oss-security mailing list - 2012/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2012/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 4	² 1	³
⁴ 6	⁵ 4	⁶ 12	⁷ 13	⁸ 2	⁹ 2	¹⁰
¹¹ 6	¹² 5	¹³	¹⁴ 4	¹⁵ 12	¹⁶ 1	¹⁷ 2
¹⁸ 3	¹⁹ 4	²⁰ 1	²¹	²² 2	²³	²⁴ 3
²⁵ 9	²⁶ 4	²⁷ 11	²⁸ 12	²⁹ 4	³⁰ 1

Messages by day:

June 1 (4 messages)

Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)

June 2 (1 message)

Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Stefan Behte <craig@...too.org>)

June 4 (6 messages)

CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version (Jan Lieskovsky <jlieskov@...hat.com>)
Re: fix to CVE-2009-4307 (Xi Wang <xi.wang@...il.com>)
Re: CVE Request for Drupal contributed modules (Greg Knaddison <greg.knaddison@...uia.com>)
Re: CVE Request for Drupal contributed modules (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal contributed modules (Greg Knaddison <greg.knaddison@...uia.com>)

June 5 (4 messages)

memory allocator upstream patches (Xi Wang <xi.wang@...il.com>)
Re: CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version (Kurt Seifried <kseifried@...hat.com>)
BIND: Handling of zero length rdata can cause named to terminate unexpectedly (Solar Designer <solar@...nwall.com>)
CVE request: openldap does not honor TLSCipherSuite configuration option (Vincent Danen <vdanen@...hat.com>)

June 6 (12 messages)

Re: CVE request: openldap does not honor TLSCipherSuite configuration option (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: openldap does not honor TLSCipherSuite configuration option (Henri Salo <henri@...v.fi>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Kurt Seifried <kseifried@...hat.com>)
CVE request: rack-cache caches sensitive headers (Set-Cookie) (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: rack-cache caches sensitive headers (Set-Cookie) (Jan Lieskovsky <jlieskov@...hat.com>)
Arbitrary File Upload/Execution in Collabtive (Mark Hoopes <xync@...c.org>)
CVE-Request: hyper-v daemon (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE request: rack-cache caches sensitive headers (Set-Cookie) (Kurt Seifried <kseifried@...hat.com>)
Re: Arbitrary File Upload/Execution in Collabtive (Kurt Seifried <kseifried@...hat.com>)
Re: Arbitrary File Upload/Execution in Collabtive (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-Request: hyper-v daemon (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-Request: hyper-v daemon (Kurt Seifried <kseifried@...hat.com>)

June 7 (13 messages)

Re: CVE-Request: hyper-v daemon (Greg KH <greg@...ah.com>)
CVE request: Mojarra allows deployed web applications to read FacesContext from other applications (David Jorm <djorm@...hat.com>)
Re: CVE request: Mojarra allows deployed web applications to read FacesContext from other applications (Kurt Seifried <kseifried@...hat.com>)
Some notes on CVE's and group privilege dropping (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE-Request: hyper-v daemon (Marcus Meissner <meissner@...e.de>)
Re: CVE-Request: hyper-v daemon (Greg KH <greg@...ah.com>)
Re: CVE-Request: hyper-v daemon (Marcus Meissner <meissner@...e.de>)
Re: memory allocator upstream patches (Jan Lieskovsky <jlieskov@...hat.com>)
WHMCS 5.0.2> SQLi CVE Request ("Dex" <0x41@...h.ai>)
Re: WHMCS 5.0.2> SQLi CVE Request ("Dex" <0x41@...h.ai>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
Re: memory allocator upstream patches (Kurt Seifried <kseifried@...hat.com>)

June 8 (2 messages)

Re: CVE request: Piwik before 1.7 (Henri Salo <henri@...v.fi>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)

June 9 (2 messages)

CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11 (David Hicks <d@...id.au>)
Security vulnerability in MySQL/MariaDB sql/password.c (Sergei Golubchik <serg@...typrogram.com>)

June 11 (6 messages)

CVE request -- libguestfs: virt-edit doesn't preserve file permissions (Petr Matousek <pmatouse@...hat.com>)
CVE request -- libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored (Kurt Seifried <kseifried@...hat.com>)
Re: Re: WHMCS 5.0.2> SQLi CVE Request (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request -- libguestfs: virt-edit doesn't preserve file permissions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11 (Kurt Seifried <kseifried@...hat.com>)

June 12 (5 messages)

Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation (Xen.org security team <security@....org>)
Xen Security Advisory 8 (CVE-2012-0218) - syscall/enter guest DoS (Xen.org security team <security@....org>)
Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Xen.org security team <security@....org>)
Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694) (Aaron Patterson <tenderlove@...y-lang.org>)
Ruby on Rails SQL Injection (CVE-2012-2695) (Aaron Patterson <tenderlove@...y-lang.org>)

June 14 (4 messages)

CVE request: XSS in uselang http parameter (mediawiki) (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: XSS in uselang http parameter (mediawiki) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Florian Weimer <fw@...eb.enyo.de>)

June 15 (12 messages)

