oss-security mailing list - 2012/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2012/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 4	² 8	³ 4	⁴ 21	⁵ 3	⁶ 1
⁷ 14	⁸ 8	⁹ 10	¹⁰ 7	¹¹ 11	¹² 8	¹³ 4
¹⁴ 3	¹⁵ 12	¹⁶ 2	¹⁷ 3	¹⁸ 16	¹⁹ 2	²⁰ 5
²¹ 3	²² 13	²³ 18	²⁴ 14	²⁵ 7	²⁶	²⁷
²⁸ 2	²⁹ 11	³⁰ 15	³¹ 5

Messages by day:

May 1 (4 messages)

Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) (Florian Weimer <fw@...eb.enyo.de>)
Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE-request: SilverStripe before 2.4.4 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: spip before 1.9.2.o, 2.0.18 and 2.1.13 multiple XSS (Kurt Seifried <kseifried@...hat.com>)

May 2 (8 messages)

Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Solar Designer <solar@...nwall.com>)
Re: CVE Request: libsoup 2.32.2 sets ssl trusted flag despite no verification (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca() (Steve Grubb <sgrubb@...hat.com>)
CVE Request: dhcpcd 3.2.3 remote stack overflow / denial of service (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: dhcpcd 3.2.3 remote stack overflow / denial of service (Kurt Seifried <kseifried@...hat.com>)
temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles (cve-assign@...re.org)
Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: libsoup 2.32.2 sets ssl trusted flag despite no verification (Vincent Danen <vdanen@...hat.com>)

May 3 (4 messages)

CVE Request for Drupal contributed modules (Greg Knaddison <greg.knaddison@...uia.com>)
Re: CVE Request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Marcus Meissner <meissner@...e.de>)
Security issue in libav/ffmpeg (Jamie Strandboge <jamie@...onical.com>)

May 4 (21 messages)

CVE Request: more tight ioctl permissions in dl2k driver (Marcus Meissner <meissner@...e.de>)
Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based) (Henri Salo <henri@...v.fi>)
Re: CVE Request: more tight ioctl permissions in dl2k driver (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Steve Beattie <steve@...w.org>)
Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Ludwig Nussel <ludwig.nussel@...e.de>)
Debian/Ubuntu php_crypt_revamped.patch (Solar Designer <solar@...nwall.com>)
Re: CVE Request: more tight ioctl permissions in dl2k driver (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- anaconda: Weak permissions by writing password configuration file in bootloader configuration module (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Debian/Ubuntu php_crypt_revamped.patch (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- anaconda: Weak permissions by writing password configuration file in bootloader configuration module (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based) (Kurt Seifried <kseifried@...hat.com>)
Re: Debian/Ubuntu php_crypt_revamped.patch (Solar Designer <solar@...nwall.com>)
Re: Debian/Ubuntu php_crypt_revamped.patch (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Debian/Ubuntu php_crypt_revamped.patch (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Marcus Meissner <meissner@...e.de>)
PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) (Solar Designer <solar@...nwall.com>)
Re: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: more tight ioctl permissions in dl2k driver (Florian Weimer <fw@...eb.enyo.de>)
Re: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) ("Mike O'Connor" <mjo@...o.mi.org>)

May 5 (3 messages)

[OSSA 2012-006] Horizon session fixation and reuse (Russell Bryant <rbryant@...hat.com>)
Re: Debian/Ubuntu php_crypt_revamped.patch (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: evolution-data-server lacks SSL checking in its libsoup users (Kurt Seifried <kseifried@...hat.com>)

May 6 (1 message)

Re: CVE id request for links2 (Kurt Seifried <kseifried@...hat.com>)

May 7 (14 messages)

