Jorm <djorm@...hat.com>)
CVE-request for three 2009 Joomla issues (second part) (Henri Salo <henri@...v.fi>)
CVE-request: Joomla com_mailto automated mail timeout bypass (2009) (Henri Salo <henri@...v.fi>)
CVE-2011-4862 is not BSD-specific (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE Request for Apache ActiveMQ DoS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request for three 2009 Joomla issues (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request for three 2009 Joomla issues (second part) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: Joomla com_mailto automated mail timeout bypass (2009) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2011-4862 is not BSD-specific (Kurt Seifried <kseifried@...hat.com>)

December 26 (3 messages)

Re: CVE-2011-4862 is not BSD-specific (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE-2011-4862 is not BSD-specific (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE-2011-4862 is not BSD-specific (Huzaifa Sidhpurwala <huzaifas@...hat.com>)

December 27 (3 messages)

Re: Disputing CVE-2011-4122 (Jeff Mitchell <mitchell@....org>)
Re: Status of two Linux kernel issues w/o CVE assignments (Vasiliy Kulikov <segoon@...nwall.com>)
Re: Disputing CVE-2011-4122 (Solar Designer <solar@...nwall.com>)

December 28 (6 messages)

Re: closed-list (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: kernel: multiple issues in ROSE (Kurt Seifried <kseifried@...hat.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Kurt Seifried <kseifried@...hat.com>)
Re: Status of two Linux kernel issues w/o CVE assignments (Kurt Seifried <kseifried@...hat.com>)
Re: Disputing CVE-2011-4122 (Sebastian Krahmer <krahmer@...e.de>)
[oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision (Andrea Barisani <lcars@...rt.org>)

December 29 (8 messages)

More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (Hanno Böck <hanno@...eck.de>)
Re: More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (Kurt Seifried <kseifrie@...hat.com>)
Re: closed-list (Solar Designer <solar@...nwall.com>)
Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision (Solar Designer <solar@...nwall.com>)
Re: Closed list (Solar Designer <solar@...nwall.com>)
Re: More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (David Jorm <djorm@...hat.com>)
Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision (Andrea Barisani <lcars@...rt.org>)
Re: More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (Andrea Barisani <lcars@...rt.org>)

December 30 (4 messages)

Re: More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (Tomas Hoger <thoger@...hat.com>)
CVE-request: Elxis CMS two XSS-vulnerabilities (Henri Salo <henri@...v.fi>)
Re: More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (Hanno Böck <hanno@...eck.de>)
Re: More CVEs? (was Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision) (cve-assign@...re.org)

December 31 (4 messages)

mpack 1.6 allows eavesdropping on mails sent by other users (Sebastian Pipping <sebastian@...ping.org>)
Re: CVE-request: Elxis CMS two XSS-vulnerabilities (Kurt Seifried <kseifrie@...hat.com>)
Re: mpack 1.6 allows eavesdropping on mails sent by other users (Kurt Seifried <kseifrie@...hat.com>)
Re: mpack 1.6 allows eavesdropping on mails sent by other users (Sebastian Pipping <sebastian@...ping.org>)

146 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.