oss-security mailing list - 2013/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 4	² 2	³ 1
⁴ 4	⁵ 24	⁶ 7	⁷ 14	⁸ 6	⁹ 1	¹⁰ 2
¹¹ 9	¹² 7	¹³ 11	¹⁴ 7	¹⁵ 19	¹⁶ 5	¹⁷
¹⁸ 2	¹⁹ 6	²⁰ 19	²¹ 27	²² 21	²³ 9	²⁴ 7
²⁵ 24	²⁶ 18	²⁷ 54	²⁸ 13

Messages by day:

February 1 (4 messages)

CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when differen… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Corosync (2.0 <= X < 2.3): Remote DoS due improper HMAC initialization ("Fabio M. Di Nitto" <fdinitto@...hat.com>)
Re: Re: CVE Request -- Corosync (2.0 <= X < 2.3): Remote DoS due improper HMAC initialization (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [OSVDB Mods] [New Vulnerability] File Disclosure in SimpleMachines Forum <= 2.0.3 (CVE-2013-0192) (fwd) (Kurt Seifried <kseifried@...hat.com>)

February 2 (2 messages)

A small backlog of vulnerabilities in Chicken Scheme (Peter Bex <Peter.Bex@...all.nl>)
Re: A small backlog of vulnerabilities in Chicken Scheme (Henri Salo <henri@...v.fi>)

February 3 (1 message)

CVE id request: latd (Nico Golde <oss-security+ml@...lde.de>)

February 4 (4 messages)

CVE id request: boost (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE id request: boost (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: latd (Kurt Seifried <kseifried@...hat.com>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)

February 5 (24 messages)

Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: latd (Ignatios Souvatzis <is@...bsd.org>)
Re: A small backlog of vulnerabilities in Chicken Scheme (Peter Bex <Peter.Bex@...all.nl>)
CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Matthias Weckbecker <mweckbecker@...e.de>)
Xen Security Advisory 36 (CVE-2013-0153) - interrupt remap entries shared and old ones not cleared on AMD IOMMUs (Xen.org security team <security@....org>)
Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring. (Xen.org security team <security@....org>)
Xen Security Advisory 43 (CVE-2013-0231) - Linux pciback DoS via not rate limited log messages. (Xen.org security team <security@....org>)
Xen Security Advisory 38 (CVE-2013-0215) - oxenstored incorrect handling of certain Xenbus ring states (Xen.org security team <security@....org>)
Xen Security Advisory 43 (CVE-2013-0231) - Linux pciback DoS via not rate limited log messages. (Xen.org security team <security@....org>)
Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring. (Xen.org security team <security@....org>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Marcus Meissner <meissner@...e.de>)
[CVE Assignment Notification] CVE-2013-0240 - Gnome Online Accounts (GOA) (previously) failed to verify SSL certificates w… (Jan Lieskovsky <jlieskov@...hat.com>)
[OSSA 2013-003] Keystone denial of service through invalid token requests (CVE-2013-0247) (Thierry Carrez <thierry@...nstack.org>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Vincent Danen <vdanen@...hat.com>)
Re: [CVE Assignment Notification] CVE-2013-0240 - Gnome Online Accounts (GOA) (previously) failed to verify SSL certificates … (Simon McVittie <smcv@...ian.org>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (cve-assign@...re.org)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Shawn <citypw@...il.com>)
CVE Request: imview (Sang Kil Cha <sangkilc@....edu>)
Re: CVE Request: imview (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: imview (Sang Kil Cha <sangkilc@....edu>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (cve-assign@...re.org)

February 6 (7 messages)

Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (cve-assign@...re.org)
CVE request: Insecure default log file path in xNBD (Sebastian Pipping <sebastian@...ping.org>)
Re: CVE Request: imview (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: imview (Sang Kil Cha <sangkilc@....edu>)
CVE id request: openssh? (Nico Golde <oss-security+ml@...lde.de>)
e1000e/82574L hardware erratum (Florian Weimer <fw@...eb.enyo.de>)
Potential Query Manipulation with Common Rails Practises (Michael Koziarski <michael@...iarski.com>)