CVE request: A Pidgin remote crash (Mark Doliner <mark@...gant.net>)
connman heads up / CVE requests (Sebastian Krahmer <krahmer@...e.de>)
CVE request: Linux kernel: Buffer overflow in HFS plus filesystem (Timo Warns <warns@...-sense.de>)
Re: CVE Request: more tight ioctl permissions in dl2k driver (Marcus Meissner <meissner@...e.de>)
Re: connman heads up / CVE requests (Jan Lieskovsky <jlieskov@...hat.com>)
Re: connman heads up / CVE requests (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE request: A Pidgin remote crash (Kurt Seifried <kseifried@...hat.com>)
CVE Request: Pidgin XMPP remote crash (#62) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Pidgin XMPP remote crash (#62) (Kurt Seifried <kseifried@...hat.com>)
Re: connman heads up / CVE requests (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Linux kernel: Buffer overflow in HFS plus filesystem (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Pidgin XMPP remote crash (#62) (Kurt Seifried <kseifried@...hat.com>)
CVE request: mybb before 1.6.7 (Hanno Böck <hanno@...eck.de>)
Re: CVE request: mybb before 1.6.7 (Kurt Seifried <kseifried@...hat.com>)

May 8 (8 messages)

Re: CVE Request -- kernel: futex: clear robust_list on execve (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- kernel: futex: clear robust_list on execve (Solar Designer <solar@...nwall.com>)
CVE-request: MyBB before 1.6.1 (Henri Salo <henri@...v.fi>)
CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure (Alex Legler <a3li@...too.org>)
CVE request: Piwik before 1.7 (Hanno Böck <hanno@...eck.de>)
CVE request: XSS and SQL injection in serendipity before 1.7.1 (Hanno Böck <hanno@...eck.de>)
Re: CVE-request: MyBB before 1.6.1 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: node.js <0.6.17/0.7.8 HTTP server information disclosure (Kurt Seifried <kseifried@...hat.com>)

May 9 (10 messages)

Re: CVE request: Piwik before 1.7 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: XSS and SQL injection in serendipity before 1.7.1 (Kurt Seifried <kseifried@...hat.com>)
Re: connman heads up / CVE requests (Sebastian Krahmer <krahmer@...e.de>)
Re: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) (Tomas Hoger <thoger@...hat.com>)
CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port (Stefan Cornelius <scorneli@...hat.com>)
Re: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) (cve-assign@...re.org)
Re: CVE Request -- kernel: futex: clear robust_list on execve (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- kernel: futex: clear robust_list on execve (Petr Matousek <pmatouse@...hat.com>)
Re: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) (Kurt Seifried <kseifried@...hat.com>)
Re: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827) (Vincent Danen <vdanen@...hat.com>)

May 10 (7 messages)

Re: CVE Request -- kernel: futex: clear robust_list on execve (Solar Designer <solar@...nwall.com>)
Re: CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port (Solar Designer <solar@...nwall.com>)
CVE-request: phpMyFAQ default password 1.3.2 (Henri Salo <henri@...v.fi>)
Re: CVE-request: phpMyFAQ default password 1.3.2 (Kurt Seifried <kseifried@...hat.com>)
CVE-request: galette sql injection (Johan Cwiklinski <mailings@...nd.be>)
CVE Request for Drupal contributed modules - 2012-05-10 (Greg Knaddison <greg.knaddison@...uia.com>)
CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (Henri Salo <henri@...v.fi>)

May 11 (11 messages)

Re: CVE-request: galette sql injection (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal contributed modules - 2012-05-10 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (Kurt Seifried <kseifried@...hat.com>)
OpenSSL invalid TLS/DTLS record attack (CVE-2012-2333) (Solar Designer <solar@...nwall.com>)
bug in OpenSSL's CVE-2012-0884 fix (Solar Designer <solar@...nwall.com>)
CVE-2012-1597: XSS in eZ Publish (Luc ABRIC <luc.abric@...ida.fr>)
CVE request: sympa (micah anderson <micah@...eup.net>)
CVE request: sympa (try again) (micah <micah@...eup.net>)
CVE request: mahara (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (Moritz Muehlenhoff <jmm@...ian.org>)
CVE request: pam_shield (Jonathan Niehof <jtniehof@...il.com>)

