oss-security mailing list - 2013/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 14	² 7	³ 2	⁴ 12	⁵ 15	⁶ 3	⁷
⁸ 2	⁹ 11	¹⁰ 19	¹¹ 12	¹² 6	¹³ 1	¹⁴
¹⁵ 10	¹⁶ 11	¹⁷ 3	¹⁸ 14	¹⁹ 12	²⁰ 3	²¹ 2
²² 8	²³ 12	²⁴ 7	²⁵ 24	²⁶ 8	²⁷ 12	²⁸ 1
²⁹ 7	³⁰ 13	³¹ 9

Messages by day:

July 1 (14 messages)

CVE-2013-2228 : Salt Stack RSA exponent of 1 (there can be only one! da-na-naaah! na-na-na-naahh-nah-nahhh!) (Kurt Seifried <kseifried@...hat.com>)
CVE Request: Ansible not caching SSH host keys (Michael Samuel <mik@...net.net>)
Re: Kernel: 2.6.32+ IP_RETOPTS Buffer Poisoning DoS hemlock.c (Sebastian Krahmer <krahmer@...e.de>)
Request for linux-distros list membership (Sona Sarmadi <sona.sarmadi@...a.com>)
CVE Request: information leak in AF_KEY notify messages (Marcus Meissner <meissner@...e.de>)
CVE-2013-2218 -- libvirt: crash when listing network interfaces with filters (Petr Matousek <pmatouse@...hat.com>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros list membership (Kurt Seifried <kseifried@...hat.com>)
Re: [Libvirt-Security] CVE-2013-2218 -- libvirt: crash when listing network interfaces with filters (Eric Blake <eblake@...hat.com>)
Re: CVE-2013-2218 -- libvirt: crash when listing network interfaces with filters (Kurt Seifried <kseifried@...hat.com>)
CVE request: FreeSWITCH regex substitution 3 buffer overflows (Michael Tokarev <mjt@....msk.ru>)
Re: CVE-2013-2218 -- libvirt: crash when listing network interfaces with filters (Agostino Sarubbo <ago@...too.org>)
Re: [Libvirt-Security] CVE-2013-2218 -- libvirt: crash when listing network interfaces with filters (Kurt Seifried <kseifried@...hat.com>)
Question about signed email (Kurt Seifried <kseifried@...hat.com>)

July 2 (7 messages)

Re: Question about signed email (Florian Weimer <fweimer@...hat.com>)
RE: Request for linux-distros list membership (Sona Sarmadi <sona.sarmadi@...a.com>)
CVE Request: kernel: ipv6: using ipv4 vs ipv6 structure during routing lookup in sendmsg (Marcus Meissner <meissner@...e.de>)
Re: CVE request: Kernel 2.6.32+ IP_RETOPTS Buffer Poisoning DoS (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request: kernel: ipv6: using ipv4 vs ipv6 structure during routing lookup in sendmsg (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Ansible not caching SSH host keys (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: information leak in AF_KEY notify messages (Kurt Seifried <kseifried@...hat.com>)

July 3 (2 messages)

CVE Request: Earlier AF_KEY in key_notify_policy_flush (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Earlier AF_KEY in key_notify_policy_flush (Marcus Meissner <meissner@...e.de>)

July 4 (12 messages)

CVE request: Quagga OSPF-API stack overrun (David Lamparter <equinox@...c24.net>)
Re: CVE request: Quagga OSPF-API stack overrun (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Earlier AF_KEY in key_notify_policy_flush (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE-2013-1942 jPlayer 2.2.19 XSS (Kurt Seifried <kseifried@...hat.com>)
CVE requests for Ajaxplorer ("Mehrenberger, Xavier" <Xavier.Mehrenberger@...sidian.com>)
CVE Request -- gallery3 (3.0.9): Fixing two security flaws (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request: glibc getaddrinfo() stack overflow (Raphael Geissert <geissert@...ian.org>)
OpenVZ security repport - Multiple memory leaks (CVE-2013-2239) (Jonathan Salwan <jonathan.salwan@...il.com>)
Re: CVE Request -- gallery3 (3.0.9): Fixing two security flaws (Bharat Mediratta <bharat@...alto.com>)
Re: CVE Request -- gallery3 (3.0.9): Fixing two security flaws (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: glibc getaddrinfo() stack overflow (Maksymilian <max@...t.cx>)

