oss-security mailing list - 2013/01

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 6	² 3	³ 12	⁴ 7	⁵	⁶ 3
⁷ 5	⁸ 15	⁹ 6	¹⁰ 4	¹¹ 15	¹²	¹³ 2
¹⁴ 7	¹⁵ 9	¹⁶ 14	¹⁷ 15	¹⁸ 10	¹⁹ 1	²⁰ 4
²¹ 22	²² 13	²³ 8	²⁴ 3	²⁵ 7	²⁶ 2	²⁷
²⁸ 3	²⁹ 11	³⁰ 6	³¹ 4

Messages by day:

January 1 (6 messages)

Charybdis: Improper assumptions in the server handshake code may lead to a remote crash (Mustapha Rabiu <muztapha@...il.com>)
CVE Request: Charybdis and ircd-ratbox remote crash flaw (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE Request: Charybdis and ircd-ratbox remote crash flaw (Kurt Seifried <kseifried@...hat.com>)
Re: Charybdis: Improper assumptions in the server handshake code may lead to a remote crash (Kurt Seifried <kseifried@...hat.com>)
Re: GnuPG 1.4.12 and lower - memory access errors and keyring database corruption (Kurt Seifried <kseifried@...hat.com>)
Re: GnuPG 1.4.12 and lower - memory access errors and keyring database corruption (Kurt Seifried <kseifried@...hat.com>)

January 2 (3 messages)

Re: CVE request: Curl insecure usage (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Charybdis: Improper assumptions in the server handshake code may lead to a remote crash (Henri Salo <henri@...v.fi>)
SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) (Aaron Patterson <tenderlove@...y-lang.org>)

January 3 (12 messages)

Re: CVE request: Curl insecure usage (Kurt Seifried <kseifried@...hat.com>)
Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE Request - SWI-Prolog / pl (X < 6.2.5): Multiple (stack-based) buffer overflows in patch canonisation code and when exp… (Jan Lieskovsky <jlieskov@...hat.com>)
nginx http proxy module does not verify peer identity of https origin server (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE Request -- rpm (X >= 4.10 and X < 3d74c43 commit): Signature checking function returned success on (possibly malicious… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request - SWI-Prolog / pl (X < 6.2.5): Multiple (stack-based) buffer overflows in patch canonisation code and when… (Kurt Seifried <kseifried@...hat.com>)
Re: nginx http proxy module does not verify peer identity of https origin server (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- rpm (X >= 4.10 and X < 3d74c43 commit): Signature checking function returned success on (possibly malic… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request (maybe): magento before 1.7.0.2 (Kurt Seifried <kseifried@...hat.com>)
Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) (Seth Arnold <seth.arnold@...onical.com>)
Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) (cve-assign@...re.org)

January 4 (7 messages)

CVE Request - cups: 'Listen localhost:631' option not honoured correctly on IPv6-enabled systems when systemd used for CU… (Jan Lieskovsky <jlieskov@...hat.com>)
Xen Security Advisory 37 (CVE-2013-0154) - Hypervisor crash due to incorrect ASSERT (debug build only) (Xen.org security team <security@....org>)
CVE Request -- qt: QSslSocket might report inappropriate errors when certificate verification fails (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- rpm (X >= 4.10 and X < 3d74c43 commit): Signature checking function returned success on (possibly mali… (Panu Matilainen <pmatilai@...hat.com>)
Re: CVE Request - cups: 'Listen localhost:631' option not honoured correctly on IPv6-enabled systems when systemd used fo… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- qt: QSslSocket might report inappropriate errors when certificate verification fails (Kurt Seifried <kseifried@...hat.com>)
Re: Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) (Seth Arnold <seth.arnold@...onical.com>)

January 6 (3 messages)

CVE request: mount/umount leak information about existence of folders (Henri Salo <henri@...v.fi>)
CVE request: Havalite CMS 1.1.7 stored XSS vulnerability in comments of blog posts (Henri Salo <henri@...v.fi>)
Re: CVE request: mount/umount leak information about existence of folders (Kurt Seifried <kseifried@...hat.com>)

