oss-security mailing list - 2013/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 4	²	³ 14	⁴ 8	⁵ 4	⁶ 5	⁷ 1
⁸ 18	⁹ 20	¹⁰ 5	¹¹ 5	¹² 6	¹³ 4	¹⁴ 3
¹⁵ 5	¹⁶ 12	¹⁷ 9	¹⁸ 13	¹⁹ 3	²⁰ 4	²¹ 10
²² 14	²³ 8	²⁴ 15	²⁵ 14	²⁶ 16	²⁷ 3	²⁸ 3
²⁹ 22	³⁰ 10

Messages by day:

April 1 (4 messages)

RE: Re: Security vulnerability tools ("Zhao, Passion" <passion.zhao@...el.com>)
Re: Re: Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)
Re: Re: Security vulnerability tools (Corey Bryant <coreyb@...ux.vnet.ibm.com>)
Re: Re: Security vulnerability tools ("Larry W. Cashdollar" <larry0@...com>)

April 3 (14 messages)

CVE-2013-1912 : haproxy may crash on TCP content inspection rules (Willy Tarreau <w@....eu>)
CVE Request: glibc getaddrinfo() stack overflow (Marcus Meissner <meissner@...e.de>)
CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request: glibc getaddrinfo() stack overflow (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: glibc getaddrinfo() stack overflow (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE Request: glibc getaddrinfo() stack overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: glibc getaddrinfo() stack overflow (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: WordPress plugin user-photo file upload arbitrary PHP code execution (Kurt Seifried <kseifried@...hat.com>)
browser document.cookie DoS vulnerability (Stefan Bühler <stbuehler@...httpd.net>)
Re: Further issue details about flaws corrected in upstream ClamAV 0.97.7 version (Kurt Seifried <kseifried@...hat.com>)
ownCloud Security Advisories (2013-011, 2013-012) (Lukas Reschke <lukas@...cloud.org>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
CVE request: rpc-gssd is vulnerable to DNS spoofing (Vincent Danen <vdanen@...hat.com>)

April 4 (8 messages)

Confused with Drupal CVEs (Henri Salo <henri@...v.fi>)
PostgreSQL security update (Solar Designer <solar@...nwall.com>)
Re: PostgreSQL security update (Solar Designer <solar@...nwall.com>)
RE: Confused with Drupal CVEs ("Christey, Steven M." <coley@...re.org>)
Re: CVE request: rpc-gssd is vulnerable to DNS spoofing (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations (Xen.org security team <security@....org>)
Multiple CVE requests for MantisBT (Damien Regad <damien.regad@...ckgroup.com>)

April 5 (4 messages)

Re: CVE Request: glibc getaddrinfo() stack overflow (Marcus Meissner <meissner@...e.de>)
CVE Request: tg3 VPD firmware -> driver injection (Marcus Meissner <meissner@...e.de>)
CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (Marcus Meissner <meissner@...e.de>)
Zimbra XSS in aspell.php, CVE request (Michael Scherer <misc@...b.org>)

April 6 (5 messages)

Re: Zimbra XSS in aspell.php, CVE request (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: tg3 VPD firmware -> driver injection (Kurt Seifried <kseifried@...hat.com>)
Re: Multiple CVE requests for MantisBT (Kurt Seifried <kseifried@...hat.com>)
Re: Zimbra XSS in aspell.php, CVE request (Michael Scherer <misc@...b.org>)

April 7 (1 message)

New vulnerabilty in imagemagick (Bastien ROUCARIES <roucaries.bastien@...il.com>)

