oss-security mailing list - 2013/08

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 5	² 3	³ 2	⁴ 2
⁵ 7	⁶ 15	⁷ 16	⁸ 19	⁹ 12	¹⁰ 5	¹¹ 3
¹² 15	¹³ 5	¹⁴ 13	¹⁵ 19	¹⁶ 7	¹⁷ 2	¹⁸
¹⁹ 4	²⁰ 14	²¹ 21	²² 21	²³ 14	²⁴ 3	²⁵ 2
²⁶ 5	²⁷ 1	²⁸ 13	²⁹ 8	³⁰ 9	³¹

Messages by day:

August 1 (5 messages)

Re: CVE request for Drupal contributed module (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Plone: 20130618 Hotfix (multiple vectors) (Kurt Seifried <kseifried@...hat.com>)
Re: Requesting CVE-ID(s) for Python's pip (isis agora lovecruft <isis@...project.org>)
Re: Requesting CVE-ID(s) for Python's pip (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Requesting CVE-ID(s) for Python's pip (Jeremy Stanley <fungi@...goth.org>)

August 2 (3 messages)

Re: [vs-plain] Request for CVE Identifiers (Kurt Seifried <kseifried@...hat.com>)
Rgpg Ruby Gem Remote Command Injection (CVE Request) ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Vincent Danen <vdanen@...hat.com>)

August 3 (2 messages)

Re: CVE request: unauthorized host/service views displayed in servicegroup view (Kurt Seifried <kseifried@...hat.com>)
Re: Rgpg Ruby Gem Remote Command Injection (CVE Request) (Kurt Seifried <kseifried@...hat.com>)

August 4 (2 messages)

Re: CVE request: unauthorized host/service views displayed in servicegroup view (Jonas Meurer <jonas@...esources.org>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)

August 5 (7 messages)

CVE request: XSS in Google Web Toolkit (GWT) (David Jorm <djorm@...hat.com>)
CVE request: lcms 1.x buffer overflows ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: CVE request: XSS in Google Web Toolkit (GWT) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: lcms 1.x buffer overflows (Raphael Geissert <geissert@...ian.org>)
valid but unusual sequence of CVEs in SYM13-009 (cve-assign@...re.org)
Update for CVE-2013-4852: PuTTY SSH handshake heap overflow (FileZilla reportedly embeds a copy) (Kurt Seifried <kseifried@...hat.com>)
owncloud 5.0.8 and 4.5.13 (oC-SA-2013-029 and oC-SA-2013-030) - CVE assignments? (Salvatore Bonaccorso <carnil@...ian.org>)

August 6 (15 messages)

CLONE_NEWUSER local DoS (Petr Matousek <pmatouse@...hat.com>)
Re: CLONE_NEWUSER local DoS (Kurt Seifried <kseifried@...hat.com>)
[OSSA 2013-019] Resource limit circumvention in Nova private flavors (CVE-2013-2256) (Jeremy Stanley <jeremy@...nstack.org>)
[OSSA 2013-020] Denial of Service in Nova network source security groups (CVE-2013-4185) (Jeremy Stanley <jeremy@...nstack.org>)
Re: CLONE_NEWUSER local DoS (Oleg Nesterov <oleg@...hat.com>)
[PATCH 0/1] (Was: CLONE_NEWUSER local DoS) (Oleg Nesterov <oleg@...hat.com>)
[PATCH 1/1] userns: unshare_userns(&cred) should not populate cred on failure (Oleg Nesterov <oleg@...hat.com>)
Re: CLONE_NEWUSER local DoS (Andy Lutomirski <luto@...capital.net>)
Re: [PATCH 1/1] userns: unshare_userns(&cred) should not populate cred on failure (Andy Lutomirski <luto@...capital.net>)
Re: CLONE_NEWUSER local DoS (Oleg Nesterov <oleg@...hat.com>)
CVE request: three additional flaws fixed in putty 0.63 (Vincent Danen <vdanen@...hat.com>)
Re: [PATCH 1/1] userns: unshare_userns(&cred) should not populate cred on failure (ebiederm@...ssion.com (Eric W. Biederman))
Re: CVE request: three additional flaws fixed in putty 0.63 (Kurt Seifried <kseifried@...hat.com>)
OpenX Ad Server Backdoor CVE? (Kurt Seifried <kseifried@...hat.com>)
SSL BREACH (Kurt Seifried <kseifried@...hat.com>)