January 7 (5 messages)

CVE Request -- proFTPD (X < 1.3.5.rc1): Symlink race condition when applying UserOwner to a newly (ProFTPD) created direct… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: Jenkins possible remote code execution (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request -- proFTPD (X < 1.3.5.rc1): Symlink race condition when applying UserOwner to a newly (ProFTPD) created di… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Jenkins possible remote code execution (Kurt Seifried <kseifried@...hat.com>)
/dev/ptmx timing (vladz <vladz@...zero.fr>)

January 8 (15 messages)

Re: /dev/ptmx timing (adam swanda <adam@...oharbor.org>)
Re: /dev/ptmx timing ("Dmitry V. Levin" <ldv@...linux.org>)
Re: /dev/ptmx timing (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Havalite CMS 1.1.7 stored XSS vulnerability in comments of blog posts (Kurt Seifried <kseifried@...hat.com>)
Re: /dev/ptmx timing (Vasily Kulikov <segoon@...nwall.com>)
CVE Request: cronie fd leak (Sebastian Krahmer <krahmer@...e.de>)
CVE Request: nagios Stack based buffer overflow in web interface (Sebastian Krahmer <krahmer@...e.de>)
Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (WHK Yan <yan.uniko.102@...il.com>)
Re: CVE Request: nagios Stack based buffer overflow in web interface (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: cronie fd leak (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (Kurt Seifried <kseifried@...hat.com>)
Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155) (Aaron Patterson <tenderlove@...y-lang.org>)
Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) (Aaron Patterson <tenderlove@...y-lang.org>)
Quick note on mfsa2013-04 / CVE-2012-0759 / CVE-2013-0759 (Kurt Seifried <kseifried@...hat.com>)

January 9 (6 messages)

Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (WHK Yan <yan.uniko.102@...il.com>)
Re: CVE Request: cronie fd leak (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: cronie fd leak (Sebastian Krahmer <krahmer@...e.de>)
Xen Security Advisory 33 (CVE-2012-5634) - VT-d interrupt remapping source validation flaw (Xen.org security team <security@....org>)
Re: CVE Request: cronie fd leak (Vincent Danen <vdanen@...hat.com>)

January 10 (4 messages)

Notification: Samba: NTML with session security handshake attack (Jan Lieskovsky <jlieskov@...hat.com>)
Confirming CVE for ettercap buffer overflow flaw (CVE-2012-0722?) (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: opus codec before 1.0.2 (Hanno Böck <hanno@...eck.de>)
Re: Confirming CVE for ettercap buffer overflow flaw (CVE-2012-0722?) ("Steven M. Christey" <coley@...-smtp.mitre.org>)

January 11 (15 messages)

CVE-2013-0422 assigned to today's Oracle Java 0-day ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156) (Reed Loden <reed@...dloden.com>)
Potential HTTP Header Injection in Apache HTTPClient (chevalier 3as <chevalier3as@...il.com>)
CVE Request -- Axis2/c (Seth Arnold <seth.arnold@...onical.com>)
gnome-keyring does not discard stored secrets in some cases (Florian Weimer <fw@...eb.enyo.de>)
Re: gnome-keyring does not discard stored secrets in some cases (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Axis2/c (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156) (Reed Loden <reed@...dloden.com>)
Re: gnome-keyring does not discard stored secrets in some cases (Florian Weimer <fweimer@...hat.com>)
Xen Security Advisory 33 (CVE-2012-5634) - VT-d interrupt remapping source validation flaw (Xen.org security team <security@....org>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: Confirming CVE for ettercap buffer overflow flaw (CVE-2012-0722?) (cve-assign@...re.org)
Re: Confirming CVE for ettercap buffer overflow flaw (CVE-2012-0722?) (Vincent Danen <vdanen@...hat.com>)

January 13 (2 messages)