April 8 (18 messages)

cve request: util-linux (Michael Gilbert <mgilbert@...ian.org>)
Any info on dovecot CVE-2010-0535? (Michael Gilbert <mgilbert@...ian.org>)
Re: cve request: util-linux ("Adam D. Barratt" <adam@...m-barratt.org.uk>)
Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (P J P <ppandit@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (P J P <ppandit@...hat.com>)
Re: Multiple CVE requests for MantisBT (Damien Regad <damien.regad@...ckgroup.com>)
Re: Re: Multiple CVE requests for MantisBT (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Multiple CVE requests for MantisBT (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (Dan Carpenter <dan.carpenter@...cle.com>)
Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Breno Silva <breno.silva@...il.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (Dan Carpenter <dan.carpenter@...cle.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (Dan Carpenter <dan.carpenter@...cle.com>)
Re: New vulnerabilty in imagemagick (Kurt Seifried <kseifried@...hat.com>)
Re: Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 (Kurt Seifried <kseifried@...hat.com>)
Re: browser document.cookie DoS vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Multiple CVE requests for MantisBT (Damien Regad <damien.regad@...ckgroup.com>)
Re: Any info on dovecot CVE-2010-0535? (Geoff Keating <geoffk@...le.com>)

April 9 (20 messages)

Re: Re: Re: Multiple CVE requests for MantisBT (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (P J P <ppandit@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (P J P <ppandit@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (P J P <ppandit@...hat.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (Dan Carpenter <dan.carpenter@...cle.com>)
Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE (P J P <ppandit@...hat.com>)
Re: Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Breno Silva <breno.silva@...il.com>)
Re: Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Breno Silva <breno.silva@...il.com>)
Re: Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Athmane Madjoudj <athmanem@...il.com>)
Re: Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks (Athmane Madjoudj <athmanem@...il.com>)
Re: CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8 (Kurt Seifried <kseifried@...hat.com>)
Re: Zimbra XSS in aspell.php, CVE request (Kurt Seifried <kseifried@...hat.com>)
Re: Zimbra XSS in aspell.php, CVE request (Jeff Flanigan <jflanigan@...bra.com>)
Postfix incorrect permissions on configurations. Request. (Russ Thompson <russ@...dbit.com>)
Re: Postfix incorrect permissions on configurations. Request. (Michael Tokarev <mjt@....msk.ru>)
Re: Postfix incorrect permissions on configurations. Request. (Russ Thompson <russ@...dbit.com>)
Re: Postfix incorrect permissions on configurations. Request. (Michael Tokarev <mjt@....msk.ru>)
Re: Postfix incorrect permissions on configurations. Request. (Mike <mikedawg@...il.com>)

April 10 (5 messages)

Re: cve request: util-linux (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: Any info on dovecot CVE-2010-0535? (Michael Gilbert <mgilbert@...ian.org>)
Remote command injection in Ruby Gem kelredd-pruview 0.3.8 ("Larry W. Cashdollar" <larry0@...com>)
Re: Re: Postfix incorrect permissions on configurations. Request. (Russ Thompson <russ@...dbit.com>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)

April 11 (5 messages)

CVE-2010-5109 libytnef buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: PostgreSQL security update (Solar Designer <solar@...nwall.com>)
SabreDAV security advisory (CVE-2013-1939) (Evert Pot <evert@...ftopsolutions.nl>)
ownCloud Security Advisories (2013-014, 2013-015, 2013-016) (Lukas Reschke <lukas@...cloud.org>)
CVE-2013-1942 jPlayer 2.2.19 XSS (Kurt Seifried <kseifried@...hat.com>)

April 12 (6 messages)

Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: Remote command injection in Ruby Gem kelredd-pruview 0.3.8 (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-1900 looks like an OpenSSL bug (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE-2013-1900 looks like an OpenSSL bug (Solar Designer <solar@...nwall.com>)
Re: CVE-2013-1900 looks like an OpenSSL bug (Florian Weimer <fw@...eb.enyo.de>)
Re-evaluating expat/libxml2 CVE assignments ("Steven M. Christey" <coley@...re.org>)

April 13 (4 messages)

CVE for XSS in EasyPHPCalender script (Anant Shrivastava <anant@...ntshri.info>)
Remote command injection md2pdf ruby gem ("Larry W. Cashdollar" <larry0@...com>)
Re: Remote command injection md2pdf ruby gem (Kurt Seifried <kseifried@...hat.com>)
Summary of security bugs (now fixed) in user namespaces (Andy Lutomirski <luto@...capital.net>)