May 12 (8 messages)

ezmlm signature mangling [was: Re: CVE request: sympa (try again)] (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: CVE request: sympa (try again) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: pam_shield (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: mahara (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: sympa (try again) (micah anderson <micah@...eup.net>)
Re: ezmlm signature mangling [was: Re: CVE request: sympa (try again)] (Solar Designer <solar@...nwall.com>)
Re: CVE request: sympa (try again) (Kurt Seifried <kseifried@...hat.com>)

May 13 (4 messages)

Re: CVE request: Piwik before 1.7 (Henri Salo <henri@...v.fi>)
Re: CVE request: Piwik before 1.7 (Hanno Böck <hanno@...eck.de>)
Re: CVE request: Piwik before 1.7 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Piwik before 1.7 (Nicob <nicob@...ob.net>)

May 14 (3 messages)

CVE request: Bytemark Symbiosis (Steve Kemp <steve@...ve.org.uk>)
socat security advisory (Gerhard Rieger <gerhard@...t-unreach.org>)
Re: CVE request: Bytemark Symbiosis (Kurt Seifried <kseifried@...hat.com>)

May 15 (12 messages)

Automatic binary hardening with Autoconf (Solar Designer <solar@...nwall.com>)
Using FreeBSD Capsicum for program and library sandboxing (Solar Designer <solar@...nwall.com>)
Re: Using FreeBSD Capsicum for program and library sandboxing (Ben Laurie <benl@...gle.com>)
Re: Automatic binary hardening with Autoconf (Steve Grubb <sgrubb@...hat.com>)
Re: Automatic binary hardening with Autoconf (Steve Grubb <sgrubb@...hat.com>)
Re: Automatic binary hardening with Autoconf (Marcus Meissner <meissner@...e.de>)
Re: Automatic binary hardening with Autoconf (Sebastian Krahmer <krahmer@...e.de>)
CVE Request: gdk-pixbuf Integer overflow in XBM file loader (Sean Amoss <ackle@...too.org>)
Re: CVE Request: gdk-pixbuf Integer overflow in XBM file loader (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: sympa (try again) (micah anderson <micah@...eup.net>)
Re: CVE request: sympa (try again) (Kurt Seifried <kseifried@...hat.com>)
CVE-request: WordPress wp-facethumb plugin reflected XSS vulnerability (Henri Salo <henri@...v.fi>)

May 16 (2 messages)

Re: CVE-request: WordPress wp-facethumb plugin reflected XSS vulnerability (Kurt Seifried <kseifried@...hat.com>)
Format string security flaw in pidgin-otr (Ian Goldberg <iang@...uwaterloo.ca>)

May 17 (3 messages)

CVE Request: Planeshift buffer overflow (Andres Gomez <agomez@...idsignal.com>)
Re: CVE Request: Planeshift buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Planeshift buffer overflow (Andres Gomez <agomez@...idsignal.com>)

May 18 (16 messages)

Re: CVE Request: Planeshift buffer overflow (Kurt Seifried <kseifried@...hat.com>)
100 bugs in Open Source C/C++ projects (Eugene Teo <eugene@...hat.com>)
Re: CVE Request: Planeshift buffer overflow (Andres Gomez <agomez@...idsignal.com>)
Re: CVE Request: Planeshift buffer overflow (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- kernel: mm: read_pmd_atomic: 32bit PAE pmd walk vs pmd_populate SMP race condition (Petr Matousek <pmatouse@...hat.com>)
CVE Request -- Tornado (python-tornado): Tornado v2.2.1 tornado.web.RequestHandler.set_header() fix to prevent header inje… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- kernel: incomplete fix for CVE-2011-4131 (Petr Matousek <pmatouse@...hat.com>)
sudo: IP addresses in sudoers with netmask may match additional hosts (CVE-2012-2337) (Solar Designer <solar@...nwall.com>)
Re: sudo: IP addresses in sudoers with netmask may match additional hosts (CVE-2012-2337) (Jan Lieskovsky <jlieskov@...hat.com>)
CVE-2012-2759 WordPress Login With Ajax plugin re-enlistment XSS (cve-assign@...re.org)
Re: CVE Request -- kernel: mm: read_pmd_atomic: 32bit PAE pmd walk vs pmd_populate SMP race condition (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Tornado (python-tornado): Tornado v2.2.1 tornado.web.RequestHandler.set_header() fix to prevent header … (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: incomplete fix for CVE-2011-4131 (Kurt Seifried <kseifried@...hat.com>)
CVE-2012-2762 Serendipity include/functions_trackbacks.inc.php SQL injection (cve-assign@...re.org)
CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot subm… (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot s… (Kurt Seifried <kseifried@...hat.com>)

