oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 6
² 1	³ 4	⁴ 13	⁵ 10	⁶ 2	⁷ 1	⁸
⁹ 14	¹⁰ 6	¹¹ 10	¹² 7	¹³ 4	¹⁴ 3	¹⁵ 3
¹⁶ 2	¹⁷ 10	¹⁸ 10	¹⁹ 3	²⁰ 5	²¹	²² 1
²³ 1	²⁴ 5	²⁵ 16	²⁶ 9	²⁷ 11	²⁸ 1	²⁹ 2
³⁰ 3

Messages by day:

September 1 (6 messages)

CVE request: serendipity before 1.7.3 XSS (Hanno Böck <hanno@...eck.de>)
Remote Command Injection in fog-dragonfly-0.8.2 Ruby Gem ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE request: serendipity before 1.7.3 XSS (cve-assign@...re.org)
Re: Remote Command Injection in fog-dragonfly-0.8.2 Ruby Gem (cve-assign@...re.org)
Re: Remote Command Injection in fog-dragonfly-0.8.2 Ruby Gem (Larry Cashdollar <larry0@...com>)
[CVE Request] IndiaNIC Testimonial 2.2 WP plugin ("Adéla Goldová" <roguecoder@...h.com>)

September 2 (1 message)

Re: [CVE Request] IndiaNIC Testimonial 2.2 WP plugin (cve-assign@...re.org)

September 3 (4 messages)

Re: CVE request for imagemagick bug (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Kurt Seifried <kseifried@...hat.com>)
CVE request for Drupal contrib modules (Forest Monsen <forest.monsen@...il.com>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Vincent Danen <vdanen@...hat.com>)

September 4 (13 messages)

Watchman - GCC buffer overflow framework (Eric Wimberley <wimberleyeric@...il.com>)
Security bug or feature? Servicegroups leak hostnames to unauthorized users (Was: CVE request: unauthorized host/service vi… (Jonas Meurer <jonas@...esources.org>)
Re: Security bug or feature? Servicegroups leak hostnames to unauthorized users (Was: CVE request: unauthorized host/service view… (Andreas Ericsson <ae@....se>)
Re: [Nagios-devel] Security bug or feature? Servicegroups leak hostnames to unauthorized users (Was: CVE request: unautho… (Jochen Bern <Jochen.Bern@...works.de>)
CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8 ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: [Nagios-devel] Security bug or feature? Servicegroups leak hostnames to unauthorized users (Was: CVE request: unauthorized ho… (Andreas Ericsson <ae@....se>)
Re: Security bug or feature? Servicegroups leak hostnames to unauthorized users (Was: CVE request: unauthorized host/servic… (Jonas Meurer <jonas@...esources.org>)
CVE-2013-2185 / Tomcat (Moritz Muehlenhoff <jmm@...ian.org>)
CVE request: Kernel PID Spoofing Privilege Escalation Vulnerability (Agostino Sarubbo <ago@...too.org>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Security bug or feature? Servicegroups leak hostnames to unauthorized users (Was: CVE request: unauthorized host/servic… (Jonas Meurer <jonas@...esources.org>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: unauthorized host/service views displayed in servicegroup view (cve-assign@...re.org)

September 5 (10 messages)

Re: CVE request: unauthorized host/service views displayed in servicegroup view (Vincent Danen <vdanen@...hat.com>)
Re: Re: CVE request: unauthorized host/service views displayed in servicegroup view (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Kernel PID Spoofing Privilege Escalation Vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2013-2185 / Tomcat (David Jorm <djorm@...hat.com>)
Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Kernel PID Spoofing Privilege Escalation Vulnerability (Dan Carpenter <dan.carpenter@...cle.com>)
Re: CVE request: Kernel PID Spoofing Privilege Escalation Vulnerability (Petr Matousek <pmatouse@...hat.com>)
[notification] exactimage DoS, jumping into the unknown (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: Kernel PID Spoofing Privilege Escalation Vulnerability (Agostino Sarubbo <ago@...too.org>)
GDM TOCTTOU race condition on /tmp/.X11-unix (CVE-2013-4169) (Vincent Danen <vdanen@...hat.com>)