February 7 (14 messages)

Re: e1000e/82574L hardware erratum (Kurt Seifried <kseifried@...hat.com>)
Re: Potential Query Manipulation with Common Rails Practises (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: openssh? (Kurt Seifried <kseifried@...hat.com>)
Re: A small backlog of vulnerabilities in Chicken Scheme (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Insecure default log file path in xNBD (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-0256 RDoc 2.3.0 through 3.12 XSS Exploit (Eric Hodel <drbrain@...ment7.net>)
Re: A small backlog of vulnerabilities in Chicken Scheme (Peter Bex <Peter.Bex@...all.nl>)
Re: CVE Request: imview (gremlin@...mlin.ru)
CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege escalation (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Hanno Böck <hanno@...eck.de>)
CVE request: XSS in roundcube before 0.8.5 (Hanno Böck <hanno@...eck.de>)
Re: CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege escalation (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations (cve-assign@...re.org)

February 8 (6 messages)

Re: CVE request: XSS in roundcube before 0.8.5 (Kurt Seifried <kseifried@...hat.com>)
Re: A small backlog of vulnerabilities in Chicken Scheme (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-0262: Rack versions 1.4.0-1.5.1, Symlink path traversal. (James Tucker <raggi@...gle.com>)
CVE-2013-0263: Rack all versions, Timing attack in cookie sessions (James Tucker <raggi@...gle.com>)
CVE request: XSS flaws fixed in ganglia (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: XSS flaws fixed in ganglia (Kurt Seifried <kseifried@...hat.com>)

February 9 (1 message)

Wordpress Pinboard theme XSS (Henrique Montenegro <typoon@...il.com>)

February 10 (2 messages)

CVE request: piwigo XSS in password.php (Kurt Seifried <kseifried@...hat.com>)
CVE request: Transmission can be made to crash remotely (Yves-Alexis Perez <corsac@...ian.org>)

February 11 (9 messages)

Re: CVE request: piwigo XSS in password.php (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: piwigo XSS in password.php (Henri Salo <henri@...v.fi>)
CVE request: Trac Ticket Modification Workflow Permission Restriction Bypass (Henri Salo <henri@...v.fi>)
Re: CVE request: Transmission can be made to crash remotely (Jan Lieskovsky <jlieskov@...hat.com>)
Circumvention of attr_protected [CVE-2013-0276] (Aaron Patterson <tenderlove@...y-lang.org>)
Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277] (Aaron Patterson <tenderlove@...y-lang.org>)
Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] (Aaron Patterson <tenderlove@...y-lang.org>)
Patch update for [CVE-2013-0269] (Aaron Patterson <tenderlove@...y-lang.org>)
CVE request: openconnect buffer overflow (Florian Weimer <fw@...eb.enyo.de>)

February 12 (7 messages)

CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than C… (Jan Lieskovsky <jlieskov@...hat.com>)
[Ignore not a security flaw] Re: CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier i… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: e1000e/82574L hardware erratum (cve-assign@...re.org)
Re: Re: e1000e/82574L hardware erratum (Eitan Adler <lists@...anadler.com>)
Re: Re: e1000e/82574L hardware erratum (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue th… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: openconnect buffer overflow (Kurt Seifried <kseifried@...hat.com>)

February 13 (11 messages)

Re: CVE request: Transmission can be made to crash remotely (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Trac Ticket Modification Workflow Permission Restriction Bypass (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: piwigo XSS in password.php (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue th… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue than CVE-… (David Jorm <djorm@...hat.com>)
Re: CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue th… (Kurt Seifried <kseifried@...hat.com>)
Re: Potential HTTP Header Injection in Apache HTTPClient (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version (Kurt Seifried <kseifried@...hat.com>)
Re: Wordpress Pinboard theme XSS (Kurt Seifried <kseifried@...hat.com>)
Xen Security Advisory 42 (CVE-2013-0228) - Linux kernel hits general protection if %ds is corrupt for 32-bit PVOPS. (Xen.org security team <security@....org>)
RE: CVE Request -- jakarta-commons-httpclient: Wildcard matching in SSL hostname verifier incorrect (a different issue… ("Christey, Steven M." <coley@...re.org>)