July 5 (15 messages)

CVE Request - PloneFormGen, multiple vulnerabilities (Matthew Wilkes <matt@...distillery.eu>)
LSE Leading Security Experts GmbH - LSE-2013-07-03 - rsyslog ElasticSearch Plugin ("LSE Leading Security Experts GmbH (Security Advisories)" <advisories@...xpe…)
Re: CVE Request -- gallery3 (3.0.9): Fixing two security flaws (Shad Laws <shad@...dlaws.com>)
Possible CVE request: virtualbox virtio-net host DoS (Raphael Geissert <geissert@...ian.org>)
CVE Request: libxml2 external parsed entities issue (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: libxml2 external parsed entities issue (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: libxml2 external parsed entities issue (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: libxml2 external parsed entities issue (Marcus Meissner <meissner@...e.de>)
NULL pointer dereferences; multiple issues ("mancha" <mancha1@...h.com>)
Re: CVE Request: libxml2 external parsed entities issue (Kurt Seifried <kseifried@...hat.com>)
Re: Possible CVE request: virtualbox virtio-net host DoS (Kurt Seifried <kseifried@...hat.com>)
Question about CVE for X!! DoS (Kurt Seifried <kseifried@...hat.com>)
CVE request for Drupal contrib module (Forest Monsen <forest.monsen@...il.com>)
Re: Question about CVE for X!! DoS (Julien Cristau <jcristau@...ian.org>)
Re: Possible CVE request: virtualbox virtio-net host DoS (Oracle Security Alerts <secalert_us@...cle.com>)

July 6 (3 messages)

Re: Question about CVE for X!! DoS (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Question about CVE for X!! DoS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contrib module (Kurt Seifried <kseifried@...hat.com>)

July 8 (2 messages)

[oCERT-2013-001] File Roller path sanitization errors (Daniele Bianco <danbia@...rt.org>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Kurt Seifried <kseifried@...hat.com>)

July 9 (11 messages)

new FFMpeg stuff (Kurt Seifried <kseifried@...hat.com>)
cryptocat/decryptocat - needs a cve? (Kurt Seifried <kseifried@...hat.com>)
Re: new FFMpeg stuff (Moritz Muehlenhoff <jmm@...til.org>)
Re: [security@...e.de] Re: Question about CVE for X!! DoS (Marcus Meissner <meissner@...e.de>)
Re: new FFMpeg stuff (Michael Niedermayer <michaelni@....at>)
Re: cryptocat/decryptocat - needs a cve? (Nadim Kobeissi <nadim@...im.cc>)
Linux kernel libceph NULL function pointer dereference (CVE-2013-1059) (Tyler Hicks <tyhicks@...onical.com>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows (Michael Tokarev <mjt@....msk.ru>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows ("Adam D. Barratt" <adam@...m-barratt.org.uk>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows (Kurt Seifried <kseifried@...hat.com>)

July 10 (19 messages)

Re: Re: cryptocat/decryptocat - needs a cve? (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows (Michael Tokarev <mjt@....msk.ru>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows ("Adam D. Barratt" <adam@...m-barratt.org.uk>)
Re: CVE request: FreeSWITCH regex substitution 3 buffer overflows (Michael Tokarev <mjt@....msk.ru>)
[NOT A CVE REQUEST] CVE-2013-2230 -- libvirt: multiple registered events crash (Petr Matousek <pmatouse@...hat.com>)
CVE Request -- FreeRDP: Multiple security fixes in 1.1.0-beta1 version (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Jonas Meurer <jonas@...esources.org>)
Re: CVE Request - PloneFormGen, multiple vulnerabilities (Matthew Wilkes <matthew@...thewwilkes.co.uk>)
Re: cryptocat/decryptocat - needs a cve? (Nadim Kobeissi <nadim@...im.cc>)
Re: Re: Re: cryptocat/decryptocat - needs a cve? (security curmudgeon <jericho@...rition.org>)
CVE request for Mozilla Firefox (Windows) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
CVE request for Mozilla Thunderbird (Windows) ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: CVE request for Mozilla Thunderbird (Windows) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Mozilla Firefox (Windows) (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Re: Re: cryptocat/decryptocat - needs a cve? (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request - PloneFormGen, multiple vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
npm uses predictable temporary filenames when unpacking tarballs (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: npm uses predictable temporary filenames when unpacking tarballs (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE request: Zenphoto waraxe-2012-SA#096 (Henri Salo <henri@...v.fi>)