April 14 (3 messages)

CVE-2013-1949 Social Media Widget remote file inclusion (Kurt Seifried <kseifried@...hat.com>)
CVE Request: VLC Buffer Overflow in ASF Demuxer (Salvatore Bonaccorso <carnil@...ian.org>)
Linux kernel: more net info leak fixes for v3.9 (Mathias Krause <minipli@...glemail.com>)

April 15 (5 messages)

CVE request - Linux kernel: tracing NULL pointer dereference (P J P <ppandit@...hat.com>)
CVE request: Linux kernel: cifs: NULL pointer dereference (P J P <ppandit@...hat.com>)
Xen Security Advisory 48 (CVE-2013-1922) - qemu-nbd format-guessing due to missing format specification (Xen.org security team <security@....org>)
re: Summary of security bugs (now fixed) in user namespaces (Brian Martin <brian@...nsecurityfoundation.org>)
Re: Summary of security bugs (now fixed) in user namespaces (Andy Lutomirski <luto@...capital.net>)

April 16 (12 messages)

autotrace: stack-based buffer overflow in bmp parser (Murray McAllister <mmcallis@...hat.com>)
CVE-2013-1922 -- qemu: qemu-nbd block format auto-detection vulnerability (Petr Matousek <pmatouse@...hat.com>)
Re: autotrace: stack-based buffer overflow in bmp parser (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Summary of security bugs (now fixed) in user namespaces (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: VLC Buffer Overflow in ASF Demuxer (Kurt Seifried <kseifried@...hat.com>)
Re: CVE for XSS in EasyPHPCalender script (Kurt Seifried <kseifried@...hat.com>)
A note on CVE assignment timelines (Kurt Seifried <kseifried@...hat.com>)
CVE Request: MediaWiki Security Releases 1.20.4 and 1.19.5 ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: Summary of security bugs (now fixed) in user namespaces (Florian Weimer <fweimer@...hat.com>)
Re: Re: Summary of security bugs (now fixed) in user namespaces (Andy Lutomirski <luto@...capital.net>)
Re: Re: Summary of security bugs (now fixed) in user namespaces (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: MediaWiki Security Releases 1.20.4 and 1.19.5 (Kurt Seifried <kseifried@...hat.com>)

April 17 (9 messages)

Fwd: Multiple Vulnerabilities in Simple HRM system v2.3 and below (Doraemon Sk8ers <doraemon.sk8ers@...il.com>)
Multiple vulnerabilities in PHP Address Book v8.2.5 (Doraemon Sk8ers <doraemon.sk8ers@...il.com>)
debian: gpg --verify suggests entire file was verified, even if file contains auxiliary data (Thomas Biege <thomas@...e.de>)
CVE request : libxml2 Multiple Use-After-Free Vulnerabilities (Agostino Sarubbo <ago@...too.org>)
Re: Multiple vulnerabilities in PHP Address Book v8.2.5 (Henri Salo <henri@...v.fi>)
Re: debian: gpg --verify suggests entire file was verified, even if file contains auxiliary data (Kurt Seifried <kseifried@...hat.com>)
Re: debian: gpg --verify suggests entire file was verified, even if file contains auxiliary data (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Fwd: Re: CVE Request: ownCloud 5.0.5 and 4.5.10 (Kurt Seifried <kseifried@...hat.com>)

April 18 (13 messages)