September 6 (2 messages)

CVE request: pyOpenSSL hostname check bypassing vulnerability (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: pyOpenSSL hostname check bypassing vulnerability (Kurt Seifried <kseifried@...hat.com>)

September 7 (1 message)

CVE request: TYPO3-CORE-SA-2013-003 (Henri Salo <henri@...v.fi>)

September 9 (14 messages)

[CVE Request] Event Easy Calendar ("Adéla Goldová" <roguecoder@...h.com>)
[CVE Request] Event Easy Calendar ("Adéla Goldová" <roguecoder@...h.com>)
[CVE Request] Event Easy Calendar ("Adéla Goldová" <roguecoder@...h.com>)
CVE request: Torque privilege escalation (Agostino Sarubbo <ago@...too.org>)
Re: [CVE Request] Event Easy Calendar (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Torque privilege escalation (Kurt Seifried <kseifried@...hat.com>)
[CVE Request] Event Easy Calendar ("Adéla Goldová" <roguecoder@...h.com>)
Re: CVE request: Torque privilege escalation (Agostino Sarubbo <ago@...too.org>)
Features 0.3.0 Ruby gem /tmp file injection vulnerability ("Larry W. Cashdollar" <larry0@...com>)
Re: Features 0.3.0 Ruby gem /tmp file injection vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Torque privilege escalation (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: TYPO3-CORE-SA-2013-003 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request : NAS v1.9.3 multiple Vulnerabilites (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE Request : NAS v1.9.3 multiple Vulnerabilites (Hamid Zamani <me@...idx9.ir>)

September 10 (6 messages)

CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Eric Hodel <drbrain@...ment7.net>)
CVE Request: OpenPNE 3, opWebAPIPlugin, opOpenSocialPlugin -- XXE vulnerability fix (Kousuke Ebihara <ebihara@...imaya.com>)
Xen Security Advisory 61 - libxl partially sets up HVM passthrough even with disabled iommu (Xen.org security team <security@....org>)
Re: Xen Security Advisory 61 - libxl partially sets up HVM passthrough even with disabled iommu (Kurt Seifried <kseifried@...hat.com>)
Re: Features 0.3.0 Ruby gem /tmp file injection vulnerability (Henri Salo <henri@...v.fi>)
Re: Features 0.3.0 Ruby gem /tmp file injection vulnerability ("Larry W. Cashdollar" <larry0@...com>)

September 11 (10 messages)

CVEs for Wireshark 1.8.10 and 1.10.2 releases (cve-assign@...re.org)
CVE Request: Three integer overflows in glibc memory allocator (Will Newton <will.newton@...aro.org>)
Xen Security Advisory 61 (CVE-2013-4329) - libxl partially sets up HVM passthrough even with disabled iommu (Xen.org security team <security@....org>)
CVE Request: lightdm incorrect .Xauthority permissions (Marc Deslauriers <marc.deslauriers@...onical.com>)
[OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends (CVE-2013-4294) (Thierry Carrez <thierry@...nstack.org>)
Re: CVE Request: OpenPNE 3, opWebAPIPlugin, opOpenSocialPlugin -- XXE vulnerability fix (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Three integer overflows in glibc memory allocator (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: lightdm incorrect .Xauthority permissions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contrib modules (Kurt Seifried <kseifried@...hat.com>)
CVE Requests for WordPress 3.6.1 (Andrew Nacin <nacin@...dpress.org>)

September 12 (7 messages)

Re: CVE Requests for WordPress 3.6.1 (Kurt Seifried <kseifried@...hat.com>)
[seth.arnold@...onical.com: CVE Requests openjpeg] (Seth Arnold <seth.arnold@...onical.com>)
Fwd: Use-after-free in TUNSETIFF (Petr Matousek <pmatouse@...hat.com>)
[OSSA 2013-026] Potential denial of service on Nova when using Qpid (CVE-2013-4261) (Thierry Carrez <thierry@...nstack.org>)
cve requests for python-oauth2 (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request: Three integer overflows in glibc memory allocator (mancha <mancha1@...h.com>)
Re: cve requests for python-oauth2 (Kurt Seifried <kseifried@...hat.com>)

