oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2012/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 2	² 7
³ 13	⁴ 11	⁵ 5	⁶ 4	⁷	⁸	⁹
¹⁰ 6	¹¹ 5	¹² 8	¹³ 23	¹⁴ 5	¹⁵ 2	¹⁶
¹⁷ 6	¹⁸ 5	¹⁹ 10	²⁰ 6	²¹ 3	²² 6	²³
²⁴	²⁵ 2	²⁶ 1	²⁷ 2	²⁸ 2	²⁹ 8	³⁰ 12
³¹ 7

Messages by day:

December 1 (2 messages)

Re: [security] CVE Request: owncloud (Lukas Reschke <lukas@...tuscode.ch>)
CVE request: TSK misrepresents "." files on FAT filesystems (Timo Warns <Warns@...-Sense.DE>)

December 2 (7 messages)

Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Sergei Golubchik <serg@...monty.org>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Sergei Golubchik <serg@...monty.org>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (king cope <isowarez.isowarez.isowarez@...glemail.com>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (king cope <isowarez.isowarez.isowarez@...glemail.com>)

December 3 (13 messages)

Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday ("Steven M. Christey" <coley@...-smtp.mitre.org>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (Sergei Golubchik <serg@...monty.org>)
CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) (Vincent Danen <vdanen@...hat.com>)
CVE Request -- Ekiga (x < 4.0.0): DoS (crash) after receiving call from other party with not UTF-8 valid name (Jan Lieskovsky <jlieskov@...hat.com>)
Xen Security Advisory 26 (CVE-2012-5510) - Grant table version switch list corruption vulnerability (Xen.org security team <security@....org>)
Xen Security Advisory 28 (CVE-2012-5512) - HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak (Xen.org security team <security@....org>)
Xen Security Advisory 32 (CVE-2012-5525) - several hypercalls do not validate input GFNs (Xen.org security team <security@....org>)
Xen Security Advisory 31 (CVE-2012-5515) - Several memory hypercall operations allow invalid extent order values (Xen.org security team <security@....org>)
Xen Security Advisory 27 (CVE-2012-5511) - several HVM operations do not validate the range of their inputs (Xen.org security team <security@....org>)
Xen Security Advisory 29 (CVE-2012-5513) - XENMEM_exchange may overwrite hypervisor memory (Xen.org security team <security@....org>)
Xen Security Advisory 30 (CVE-2012-5514) - Broken error handling in guest_physmap_mark_populate_on_demand() (Xen.org security team <security@....org>)
CVE-2012-5468: bogofilter-SA-2012-01 (Matthias Andree <matthias.andree@....de>)

December 4 (11 messages)

Re: CVE request for Ushahidi security vulnerability 2012-008 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: TSK misrepresents "." files on FAT filesystems (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Ekiga (x < 4.0.0): DoS (crash) after receiving call from other party with not UTF-8 valid name (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday (king cope <isowarez.isowarez.isowarez@...glemail.com>)
Re: Strange CVE situation (at least one ID should come of this) (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- Qt (x < 4.8.4): QML XmlHttpRequest insecure redirection (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Qt (x < 4.8.4): QML XmlHttpRequest insecure redirection (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) (Vincent Danen <vdanen@...hat.com>)

December 5 (5 messages)

Re: CVE request: Dovecot DoS in 2.x (fixed in 2.1.11) (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel handling of IPv6 temporary addresses (Kurt Seifried <kseifried@...hat.com>)
CVE request: Mysql/Mariadb insecure salt-usage (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Linux kernel handling of IPv6 temporary addresses (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request: Mysql/Mariadb insecure salt-usage (Sergei Golubchik <serg@...monty.org>)

December 6 (4 messages)

Re: Strange CVE situation (at least one ID should come of this) (Vincent Danen <vdanen@...hat.com>)
Re: Strange CVE situation (at least one ID should come of this) (Josh Bressers <bressers@...hat.com>)
Re: Strange CVE situation (at least one ID should come of this) (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: Mysql/Mariadb insecure salt-usage (Kurt Seifried <kseifried@...hat.com>)

December 10 (6 messages)

CVE-2012-6302 Soapbox 0.3.1 sandbox bypass (cve-assign@...re.org)
CVE-2012-6303 WaveSurfer and Snack Sound Toolkit buffer overflows (cve-assign@...re.org)
CVE-2012-6306 HCView Write Access Violation with GIF file (cve-assign@...re.org)
CVE-2012-6307 JPEGsnoop Write Access Violation with JPEG file (cve-assign@...re.org)
CVE-2012-6309 Arctic Torrent crash with .torrent file (cve-assign@...re.org)
TYPO3-CORE-SA-2012-005: Several Vulnerabilities in TYPO3 Core (Kurt Seifried <kseifried@...hat.com>)

December 11 (5 messages)