Re: debian: gpg --verify suggests entire file was verified, even if file contains auxiliary data (Kurt Seifried <kseifried@...hat.com>)
partial signed message verification in MUAs [was: Re: debian: gpg --verify suggests entire file was verified, even if … (Daniel Kahn Gillmor <dkg@...thhorseman.…)
Xorg-x11-server: Information disclosure due enabling events from hot-plug devices despite input from the device being m… (Huzaifa Sidhpurwala <huzaifas@...hat.co…)
CVE-2012-XXYY Request -- google-authenticator: Information disclosure due insecure requirement on the secrets file (Jan Lieskovsky <jlieskov@...hat.com>)
plone, rrdtool, zenoss bugs (Thomas Pollet <thomas.pollet@...il.com>)
Xen Security Advisory 46 (CVE-2013-1919) - Several access permission issues with IRQs for unprivileged guests (Xen.org security team <security@....org>)
Xen Security Advisory 44 (CVE-2013-1917) - Xen PV DoS vulnerability with SYSENTER (Xen.org security team <security@....org>)
Xen Security Advisory 44 (CVE-2013-1917) - Xen PV DoS vulnerability with SYSENTER (Xen.org security team <security@....org>)
Xen Security Advisory 50 (CVE-2013-1964) - grant table hypercall acquire/release imbalance (Xen.org security team <security@....org>)
Re: CVE-2012-XXYY Request -- google-authenticator: Information disclosure due insecure requirement on the secrets file (Kurt Seifried <kseifried@...hat.com>)
Re: plone, rrdtool, zenoss bugs (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request : libxml2 Multiple Use-After-Free Vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)

April 19 (3 messages)

Re: CVE request : libxml2 Multiple Use-After-Free Vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-1977 - OpenStack keystone.conf insecure file permissions (Kurt Seifried <kseifried@...hat.com>)
distros list news (Solar Designer <solar@...nwall.com>)

April 20 (4 messages)

Request for linux-distros list membership (Allan McRae <allan@...hlinux.org>)
Re: CVE-2013-1942 jPlayer 2.2.19 XSS (Lukas Reschke <lukas@...cloud.org>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
upstream source code authenticity checking (Solar Designer <solar@...nwall.com>)

April 21 (10 messages)

Re: Request for linux-distros list membership (Allan McRae <allan@...hlinux.org>)
ownCloud Security Advisories (2013-017, 2013-018) (Lukas Reschke <lukas@...cloud.org>)
Re: upstream source code authenticity checking (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: upstream source code authenticity checking (Marcus Meissner <meissner@...e.de>)
OS command injection vulnerability in Chicken Scheme (Peter Bex <Peter.Bex@...all.nl>)
Vulnerabilities in jPlayer ("MustLive" <mustlive@...security.com.ua>)
Re: upstream source code authenticity checking (Jeremy Stanley <fungi@...goth.org>)
Re: upstream source code authenticity checking (Allan McRae <allan@...hlinux.org>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)

April 22 (14 messages)

Re: upstream source code authenticity checking (Allan McRae <allan@...hlinux.org>)
Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)
Re: Linux kernel: more net info leak fixes for v3.9 (cve-assign@...re.org)
Re: upstream source code authenticity checking (Stuart Henderson <sthen@...nbsd.org>)
CVE request: libxmp MASI Parsing Buffer Overflow Vulnerability (Agostino Sarubbo <ago@...too.org>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (P J P <ppandit@...hat.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (Mathias Krause <minipli@...glemail.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (P J P <ppandit@...hat.com>)
[CVE assignment notification] CVE-2013-1950 libtirpc: Invalid pointer free leads to rpcbind daemon crash (A different vul… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (Mathias Krause <minipli@...glemail.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (Greg KH <greg@...ah.com>)
Re: CVE request: libxmp MASI Parsing Buffer Overflow Vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (cve-assign@...re.org)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (Greg KH <greg@...ah.com>)

April 23 (8 messages)

Vulnerabilities in multiple plugins for WordPress with jPlayer ("MustLive" <mustlive@...security.com.ua>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (Petr Matousek <pmatouse@...hat.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (P J P <ppandit@...hat.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (P J P <ppandit@...hat.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (Mathias Krause <minipli@...glemail.com>)
Re: Re: Linux kernel: more net info leak fixes for v3.9 (P J P <ppandit@...hat.com>)
Re: CVE-2013-1977 - OpenStack keystone.conf insecure file permissions (Thierry Carrez <thierry@...nstack.org>)
CVE Request for XSS vulnerability in Ushahidi Web (Robbie Mackay <robbie@...ahidi.com>)

April 24 (15 messages)