September 13 (4 messages)

GnuPG treats no-usage-permitted keys as all-usages-permitted (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE request -- Linux kernel: net: sctp: ipv6 ipsec encryption bug in sctp_v6_xmit (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- Linux kernel: net: sctp: ipv6 ipsec encryption bug in sctp_v6_xmit (Kurt Seifried <kseifried@...hat.com>)
Re: GnuPG treats no-usage-permitted keys as all-usages-permitted (Kurt Seifried <kseifried@...hat.com>)

September 14 (3 messages)

CVE request: proftpd: mod_sftp/mod_sftp_pam invalid pool allocation during kbdint authentication (Agostino Sarubbo <ago@...too.org>)
Re: Re: CVE Request: glibc getaddrinfo() stack overflow (Florian Weimer <fweimer@...hat.com>)
Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Alexander Cherepanov <cherepan@...me.ru>)

September 15 (3 messages)

Re: GIMP Scriptfu Python Remote Command Execution (Sebastian Pipping <sebastian@...ping.org>)
CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Henri Salo <henri@...v.fi>)
[notification] django: CVE-2013-1443: denial-of-service via large passwords (Salvatore Bonaccorso <carnil@...ian.org>)

September 16 (2 messages)

Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
IcedTea-Web release 1.4.1 fixing CVE-2012-4540 (Tomas Hoger <thoger@...hat.com>)

September 17 (10 messages)

CVE-Request FFmpeg vulnerability (Reno Robert <renorobert@...il.com>)
Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request: glibc getaddrinfo() stack overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-Request FFmpeg vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: proftpd: mod_sftp/mod_sftp_pam invalid pool allocation during kbdint authentication (Kurt Seifried <kseifried@...hat.com>)
CVE request: davfs2 - Unsecure use of system() (Luciano Bello <luciano@...ian.org>)
Re: Re: CVE Request: glibc getaddrinfo() stack overflow (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: davfs2 - Unsecure use of system() (Salvatore Bonaccorso <carnil@...ian.org>)
Research on better-than-brute-force attacks on PDF cryptography (Florian Weimer <fweimer@...hat.com>)

September 18 (10 messages)

Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Eric Hodel <drbrain@...ment7.net>)
Re: CVE request: davfs2 - Unsecure use of system() (Tavis Ormandy <taviso@...xchg8b.com>)
CVE Request : poppler < 0.13.0 (etienne <etiennehelluy@...il.com>)
Fwd: [vs-plain] polkit races (Sebastian Krahmer <krahmer@...e.de>)
Re: Fwd: [vs-plain] polkit races (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Fwd: [vs-plain] polkit races (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: davfs2 - Unsecure use of system() (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request: davfs2 - Unsecure use of system() (Tim <tim-security@...tinelchicken.org>)
Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Alexander Cherepanov <cherepan@...me.ru>)

September 19 (3 messages)

Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Eric Hodel <drbrain@...ment7.net>)
OpenStack: Glance image creation in other tenant accounts (CVE-2013-4354) (Kurt Seifried <kseifried@...hat.com>)
Re: OpenStack: Glance image creation in other tenant accounts (CVE-2013-4354) (Jeremy Stanley <fungi@...goth.org>)

September 20 (5 messages)

Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Eric Hodel <drbrain@...ment7.net>)
CVE-2013-5696: split needed (Raphael Geissert <geissert@...ian.org>)
Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older (Tomas Hoger <thoger@...hat.com>)
Re: browser document.cookie DoS vulnerability (Joel Weinberger <jww@...omium.org>)
Re: CVE-2013-5696: split needed (Kurt Seifried <kseifried@...hat.com>)

September 22 (1 message)

Re: Research on better-than-brute-force attacks on PDF cryptography (Dhiru Kholia <dhiru.kholia@...il.com>)

September 23 (1 message)

Re: CVE-2013-5696: split needed (cve-assign@...re.org)

September 24 (5 messages)

