oss-security mailing list - 2012/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2012/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 5	² 4
³ 2	⁴ 4	⁵ 17	⁶ 10	⁷ 16	⁸ 1	⁹ 2
¹⁰ 6	¹¹ 10	¹² 19	¹³ 27	¹⁴ 12	¹⁵ 2	¹⁶ 1
¹⁷ 8	¹⁸ 5	¹⁹ 3	²⁰ 9	²¹ 15	²² 2	²³ 4
²⁴ 9	²⁵ 15	²⁶ 9	²⁷ 6	²⁸ 6	²⁹ 4	³⁰ 1

Messages by day:

September 1 (5 messages)

Re: CVE Request -- wireshark (X >= 1.6.8): DoS (excessive CPU use and infinite loop) in DRDA dissector (Gerald Combs <gerald@...eshark.org>)
Re: CVE Request -- wireshark (X >= 1.6.8): DoS (excessive CPU use and infinite loop) in DRDA dissector (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- wireshark (X >= 1.6.8): DoS (excessive CPU use and infinite loop) in DRDA dissector (Eygene Ryabinkin <rea-sec@...elabs.ru>)
CVE request: Apache Struts S2-010 and S2-011 (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: Apache Struts S2-010 and S2-011 (Kurt Seifried <kseifried@...hat.com>)

September 2 (4 messages)

Re: php header() header injection detection bypass (Kurt Seifried <kseifried@...hat.com>)
Re: CVE - ownCloud (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- kernel: request_module() OOM local DoS (Kurt Seifried <kseifried@...hat.com>)
Re: Information on security issues fixed in ffmpeg 0.11? (Michael Niedermayer <michaelni@....at>)

September 3 (2 messages)

CVE-request: CakePHP XXE injection (Henri Salo <henri@...v.fi>)
Re: CVE-request: CakePHP XXE injection (Kurt Seifried <kseifried@...hat.com>)

September 4 (4 messages)

Re: php header() header injection detection bypass (Eygene Ryabinkin <rea-sec@...elabs.ru>)
Re: php header() header injection detection bypass (cve-assign@...re.org)
Re: Re: php header() header injection detection bypass (Raphael Geissert <geissert@...ian.org>)
CVE request: moinmoin incorrect ACL evaluation for virtual groups (Raphael Geissert <geissert@...ian.org>)

September 5 (17 messages)

(linux-)distros membership changes (Solar Designer <solar@...nwall.com>)
Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups (Kurt Seifried <kseifried@...hat.com>)
Re: Re: php header() header injection detection bypass (Eygene Ryabinkin <rea-sec@...elabs.ru>)
CVE-Request: openstack pickle de-serialization (Sebastian Krahmer <krahmer@...e.de>)
Xen Security Advisory 12 (CVE-2012-3494) - hypercall set_debugreg vulnerability (Xen.org security team <security@....org>)
Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability (Xen.org security team <security@....org>)
Xen Security Advisory 14 (CVE-2012-3496) - XENMEM_populate_physmap DoS vulnerability (Xen.org security team <security@....org>)
Xen Security Advisory 15 (CVE-2012-3497) - multiple TMEM hypercall vulnerabilities (Xen.org security team <security@....org>)
Xen Security Advisory 16 (CVE-2012-3498) - PHYSDEVOP_map_pirq index vulnerability (Xen.org security team <security@....org>)
Xen Security Advisory 17 (CVE-2012-3515) - Qemu VT100 emulation vulnerability (Xen.org security team <security@....org>)
Xen Security Advisory 18 (CVE-2012-3516) - grant table entry swaps have inadequate bounds checking (Xen.org security team <security@....org>)
CVE Request: pidgin lack of SSL checks (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: pidgin lack of SSL checks (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request: pidgin lack of SSL checks (Marcus Meissner <meissner@...e.de>)
Re: php header() header injection detection bypass (cve-assign@...re.org)
Re: CVE-Request: openstack pickle de-serialization (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE - ownCloud ("Steven M. Christey" <coley@...-smtp.mitre.org>)