February 14 (7 messages)

Some rubygems related CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: Some rubygems related CVEs (Reed Loden <reed@...dloden.com>)
Re: Some rubygems related CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: Wordpress Pinboard theme XSS (Kurt Seifried <kseifried@...hat.com>)
CVE Request - Full Path disclosure on Wordpress plugin NextGEN Gallery (Henrique Montenegro <typoon@...il.com>)
[FYI / CVE assignment notification] CVE-2013-0281 pacemaker: Denial of service when remote CIB management enabled due to u… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: kernel -- local DOS (endless loop with interrupts disabled) (Mathias Krause <minipli@...glemail.com>)

February 15 (19 messages)

Re: Potential HTTP Header Injection in Apache HTTPClient (David Jorm <djorm@...hat.com>)
Re: CVE Request: kernel -- local DOS (endless loop with interrupts disabled) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - Full Path disclosure on Wordpress plugin NextGEN Gallery (Kurt Seifried <kseifried@...hat.com>)
CVE# request: pigz creates temp file with insecure permissions (Michael Tokarev <mjt@....msk.ru>)
Xen Security Advisory 38 (CVE-2013-0215) - oxenstored incorrect handling of certain Xenbus ring states (Xen.org security team <security@....org>)
CVE request: unauthorized SSL certificates by Türktrust discovered (Agostino Sarubbo <ago@...too.org>)
Re: CVE# request: pigz creates temp file with insecure permissions (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: unauthorized SSL certificates by Türktrust discovered (Tomas Hoger <thoger@...hat.com>)
CVE request: python-pyrad insecurities (Vincent Danen <vdanen@...hat.com>)
CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib < 0.100.1 (Simon McVittie <simon.mcvittie@...labora.co.uk>)
Re: (linux-)distros membership changes (Miklos Vajna <vmiklos@...galware.org>)
Re: CVE# request: pigz creates temp file with insecure permissions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: python-pyrad insecurities (Kurt Seifried <kseifried@...hat.com>)
Re: (linux-)distros membership changes (Solar Designer <solar@...nwall.com>)
RE: CVE request: python-pyrad insecurities ("Christey, Steven M." <coley@...re.org>)
Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Julien Tinnes <julien@....org>)
Re: (linux-)distros membership changes (Jeremy Stanley <fungi@...goth.org>)
Re: CVE# request: pigz creates temp file with insecure permissions ("Steven M. Christey" <coley@...re.org>)
Re: CVE request: python-pyrad insecurities (Vincent Danen <vdanen@...hat.com>)

February 16 (5 messages)

Re: CVE# request: pigz creates temp file with insecure permissions (Michael Tokarev <mjt@....msk.ru>)
Re: CVE# request: pigz creates temp file with insecure permissions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE# request: pigz creates temp file with insecure permissions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: python-pyrad insecurities (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Solar Designer <solar@...nwall.com>)

February 18 (2 messages)

Jenkins CVE request for Jenkins Security Advisory 2013-02-16 (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to stack-based buffer overflow (Jan Lieskovsky <jlieskov@...hat.com>)

February 19 (6 messages)

CVE request: zoneminder: local file inclusion vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
[OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665) (Thierry Carrez <thierry@...nstack.org>)
[OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282) (Thierry Carrez <thierry@...nstack.org>)
REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280 (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Julien Tinnes <julien@....org>)
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Solar Designer <solar@...nwall.com>)

February 20 (19 messages)