CVE request: opus codec before 1.0.2 (Hanno Böck <hanno@...eck.de>)
CVE request: perl-modules (Jamie Strandboge <jamie@...onical.com>)
Re: CVE request: opus codec before 1.0.2 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: perl-modules (Kurt Seifried <kseifried@...hat.com>)
[OSSA 2012-020] Information leak in libvirt LVM-backed instances (CVE-2012-5625) (Thierry Carrez <thierry@...nstack.org>)

December 12 (8 messages)

CVE request: thttpd: Denial of Service (App. crash, local) (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: thttpd: Denial of Service (App. crash, local) (Henri Salo <henri@...v.fi>)
Due to Nagios (core) 3.4.3 history.cgi crash (fulldisclosure/2012/Dec/107 post) (Jan Lieskovsky <jlieskov@...hat.com>)
Geany IDE not escaping filenames during compilation / build - a security issue or not? (Jan Lieskovsky <jlieskov@...hat.com>)
Robust XML validation (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: perl-modules (cve-assign@...re.org)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Frank Lanitz <frank@...nk.uvena.de>)
CVE-2012-5617: gksu-polkit privileged code execution with unprivileged credentials (Vincent Danen <vdanen@...hat.com>)

December 13 (23 messages)

Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Eitan Adler <lists@...anadler.com>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Andreas Ericsson <ae@....se>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Simon McVittie <smcv@...ian.org>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Simon McVittie <smcv@...ian.org>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Andreas Ericsson <ae@....se>)
Re: Robust XML validation (Timo Warns <warns@...-sense.de>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Matthew Brush <mbrush@...ebrainz.ca>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Andreas Ericsson <ae@....se>)
Remote file inclusion by office applications (Timo Warns <Warns@...-Sense.DE>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Kurt Seifried <kseifried@...hat.com>)
Re: Robust XML validation (Tim <tim-security@...tinelchicken.org>)
Re: Remote file inclusion by office applications (Kurt Seifried <kseifried@...hat.com>)
Re: Remote file inclusion by office applications (Timo Warns <warns@...-sense.de>)
Re: Robust XML validation (Timo Warns <warns@...-sense.de>)
Re: Remote file inclusion by office applications (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Colomban Wendling <lists.ban@...besfolles.org>)
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? (Peter Bex <Peter.Bex@...all.nl>)
pacemaker strcmp ("Simon ." <bofh666ftw@...glemail.com>)
CVE-2012-5374 CVE-2012-5375 Btrfs CRC32C denial of service issues (cve-assign@...re.org)
Re: CVE request: opus codec before 1.0.2 (Hanno Böck <hanno@...eck.de>)
Re: Xen Security Advisory 27 (CVE-2012-5511) - several HVM operations do not validate the range of their inputs ("Steven M. Christey" <coley@...-smtp.mitre.org…)
Re: CVE request: opus codec before 1.0.2 (Kurt Seifried <kseifried@...hat.com>)

December 14 (5 messages)

Re: Remote file inclusion by office applications (Kurt Seifried <kseifried@...hat.com>)
CVE for tog-pegasus Hash DoS issue from 2011 (Kurt Seifried <kseifried@...hat.com>)
Re: Remote file inclusion by office applications (Tim Brown <tmb@...35.com>)
Re: Remote file inclusion by office applications (Florian Weimer <fweimer@...hat.com>)
Re: Robust XML validation (Florian Weimer <fweimer@...hat.com>)

December 15 (2 messages)

Re: CVE request: thttpd: Denial of Service (App. crash, local) (Kurt Seifried <kseifried@...hat.com>)
Re: pacemaker strcmp (Kurt Seifried <kseifried@...hat.com>)

December 17 (6 messages)

CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on <matches> content (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- SQUID-2012:1 / Squid: DoS (excessive resource consumption) via invalid Content-Length headers or via memor… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- SQUID-2012:1 / Squid: DoS (excessive resource consumption) via invalid Content-Length headers or via m… (Kurt Seifried <kseifried@...hat.com>)
Django 1.3.5, Django 1.4.3, and Django 1.5 beta 2 Security Update (Kurt Seifried <kseifried@...hat.com>)
CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)

December 18 (5 messages)

Plug-and-wipe and Secure Boot semantics (Florian Weimer <fweimer@...hat.com>)
CVE Request -- Freeciv (X < 2.3.3): DoS (memory exhaustion or excessive CPU consumption) via malformed network packets (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Plug-and-wipe and Secure Boot semantics (Greg KH <greg@...ah.com>)
Re: Plug-and-wipe and Secure Boot semantics (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request -- Freeciv (X < 2.3.3): DoS (memory exhaustion or excessive CPU consumption) via malformed network packets (Kurt Seifried <kseifried@...hat.com>)

December 19 (10 messages)

Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images (Kurt Seifried <kseifried@...hat.com>)
Re: Plug-and-wipe and Secure Boot semantics (Greg KH <greg@...ah.com>)
Re: Plug-and-wipe and Secure Boot semantics (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images (Jan Lieskovsky <jlieskov@...hat.com>)
[CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping (Frédéric Basse <frederic.basse@....b-care.net>)
Re: Plug-and-wipe and Secure Boot semantics (Greg KH <greg@...ah.com>)
Re: Plug-and-wipe and Secure Boot semantics (Kurt Seifried <kseifried@...hat.com>)
CVE request: qemu e1000 emulated device gues-side buffer overflow (Michael Tokarev <mjt@....msk.ru>)
CVE request for Drupal core, and contributed modules (Forest Monsen <forest.monsen@...il.com>)

