oss-security mailing list - 2013/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 12	² 3	³ 15
⁴ 12	⁵ 15	⁶ 5	⁷ 7	⁸ 7	⁹ 1	¹⁰ 4
¹¹ 9	¹² 7	¹³ 13	¹⁴ 23	¹⁵ 7	¹⁶ 1	¹⁷ 1
¹⁸ 5	¹⁹ 12	²⁰ 14	²¹ 6	²² 11	²³ 3	²⁴ 1
²⁵ 12	²⁶ 13	²⁷ 10	²⁸ 9	²⁹ 4	³⁰	³¹ 4

Messages by day:

March 1 (12 messages)

Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Eugene Teo <eugeneteo@...nel.sg>)
Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 (Kurt Seifried <kseifried@...hat.com>)
CVE id request: busybox (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow (Yves-Alexis Perez <corsac@...ian.org>)
CVE request: ruby-openid XML denial of service attack (Marcus Meissner <meissner@...e.de>)
CVE Request: various gems in aftermath of rubygem actionpack issue (Marcus Meissner <meissner@...e.de>)
CVE Request: rubygem passenger security issue (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: various gems in aftermath of rubygem actionpack issue (Reed Loden <reed@...dloden.com>)
Re: CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: MantisBT before 1.2.13 "Change Status To" feature allows unauthorised workflow changes (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: various gems in aftermath of rubygem actionpack issue (Kurt Seifried <kseifried@...hat.com>)
CVE Request: Gambas Directory hijack vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)

March 2 (3 messages)

Re: CVE Request: rubygem passenger security issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: various gems in aftermath of rubygem actionpack issue (Olivier Gonzalez <gonzoyumo@...il.com>)
Re: CVE Request: various gems in aftermath of rubygem actionpack issue (Kurt Seifried <kseifried@...hat.com>)

March 3 (15 messages)

CVE request: PHP-Fusion waraxe-2013-SA#097 (Henri Salo <henri@...v.fi>)
Re: CVE request: PHP-Fusion waraxe-2013-SA#097 (Kurt Seifried <kseifried@...hat.com>)
Re: [Full-disclosure] XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS - ZeroClipboard.swf (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Gambas Directory hijack vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MantisBT before 1.2.13 "Change Status To" feature allows unauthorised workflow changes (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MantisBT before 1.2.13 "Change Status To" feature allows unauthorised workflow changes (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ruby-openid XML denial of service attack (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: busybox (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: busybox (gremlin@...mlin.ru)
Re: CVE id request: busybox (Michael Tokarev <mjt@....msk.ru>)
Re: CVE id request: busybox (Piotr Karbowski <piotr.karbowski@...il.com>)
Re: CVE id request: busybox (Michael Tokarev <mjt@....msk.ru>)
Re: CVE id request: busybox (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: busybox (Michael Gilbert <mgilbert@...ian.org>)

March 4 (12 messages)

handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Solar Designer <solar@...nwall.com>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Greg KH <greg@...ah.com>)
Re: CVE id request: busybox (Kurt Seifried <kseifried@...hat.com>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Solar Designer <solar@...nwall.com>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Michael Gilbert <mgilbert@...ian.org>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Greg KH <greg@...ah.com>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Greg KH <greg@...ah.com>)
CVE-2013-1769: remotely-triggered NULL pointer dereference in telepathy-gabble (Will Thompson <will.thompson@...labora.co.uk>)
Re: CVE request: MantisBT before 1.2.13 "Change Status To" feature allows unauthorised workflow changes (Damien Regad <damien.regad@...ckgroup.com>)
Reverse lookup issue in Net::Server (Remi Gacogne <rgacogne-bugs@...edump.fr>)
Re: Reverse lookup issue in Net::Server (Russ Allbery <rra@...nford.edu>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Eric Lacombe <goretux@...il.com>)

March 5 (15 messages)

Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Greg KH <greg@...ah.com>)
Re: handling of Linux kernel vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: handling of Linux kernel vulnerabilities (Solar Designer <solar@...nwall.com>)
CVE's for MediaWiki 1.20.2 / 1.19.2 (Kurt Seifried <kseifried@...hat.com>)
Re: handling of Linux kernel vulnerabilities (Andreas Ericsson <ae@....se>)
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) (Eric Lacombe <goretux@...il.com>)
Re: CVE id request: busybox (Thomas Biege <thomas@...e.de>)
Re: CVE id request: busybox (Thomas Biege <thomas@...e.de>)
CVE request: Linux kernel: xfs: _xfs_buf_find NULL pointer dereference (P J P <ppandit@...hat.com>)
Re: CVE request: Linux kernel: xfs: _xfs_buf_find NULL pointer dereference (Kurt Seifried <kseifried@...hat.com>)
Re: CVE id request: busybox (Raphael Geissert <geissert@...ian.org>)
Re: CVE id request: busybox (Kurt Seifried <kseifried@...hat.com>)
CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Mathias Krause <minipli@...glemail.com>)
Re: handling of Linux kernel vulnerabilities (Noel Butler <noel.butler@...ics.net>)
Re: handling of Linux kernel vulnerabilities (Solar Designer <solar@...nwall.com>)

March 6 (5 messages)

Re: handling of Linux kernel vulnerabilities (Alton Moore <alton.moore@...comlink.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Mathias Krause <minipli@...glemail.com>)
Re: CVE id request: busybox (Raphael Geissert <geissert@...ian.org>)
CVE for Ruby Entity expansion DoS vulnerability in REXML (XML bomb) (Kurt Seifried <kseifried@...hat.com>)

March 7 (7 messages)

CVE-2013-1792 Linux kernel: KEYS: race with concurrent install_user_keyrings() (P J P <ppandit@...hat.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Solar Designer <solar@...nwall.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Kurt Seifried <kseifried@...hat.com>)
Re: Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269] (jordi gemsstatus <jordigemsstatus@...il.com>)
RE: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs ("Christey, Steven M." <coley@...re.org>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Solar Designer <solar@...nwall.com>)

March 8 (7 messages)

CVE Request -- Linux kernel: sctp: SCTP_GET_ASSOC_STATS stack overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- Linux kernel: sctp: SCTP_GET_ASSOC_STATS stack overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Linux kernel: sctp: SCTP_GET_ASSOC_STATS stack overflow (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Kurt Seifried <kseifried@...hat.com>)
CVE abstraction choices and the Linux kernel ("Steven M. Christey" <coley@...re.org>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (Thomas Biege <thomas@...e.de>)

March 9 (1 message)

CVE Request: typo3 sql injection and open redirection (Marcus Meissner <meissner@...e.de>)

March 10 (4 messages)

Multiple SQL Injection vulnerabilities in Disk Pool Manager (DPM) (Adam Zabrocki <pi3@....com.pl>)
WordPress plugins vulnerable to CVE-2013-1808 (Henri Salo <henri@...v.fi>)
CVE-2009-4168: WordPress plugin snazzy-archives XSS vulnerability (Henri Salo <henri@...v.fi>)
CVE request: XSS in piwik 1.11 (Hanno Böck <hanno@...eck.de>)

March 11 (9 messages)

CVE-2009-4168: WordPress plugin vkontakte-api XSS vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE for Ruby Entity expansion DoS vulnerability in REXML (XML bomb) ("U.Nakamura" <usa@...bagecollect.jp>)
*.nist.gov websites gone forever? (Kurt Seifried <kseifried@...hat.com>)
CVE Request: MD5 used for Download verification (Donald Stufft <donald@...fft.io>)
Re: CVE Request: MD5 used for Download verification (Jeremy Stanley <fungi@...goth.org>)
CVE-2013-0913 Linux kernel i915 integer overflow (Kees Cook <keescook@...omium.org>)
Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-0914 Linux kernel sa_restorer information leak (Kees Cook <keescook@...omium.org>)
RE: *.nist.gov websites gone forever? ("Christey, Steven M." <coley@...re.org>)

March 12 (7 messages)

Re: Multiple SQL Injection vulnerabilities in Disk Pool Manager (DPM) (Kurt Seifried <kseifried@...hat.com>)
Re: Reverse lookup issue in Net::Server (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: typo3 sql injection and open redirection (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: XSS in piwik 1.11 (Kurt Seifried <kseifried@...hat.com>)
CVE assignments for "weak" crypto (was CVE Request: MD5 used for Download verification) ("Christey, Steven M." <coley@...re.org>)
Re: CVE assignments for "weak" crypto (was CVE Request: MD5 used for Download verification) (Tim <tim-security@...tinelchicken.org>)
CVE request: almanah does not encrypt its database (Vincent Danen <vdanen@...hat.com>)

March 13 (13 messages)