CVE-2013-2006 OpenStack keystone LDAP password disclosure in log files (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2013-2006 OpenStack keystone LDAP password disclosure in log files (Thierry Carrez <thierry@...nstack.org>)
Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Jan Lieskovsky <jlieskov@...hat.com>)
Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Henri Salo <henri@...v.fi>)
CVE(-2007-xxxx?) request: telepathy-idle does not check SSL certificates (Simon McVittie <smcv@...ian.org>)
Advisory dates (Dag-Erling Smørgrav <des@....no>)
CVE-2013-3221 can also relate to Microsoft SQL Server and IBM DB2 (cve-assign@...re.org)
WP-Super-Cache XSS and Remote Code Exec (Kurt Seifried <kseifried@...hat.com>)
W3 Total Cache 0.9.2.8 Remote Code Exec (Kurt Seifried <kseifried@...hat.com>)
Re: WP-Super-Cache XSS and Remote Code Exec (Kurt Seifried <kseifried@...hat.com>)
Re: Advisory dates (Kurt Seifried <kseifried@...hat.com>)
Re: WP-Super-Cache XSS and Remote Code Exec (Henri Salo <henri@...v.fi>)
Re: WP-Super-Cache XSS and Remote Code Exec (Henri Salo <henri@...v.fi>)
Vulnerabilities in multiple themes for WordPress with jPlayer ("MustLive" <mustlive@...security.com.ua>)
Re: WP-Super-Cache XSS and Remote Code Exec (Hanno Böck <hanno@...eck.de>)

April 25 (14 messages)

Re: WP-Super-Cache XSS and Remote Code Exec (Kurt Seifried <kseifried@...hat.com>)
Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Kurt Seifried <kseifried@...hat.com>)
Re: upstream source code authenticity checking ("Eric H. Christensen" <sparks@...hat.com>)
WP-Super-Cache 1.3.1 Remote Code Exec - properly fixed? (Kurt Seifried <kseifried@...hat.com>)
Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)
Re: upstream source code authenticity checking (Allan McRae <allan@...hlinux.org>)
Re: upstream source code authenticity checking (Kurt Seifried <kseifried@...hat.com>)
Re: Advisory dates (Dag-Erling Smørgrav <des@....no>)
Re: upstream source code authenticity checking (Josh Bressers <bressers@...hat.com>)
Re: upstream source code authenticity checking (nicolas vigier <boklm@...s-attacks.org>)
Re: upstream source code authenticity checking (nicolas vigier <boklm@...s-attacks.org>)
Re: upstream source code authenticity checking (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE Request -- autojump: autojump profile will load random stuff from a directory called custom_install (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- autojump: autojump profile will load random stuff from a directory called custom_install (Kurt Seifried <kseifried@...hat.com>)

April 26 (16 messages)

Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)
Nginx ngx_http_close_connection function integer overflow - can anyone confirm this? (Kurt Seifried <kseifried@...hat.com>)
Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)
Re: Nginx ngx_http_close_connection function integer overflow - can anyone confirm this? (Alistair Crooks <agc@...src.org>)
Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)
CVE-2013-2013 - OpenStack keystone password disclosure on command line (Kurt Seifried <kseifried@...hat.com>)
Re: upstream source code authenticity checking (Kurt Seifried <kseifried@...hat.com>)
Re: Nginx ngx_http_close_connection function integer overflow - can anyone confirm this? (Andrew Alexeev <andrew@...nx.com>)
Re: upstream source code authenticity checking (yersinia <yersinia.spiros@...il.com>)
Re: upstream source code authenticity checking (Dag-Erling Smørgrav <des@....no>)
Re: upstream source code authenticity checking (Marcus Meissner <meissner@...e.de>)
Re: upstream source code authenticity checking (Kurt Seifried <kseifried@...hat.com>)
Re: upstream source code authenticity checking (Dag-Erling Smørgrav <des@....no>)
Re: upstream source code authenticity checking (Florian Weimer <fweimer@...hat.com>)
CVE request: Linux kernel: ext4: hang during mount(8) (P J P <ppandit@...hat.com>)
Re: CVE request: Linux kernel: ext4: hang during mount(8) (Kurt Seifried <kseifried@...hat.com>)