July 11 (12 messages)

CVE request: WordPress plugin category-grid-view-gallery XSS (Henri Salo <henri@...v.fi>)
CVE request: SQUID-2013:2: buffer overflow in HTTP request handling (Raphael Geissert <geissert@...ian.org>)
CVE Request -- Nagstamon (prior 0.9.10): Monitor server user credentials exposure in automated requests to get update info… (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request - php 5.3.27 fixing heap corruption in the XML parser (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: WordPress plugin category-grid-view-gallery XSS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - php 5.3.27 fixing heap corruption in the XML parser (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Nagstamon (prior 0.9.10): Monitor server user credentials exposure in automated requests to get update … (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: SQUID-2013:2: buffer overflow in HTTP request handling (Kurt Seifried <kseifried@...hat.com>)
Re: npm uses predictable temporary filenames when unpacking tarballs (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: WordPress plugin category-grid-view-gallery XSS (Henri Salo <henri@...v.fi>)
Re: CVE request: WordPress plugin category-grid-view-gallery XSS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- FreeRDP: Multiple security fixes in 1.1.0-beta1 version (Kurt Seifried <kseifried@...hat.com>)

July 12 (6 messages)

Re: CVE Request -- Nagstamon (prior 0.9.10): Monitor server user credentials exposure in automated requests to get update in… (Henri Wahl <h.wahl@...-dresden.de>)
Re: CVE Request -- FreeRDP: Multiple security fixes in 1.1.0-beta1 version (Bernhard Miklautz <bmiklautz@...nstuff.at>)
CVE request: Cyrus-sasl NULL ptr. dereference ("mancha" <mancha1@...h.com>)
Re: CVE request: Cyrus-sasl NULL ptr. dereference (Solar Designer <solar@...nwall.com>)
Re: CVE request: Cyrus-sasl NULL ptr. dereference ("mancha" <mancha1@...h.com>)
Re: CVE request: Cyrus-sasl NULL ptr. dereference (Solar Designer <solar@...nwall.com>)

July 13 (1 message)

Re: CVE request: Cyrus-sasl NULL ptr. dereference (Kurt Seifried <kseifried@...hat.com>)

July 15 (10 messages)

Re: CVE request: Cyrus-sasl NULL ptr. dereference (Sebastian Krahmer <krahmer@...e.de>)
Re: Insecure temp files usage in phusion passenger (other than CVE-2013-2119) (Raphael Geissert <geissert@...ian.org>)
CVE Request -- Linux kernel: ipv6: BUG_ON in fib6_add_rt2node() (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- Linux kernel: ipv6: BUG_ON in fib6_add_rt2node() (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-4788 - Eglibc PTR MANGLE bug (Hector Marco <hecmargi@....es>)
CVE Request -- Linux kernel: vhost-net: use-after-free in vhost_net_flush (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- Linux kernel: vhost-net: use-after-free in vhost_net_flush (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- Linux kernel: bridge: BUG at kernel/timer.c:729 (Petr Matousek <pmatouse@...hat.com>)
Re: CVE-2013-4788 - Eglibc PTR MANGLE bug (Hector Marco <hecmargi@....es>)
CVE Request -- spice: unsafe clients ring access abort (Petr Matousek <pmatouse@...hat.com>)

July 16 (11 messages)