Re: CVE request: almanah does not encrypt its database (Kurt Seifried <kseifried@...hat.com>)
Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (gremlin@...mlin.ru)
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (Tim Brown <tmb@...35.com>)
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (Eduardo Tongson <propolice@...il.com>)
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (Pavel Labushev <pavel.labushev@...box.no>)
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (gremlin@...mlin.ru)
Re: CVE assignments for "weak" crypto (was CVE Request: MD5 used for Download verification) ("Mike O'Connor" <mjo@...o.mi.org>)
CLONE_NEWUSER|CLONE_FS root exploit (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE-2013-0913 Linux kernel i915 integer overflow ("Alexander E. Patrakov" <patrakov@...il.com>)
Re: CLONE_NEWUSER|CLONE_FS root exploit (Kees Cook <keescook@...omium.org>)
Re: Reverse lookup issue in Net::Server ("Steven M. Christey" <coley@...re.org>)
Re: Reverse lookup issue in Net::Server (Salvatore Bonaccorso <carnil@...ian.org>)
Temporary Notifications of New CVE Entries During NVD Outage ("Steven M. Christey" <coley@...re.org>)

March 14 (23 messages)

Re: CLONE_NEWUSER|CLONE_FS root exploit (Eugene Teo <eugeneteo@...nel.sg>)
Re: CLONE_NEWUSER|CLONE_FS root exploit (Eugene Teo <eugeneteo@...nel.sg>)
Re: Reverse lookup issue in Net::Server (Kurt Seifried <kseifried@...hat.com>)
Re: CLONE_NEWUSER|CLONE_FS root exploit (Greg KH <gregkh@...uxfoundation.org>)
Re: CVE assignments for "weak" crypto (was CVE Request: MD5 used for Download verification) (Kurt Seifried <kseifried@...hat.com>)
Re: CLONE_NEWUSER|CLONE_FS root exploit (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (gremlin@...mlin.ru)
ownCloud Security Advisories (2013-008, 2013-009, 2013-010) (Lukas Reschke <lukas@...cloud.org>)
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2009-4168: WordPress plugin vkontakte-api XSS vulnerability (Henri Salo <henri@...v.fi>)
Re: WordPress plugins vulnerable to CVE-2013-1808 (Henri Salo <henri@...v.fi>)
CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device (Marcus Meissner <meissner@...e.de>)
Re: CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device (Eugene Teo <eugeneteo@...nel.sg>)
US national vulnerability database hacked (Henri Salo <henri@...v.fi>)
[OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840) (Thierry Carrez <thierry@...nstack.org>)
Re: CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device (Petr Matousek <pmatouse@...hat.com>)
RE: CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device ("Christey, Steven M." <coley@...re.org>)
[OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838) (Thierry Carrez <thierry@...nstack.org>)
Re: CVE abstraction choices and the Linux kernel (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs (cve-assign@...re.org)
Re: CVE-2013-0913 Linux kernel i915 integer overflow (Xin Li <delphij@...phij.net>)
CVE request for a Drupal contributed module (Forest Monsen <forest.monsen@...il.com>)

March 15 (7 messages)

Re: CVE abstraction choices and the Linux kernel (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE request for a Drupal contributed module (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-1861 for MySQL/MariaDB: geometry query crashes mysqld (Kurt Seifried <kseifried@...hat.com>)
Further issue details about flaws corrected in upstream ClamAV 0.97.7 version (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: billion laughs flaw in ptlib (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: billion laughs flaw in ptlib (Kurt Seifried <kseifried@...hat.com>)

March 16 (1 message)

Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) (Solar Designer <solar@...nwall.com>)

March 17 (1 message)

CVE Request: VLC Buffer overflows (Sean Amoss <ackle@...too.org>)

March 18 (5 messages)

Re: CLONE_NEWUSER|CLONE_FS root exploit (Agostino Sarubbo <ago@...too.org>)
[CVE-2013-1854] Symbol DoS vulnerability in Active Record (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2013-1855] XSS vulnerability in sanitize_css in Action Pack (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2013-1856] XML Parsing Vulnerability affecting JRuby users (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2013-1857] XSS Vulnerability in the `sanitize` helper of Ruby on Rails (Aaron Patterson <tenderlove@...y-lang.org>)

March 19 (12 messages)