DoS vulnerability in the BIND resolver (and potentially others) (Florian Weimer <fw@...eb.enyo.de>)
Re: DoS vulnerability in the BIND resolver (and potentially others) (Kurt Seifried <kseifried@...hat.com>)

January 14 (7 messages)

Re: DoS vulnerability in the BIND resolver (and potentially others) (Solar Designer <solar@...nwall.com>)
Re: Plug-and-wipe and Secure Boot semantics (Florian Weimer <fweimer@...hat.com>)
CVE Request -- redis: Two insecure temporary file use flaws (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: memcached DoS when printing out keys to be deleted in verbose mode (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request -- redis: Two insecure temporary file use flaws (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: memcached DoS when printing out keys to be deleted in verbose mode (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- redis: Two insecure temporary file use flaws (Kurt Seifried <kseifried@...hat.com>)

January 15 (9 messages)

CVE request: 3 DoS conditions in Rake (Vincent Danen <vdanen@...hat.com>)
Re: CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: 3 DoS conditions in Rake (Kurt Seifried <kseifried@...hat.com>)
CVE request: Digest::SHA double free when using load subroutine (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: Curl insecure usage (Moritz Muehlenhoff <jmm@...ian.org>)
pam-pgsql NULL password handling issue (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE request: Digest::SHA double free when using load subroutine (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Digest::SHA double free when using load subroutine (Florian Weimer <fw@...eb.enyo.de>)

January 16 (14 messages)

Re: CVE request: Digest::SHA double free when using load subroutine (Kurt Seifried <kseifried@...hat.com>)
Re: pam-pgsql NULL password handling issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Digest::SHA double free when using load subroutine (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux kernel handling of IPv6 temporary addresses (P J P <ppandit@...hat.com>)
Re: Linux kernel handling of IPv6 temporary addresses (George Kargiotakis <kargig@...d.gr>)
[PATCH] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests. (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Linux kernel handling of IPv6 temporary addresses (P J P <ppandit@...hat.com>)
Xen Security Advisory 40 (CVE-2013-0190) - Linux stack corruption in xen_failsafe_callback for 32bit PVOPS guests. (Xen.org security team <security@....org>)
Xen Security Advisory 41 (CVE-2012-6075) - qemu (e1000 device driver): Buffer overflow when processing large packets (Xen.org security team <security@....org>)
Re: Linux kernel handling of IPv6 temporary addresses (George Kargiotakis <kargig@...d.gr>)
Re: pam-pgsql NULL password handling issue (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel handling of IPv6 temporary addresses (P J P <ppandit@...hat.com>)
Re: Xen Security Advisory 41 (CVE-2012-6075) - qemu (e1000 device driver): Buffer overflow when processing large packets (Michael Tokarev <mjt@....msk.ru>)
bcron: cron jobs get access to the temporary output files from all other jobs that are still running (Salvatore Bonaccorso <carnil@...ian.org>)

January 17 (15 messages)

Re: bcron: cron jobs get access to the temporary output files from all other jobs that are still running (Kurt Seifried <kseifried@...hat.com>)
Re: gnome-keyring does not discard stored secrets in some cases (Kurt Seifried <kseifried@...hat.com>)
Re: gnome-keyring does not discard stored secrets in some cases (Florian Weimer <fw@...eb.enyo.de>)
Re: gnome-keyring does not discard stored secrets in some cases (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 (Kurt Seifried <kseifried@...hat.com>)
Request for CVE Identifiers (Kurt Seifried <kseifried@...hat.com>)
CVE request: piwik before 1.10 (Hanno Böck <hanno@...eck.de>)
Re: CVE request: Digest::SHA double free when using load subroutine (Mark Shelor <mshelor@...n.org>)
Re: Linux kernel handling of IPv6 temporary addresses (P J P <ppandit@...hat.com>)
Xen Security Advisory 27 (CVE-2012-5511,CVE-2012-6333) - several HVM operations do not validate the range of their inpu… (Xen.org security team <security@....org…)
Re: Linux kernel handling of IPv6 temporary addresses (George Kargiotakis <kargig@...d.gr>)
Xen Security Advisory 41 (CVE-2012-6075) - qemu (e1000 device driver): Buffer overflow when processing large packets (Xen.org security team <security@....org>)
Re: Linux kernel handling of IPv6 temporary addresses (P J P <ppandit@...hat.com>)
CVE Request - SA-CORE-2013-001 (one JQuery X < 1.63 issue and two Drupal modules issues) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: piwik before 1.10 (Kurt Seifried <kseifried@...hat.com>)