August 7 (16 messages)

Re: SSL BREACH (cve-assign@...re.org)
Re: OpenX Ad Server Backdoor CVE? (Kurt Seifried <kseifried@...hat.com>)
Re: [PATCH 0/1] (Was: CLONE_NEWUSER local DoS) (Petr Matousek <pmatouse@...hat.com>)
Re: OpenX Ad Server Backdoor CVE? (Nathan March <nathan@...net>)
[OSSA 2013-021] Cinder LVM volume driver does not support secure deletion (CVE-2013-4183) (Jeremy Stanley <jeremy@...nstack.org>)
[OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155) (Thierry Carrez <thierry@...nstack.org>)
CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b (Vincent Danen <vdanen@...hat.com>)
CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow (Florian <floriangaultier@...il.com>)
Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b (Kurt Seifried <kseifried@...hat.com>)
Reserved CVE for pip (Donald Stufft <donald@...fft.io>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow (Florian <floriangaultier@...il.com>)
tomcat CVE confusion (David Walser <luigiwalser@...oo.com>)
Re: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b (Salvatore Bonaccorso <carnil@...ian.org>)
Re: tomcat CVE confusion (David Jorm <djorm@...hat.com>)

August 8 (19 messages)

Some Nagios /tmp vulns (no reply from upstream) (Kurt Seifried <kseifried@...hat.com>)
Re: tomcat CVE confusion (Kurt Seifried <kseifried@...hat.com>)
Re: Reserved CVE for pip (Kurt Seifried <kseifried@...hat.com>)
Re: Reserved CVE for pip (Donald Stufft <donald@...fft.io>)
CVE request: remote code execution due to XML deserialization in Restlet (David Jorm <djorm@...hat.com>)
CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro (Jan Lieskovsky <jlieskov@...hat.com>)
CVE Request: Linux kernel: arm64: unhandled el0 traps (P J P <ppandit@...hat.com>)
Re: tomcat CVE confusion (Marcus Meissner <meissner@...e.de>)
[OSSA 2013-023] Denial of Service using XML entities in Nova/Cinder extensions (CVE-2013-4179, CVE-2013-4202) (Thierry Carrez <thierry@...nstack.org>)
CVE Request -- Four flaws in WiMAX (afaik upstream is dead for this) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Four flaws in WiMAX (afaik upstream is dead for this) (Dan Williams <dcbw@...hat.com>)
Re: CVE Request: Linux kernel: arm64: unhandled el0 traps (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: remote code execution due to XML deserialization in Restlet (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request -- Four flaws in WiMAX (afaik upstream is dead for this) (Seth Arnold <seth.arnold@...onical.com>)
Re: Re: CVE Request -- Four flaws in WiMAX (afaik upstream is dead for this) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- Four flaws in WiMAX (afaik upstream is dead for this) (Kurt Seifried <kseifried@...hat.com>)
CVE Request: Regression introduced in cacti with fix for CVE-2013-1435 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Regression introduced in cacti with fix for CVE-2013-1435 (Vincent Danen <vdanen@...hat.com>)

August 9 (12 messages)