December 20 (6 messages)

Re: CVE request for Drupal core, and contributed modules (Kurt Seifried <kseifried@...hat.com>)
CVE request: information disclosure flaw in php-ZendFramework (ZF2012-05) (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: Inkscape fixes a XXE vulnerability during rasterization of SVG images (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: information disclosure flaw in php-ZendFramework (ZF2012-05) (Kurt Seifried <kseifried@...hat.com>)
Multiple SQL injection vulnerabilities in the puppetclass.rb and search.rb scripts in Foreman 1.0.1 (Amos Benari <abenari@...hat.com>)
Re: [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping (Frédéric Basse <frederic.basse@....b-care.net>)

December 21 (3 messages)

Isearch insecure temporary files (David Holland <dholland-oss-security@...bsd.org>)
Re: Isearch insecure temporary files (Kurt Seifried <kseifried@...hat.com>)
Re: Isearch insecure temporary files (David Holland <dholland-oss-security@...bsd.org>)

December 22 (6 messages)

CVE Request: grep (Seth Arnold <seth.arnold@...onical.com>)
CVE request: ownCloud (Lukas Reschke <lukas@...tuscode.ch>)
Re: CVE Request: grep (Paul Eggert <eggert@...ucla.edu>)
About CVE-2012-5645 (Marko Lindqvist <cazfi74@...il.com>)
Re: CVE request: ownCloud (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: grep (Kurt Seifried <kseifried@...hat.com>)

December 25 (2 messages)

CVE Request - Multiple security fixes in freetype - 2.4.11 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE Request - Multiple security fixes in freetype - 2.4.11 (Kurt Seifried <kseifried@...hat.com>)

December 26 (1 message)

Re: CVE request: Curl insecure usage (Moritz Muehlenhoff <jmm@...ian.org>)

December 27 (2 messages)

Re: CVE request: Curl insecure usage (Kurt Seifried <kseifried@...hat.com>)
CVE request: Jenkins (Moritz Muehlenhoff <jmm@...ian.org>)

December 28 (2 messages)

Re: CVE request: Jenkins (Kurt Seifried <kseifried@...hat.com>)
CVE Request: W3 Total Cache - public cache exposure ("Jason A. Donenfeld" <Jason@...c4.com>)

December 29 (8 messages)

Re: CVE Request: W3 Total Cache - public cache exposure (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: W3 Total Cache - public cache exposure ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request: qemu e1000 emulated device gues-side buffer overflow (Michael Tokarev <mjt@....msk.ru>)
Re: CVE Request: W3 Total Cache - public cache exposure ("Jason A. Donenfeld" <Jason@...c4.com>)
Inkscape reads .eps files from /tmp instead of the current directory (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request: MoinMoin Wiki (remote code execution vulnerability) (Tilmann Haak <tilmann@...pwiki.de>)
CVE request: MoinMoin Wiki (XSS in rss link) (Tilmann Haak <tilmann.haak@....de>)
CVE request: MoinMoin Wiki (path traversal vulnerability) (Tilmann Haak <tilmann@...pwiki.de>)

December 30 (12 messages)

Re: CVE request: qemu e1000 emulated device gues-side buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: Inkscape reads .eps files from /tmp instead of the current directory (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: W3 Total Cache - public cache exposure (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MoinMoin Wiki (remote code execution vulnerability) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MoinMoin Wiki (XSS in rss link) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MoinMoin Wiki (path traversal vulnerability) (Kurt Seifried <kseifried@...hat.com>)
Re: TYPO3-CORE-SA-2012-005: Several Vulnerabilities in TYPO3 Core (Kurt Seifried <kseifried@...hat.com>)
Re: About CVE-2012-5645 (Kurt Seifried <kseifried@...hat.com>)
Re: Isearch insecure temporary files (Kurt Seifried <kseifried@...hat.com>)
2012 close out/cleanup (Kurt Seifried <kseifried@...hat.com>)
Re: About CVE-2012-5645 (Marko Lindqvist <cazfi74@...il.com>)
Re: Isearch insecure temporary files (Henri Salo <henri@...v.fi>)

December 31 (7 messages)

Re: Isearch insecure temporary files (Kurt Seifried <kseifried@...hat.com>)
Re: About CVE-2012-5645 (Kurt Seifried <kseifried@...hat.com>)
CVE request (maybe): magento before 1.7.0.2 (Hanno Böck <hanno@...eck.de>)
Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS (Henri Salo <henri@...v.fi>)
Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS (Moritz Naumann <oss-security@...itz-naumann.com>)
Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS (Hanno Böck <hanno@...eck.de>)
Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS (Emanuele <emanuele45@...il.com>)

161 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.