May 19 (2 messages)

Re: libupnp buffer overflows (Henri Salo <henri@...v.fi>)
RE: libupnp buffer overflows (<fabrice.fontaine@...nge.com>)

May 20 (5 messages)

CVE Request: PHP 5.4.3 on Windows com_print_typeinfo() Buffer Overflow (?) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: PHP 5.4.3 on Windows com_print_typeinfo() Buffer Overflow (?) (Kurt Seifried <kseifried@...hat.com>)
Acuity CMS 2.6.x <= Path Traversal Arbitrary File Access (YGN Ethical Hacker Group <lists@...g.net>)
Acuity CMS 2.6.x <= Arbitrary File Upload (YGN Ethical Hacker Group <lists@...g.net>)
CVE request: PHP Phar - arbitrary code execution (Felipe Pena <felipensp@...il.com>)

May 21 (3 messages)

CVE Request: some drm overflow checks (Marcus Meissner <meissner@...e.de>)
Re: CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot … (Michael Gilbert <mgilbert@...ian.org>)
CVE-2011-3102 / libxml2 (Moritz Muehlenhoff <jmm@...ian.org>)

May 22 (13 messages)

CVE request: Serendipity before 1.6.2 SQL Injection (Hanno Böck <hanno@...eck.de>)
Re: CVE-2011-3102 / libxml2 (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: Serendipity before 1.6.2 SQL Injection (Henri Salo <henri@...v.fi>)
Re: [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP options (maximilian attems <max@...o.at>)
Re: CVE request: Serendipity before 1.6.2 SQL Injection (Hanno Böck <hanno@...eck.de>)
CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in ter… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Re: [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP options (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: some drm overflow checks (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: PHP Phar - arbitrary code execution (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot s… (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP options (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in term… (Keith Winstein <keithw@....EDU>)

May 23 (18 messages)

Re: Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameter… (Kurt Seifried <kseifried@...hat.com>)
Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials (Matthias Weckbecker <mweckbecker@...e.de>)
CVE request: cobbler command injection (David Black <disclosure@....org>)
Re: CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in … (Behdad Esfahbod <behdad@...dad.org>)
CVE Request -- kernel: huge pages: memory leak on mmap failure (Petr Matousek <pmatouse@...hat.com>)
CVE request: Multiple vulnerabilities in LogAnalyzer (Filippo Cavallarin <filippo.cavallarin@...seq.it>)
CVE request: Multiple vulnerabilities in LogAnalyzer (Filippo Cavallarin <filippo.cavallarin@...seq.it>)
CVE Request -- wireshark: wnpa-sec-2012-08, wnpa-sec-2012-09, wnpa-sec-2012-10 (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials (Matthias Weckbecker <mweckbecker@...e.de>)
CVE request: haproxy trash buffer overflow flaw (Vincent Danen <vdanen@...hat.com>)
Re: CVE request(?): hostapd: improper file permissions of hostapd's config leaks credentials (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: huge pages: memory leak on mmap failure (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: haproxy trash buffer overflow flaw (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Multiple vulnerabilities in LogAnalyzer (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- wireshark: wnpa-sec-2012-08, wnpa-sec-2012-09, wnpa-sec-2012-10 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: cobbler command injection (Kurt Seifried <kseifried@...hat.com>)