CVE Request: NetworkManager creates an open network when asked to create an adhoc-WPA network (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE Request: NetworkManager creates an open network when asked to create an adhoc-WPA network (Kurt Seifried <kseifried@...hat.com>)
CVE-2012-3345: symlink attack in ioquake3 >= r1773, < r2253 (Simon McVittie <smcv@...ian.org>)
Re: CVE Request: NetworkManager creates an open network when asked to create an adhoc-WPA network (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request for Drupal contributed modules (Henri Salo <henri@...v.fi>)
Re: CVE Request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Giles Coochey <giles@...chey.net>)
Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters … (Stefan Cornelius <scorneli@...hat.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Florian Weimer <fw@...eb.enyo.de>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (John Haxby <john.haxby@...cle.com>)
Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters in… (Kurt Seifried <kseifried@...hat.com>)
CVE request: java hashdos vulnerability (Hanno Böck <hanno@...eck.de>)

June 16 (1 message)

CVE request: phplist before 2.10.18 XSS and sql injection (Hanno Böck <hanno@...eck.de>)

June 17 (2 messages)

Re: CVE request: java hashdos vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: phplist before 2.10.18 XSS and sql injection (Kurt Seifried <kseifried@...hat.com>)

June 18 (3 messages)

CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase through … (Jan Lieskovsky <jlieskov@...hat.com>)
Re: MySQL CVEs (was: Security vulnerability in MySQL/MariaDB sql/password.c) (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase thro… (Kurt Seifried <kseifried@...hat.com>)

June 19 (4 messages)

Joomla! Security News 2012-06-19 (Henri Salo <henri@...v.fi>)
Re: Joomla! Security News 2012-06-19 (Kurt Seifried <kseifried@...hat.com>)
Re: MySQL CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase t… ("Steven M. Christey" <coley@...-smtp.mi…)

June 20 (1 message)

Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Marcus Meissner <meissner@...e.de>)

June 22 (2 messages)

mod_security CVE request (Kurt Seifried <kseifried@...hat.com>)
Re: mod_security CVE request (Kurt Seifried <kseifried@...hat.com>)

June 24 (3 messages)

CVE request: CSRF in eXtplorer (Luciano Bello <luciano@...ian.org>)
CVE request: Full path disclosure in DokuWiki (Felipe Pena <felipensp@...il.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Florian Weimer <fw@...eb.enyo.de>)

June 25 (9 messages)

Re: CVE request: CSRF in eXtplorer (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Full path disclosure in DokuWiki (Kurt Seifried <kseifried@...hat.com>)
Xen vulnerability disclosure process, recent timeline (Solar Designer <solar@...nwall.com>)
CVE Request: viewvc (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Album',… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Alb… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Alb… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: viewvc (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: CSRF in eXtplorer (Moritz Muehlenhoff <jmm@...ian.org>)

June 26 (4 messages)

Re: CVE request: CSRF in eXtplorer (Luciano Bello <luciano@...ian.org>)
XXE in Zend (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
CVE-2012-2639 reject request (duplicate of CVE-2011-4940) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: XXE in Zend (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)

June 27 (11 messages)

Re: CVE request: CSRF in eXtplorer (Kurt Seifried <kseifried@...hat.com>)
Re: XXE in Zend (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- dtach: Memory portion (random stack data) disclosure to the client by unclean client disconnect (Jan Lieskovsky <jlieskov@...hat.com>)
Re: MySQL CVEs (was: Security vulnerability in MySQL/MariaDB sql/password.c) (Tomas Hoger <thoger@...hat.com>)
please verify unusual x.509 constraints are handled (Tavis Ormandy <taviso@...xchg8b.com>)
Re: please verify unusual x.509 constraints are handled (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: please verify unusual x.509 constraints are handled (Tim <tim-security@...tinelchicken.org>)
CVE Request: Kernel [PATCH] NFC: prevent multiple buffer overflows in NCI (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Kernel [PATCH] NFC: prevent multiple buffer overflows in NCI (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal contributed modules ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE request: arbitrary code exec in bcfg2 (Vincent Danen <vdanen@...hat.com>)

June 28 (12 messages)

Re: CVE request: arbitrary code exec in bcfg2 (Kurt Seifried <kseifried@...hat.com>)
PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Kurt Seifried <kseifried@...hat.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Pierre Joye <pierre.php@...il.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Matthias Weckbecker <mweckbecker@...e.de>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Kurt Seifried <kseifried@...hat.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Johannes Schlüter <johannes@....net>)
Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Stuart Henderson <stu@...cehopper.org>)
RE: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Zeev Suraski <zeev@...d.com>)
accountsservice local file disclosure flaw (CVE-2012-2737) (Vincent Danen <vdanen@...hat.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 ("Oden Eriksson" <oeriksson@...driva.com>)
Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Kurt Seifried <kseifried@...hat.com>)
Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Rasmus Lerdorf <rasmus@...dorf.com>)

June 29 (4 messages)

Re: CVE Request -- dtach: Memory portion (random stack data) disclosure to the client by unclean client disconnect (Kurt Seifried <kseifried@...hat.com>)
Irfanview Plugins JLS Decompression ("Joseph Sheridan" <joe@...ctionis.com>)
GIMP FIT File Format DoS ("Joseph Sheridan" <joe@...ctionis.com>)
RE: GIMP FIT File Format DoS ("Morris, Patrick" <patrick.morris@...com>)

June 30 (1 message)

Re: RE: GIMP FIT File Format DoS (Benji <me@...ji.com>)

128 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.