Re: CVE Request: Linux kernel: arm64: unhandled el0 traps (Greg KH <greg@...ah.com>)
Re: tomcat CVE confusion (cve-assign@...re.org)
Re: CVE Request: Linux kernel: arm64: unhandled el0 traps (Kurt Seifried <kseifried@...hat.com>)
[Not a CVE request, just notification] CVE-2012-4502, CVE-2012-4503 -- Two security flaws fixed in Chrony v1.29 (Jan Lieskovsky <jlieskov@...hat.com>)
[CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the error mess… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: [CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the error … (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: nullmailer world readable /etc/nullmailer/remotes (Agostino Sarubbo <ago@...too.org>)
RE: CVE request: nullmailer world readable /etc/nullmailer/remotes ("Christey, Steven M." <coley@...re.org>)
Re: CVE request: nullmailer world readable /etc/nullmailer/remotes (William Pitcock <nenolod@...eferenced.org>)
Re: CVE request: nullmailer world readable /etc/nullmailer/remotes (Evan Teitelman <teitelmanevan@...il.com>)
Re: CVE request: nullmailer world readable /etc/nullmailer/remotes (Kurt Seifried <kseifried@...hat.com>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)

August 10 (5 messages)

Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Four (stack-based) buffer overflows and one use-after-free in libtiff v4.0.3 reported by Pedro Ribeiro (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Henri Salo <henri@...v.fi>)
CVE Request - HMS Testimonials 2.0.10 WP plugin ("Adéla Goldová" <roguecoder@...h.com>)

August 11 (3 messages)

Re: [CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the error message {AKA… (mancha <mancha1@...h.com>)
CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX char… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX c… (Florian Weimer <fweimer@...hat.com>)

August 12 (15 messages)

Re: CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE Request - HMS Testimonials 2.0.10 WP plugin ("Adéla Goldová" <roguecoder@...h.com>)
Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow (Raphael Geissert <geissert@...ian.org>)
X.509 name constraints and potential interpretation conflict (Florian Weimer <fweimer@...hat.com>)
CVE Request -- vdsm: incomplete fix for CVE-2013-0167 issue (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- vdsm: incomplete fix for CVE-2013-0167 issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX … (Kurt Seifried <kseifried@...hat.com>)
pending Bitcoin/Android CVE assignments (cve-assign@...re.org)
Re: pending Bitcoin/Android CVE assignments (Florent Daigniere <florent.daigniere@...stmatta.com>)
CVE Request -- libvirt: memory corruption in xenDaemonListDefinedDomains function (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request -- libvirt: memory corruption in xenDaemonListDefinedDomains function (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request - HMS Testimonials 2.0.10 WP plugin (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the er… (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [CVE assignment notification] CVE-2012-2142 poppler, xpdf: Insufficient sanitization of escape sequences in the e… (Michael Gilbert <mgilbert@...ian.org>)

August 13 (5 messages)

CVE Request -- Python SSL module does not handle certificates that contain hostnames with NULL bytes (Murray McAllister <mmcallis@...hat.com>)
Re: CVE Request -- Python SSL module does not handle certificates that contain hostnames with NULL bytes (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b (Giuseppe Iuculano <iuculano@...ian.org>)
Quick Blind TCP Connection Spoofing with SYN Cookies (Jakob Lell <jakob@...oblell.com>)
Re: ISC DHCP client and unsolicited DHCP options (Tomas Hoger <thoger@...hat.com>)

August 14 (13 messages)