CVE request -- Linux kernel: mm: thp: pmd_present and PROT_NONE local DoS (Petr Matousek <pmatouse@...hat.com>)
CVE request -- Linux kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference (Petr Matousek <pmatouse@...hat.com>)
CVE request -- Linux kernel: vhost: fix length for cross region descriptor (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- Linux kernel: mm: thp: pmd_present and PROT_NONE local DoS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request -- Linux kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request -- Linux kernel: vhost: fix length for cross region descriptor (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Greg KH <greg@...ah.com>)
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Greg KH <greg@...ah.com>)
isync/mbsync security advisory: missing SSL subject verification (CVE-2013-0289) (Oswald Buddenhagen <ossi@....org>)
Handling CVEs for the XML entity expansion issues (Kurt Seifried <kseifried@...hat.com>)
RE: Handling CVEs for the XML entity expansion issues ("Christey, Steven M." <coley@...re.org>)
Re: isync/mbsync security advisory: missing SSL subject verification (CVE-2013-0289) (Vincent Danen <vdanen@...hat.com>)
Re: RE: Handling CVEs for the XML entity expansion issues (Tim <tim-security@...tinelchicken.org>)
Re: RE: Handling CVEs for the XML entity expansion issues (Kurt Seifried <kseifried@...hat.com>)
CVE request - Linux kernel: evm: NULL pointer de-reference flaw (P J P <ppandit@...hat.com>)
Re: CVE request - Linux kernel: evm: NULL pointer de-reference flaw (Kurt Seifried <kseifried@...hat.com>)
Re: RE: Handling CVEs for the XML entity expansion issues (Tim <tim-security@...tinelchicken.org>)
Re: RE: Handling CVEs for the XML entity expansion issues (Kurt Seifried <kseifried@...hat.com>)
Re: RE: Handling CVEs for the XML entity expansion issues (Tim <tim-security@...tinelchicken.org>)

February 21 (27 messages)

Re: RE: Handling CVEs for the XML entity expansion issues (Kurt Seifried <kseifried@...hat.com>)
RE: RE: Handling CVEs for the XML entity expansion issues ("Christey, Steven M." <coley@...re.org>)
Re: RE: Handling CVEs for the XML entity expansion issues (Kurt Seifried <kseifried@...hat.com>)
CVE request for Drupal Core and contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request for Drupal Core and contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: evm: NULL pointer de-reference flaw (P J P <ppandit@...hat.com>)
Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: zoneminder: local file inclusion vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: zoneminder: local file inclusion vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: XSS flaws fixed in ganglia (Raphael Geissert <atomo64@...il.com>)
Re: CVE request: XSS flaws fixed in ganglia (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: XSS flaws fixed in ganglia (Raphael Geissert <atomo64@...il.com>)
Re: RE: Handling CVEs for the XML entity expansion issues (Tim Brown <tmb@...35.com>)
Xen Security Advisory 36 (CVE-2013-0153) - interrupt remap entries shared and old ones not cleared on AMD IOMMUs (Xen.org security team <security@....org>)
nginx world-readable logdir (Agostino Sarubbo <ago@...too.org>)
Re: nginx world-readable logdir (Henri Salo <henri@...v.fi>)
ownCloud Security Advisories (2013-003, 2013-004, 2013-005, 2013-006, 2013-007) (Lukas Reschke <lukas@...cloud.org>)
CVE request: nginx world-readable logdir (Henri Salo <henri@...v.fi>)
Two more ZoneMinder that need CVE (security curmudgeon <jericho@...rition.org>)
Re: CVE request: nginx world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: Two more ZoneMinder that need CVE (Kurt Seifried <kseifried@...hat.com>)
RE: Two more ZoneMinder that need CVE ("Christey, Steven M." <coley@...re.org>)
Re: Two more ZoneMinder that need CVE (Kurt Seifried <kseifried@...hat.com>)
CVE Guidance for Libraries and Resource-Consumption DoS ("Steven M. Christey" <coley@...re.org>)
Re: CVE request: nginx world-readable logdir (Anders Petersson <anders@....se>)
Re: CVE request: nginx world-readable logdir (Anders Petersson <anders@....se>)
Re: CVE request: python-pyrad insecurities (Vincent Danen <vdanen@...hat.com>)