Re: CVE Request -- kernel: net: slab corruption due to improper synchronization around inet->opt (Solar Designer <solar@...nwall.com>)
Ruby CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: Further issue details about flaws corrected in upstream ClamAV 0.97.7 version (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: VLC Buffer overflows (Kurt Seifried <kseifried@...hat.com>)
Re: Ruby CVEs (Henri Salo <henri@...v.fi>)
Re: Ruby CVEs (Kurt Seifried <kseifried@...hat.com>)
Remote command execution in Ruby Gem Command Wrap (larry Cashdollar <larry0@...com>)
Fwd: CVE requests (larry Cashdollar <larry0@...com>)
Fwd: CVE requests (larry Cashdollar <larry0@...com>)
Re: Further issue details about flaws corrected in upstream ClamAV 0.97.7 version (Gynvael Coldwind <gynvael@...dwind.pl>)
Untrusted startup file inclusion in Chicken Scheme (Peter Bex <Peter.Bex@...all.nl>)
Linux kernel: net - three info leaks in rtnl (Mathias Krause <minipli@...glemail.com>)

March 20 (14 messages)

Re: Linux kernel: net - three info leaks in rtnl (Kurt Seifried <kseifried@...hat.com>)
Re: Untrusted startup file inclusion in Chicken Scheme (Kurt Seifried <kseifried@...hat.com>)
Re: Ruby CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: [Red Hat - Possible Forgery] Re: Ruby CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: Ruby CVEs (Henri Salo <henri@...v.fi>)
Re: Re: [Red Hat - Possible Forgery] Re: Ruby CVEs (Reed Loden <reed@...dloden.com>)
Re: CVE request: XSS flaws fixed in ganglia (Raphael Geissert <geissert@...ian.org>)
CVE-2013-1848 -- Linux kernel: ext3: format string issues (Petr Matousek <pmatouse@...hat.com>)
linux kernel: kvm: CVE-2013-179[6..8] (Petr Matousek <pmatouse@...hat.com>)
RE: Re: [Red Hat - Possible Forgery] Re: Ruby CVEs ("Christey, Steven M." <coley@...re.org>)
CVE Request: python-pip insecure temporary directory handling (David Black <disclosure@....org>)
CVE-2013-0287: sssd simple access provider flaw prevents intended ACL use when client to an AD provider (Vincent Danen <vdanen@...hat.com>)
[OSSA 2013-009] Keystone PKI tokens online validation bypasses revocation check (CVE-2013-1865) (Thierry Carrez <thierry@...nstack.org>)
RE: [Red Hat - Possible Forgery] Re: Ruby CVEs ("Christey, Steven M." <coley@...re.org>)

March 21 (6 messages)

Re: RE: [Red Hat - Possible Forgery] Re: Ruby CVEs (larry Cashdollar <larry0@...com>)
Re: Ruby CVEs (Solar Designer <solar@...nwall.com>)
CVE request: MantisBT text search query can crash site (Damien Regad <damien.regad@...ckgroup.com>)
CVE-2012-5662 x3270 improper validation of SSL certificates (Stefan Cornelius <scorneli@...hat.com>)
RE: Ruby CVEs ("Christey, Steven M." <coley@...re.org>)
Re: Ruby CVEs (Henri Salo <henri@...v.fi>)

March 22 (11 messages)

Re: CVE Request: python-pip insecure temporary directory handling (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: MantisBT text search query can crash site (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: python-pip insecure temporary directory handling (David Black <disclosure@....org>)
CVE Request -- drupal7-views : SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS) (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: mod_ruid2 before 0.9.8 (John Lightsey <jd@...nel.net>)
CVE request for "Views" (Drupal contributed module) (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request: mod_ruid2 before 0.9.8 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- drupal7-views : SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for "Views" (Drupal contributed module) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: python-pip insecure temporary directory handling (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: mod_ruid2 before 0.9.8 (John Lightsey <john@...nuts.net>)

March 23 (3 messages)

Re: CVE request: mod_ruid2 before 0.9.8 (Kurt Seifried <kseifried@...hat.com>)
CVE request: OpenCart filemanager.php parameter traversal arbitrary file access (Henri Salo <henri@...v.fi>)
Re: CVE request for "Views" (Drupal contributed module) (Forest Monsen <forest.monsen@...il.com>)

March 24 (1 message)

Re: CVE request: OpenCart filemanager.php parameter traversal arbitrary file access (Kurt Seifried <kseifried@...hat.com>)

March 25 (12 messages)