[CVE request] Django 1.4.6 security release (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [CVE request] Django 1.4.6 security release (Kurt Seifried <kseifried@...hat.com>)
Re: [CVE request] Django 1.4.6 security release ("Thijs Kinkhorst" <thijs@...ian.org>)
CVE Request -- php - handling of certs with null bytes (Oden Eriksson <oeriksson@...driva.com>)
Possible CVE request: dovecot crash when disconnecting during pop3 LIST (Raphael Geissert <geissert@...ian.org>)
Re: Possible CVE request: dovecot crash when disconnecting during pop3 LIST (Timo Sirainen <tss@....fi>)
CVE request: TYPO3 remote code execution by arbitrary file creation TYPO3-CORE-SA-2013-002 (Henri Salo <henri@...v.fi>)
CVE Request: Linux kernel: cifs: off-by-one bug in build_unc_path_to_root (P J P <ppandit@...hat.com>)
rubygems insecure download (and other problems) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Linux kernel: cifs: off-by-one bug in build_unc_path_to_root (Kurt Seifried <kseifried@...hat.com>)
Re: rubygems insecure download (and other problems) (Donald Stufft <donald@...fft.io>)
Re: [Full-disclosure] Quick Blind TCP Connection Spoofing with SYN Cookies (some one <s3cret.squirell@...il.com>)
CVE Request: linux-kernel priviledge escalation on ARM/perf (Vince Weaver <vincent.weaver@...ne.edu>)

August 15 (19 messages)

Re: [CVE request] Django 1.4.6 security release (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: TYPO3 remote code execution by arbitrary file creation TYPO3-CORE-SA-2013-002 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- php - handling of certs with null bytes (Kurt Seifried <kseifried@...hat.com>)
Re: [Ticket#2013081510000021] CVE request: TYPO3 remote code execution by arbitrary file creation TYPO3-CORE-SA-201 [… (TYPO3 Security Team <security@...o3.org…)
Re: HTTPS (was: rubygems insecure download (and other problems)) (gremlin@...mlin.ru)
Re: HTTPS (was: rubygems insecure download (and other problems)) (Donald Stufft <donald@...fft.io>)
Re: HTTPS (Kurt Seifried <kseifried@...hat.com>)
Re: rubygems insecure download (and other problems) (Reed Loden <reed@...dloden.com>)
Re: rubygems insecure download (and other problems) (Marcus Meissner <meissner@...e.de>)
Re: rubygems insecure download (and other problems) (Henri Salo <henri@...v.fi>)
Re: HTTPS (gremlin@...mlin.ru)
Re: HTTPS (Donald Stufft <donald@...fft.io>)
Re: HTTPS (Florian Weimer <fweimer@...hat.com>)
Re: HTTPS (Jeremy Stanley <fungi@...goth.org>)
Re: HTTPS (Kurt Seifried <kseifried@...hat.com>)
Re: rubygems insecure download (and other problems) (Kurt Seifried <kseifried@...hat.com>)
RE: rubygems insecure download (and other problems) ("Christey, Steven M." <coley@...re.org>)
Re: HTTPS (gremlin@...mlin.ru)
Re: CVE Request -- Python SSL module does not handle certificates that contain hostnames with NULL bytes (Brian Cameron <brian.cameron@...cle.com>)

August 16 (7 messages)

Re: [PSRT] CVE Request -- Python SSL module does not handle certificates that contain hostnames with NULL bytes (Christian Heimes <christian@...hon.org>)
CVE Request : NAS v1.9.3 multiple Vulnerabilites (Hamid Zamani <me@...idx9.ir>)
Re: HTTPS (gremlin@...mlin.ru)
Re: HTTPS (gremlin@...mlin.ru)
Re: CVE Request: linux-kernel priviledge escalation on ARM/perf (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request: linux-kernel priviledge escalation on ARM/perf (Kurt Seifried <kseifried@...hat.com>)
Re: SSL BREACH (Stefan Fritsch <sf@...itsch.de>)

August 17 (2 messages)

Re: HTTPS (was: rubygems insecure download (and other problems)) (Pavel Labushev <pavel.labushev@...box.no>)
Re: HTTPS (was: rubygems insecure download (and other problems)) (Pavel Labushev <pavel.labushev@...box.no>)

August 19 (4 messages)

Re: CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX c… (Florian Weimer <fweimer@...hat.com>)
Re: [CVE request] Django 1.4.6 security release (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request : NAS v1.9.3 multiple Vulnerabilites (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request : NAS v1.9.3 multiple Vulnerabilites (Hamid Zamani <me@...idx9.ir>)