Re: CVE Request -- Linux kernel: bridge: BUG at kernel/timer.c:729 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- spice: unsafe clients ring access abort (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- kde-workspace 4.10.5 fixing two security flaws (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- kde-workspace 4.10.5 fixing two security flaws (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - PloneFormGen, multiple vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Insecure temp files usage in phusion passenger (other than CVE-2013-2119) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kde-workspace 4.10.5 fixing two security flaws ("mancha" <mancha1@...h.com>)
CVE Request - xlockmore 5.43 fixes a security flaw ("mancha" <mancha1@...h.com>)
Re: CVE Request - xlockmore 5.43 fixes a security flaw (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - xlockmore 5.43 fixes a security flaw ("mancha" <mancha1@...h.com>)
CVE request for Drupal contrib modules (Forest Monsen <forest.monsen@...il.com>)

July 17 (3 messages)

Re: CVE request for Drupal contrib modules (Kurt Seifried <kseifried@...hat.com>)
CVE Request - MongoDB <=2.4.4 uninitialized object (Florian <floriangaultier@...il.com>)
ISC DHCP client and unsolicited DHCP options (Florian Weimer <fw@...eb.enyo.de>)

July 18 (14 messages)

Re: ISC DHCP client and unsolicited DHCP options (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Kurt Seifried <kseifried@...hat.com>)
Please REJECT CVE-2013-4141 (Kurt Seifried <kseifried@...hat.com>)
Please REJECT CVE-2013-4141 (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-4137: StatusNet v1.1.0: SQL injection (Joshua Wise <joshua@...huawise.com>)
Re: CVE Request - xlockmore 5.43 fixes a security flaw (Kurt Seifried <kseifried@...hat.com>)
CVE Request: OpenJDK and lcms2 2.5 release fixes various denial of service issues in lcms2 (Marcus Meissner <meissner@...e.de>)
Re: CVE Request - xlockmore 5.43 fixes a security flaw (mancha <mancha1@...h.com>)
Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Dan Pasette <dan@...en.com>)
SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws (Kurt Seifried <kseifried@...hat.com>)
Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws (Andrew Nacin <nacin@...dpress.org>)
RE: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws ("Christey, Steven M." <coley@...re.org>)
Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws (Andrew Nacin <nacin@...dpress.org>)
RE: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws ("Christey, Steven M." <coley@...re.org>)

July 19 (12 messages)

CVE Request : Radius Daemon (YardRadius v1.1.2-4 ) Multiple Format String Vulnerabilities (Hamid Zamani <me@...idx9.ir>)
Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request : Radius Daemon (YardRadius v1.1.2-4 ) Multiple Format String Vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws (Kurt Seifried <kseifried@...hat.com>)
Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws (Reed Loden <reed@...dloden.com>)
Re: CVE Request - PloneFormGen, multiple vulnerabilities (Matthew Wilkes <matt@...distillery.eu>)
RE: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws ("Christey, Steven M." <coley@...re.org>)
CVE request -- libvirt: double free of returned JSON array in qemuAgentGetVCPUs() (Petr Matousek <pmatouse@...hat.com>)
CVE request -- libvirt: crash of libvirtd without guest agent configuration (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- libvirt: double free of returned JSON array in qemuAgentGetVCPUs() (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request -- libvirt: crash of libvirtd without guest agent configuration (Kurt Seifried <kseifried@...hat.com>)

July 20 (3 messages)

CVE Request: smokeping incomplete fix for CVE-2012-0790 (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request: smokeping incomplete fix for CVE-2012-0790 (Kurt Seifried <kseifried@...hat.com>)
CVE Request: XSS in smokeping / start and end time fields not filtered (Salvatore Bonaccorso <carnil@...ian.org>)

July 21 (2 messages)

cve request: cms made simple XSS before 1.11.7 (Hanno Böck <hanno@...eck.de>)
CVE Request: evolution mail client GPG key selection issue (Yves-Alexis Perez <corsac@...ian.org>)

July 22 (8 messages)

Re: CVE Request: OpenJDK and lcms2 2.5 release fixes various denial of service issues in lcms2 (Kurt Seifried <kseifried@...hat.com>)
CVE request: webcalendar before 1.2.7 (Hanno Böck <hanno@...eck.de>)
CVE-2013-2231 -- qemu: qemu-ga win32 service unquoted search path (Petr Matousek <pmatouse@...hat.com>)
CVE Request: Django: Account enumeration through timing attack in password verification in django.contrib.auth (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request: webcalendar before 1.2.7 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for a Drupal contributed module (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request: webcalendar before 1.2.7 (security curmudgeon <jericho@...rition.org>)