September 6 (10 messages)

CVE request - mcrypt buffer overflow flaw (Vincent Danen <vdanen@...hat.com>)
Xen Security Advisory 19 - guest administrator can access qemu monitor console (Xen.org security team <security@....org>)
CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine … (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request - mcrypt buffer overflow flaw (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel rout… (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 19 - guest administrator can access qemu monitor console (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 19 - guest administrator can access qemu monitor console (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - mcrypt buffer overflow flaw (Raphael Geissert <geissert@...ian.org>)
Re: CVE request - mcrypt buffer overflow flaw (Vincent Danen <vdanen@...hat.com>)
Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routin… (Eitan Adler <lists@...anadler.com>)

September 7 (16 messages)

Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel rout… (Kurt Seifried <kseifried@...hat.com>)
CVE request: opencryptoki insecure lock files handling (Raphael Geissert <geissert@...ian.org>)
Re: Re: php header() header injection detection bypass (Raphael Geissert <geissert@...ian.org>)
Re: CVE Request -- kernel: net: slab corruption due to improper synchronization around inet->opt (Petr Matousek <pmatouse@...hat.com>)
Xen Security Advisory 19 (CVE-2012-4411) - guest administrator can access qemu monitor console (Xen.org security team <security@....org>)
Re: CVE request: opencryptoki insecure lock files handling (Tomas Hoger <thoger@...hat.com>)
CVE Request -- urllib3: Does not check for SSL certificates by default (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- urllib3: Does not check for SSL certificates by default (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstr… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: opencryptoki insecure lock files handling (Raphael Geissert <geissert@...ian.org>)
Re: CVE Request -- urllib3: Does not check for SSL certificates by default (Andrey Petrov <andrey.petrov@...zow.net>)
Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (u… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel rout… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routin… (Eitan Adler <lists@...anadler.com>)
Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #1… (Jeff Law <law@...hat.com>)
Re: [Xen-users] Xen Security Advisory 17 (CVE-2012-3515) - Qemu VT100 emulation vulnerability ("Nathan March" <nathan@...net>)

September 8 (1 message)

note on gnome shell extensions (Tavis Ormandy <taviso@...xchg8b.com>)

September 9 (2 messages)

Re: note on gnome shell extensions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: opencryptoki insecure lock files handling (Tomas Hoger <thoger@...hat.com>)

September 10 (6 messages)

Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (up… (Florian Weimer <fweimer@...hat.com>)
[PRE-SA-2012-06] FreeRADIUS: Stack Overflow in TLS-based EAP Methods (Timo Warns <Warns@...-Sense.DE>)
Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (up… (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request - mcrypt buffer overflow flaw (Raphael Geissert <geissert@...ian.org>)
Re: note on gnome shell extensions (Vincent Danen <vdanen@...hat.com>)

September 11 (10 messages)

CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) (Jan Lieskovsky <jlieskov@...hat.com>)
CVE-2012-4405 ghostscript, argyllcms: Array index error leading to heap-based bufer OOB write (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE id request: guacd (Nico Golde <oss-security+ml@...lde.de>)
Multiple SQL injections in MySQL/MariaDB (sergii@...em.net)
Re: CVE request - mcrypt buffer overflow flaw (Eygene Ryabinkin <rea-sec@...elabs.ru>)
Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: guacd (Kurt Seifried <kseifried@...hat.com>)
NTP authentication (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE-2012-2238: trytond missing permissions check in button model (Raphael Geissert <geissert@...ian.org>)

September 12 (19 messages)