August 20 (14 messages)

PostgreSQL insecure install via yum (multiple problems) (Kurt Seifried <kseifried@...hat.com>)
Re: PostgreSQL insecure install via yum (multiple problems) (Landon Hurley <ljrhurley@...il.com>)
Re: PostgreSQL insecure install via yum (multiple problems) ("Eric H. Christensen" <echriste@...hat.com>)
Re: PostgreSQL insecure install via yum (multiple problems) (Kurt Seifried <kseifried@...hat.com>)
Re: PostgreSQL insecure install via yum (multiple problems) (Kurt Seifried <kseifried@...hat.com>)
Re: PostgreSQL insecure install via yum (multiple problems) (Kevin Fenzi <kevin@...ye.com>)
Re: PostgreSQL insecure install via yum (multiple problems) (Moritz Naumann <info@...itz-naumann.com>)
Xen Security Advisory 59 (CVE-2013-3495) - Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupt… (Xen.org security team <security@....org…)
Fix for CVE-2013-0343 queued up (linux-kernel/ipv6 temp. addresses) (Hannes Frederic Sowa <hannes@...essinduktion.org>)
Re: X.509 name constraints and potential interpretation conflict (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: [pgsql-security] Re: PostgreSQL insecure install via yum (multiple problems) (Magnus Hagander <magnus@...ander.net>)
Re: CVE Request: linux-kernel priviledge escalation on ARM/perf (Vince Weaver <vincent.weaver@...ne.edu>)
Linux kernel: vfs_read()/vfs_write(): potential missing checks (or not?) (vladz <vladz@...zero.fr>)
Re: PostgreSQL insecure install via yum (multiple problems) (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

August 21 (21 messages)

CVE Request: FFmpeg 2.0.1 multiple problems (Michael Niedermayer <michaelni@....at>)
Re: Linux kernel: vfs_read()/vfs_write(): potential missing checks (or not?) (Hannes Frederic Sowa <hannes@...essinduktion.org>)
Re: Linux kernel: vfs_read()/vfs_write(): potential missing checks (or not?) (John Haxby <john.haxby@...cle.com>)
PoC: Function Pointer Protection in C Programs ("Stephen Röttger" <stephen.roettger@...il.com>)
Re: PoC: Function Pointer Protection in C Programs (Alessandro Cresto Miseroglio <alex179ohm@...il.com>)
Re: PoC: Function Pointer Protection in C Programs (Alessandro Cresto Miseroglio <alex179ohm@...il.com>)
Re: PoC: Function Pointer Protection in C Programs ("Stephen Röttger" <stephen.roettger@...il.com>)
Re: PoC: Function Pointer Protection in C Programs (Alessandro Cresto Miseroglio <alex179ohm@...il.com>)
Re: PoC: Function Pointer Protection in C Programs (Ondřej Bílka <neleai@...nam.cz>)
Re: PoC: Function Pointer Protection in C Programs ("Stephen Röttger" <stephen.roettger@...il.com>)
Re: CVE Request: FFmpeg 2.0.1 multiple problems (Kurt Seifried <kseifried@...hat.com>)
Kurt go byebye for vacation next week (Kurt Seifried <kseifried@...hat.com>)
Re: HTTPS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: lcms 1.x buffer overflows (Kurt Seifried <kseifried@...hat.com>)
Re: CVE requests for Ajaxplorer (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Insecure Software Download in pip (Donald Stufft <donald@...fft.io>)
Re: CVE Request: Insecure Software Download in pip (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: lcms 1.x buffer overflows ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: PoC: Function Pointer Protection in C Programs (Hannes Frederic Sowa <hannes@...essinduktion.org>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)

August 22 (21 messages)