February 22 (21 messages)

Re: CVE request: nginx world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: python-pyrad insecurities (Kurt Seifried <kseifried@...hat.com>)
CVEs for libxml2 and expat internal and external XML entity expansion (Kurt Seifried <kseifried@...hat.com>)
CVEs for libxml2 and expat internal and external XML entity expansion (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-0162 rubygem-ruby_parser: incorrect temporary file usage / Public Service Announcement (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel handling of IPv6 temporary addresses (Kurt Seifried <kseifried@...hat.com>)
Re: nginx world-readable logdir (gremlin@...mlin.ru)
Re: nginx world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: nginx world-readable logdir (gremlin@...mlin.ru)
Re: nginx world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: nginx world-readable logdir (Henri Salo <henri@...v.fi>)
CVE request: Linux kernel: Bluetooth HIDP information disclosure (P J P <ppandit@...hat.com>)
Re: nginx world-readable logdir (gremlin@...mlin.ru)
CVE request: varnish world-readable logdir (Agostino Sarubbo <ago@...too.org>)
Cve request: tomcat world-readable logdir (Agostino Sarubbo <ago@...too.org>)
CVE request: webfs world-readable log (Agostino Sarubbo <ago@...too.org>)
Re: CVE request: webfs world-readable log (Agostino Sarubbo <ago@...too.org>)
CVE request: sthttpd world-redable logdir (Agostino Sarubbo <ago@...too.org>)
Re: CVEs for libxml2 and expat internal and external XML entity expansion (Florian Weimer <fweimer@...hat.com>)
Re: CVEs for libxml2 and expat internal and external XML entity expansion (Jakub Wilk <jwilk@...lk.net>)
Re: CVEs for libxml2 and expat internal and external XML entity expansion (Tim <tim-security@...tinelchicken.org>)

February 23 (9 messages)

Re: CVEs for libxml2 and expat internal and external XML entity expansion (Kurt Seifried <kseifried@...hat.com>)
Re: CVEs for libxml2 and expat internal and external XML entity expansion (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Linux kernel: Bluetooth HIDP information disclosure (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: varnish world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: Cve request: tomcat world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request: webfs world-readable log (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: sthttpd world-redable logdir (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-0350 for pktstat: writes content from TCP streams to public readable file /tmp/smtp.log (Kurt Seifried <kseifried@...hat.com>)
CVE Request: PackageKit"update" allows downgrade of packages when using the "zypp" backend (Marcus Meissner <meissner@...e.de>)

February 24 (7 messages)

nginx CVE-2013-0337 world-readable logs (gremlin@...mlin.ru)
CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Mathias Krause <minipli@...glemail.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Petr Matousek <pmatouse@...hat.com>)
CVE request: skunkweb world-readable logdir (Agostino Sarubbo <ago@...too.org>)
CVE request: monkeyd world-readable logdir (Agostino Sarubbo <ago@...too.org>)
Re: nginx CVE-2013-0337 world-readable logs (Kurt Seifried <kseifried@...hat.com>)
CVE request: WordPress plugin smart-flv jwplayer.swf XSS (Henri Salo <henri@...v.fi>)

February 25 (24 messages)

Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Solar Designer <solar@...nwall.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Mathias Krause <minipli@...glemail.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Mathias Krause <minipli@...glemail.com>)
fusionforge CVE-2013-1423 multiple privilege escalations (Helmut Grohne <helmut@...divi.de>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Solar Designer <solar@...nwall.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Mathias Krause <minipli@...glemail.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Mathias Krause <minipli@...glemail.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Mathias Krause <minipli@...glemail.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Dan Rosenberg <dan.j.rosenberg@...il.com>)
kernel: tmpfs use-after-free ("Jason A. Donenfeld" <Jason@...c4.com>)
CVE request: libvirt kvm-group writable storage (Bastian Blank <waldi@...ian.org>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Solar Designer <solar@...nwall.com>)
Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] (Solar Designer <solar@...nwall.com>)
Re: CVE request: skunkweb world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: monkeyd world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: PackageKit"update" allows downgrade of packages when using the "zypp" backend (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: WordPress plugin smart-flv jwplayer.swf XSS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: libvirt kvm-group writable storage (Kurt Seifried <kseifried@...hat.com>)
Re: kernel: tmpfs use-after-free (Kurt Seifried <kseifried@...hat.com>)
Re: kernel: tmpfs use-after-free (Solar Designer <solar@...nwall.com>)