CVE Request: Apache Axis2 XML Signature Wrapping Attack (David Jorm <djorm@...hat.com>)
Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) (Florian Weimer <fweimer@...hat.com>)
CVEs for wordpress 3.4.2 release (Hanno Boeck <hanno@...eck.de>)
Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) (Jan Lieskovsky <jlieskov@...hat.com>)
CVE id request: tor (Nico Golde <oss-security+ml@...lde.de>)
libdbus CVE-2012-3524 fix (Sebastian Krahmer <krahmer@...e.de>)
[OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Thierry Carrez <thierry@...nstack.org>)
Re: CVE id request: tor (Kurt Seifried <kseifried@...hat.com>)
Re: CVEs for wordpress 3.4.2 release (Kurt Seifried <kseifried@...hat.com>)
Re: [Openstack-announce] [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Matt Joyce <matt@...resistor.com>)
Re: Re: [Openstack-announce] [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Kurt Seifried <kseifried@...hat.com>)
Re: [Openstack] [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Soren Hansen <soren@...ux2go.dk>)
Re: [Openstack] [Openstack-announce] [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Russell Bryant <rbryant@...hat.com>)
Re: [Openstack] [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Dolph Mathews <dolph.mathews@...il.com>)
Re: CVE request - mcrypt buffer overflow flaw (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: opencryptoki insecure lock files handling (Raphael Geissert <geissert@...ian.org>)
Re: CVEs for wordpress 3.4.2 release (Andrew Nacin <nacin@...dpress.org>)
Re: [Openstack] [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413) (Matt Joyce <matt.joyce@...udscaling.com>)
Re: CVE id request: tor (Nico Golde <oss-security+ml@...lde.de>)

September 13 (27 messages)

Re: CVE Request: Apache Axis2 XML Signature Wrapping Attack (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: tor (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) (Kurt Seifried <kseifried@...hat.com>)
Re: CVEs for wordpress 3.4.2 release (Kurt Seifried <kseifried@...hat.com>)
Re: [Openstack] [OSSA 2012-012] Horizon, Open redirect through 'next' parameter (CVE-2012-3540) (andi abes <andi.abes@...il.com>)
Re: note on gnome shell extensions (Tavis Ormandy <taviso@...xchg8b.com>)
Re: [Openstack] [OSSA 2012-012] Horizon, Open redirect through 'next' parameter (CVE-2012-3540) (Kiall Mac Innes <kiall@...agedit.ie>)
Re: note on gnome shell extensions (Marcus Meissner <meissner@...e.de>)
Re: libdbus hardening (Tomas Hoger <thoger@...hat.com>)
Re: note on gnome shell extensions (Vincent Danen <vdanen@...hat.com>)
CVE Request -- libvirt: null function pointer invocation in virNetServerProgramDispatchCall() (Petr Matousek <pmatouse@...hat.com>)
CVE for Virtualbox 0x8 DoS? (Raphael Geissert <geissert@...ian.org>)
Re: CVE for Virtualbox 0x8 DoS? (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- libvirt: null function pointer invocation in virNetServerProgramDispatchCall() (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - mcrypt buffer overflow flaw (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (u… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - mcrypt buffer overflow flaw (Raphael Geissert <geissert@...ian.org>)
Re: libdbus CVE-2012-3524 fix (Kurt Seifried <kseifried@...hat.com>)
Re: note on gnome shell extensions (Tavis Ormandy <taviso@...xchg8b.com>)
Re: CVEs for wordpress 3.4.2 release (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVEs for wordpress 3.4.2 release (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - mcrypt buffer overflow flaw (Kurt Seifried <kseifried@...hat.com>)
Re: Re: note on gnome shell extensions (Vincent Danen <vdanen@...hat.com>)
CVE request: DoS in OpenSLP (Vincent Danen <vdanen@...hat.com>)
CVE request: information leak in vino (Vincent Danen <vdanen@...hat.com>)
Re: Re: note on gnome shell extensions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: DoS in OpenSLP (Kurt Seifried <kseifried@...hat.com>)

September 14 (12 messages)