FreeBSD Security Advisory FreeBSD-SA-13:10.sctp (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: lcms 1.x buffer overflows (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request: glibc getaddrinfo() stack overflow (Florian Weimer <fweimer@...hat.com>)
Re: PoC: Function Pointer Protection in C Programs (Ondřej Bílka <neleai@...nam.cz>)
Re: PoC: Function Pointer Protection in C Programs ("Stephen Röttger" <stephen.roettger@...il.com>)
Re: PoC: Function Pointer Protection in C Programs ("Stephen Röttger" <stephen.roettger@...il.com>)
Re: FreeBSD Security Advisory FreeBSD-SA-13:10.sctp (Dag-Erling Smørgrav <des@....no>)
Re: FreeBSD Security Advisory FreeBSD-SA-13:10.sctp (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: FreeBSD Security Advisory FreeBSD-SA-13:10.sctp (Dag-Erling Smørgrav <des@....no>)
Re: HTTPS (Pavel Labushev <pavel.labushev@...box.no>)
[PATCH] implement privmode support in dash (Tavis Ormandy <taviso@...gle.com>)
Possibly insecure permissions on sshd_config in Debian-based distros (Andrey Korolyov <andrey@...l.ru>)
Re: [PATCH] implement privmode support in dash (Simon McVittie <smcv@...ian.org>)
Re: [PATCH] implement privmode support in dash (Harald van Dijk <harald@...awatt.nl>)
Re: [PATCH] implement privmode support in dash (Tavis Ormandy <taviso@...gle.com>)
Re: Possibly insecure permissions on sshd_config in Debian-based distros (Kurt Seifried <kseifried@...hat.com>)
Re: Possibly insecure permissions on sshd_config in Debian-based distros (Andrey Korolyov <andrey@...l.ru>)
Re: [PATCH] implement privmode support in dash (Tavis Ormandy <taviso@...gle.com>)
Re: [PATCH] implement privmode support in dash (Jilles Tjoelker <jilles@...ck.nl>)
Re: Possibly insecure permissions on sshd_config in Debian-based distros (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

August 23 (14 messages)

Re: Possibly insecure permissions on sshd_config in Debian-based distros (Kurt Seifried <kseifried@...hat.com>)
Re: [PATCH] implement privmode support in dash (Kurt Seifried <kseifried@...hat.com>)
Re: [PATCH] implement privmode support in dash (Seth Arnold <seth.arnold@...onical.com>)
Re: [PATCH] implement privmode support in dash (Michael Samuel <mik@...net.net>)
Re: [PATCH] implement privmode support in dash (Tavis Ormandy <taviso@...gle.com>)
Re: [PATCH] implement privmode support in dash (Tavis Ormandy <taviso@...xchg8b.com>)
Re: [PATCH] implement privmode support in dash (Florian Weimer <fweimer@...hat.com>)
Re: [PATCH] implement privmode support in dash (jca+dash@...vbn.org (Jérémie Courrèges-Anglas))
Re: [PATCH] implement privmode support in dash (jca+dash@...vbn.org (Jérémie Courrèges-Anglas))
Re: [PATCH] implement privmode support in dash (Tim Brown <tmb@...35.com>)
Re: [PATCH] implement privmode support in dash (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: [PATCH] implement privmode support in dash (Roy <roytam@...il.com>)
CVE request: roundcube 0.9.3 fixes two XSS flaws (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: roundcube 0.9.3 fixes two XSS flaws (cve-assign@...re.org)

August 24 (3 messages)

CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 (Hanno Böck <hanno@...eck.de>)
CVE-2013-5575 LibTIFF through 3.9.5 integer overflow (cve-assign@...re.org)
Re: CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 (cve-assign@...re.org)

August 25 (2 messages)

CVE Request: 3 XSS vulnerabilities in Cacti <= 0.8.8b (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: 3 XSS vulnerabilities in Cacti <= 0.8.8b (cve-assign@...re.org)

August 26 (5 messages)