January 18 (10 messages)

CVE request: MantisBT before 1.2.13 match_type XSS vulnerability (David Hicks <d@...id.au>)
CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: mantis before 1.2.12 (Damien Regad <damien.regad@...ckgroup.com>)
Re: CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: PHP openssl_encrypt memory disclosure (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: PHP openssl_encrypt memory disclosure (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: [security] CVE Request - SA-CORE-2013-001 (one JQuery X < 1.63 issue and two Drupal modules issues) (Greg Knaddison <greg.knaddison@...il.com>)
CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability (David Hicks <d@...id.au>)

January 19 (1 message)

CVE request: MantisBT before 1.2.13 "Change Status To" feature allows unauthorised workflow changes (David Hicks <d@...id.au>)

January 20 (4 messages)

CVE request: hs-tls: Basic constraints vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux kernel handling of IPv6 temporary addresses (George Kargiotakis <kargig@...d.gr>)
CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Henrique <typoon@...il.com>)
ffmpeg/libav CVE dupe (Moritz Muehlenhoff <jmm@...ian.org>)

January 21 (22 messages)

Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: [security] CVE Request - SA-CORE-2013-001 (one JQuery X < 1.63 issue and two Drupal modules issues) (Forest Monsen <forest.monsen@...il.com>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Agostino Sarubbo <ago@...too.org>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Henrique Montenegro <typoon@...il.com>)
Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability (Damien Regad <damien.regad@...ckgroup.com>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Giles Coochey <giles@...chey.net>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Milan Berger <m.berger@...ject-mindstorm.net>)
Re: Linux kernel handling of IPv6 temporary addresses (P J P <ppandit@...hat.com>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Henrique Montenegro <typoon@...il.com>)
CVE Request coreutils (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE Request coreutils (Michael Tokarev <mjt@....msk.ru>)
Re: CVE Request - Wordpress 3.5 Full-path disclosure vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request coreutils (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request coreutils (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE Request coreutils (Vincent Danen <vdanen@...hat.com>)
CVE request for Movable Type (Yves-Alexis Perez <corsac@...ian.org>)
Whats worth a CVE? (Scott Herbert <scott.a.herbert@...glemail.com>)
Re: Whats worth a CVE? (Eitan Adler <lists@...anadler.com>)

January 22 (13 messages)

Re: Whats worth a CVE? (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request coreutils (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Movable Type (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request coreutils (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE Request coreutils (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE Request coreutils (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request coreutils (Sebastian Krahmer <krahmer@...e.de>)
predictable /tmp filename in git-extras (Helmut Grohne <helmut@...divi.de>)
Xen Security Advisory 35 (CVE-2013-0152) - Nested HVM exposes host to being driven out of memory by guest (Xen.org security team <security@....org>)
Xen Security Advisory 34 (CVE-2013-0151) - nested virtualization on 32-bit exposes host crash (Xen.org security team <security@....org>)
Re: CVE Request coreutils (Vincent Danen <vdanen@...hat.com>)
ownCloud Security Advisories - 2013-001 & 2013-002 (Lukas Reschke <lukas@...cloud.org>)
Re: [Xen-devel] Xen Security Advisory 35 (CVE-2013-0152) - Nested HVM exposes host to being driven out of memory by guest (M A Young <m.a.young@...ham.ac.uk>)

January 23 (8 messages)