April 27 (3 messages)

Re: upstream source code authenticity checking (Alistair Crooks <agc@...src.org>)
Re: upstream source code authenticity checking (Kurt Seifried <kseifried@...hat.com>)
Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Felix Gröbert <groebert@...gle.com>)

April 28 (3 messages)

Re: Nginx ngx_http_close_connection function integer overflow - can anyone confirm this? (Shawn <citypw@...il.com>)
Re: [PATCH 1/3] virtio-pci: properly validate address before accessing config (Petr Matousek <pmatouse@...hat.com>)
Multiple vulnerabilities in BOINC (Alyssa Milburn <amilburn@...l.org>)

April 29 (22 messages)

Multiple Linux setuid output redirection vulnerabilities (Andy Lutomirski <luto@...capital.net>)
distros vs. linux-distros lists (Solar Designer <solar@...nwall.com>)
Re: CVE request - Linux kernel: tracing NULL pointer dereference (cve-assign@...re.org)
Re: CVE request: Linux kernel: cifs: NULL pointer dereference (cve-assign@...re.org)
Re: Re: [PATCH 1/3] virtio-pci: properly validate address before accessing config (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [PATCH 1/3] virtio-pci: properly validate address before accessing config ("Michael S. Tsirkin" <mst@...hat.com>)
CVE request -- Linux kernel: veth: double-free in case of congestion (Petr Matousek <pmatouse@...hat.com>)
Re: Nginx ngx_http_close_connection function integer overflow - can anyone confirm this? (Andrew Alexeev <andrew@...nx.com>)
Re: upstream source code authenticity checking ("Eric H. Christensen" <sparks@...hat.com>)
Re: CVE request -- Linux kernel: veth: double-free in case of congestion (Kurt Seifried <kseifried@...hat.com>)
Re: Multiple vulnerabilities in BOINC (Kurt Seifried <kseifried@...hat.com>)
Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Kurt Seifried <kseifried@...hat.com>)
Re: OS command injection vulnerability in Chicken Scheme (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for XSS vulnerability in Ushahidi Web (Kurt Seifried <kseifried@...hat.com>)
Re: CVE(-2007-xxxx?) request: telepathy-idle does not check SSL certificates (Kurt Seifried <kseifried@...hat.com>)
Re: OS command injection vulnerability in Chicken Scheme (Peter Bex <Peter.Bex@...all.nl>)
Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2013-1942 jPlayer 2.2.19 XSS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE(-2007-xxxx?) request: telepathy-idle does not check SSL certificates (Kurt Seifried <kseifried@...hat.com>)
Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details? (Kurt Seifried <kseifried@...hat.com>)
Re: OS command injection vulnerability in Chicken Scheme (Kurt Seifried <kseifried@...hat.com>)
RE: OS command injection vulnerability in Chicken Scheme ("Christey, Steven M." <coley@...re.org>)

April 30 (10 messages)

Re: OS command injection vulnerability in Chicken Scheme (Kurt Seifried <kseifried@...hat.com>)
memcached remote seg fault (Kurt Seifried <kseifried@...hat.com>)
Re: memcached remote seg fault (Kurt Seifried <kseifried@...hat.com>)
[NOTIFICATION] strongSwan-5.0.4 correcting ECDSA flaw (CVE-2013-2944) (Jan Lieskovsky <jlieskov@...hat.com>)
Flightgear remote format string (Andrés Gómez Ramírez <andresgomezram7@...il.com>)
Re: Flightgear remote format string (Kurt Seifried <kseifried@...hat.com>)
Re: upstream source code authenticity checking (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE-2013-2029: Nagios RPM nagios.upgrade_to_v3.sh (Kurt Seifried <kseifried@...hat.com>)
Re-emergence of CVE-2008-4796 in Nagios current (Kurt Seifried <kseifried@...hat.com>)
Re: Re-emergence of CVE-2008-4796 in Nagios current (David Jorm <djorm@...hat.com>)

258 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.