Re: CVE request: information leak in vino (Kurt Seifried <kseifried@...hat.com>)
Re: libdbus CVE-2012-3524 fix (Tomas Hoger <thoger@...hat.com>)
Re: CVE for Virtualbox 0x8 DoS? (halfdog <me@...fdog.net>)
CVE-request: SMF index.php msg parameter SQL-injection (2005) (Henri Salo <henri@...v.fi>)
CVE-request: WordPress insufficient permissions verification on XMLRPC interface (Henri Salo <henri@...v.fi>)
Re: CVE for Virtualbox 0x8 DoS? (Frank Mehnert <frank.mehnert@...cle.com>)
Re: CVE for Virtualbox 0x8 DoS? (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: SMF index.php msg parameter SQL-injection (2005) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE for Virtualbox 0x8 DoS? (Raphael Geissert <geissert@...ian.org>)
Re: CVE-request: WordPress insufficient permissions verification on XMLRPC interface (Kurt Seifried <kseifried@...hat.com>)
CVE request: bacula: Console ACL Bypass (Agostino Sarubbo <ago@...too.org>)
Re: CVE request: bacula: Console ACL Bypass (Agostino Sarubbo <ago@...too.org>)

September 15 (2 messages)

Re: Randomness Attacks Against PHP Applications (Solar Designer <solar@...nwall.com>)
Re: Re: CVE request: bacula: Console ACL Bypass (Kurt Seifried <kseifried@...hat.com>)

September 16 (1 message)

Re: CVE request - mcrypt buffer overflow flaw (Raphael Geissert <geissert@...ian.org>)

September 17 (8 messages)

Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
Re: libdbus CVE-2012-3524 fix (Sebastian Krahmer <krahmer@...e.de>)
Re: Randomness Attacks Against PHP Applications (Josh Bressers <bressers@...hat.com>)
Re: Randomness Attacks Against PHP Applications (Vladimir Vorontsov <vladimir.vorontsov@...ec.ru>)
CVE request: OptiPNG Palette Reduction Use-After-Free Vulnerability (Agostino Sarubbo <ago@...too.org>)
Re: Randomness Attacks Against PHP Applications (Raphael Geissert <geissert@...ian.org>)
Re: Randomness Attacks Against PHP Applications (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Re: note on gnome shell extensions (Vincent Danen <vdanen@...hat.com>)

September 18 (5 messages)

Re: Randomness Attacks Against PHP Applications (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: OptiPNG Palette Reduction Use-After-Free Vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: Re: note on gnome shell extensions (Sebastian Krahmer <krahmer@...e.de>)
Vulnerabilities in Oki CUPS printer drivers (Guido Berhoerster <guido+openwall.com@...hoerster.name>)
Re: Re: note on gnome shell extensions (Vincent Danen <vdanen@...hat.com>)

September 19 (3 messages)

CVE Request Smarty / php-Smarty: XSS in Smarty exception messages (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request -- fwknop 2.0.3: Multiple security issues (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- fwknop 2.0.3: Multiple security issues (Michael Rash <mbr@...herdyne.org>)

September 20 (9 messages)

Re: Re: CVE Request -- fwknop 2.0.3: Multiple security issues (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- fwknop 2.0.3: Multiple security issues (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request Smarty / php-Smarty: XSS in Smarty exception messages (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- fwknop 2.0.3: Multiple security issues (Michael Rash <mbr@...herdyne.org>)
Re: CVE Request (minor) -- JVM: heap memory disclosure (possibly various JDKs) (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: opencryptoki insecure lock files handling (Tomas Hoger <thoger@...hat.com>)
CVE-request: monkey fails to drop supplemental groups when lowering privileges (Henri Salo <henri@...v.fi>)
Re: Randomness Attacks Against PHP Applications (George Argyros <argyros.george@...il.com>)
Notification of upstream Condor security fixes (Vincent Danen <vdanen@...hat.com>)

September 21 (15 messages)

CVE Request: Jenkins and plugins (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Jenkins and plugins (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-request: monkey fails to drop supplemental groups when lowering privileges (Kurt Seifried <kseifried@...hat.com>)
CVE request(?): gpg: improper file permssions set when en/de-crypting files (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Tomas Mraz <tmraz@...hat.com>)
CVE-request: monkey CGI scripts executed without dropping RUID/RGID root (Henri Salo <henri@...v.fi>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE-request: monkey CGI scripts executed without dropping RUID/RGID root (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <mgilbert@...ian.org>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <mgilbert@...ian.org>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <michael.s.gilbert@...il.com>)