Re: SSL BREACH (cve-assign@...re.org)
Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Henri Salo <henri@...v.fi>)
Reproducible Builds for Fedora (Dhiru Kholia <dhiru.kholia@...il.com>)
CVE request: X2Go server (Chris Reffett <creffett@...too.org>)
graphite CVE-2013-5903 confusion (Seth Arnold <seth.arnold@...onical.com>)

September 25 (16 messages)

Re: Reproducible Builds for Fedora (Sebastian Krahmer <krahmer@...e.de>)
Xen Security Advisory 62 (CVE-2013-1442) - Information leak on AVX and/or LWP capable CPUs (Xen.org security team <security@....org>)
Re: Reproducible Builds for Fedora (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: Reproducible Builds for Fedora (Steve Grubb <sgrubb@...hat.com>)
Re: Reproducible Builds for Fedora (Nicolas Vigier <boklm@...s-attacks.org>)
Re: Reproducible Builds for Fedora (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Moritz Naumann <security@...itz-naumann.com>)
Re: Reproducible Builds for Fedora (Solar Designer <solar@...nwall.com>)
Re: Re: browser document.cookie DoS vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: Reproducible Builds for Fedora (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: X2Go server (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Henri Salo <henri@...v.fi>)
Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5 - multiple vulnerabilities (Henri Salo <henri@...v.fi>)
[notification] txt2man unsafe use of tempoarary files (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request: pyxtrlock (Leon Weber <leon@...nweber.de>)

September 26 (9 messages)

RESEND: CVE Request: pwgen (Michael Samuel <mik@...net.net>)
Re: Reproducible Builds for Fedora (Dhiru Kholia <dhiru.kholia@...il.com>)
CVE request: Javamelody blind XSS through X-Forwarded-For header (Rafael Luque <rafael.luque.leiva@...il.com>)
CVE request: qemu host crash from within guest (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: qemu host crash from within guest (Kurt Seifried <kseifried@...hat.com>)
CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
Buffer overrun vulnerability in CHICKEN Scheme (Peter Bex <Peter.Bex@...all.nl>)
Re: Reproducible Builds for Fedora (Alexander Cherepanov <cherepan@...me.ru>)
Re: Reproducible Builds for Fedora (Steve Grubb <sgrubb@...hat.com>)

September 27 (11 messages)

Re: Reproducible Builds for Fedora (Alexander Cherepanov <cherepan@...me.ru>)
Re: Reproducible Builds for Fedora (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Trend micro contact details ("donesh.l" <donesh.l@...ecti.com>)
Re: Reproducible Builds for Fedora (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Javamelody blind XSS through X-Forwarded-For header (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: Buffer overrun vulnerability in CHICKEN Scheme (Kurt Seifried <kseifried@...hat.com>)
Re: Reproducible Builds for Fedora (Dhiru Kholia <dhiru.kholia@...il.com>)
Re: CVE request: Javamelody blind XSS through X-Forwarded-For header (Rafael Luque <rafael.luque.leiva@...il.com>)
Re: graphite CVE-2013-5903 confusion (cve-assign@...re.org)
Re: Reproducible Builds for Fedora (Paul Pluzhnikov <ppluzhnikov@...gle.com>)

September 28 (1 message)

linux kernel memory corruption with ipv6 udp offloading (Hannes Frederic Sowa <hannes@...essinduktion.org>)

September 29 (2 messages)

Re: linux kernel memory corruption with ipv6 udp offloading (Kurt Seifried <kseifried@...hat.com>)
Re: Trend micro contact details (Florian Weimer <fw@...eb.enyo.de>)

September 30 (3 messages)

Xen Security Advisory 63 (CVE-2013-4355) - Information leaks through I/O instruction emulation (Xen.org security team <security@....org>)
Xen Security Advisory 64 (CVE-2013-4356) - Memory accessible by 64-bit PV guests under live migration (Xen.org security team <security@....org>)
Xen Security Advisory 66 (CVE-2013-4361) - Information leak through fbld instruction emulation (Xen.org security team <security@....org>)

163 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.