July 23 (12 messages)

Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE Request: Django: Account enumeration through timing attack in password verification in django.contrib.auth (Salvatore Bonaccorso <carnil@...ian.org>)
Cisco announces agreement to acquire Sourcefire (Henri Salo <henri@...v.fi>)
CVE request: mysecureshell: information disclosure (or worse) (Sebastian Pipping <sebastian@...ping.org>)
CVE request: mysecureshell: local denial of service (or worse) (Sebastian Pipping <sebastian@...ping.org>)
CVE Request: Linux kernel: panic while pushing pending data out of an IPv6 socket with UDP_CORK enabled. (P J P <ppandit@...hat.com>)
CVE request: Linux kernel: panic while appending data to a corked IPv6 socket in ip6_append_data_mtu (P J P <ppandit@...hat.com>)
Re: CVE request: Linux kernel: panic while appending data to a corked IPv6 socket in ip6_append_data_mtu (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request: Linux kernel: panic while pushing pending data out of an IPv6 socket with UDP_CORK enabled. (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Linux kernel: panic while appending data to a corked IPv6 socket in ip6_append_data_mtu (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Linux kernel: panic while appending data to a corked IPv6 socket in ip6_append_data_mtu (P J P <ppandit@...hat.com>)
Re: CVE Request: Django: Account enumeration through timing attack in password verification in django.contrib.auth (Henri Salo <henri@...v.fi>)

July 24 (7 messages)

Re: CVE Request: Django: Account enumeration through timing attack in password verification in django.contrib.auth (Donald Stufft <donald@...fft.io>)
RE: CVE Request: Django: Account enumeration through timing attack in password verification in django.contrib.auth ("Christey, Steven M." <coley@...re.org>)
Re: CVE request: mysecureshell: information disclosure (or worse) (Sebastian Pipping <sebastian@...ping.org>)
Xen Security Advisory 60 (CVE-2013-2212) - Excessive time to disable caching with HVM guests with PCI passthrough (Xen.org security team <security@....org>)
Re: Xen Security Advisory 60 (CVE-2013-2212) - Excessive time to disable caching with HVM guests with PCI passthrough (Konrad Rzeszutek Wilk <konrad.wilk@...cl…)
Xen Security Advisory 60 (CVE-2013-2212) - Excessive time to disable caching with HVM guests with PCI passthrough (Xen.org security team <security@....org>)
CVE request: timing leak in bitcoind (Paul <pawlkt@...il.com>)

July 25 (24 messages)

Two OpenAFS security advisories (Russ Allbery <rra@...nford.edu>)
Re: CVE request: mysecureshell: local denial of service (or worse) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: mysecureshell: information disclosure (or worse) (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request: webcalendar before 1.2.7 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: timing leak in bitcoind (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: evolution mail client GPG key selection issue (Kurt Seifried <kseifried@...hat.com>)
Re: cve request: cms made simple XSS before 1.11.7 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: XSS in smokeping / start and end time fields not filtered (Kurt Seifried <kseifried@...hat.com>)
Re: new FFMpeg stuff (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request - PloneFormGen, multiple vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: new FFMpeg stuff (Kurt Seifried <kseifried@...hat.com>)
Re: new FFMpeg stuff (Jean-Baptiste Kempf <jb@...eolan.org>)
Re: CVE request: mysecureshell: information disclosure (or worse) (Sebastian Pipping <sebastian@...ping.org>)
Re: CVE request: mysecureshell: local denial of service (or worse) (Sebastian Pipping <sebastian@...ping.org>)
CVE request: GnuPG side-channel attack on RSA secret keys ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: CVE Request: evolution mail client GPG key selection issue (Yves-Alexis Perez <corsac@...ian.org>)
Re: new FFMpeg stuff (Rémi Denis-Courmont <remi@...lab.net>)
CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
Re: CVE Request - PloneFormGen, multiple vulnerabilities (Matthew Wilkes <matthew@...thewwilkes.co.uk>)
Re: new FFMpeg stuff (Jean-Baptiste Kempf <jb@...eolan.org>)
Re: CVE Request: evolution mail client GPG key selection issue (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE Request: evolution mail client GPG key selection issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: evolution mail client GPG key selection issue (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