February 26 (18 messages)

Re: CVE request: monkeyd world-readable logdir (Agostino Sarubbo <ago@...too.org>)
Re: CVE request: monkeyd world-readable logdir (Moritz Muehlenhoff <jmm@...ian.org>)
CVE request -- Linux kernel: call_console_drivers() Function Log Prefix Stripping buffer overflow (Petr Matousek <pmatouse@...hat.com>)
Archlinux/x86-64 3.1.x-3.7.x x86-64 CVE-2013-1763 sock_diag_handlers[] warez (sd <sd@...ksheep.org>)
CVE request - Linux kernel: VFAT slab-based buffer overflow ("Joshua J. Drake" <oss-sec-vfat@...p.org>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
[OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335) (Russell Bryant <rbryant@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request -- Linux kernel: call_console_drivers() Function Log Prefix Stripping buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: monkeyd world-readable logdir (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: XSS flaws fixed in ganglia (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Henri Salo <henri@...v.fi>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Yves-Alexis Perez <corsac@...ian.org>)
CVE request: psi+ stores the cache file as world-readable (Agostino Sarubbo <ago@...too.org>)
Re: CVE request: psi+ stores the cache file as world-readable (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request: psi+ stores the cache file as world-readable (Agostino Sarubbo <ago@...too.org>)

February 27 (54 messages)

Re: CVE request: psi+ stores the cache file as world-readable (gremlin@...mlin.ru)
Re: CVE request: psi+ stores the cache file as world-readable (Russ Allbery <rra@...nford.edu>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: psi+ stores the cache file as world-readable (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE request: psi+ stores the cache file as world-readable (gremlin@...mlin.ru)
Re: CVE request: psi+ stores the cache file as world-readable (Agostino Sarubbo <ago@...too.org>)
CVE Request: poppler 0.22.1 security fixes (Marcus Meissner <meissner@...e.de>)
CVE request: Linux kernel: USB: io_ti: NULL pointer dereference (P J P <ppandit@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Solar Designer <solar@...nwall.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Benji <me@...ji.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Benji <me@...ji.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Benji <me@...ji.com>)
CVE request: sudo authentication bypass when clock is reset ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
CVE request: potential bypass of sudo tty_tickets constraints ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request: Linux kernel: USB: io_ti: NULL pointer dereference (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: sudo authentication bypass when clock is reset (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: potential bypass of sudo tty_tickets constraints (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Tim <tim-security@...tinelchicken.org>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE# request: pigz creates temp file with insecure permissions (Jim Mellander <jmellander@....gov>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
CVE Request for Drupal Contributed Modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Jiri Kosina <jikos@...os.cz>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Jiri Kosina <jikos@...os.cz>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Greg KH <greg@...ah.com>)

February 28 (13 messages)

Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Jiri Kosina <jikos@...os.cz>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal Contributed Modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: poppler 0.22.1 security fixes (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: poppler 0.22.1 security fixes (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request: poppler 0.22.1 security fixes (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request: poppler 0.22.1 security fixes (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Jiri Kosina <jikos@...os.cz>)
Re: [Full-disclosure] MySQL Denial of Service Zeroday PoC (Sergei Golubchik <serg@...monty.org>)
Re: CVE request: sudo authentication bypass when clock is reset ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
Re: CVE request: potential bypass of sudo tty_tickets constraints ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
CVE-2013-0293 -- ovirt-node: Lock screen accepts F2 to drop to shell (Petr Matousek <pmatouse@...hat.com>)

323 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.