XSS vulnerabilities in ZeroClipboard and multiple web applications ("MustLive" <mustlive@...security.com.ua>)
Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
Re: XSS vulnerabilities in ZeroClipboard and multiple web applications (Henri Salo <henri@...v.fi>)
Re: CVE Request -- drupal7-views : SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Linux kernel: net - three info leaks in rtnl (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Linux kernel: net - three info leaks in rtnl (Moritz Muehlenhoff <jmm@...ian.org>)
CVE Request: Mongo DB (Marcus Meissner <meissner@...e.de>)
CVE request: libxslt "xsltDocumentFunction()" and "xsltAddKey()" Denial of Service Vulnerabilities (Agostino Sarubbo <ago@...too.org>)
Re: CVE Request: Mongo DB (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: libxslt "xsltDocumentFunction()" and "xsltAddKey()" Denial of Service Vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
CVE request: ibutils improper use of files in /tmp (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: ibutils improper use of files in /tmp ("Larry W. Cashdollar" <larry0@...com>)

March 26 (13 messages)

Re: CVE request: ibutils improper use of files in /tmp (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-1895 py-bcrypt 0.2 concurrency vulnerability (auth bypass) (Kurt Seifried <kseifried@...hat.com>)
Ruby gem Thumbshooter 0.1.5 remote code execution (larry Cashdollar <larry0@...com>)
Re: CVE request: ibutils improper use of files in /tmp ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE request: ibutils improper use of files in /tmp (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: ibutils improper use of files in /tmp (Vincent Danen <vdanen@...hat.com>)
Re: Ruby gem Thumbshooter 0.1.5 remote code execution ("Larry W. Cashdollar" <larry0@...com>)
Re: WordPress plugins vulnerable to CVE-2013-1808 (Henri Salo <henri@...v.fi>)
Re: CVE request: ibutils improper use of files in /tmp (Kurt Seifried <kseifried@...hat.com>)
CVE request: WordPress plugin user-photo file upload arbitrary PHP code execution (Henri Salo <henri@...v.fi>)
Re: CVE request: ibutils improper use of files in /tmp (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ibutils improper use of files in /tmp (Agostino Sarubbo <ago@...too.org>)
Re: Ruby gem Thumbshooter 0.1.5 remote code execution (Kurt Seifried <kseifried@...hat.com>)

March 27 (10 messages)

Re: Ruby gem Thumbshooter 0.1.5 remote code execution ("Larry W. Cashdollar" <larry0@...com>)
Denial of service in 389-ds and FreeIPA (CVE-2013-0336) (Vincent Danen <vdanen@...hat.com>)
CVE Request -- yum: Not removing bad metadata and using it in next run (Jan Lieskovsky <jlieskov@...hat.com>)
Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)
Re: [kernel-hardening] Security vulnerability tools (Tim Brown <tmb@...35.com>)
Re: Security vulnerability tools (Solar Designer <solar@...nwall.com>)
Re: Security vulnerability tools (Russ Allbery <rra@...nford.edu>)
Re: [kernel-hardening] Re: Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)
Re: Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)
Re: Re: [kernel-hardening] Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)

March 28 (9 messages)

Re: Security vulnerability tools (Murray McAllister <mmcallis@...hat.com>)
Re: Security vulnerability tools (Solar Designer <solar@...nwall.com>)
Re: Security vulnerability tools (Andreas Ericsson <ae@....se>)
CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options (Jan Lieskovsky <jlieskov@...hat.com>)
RE: WordPress plugins vulnerable to CVE-2013-1808 ("Christey, Steven M." <coley@...re.org>)
Re: Re: [kernel-hardening] Security vulnerability tools (Tim Brown <tmb@...35.com>)
Re: Re: [kernel-hardening] Security vulnerability tools (Steve Grubb <sgrubb@...hat.com>)
Re: CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options (Kurt Seifried <kseifried@...hat.com>)
CVE Request for Drupal contrib modules (Forest Monsen <forest.monsen@...il.com>)

March 29 (4 messages)

Re: CVE Request for Drupal contrib modules (Kurt Seifried <kseifried@...hat.com>)
Re: Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)
Re: Re: Security vulnerability tools (Raphael Geissert <geissert@...ian.org>)
Re: CVE Request -- yum: Not removing bad metadata and using it in next run (Kurt Seifried <kseifried@...hat.com>)

March 31 (4 messages)

Remote command execution in Ruby Gem ldoce 0.0.2 ("Larry W. Cashdollar" <larry0@...com>)
Re: Remote command execution in Ruby Gem ldoce 0.0.2 (Kurt Seifried <kseifried@...hat.com>)
Re: Remote command execution in Ruby Gem ldoce 0.0.2 (Larry Cashdollar <larry0@...com>)
Re: [Full-disclosure] XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS - ZeroClipboard.swf ("MustLive" <mustlive@...security.com.ua>)

246 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.