May 24 (14 messages)

CVE-2012-2216 - Social Engine Multiples Vulnerabilities (XSS and CSRF) (Tiago Natel de Moura <natel@...plus.com.br>)
CVE Request: powerdns does not clear supplementary groups (David Black <disclosure@....org>)
Re: CVE Request -- kernel: mm: read_pmd_atomic: 32bit PAE pmd walk vs pmd_populate SMP race condition (akuster <akuster@...sta.com>)
Re: CVE Request -- kernel: mm: read_pmd_atomic: 32bit PAE pmd walk vs pmd_populate SMP race condition (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Steve Grubb <sgrubb@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Miloslav Trmac <mitr@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Solar Designer <solar@...nwall.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Solar Designer <solar@...nwall.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Steve Grubb <sgrubb@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Solar Designer <solar@...nwall.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Steve Grubb <sgrubb@...hat.com>)

May 25 (7 messages)

CVE-2012-2417 - PyCrypto <= 2.5 insecure ElGamal key generation ("Dwayne C. Litzenberger" <dlitz@...tz.net>)
Re: CVE Request: powerdns does not clear supplementary groups (christos@...las.com (Christos Zoulas))
CVE-2011-2906 should have been rejected (kernel non-security issue) (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (David Black <disclosure@....org>)
Re: CVE Request: powerdns does not clear supplementary groups (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: powerdns does not clear supplementary groups (Peter van Dijk <peter.van.dijk@...herlabs.nl>)
Re: CVE Request: powerdns does not clear supplementary groups (Kurt Seifried <kseifried@...hat.com>)

May 28 (2 messages)

Duplicate CVE identifiers (CVE-2012-2391 and CVE-2012-2942) assigned to HAProxy issue (Jan Lieskovsky <jlieskov@...hat.com>)
Kind request to update upstream CVE-2012-2334 advisories they to reflect arbitrary code execution possibility too and OSS … (Jan Lieskovsky <jlieskov@...hat.com>)

May 29 (11 messages)

Re: Kind request to update upstream CVE-2012-2334 advisories they to reflect arbitrary code execution possibility too and … (Jan Lieskovsky <jlieskov@...hat.com>)
linux-distros unsubscriptions (Mark J Cox <mjc@...hat.com>)
Re: [Officesecurity] Kind request to update upstream CVE-2012-2334 advisories they to reflect arbitrary code execution po… (Caolán McNamara <caolanm@...hat.com>)
CVE Request: XXE vulnerability in Restlet (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: linux-distros unsubscriptions (Solar Designer <solar@...nwall.com>)
Re: CVE Request (2002): Linux TCP stack could accept invalid TCP flag combinations (John Haxby <john.haxby@...cle.com>)
CVE id request: Multiple buffer overflow in unixODBC (Felipe Pena <felipensp@...il.com>)
Re: CVE Request (2002): Linux TCP stack could accept invalid TCP flag combinations (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: XXE vulnerability in Restlet (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: XXE vulnerability in Restlet (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)

May 30 (15 messages)

Re: CVE id request: Multiple buffer overflow in unixODBC (Tomas Hoger <thoger@...hat.com>)
CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Update of upstream patch links for AST-2012-007 / CVE-2012-2947 advisory needed (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Henri Salo <henri@...v.fi>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Felipe Pena <felipensp@...il.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Felipe Pena <felipensp@...il.com>)
CVE Request for Drupal contributed modules (Greg Knaddison <greg.knaddison@...uia.com>)

May 31 (5 messages)

ScriptFu Server Buffer Overflow in GIMP <= 2.6 ("Joseph Sheridan" <joe@...ctionis.com>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2661) (Aaron Patterson <tenderlove@...y-lang.org>)
Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660) (Aaron Patterson <tenderlove@...y-lang.org>)

234 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.