Re: CVE-2013-5575 LibTIFF through 3.9.5 integer overflow (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: HTTPS (Alexander Cherepanov <cherepan@...me.ru>)
CVE request: Linux Kernel: ARM: KVM: NULL pointer dereferences (P J P <ppandit@...hat.com>)
Re: CVE request: Linux Kernel: ARM: KVM: NULL pointer dereferences (cve-assign@...re.org)
Fw: python CVE typoed in Mageia advisory (David Walser <luigiwalser@...oo.com>)

August 27 (1 message)

Re: Re: CVE request: roundcube 0.9.3 fixes two XSS flaws (Vincent Danen <vdanen@...hat.com>)

August 28 (13 messages)

Command Injection in Ruby Gem Sounder 1.0.1 ("Larry W. Cashdollar" <larry0@...com>)
[OSSA 2013-024] Resource limit circumvention in Nova private flavors (CVE-2013-4278) (Thierry Carrez <thierry@...nstack.org>)
CVE oops in GLSA 201308-05 (wireshark) (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: roundcube 0.9.3 fixes two XSS flaws (cve-assign@...re.org)
CVE-2013-5641 CVE-2013-5642 recent Asterisk issues (cve-assign@...re.org)
Re: CVE oops in GLSA 201308-05 (wireshark) (cve-assign@...re.org)
Re: CVE Request: 3 XSS vulnerabilities in Cacti <= 0.8.8b (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Command Injection in Ruby Gem Sounder 1.0.1 (Henri Salo <henri@...v.fi>)
Re: Command Injection in Ruby Gem Sounder 1.0.1 ("Larry W. Cashdollar" <larry0@...com>)
Re: Re: CVE oops in GLSA 201308-05 (wireshark) (Vincent Danen <vdanen@...hat.com>)
CVE request, libdigidoc arbitrary file overwrite flaw (Vincent Danen <vdanen@...hat.com>)
Re: Re: CVE request: roundcube 0.9.3 fixes two XSS flaws (Vincent Danen <vdanen@...hat.com>)
Linux HID security flaws (Kees Cook <keescook@...omium.org>)

August 29 (8 messages)

Re: Command Injection in Ruby Gem Sounder 1.0.1 (cve-assign@...re.org)
Re: CVE request, libdigidoc arbitrary file overwrite flaw (cve-assign@...re.org)
[notification] libraw: multiple denial of service vulnerabilities (Raphael Geissert <atomo64@...il.com>)
Re: CVE oops in GLSA 201308-05 (wireshark) (Sergey Popov <pinkbyte@...too.org>)
Re: Re: CVE oops in GLSA 201308-05 (wireshark) (Alex Legler <a3li@...too.org>)
CVE request -- libvirt: virBitmapParse out-of-bounds read access (Petr Matousek <pmatouse@...hat.com>)
Re: Re: CVE oops in GLSA 201308-05 (wireshark) (Vincent Danen <vdanen@...hat.com>)
YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload ("Larry W. Cashdollar" <larry0@...com>)

August 30 (9 messages)

Re: CVE request -- libvirt: virBitmapParse out-of-bounds read access (cve-assign@...re.org)
Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload (cve-assign@...re.org)
CVE request for imagemagick bug (Bastien ROUCARIES <roucaries.bastien@...il.com>)
Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload ("Larry W. Cashdollar" <larry0@...com>)
Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload ("Larry W. Cashdollar" <larry0@...com>)
YingZhi Lua Programming Language for iOS ftp .. bug & httpd arbitrary upload ("Larry W. Cashdollar" <larry0@...com>)
OSS at all? (was: YingZhi Lua Programming Language for iOS ftp .. bug & httpd arbitrary upload) (Raphael Geissert <geissert@...ian.org>)
Re: OSS at all? (was: YingZhi Lua Programming Language for iOS ftp .. bug & httpd arbitrary upload) ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Jonas Meurer <jonas@...esources.org>)

265 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.