July 26 (8 messages)

Re: CVE Request: evolution mail client GPG key selection issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: evolution mail client GPG key selection issue (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE Request: Xymon Systems and Network Monitor - remote file deletion vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Requesting CVE-ID(s) for Python's pip (isis agora lovecruft <isis@...project.org>)
CVE-2013-1436: xmonad-contrib remote command injection (Raúl Benencia <rul@...gan.cc>)
Re: Requesting CVE-ID(s) for Python's pip (Donald Stufft <donald@...fft.io>)
Re: CVE request: GnuPG side-channel attack on RSA secret keys (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Kurt Seifried <kseifried@...hat.com>)

July 27 (12 messages)

FreeBSD Security Advisory FreeBSD-SA-13:08.nfsserver (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-13:07.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: CVE Request: Xymon Systems and Network Monitor - remote file deletion vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: mysecureshell: local denial of service (or worse) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: mysecureshell: information disclosure (or worse) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for a Drupal contributed module (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
CVE Request - Coin Widget serves code over plain http. (Evan Teitelman <teitelmanevan@...il.com>)
Re: CVE Request - Coin Widget serves code over plain http. (Kurt Seifried <kseifried@...hat.com>)

July 28 (1 message)

Re: ISC DHCP client and unsolicited DHCP options (Helmut Grohne <helmut@...divi.de>)

July 29 (7 messages)

RE: CVE Request - Coin Widget serves code over plain http. ("Christey, Steven M." <coley@...re.org>)
CVE missing? for "Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution" (Alexandre Dulaunoy <a@....be>)
CVE Request -- phpMyAdmin 3.5.8.2 and 4.0.4.2 are released (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- phpMyAdmin 3.5.8.2 and 4.0.4.2 are released (cve-assign@...re.org)
Re: FreeBSD Security Advisory FreeBSD-SA-13:07.bind (Tomas Hoger <thoger@...hat.com>)
Re: FreeBSD Security Advisory FreeBSD-SA-13:07.bind (Kurt Seifried <kseifried@...hat.com>)
Re: FreeBSD Security Advisory FreeBSD-SA-13:07.bind (Solar Designer <solar@...nwall.com>)

July 30 (13 messages)

Re: CVE Request -- phpMyAdmin 3.5.8.2 and 4.0.4.2 are released (cve-assign@...re.org)
Re: CVE missing? for "Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution" (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - Coin Widget serves code over plain http. (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
Re: Requesting CVE-ID(s) for Python's pip (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Kurt Seifried <kseifried@...hat.com>)
Re: Requesting CVE-ID(s) for Python's pip (Donald Stufft <donald@...fft.io>)
Re: Re: CVE Request -- phpMyAdmin 3.5.8.2 and 4.0.4.2 are released (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request - MongoDB <=2.4.4 uninitialized object (Andreas Nilsson <andreas.nilsson@...en.com>)
[OSSA 2013-018] Missing SSL certificate check in Python glance client (CVE-2013-4111) (Thierry Carrez <thierry@...nstack.org>)
Re: [Phpmyadmin-security] Re: CVE Request -- phpMyAdmin 3.5.8.2 and 4.0.4.2 are released (Dieter Adriaenssens <dieter.adriaenssens@...il.com>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)

July 31 (9 messages)

CVE Request: CPAN perl module Data::UUID symlink attacks (Tim Retout <tim@...out.co.uk>)
Re: CVE Request: CPAN perl module Data::UUID symlink attacks (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Insecure Software Download in pip (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: CPAN perl module Data::UUID symlink attacks (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
Re: CVE Request: Insecure Software Download in pip (Raphael Geissert <geissert@...ian.org>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
CVE Request -- Plone: 20130618 Hotfix (multiple vectors) (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request for Drupal contributed module (Forest Monsen <forest.monsen@...il.com>)

260 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.