September 22 (2 messages)

Request for linux-distros@...openwall.org membership (Seth Arnold <seth.arnold@...onical.com>)
Re: Request for linux-distros@...openwall.org membership (Solar Designer <solar@...nwall.com>)

September 23 (4 messages)

Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Solar Designer <solar@...nwall.com>)
Re: tiff2pdf: Heap-based buffer overflow due to improper initialization of T2P context struct pointer (Solar Designer <solar@...nwall.com>)
Re: Randomness Attacks Against PHP Applications (Solar Designer <solar@...nwall.com>)
Re: Randomness Attacks Against PHP Applications (Vladimir Vorontsov <vladimir.vorontsov@...ec.ru>)

September 24 (9 messages)

Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Matthias Weckbecker <mweckbecker@...e.de>)
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <mgilbert@...ian.org>)
Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <mgilbert@...ian.org>)
Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files ("Steven M. Christey" <coley@...-smtp.mitre.org>)

September 25 (15 messages)

Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files ("Patrick J. Volkerding" <security@...ckware.com>)
Re: CVE request: opencryptoki insecure lock files handling (Raphael Geissert <geissert@...ian.org>)
Re: Randomness Attacks Against PHP Applications (Raphael Geissert <geissert@...ian.org>)
Re: Request for linux-distros@...openwall.org membership (Seth Arnold <seth.arnold@...onical.com>)
Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Matthias Weckbecker <mweckbecker@...e.de>)
CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request -- WordPress (3,4.2): CSRF in the incoming links section of the dashboard (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request - phpMyAdmin: PMASA-2012-5 incident (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request - phpMyAdmin: PMASA-2012-5 incident (Marcus Meissner <meissner@...e.de>)
Re: CVE Request - phpMyAdmin: PMASA-2012-5 incident (cve-assign@...re.org)
Re: CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- WordPress (3,4.2): CSRF in the incoming links section of the dashboard (Kurt Seifried <kseifried@...hat.com>)

September 26 (9 messages)

Re: CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request -- 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible) (Jan Lieskovsky <jlieskov@...hat.com>)
RFC: ntp behavior with spoofed source IPs (Fiedler Roman <Roman.Fiedler@....ac.at>)
Re: CVE Request -- 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible) (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- php-ZendFramework: XSS vectors in multiple Zend Framework components (ZF2012-03) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request: libtiff: Heap-buffer overflow when processing a TIFF image with PixarLog Compression (Tom Lane <tgl@...hat.com>)
Re: CVE Request -- php-ZendFramework: XSS vectors in multiple Zend Framework components (ZF2012-03) (Kurt Seifried <kseifried@...hat.com>)

September 27 (6 messages)

CVE-2009-4030 regression in mysql (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request: opencryptoki insecure lock files handling (Kurt Seifried <kseifried@...hat.com>)
dracut creates non-world readable initramfs images (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: dracut creates non-world readable initramfs images (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: dracut creates world readable initramfs images (Kurt Seifried <kseifried@...hat.com>)
Re: dracut creates world readable initramfs images (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

September 28 (6 messages)

Re: Randomness Attacks Against PHP Applications (George Argyros <argyros.george@...il.com>)
Re: Randomness Attacks Against PHP Applications (George Argyros <argyros.george@...il.com>)
Re: RFC: ntp behavior with spoofed source IPs ("Mike O'Connor" <mjo@...o.mi.org>)
Re: RFC: ntp behavior with spoofed source IPs (cve-assign@...re.org)
[OSSA 2012-015] Some actions in Keystone admin API do not validate token (CVE-2012-4456) (Russell Bryant <rbryant@...hat.com>)
[OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) (Russell Bryant <rbryant@...hat.com>)

September 29 (4 messages)

Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) (andi abes <andi.abes@...il.com>)
Re: Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) (Russell Bryant <rbryant@...hat.com>)
Re: Re: [Openstack] [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) (andi abes <andi.abes@...il.com>)

September 30 (1 message)

cgit: heap buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)

234 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.