CVE ID Syntax Change - Call for Public Feedback (cve-id-change@...re.org)
Re: CVE request for Movable Type (cve-assign@...re.org)
Re: CVE Request coreutils (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE Request coreutils (Florian Weimer <fweimer@...hat.com>)
Re: predictable /tmp filename in git-extras (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request coreutils (Kurt Seifried <kseifried@...hat.com>)
[Security hardening] [Notification] haproxy (previously) failed to drop supplementary groups after setuid / setgid calls p… (Jan Lieskovsky <jlieskov@...hat.com>)
Xen Security Advisory 35 (CVE-2013-0152) - Nested HVM exposes host to being driven out of memory by guest (Xen.org security team <security@....org>)

January 24 (3 messages)

Re: CVE Request coreutils (Vincent Danen <vdanen@...hat.com>)
Re: CVE ID Syntax Change - Call for Public Feedback (Florian Weimer <fw@...eb.enyo.de>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)

January 25 (7 messages)

Re: [Security hardening] [Notification] haproxy (previously) failed to drop supplementary groups after setuid / setgid cal… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: [Security hardening] [Notification] haproxy (previously) failed to drop supplementary groups after setuid / setgid calls pro… (Steve Grubb <sgrubb@...hat.com>)
CVE Request: zoneminder: arbitrary command execution vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request: WordPress 3.5.1 Maintenance and Security Release (Henri Salo <henri@...v.fi>)

January 26 (2 messages)

Re: CVE request: WordPress 3.5.1 Maintenance and Security Release (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: WordPress 3.5.1 Maintenance and Security Release (Andrew Nacin <nacin@...dpress.org>)

January 28 (3 messages)

CVE request: WordPress 3.1.4 (and 3.2 Release Candidate 3) (Henri Salo <henri@...v.fi>)
Re: CVE Request: zoneminder: arbitrary command execution vulnerability (Kurt Seifried <kseifried@...hat.com>)
Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 (Michael Koziarski <michael@...iarski.com>)

January 29 (11 messages)

CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget") (Moritz Naumann <security@...itz-naumann.com>)
CVE request for 'devise' ruby gem (Reed Loden <reed@...dloden.com>)
Re: CVE request for 'devise' ruby gem (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget") (Kurt Seifried <kseifried@...hat.com>)
Re: [Security hardening] [Notification] haproxy (previously) failed to drop supplementary groups after setuid / setgid calls properly (Willy Tarreau <w@....eu>)
Re: CVE request: WordPress 3.1.4 (and 3.2 Release Candidate 3) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: WordPress 3.5.1 Maintenance and Security Release (Kurt Seifried <kseifried@...hat.com>)
ircd-hybrid: Denial of service vulnerability in hostmask.c:try_parse_v4_netmask() (Henri Salo <henri@...v.fi>)
[OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208) (Thierry Carrez <thierry@...nstack.org>)
[OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212) (Thierry Carrez <thierry@...nstack.org>)
Re: ircd-hybrid: Denial of service vulnerability in hostmask.c:try_parse_v4_netmask() (Kurt Seifried <kseifried@...hat.com>)

January 30 (6 messages)

CVE Request -- glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: hs-tls: Basic constraints vulnerability (Florian Weimer <fweimer@...hat.com>)
CVE request -- qxl: synchronous io guest DoS (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- qxl: synchronous io guest DoS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: hs-tls: Basic constraints vulnerability (Kurt Seifried <kseifried@...hat.com>)

January 31 (4 messages)

Re: [OSVDB Mods] [New Vulnerability] File Disclosure in SimpleMachines Forum <= 2.0.3 (CVE-2013-0192) (fwd) (Brian Martin <brian@...nsecurityfoundation.org>)
Wireshark before 1.8.5 (etc.) wnpa-sec-2013-01 through wnpa-sec-2013-09 (cve-assign@...re.org)
jQuery 1.6.2 XSS CVE assignment (Kurt Seifried <kseifried@...hat.com>)
Re: CVE (Kurt Seifried <kseifried@...hat.com>)

217 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.