oss-security mailing list - 2013/11

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2013/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 3	²	³ 5
⁴ 24	⁵ 8	⁶ 2	⁷ 1	⁸ 8	⁹	¹⁰ 4
¹¹ 2	¹² 7	¹³ 11	¹⁴ 13	¹⁵ 20	¹⁶	¹⁷
¹⁸ 7	¹⁹ 2	²⁰ 3	²¹ 3	²² 5	²³	²⁴
²⁵ 4	²⁶ 15	²⁷ 6	²⁸ 17	²⁹ 10	³⁰ 2

Messages by day:

November 1 (3 messages)

Xen Security Advisory 73 - Lock order reversal between page allocation and grant table locks (Xen.org security team <security@....org>)
Xen Security Advisory 73 - Lock order reversal between page allocation and grant table locks (Xen.org security team <security@....org>)
Re: Xen Security Advisory 73 - Lock order reversal between page allocation and grant table locks (Kurt Seifried <kseifried@...hat.com>)

November 3 (5 messages)

CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
CVE request for a vulnerability in OpenStack Nova (Jeremy Stanley <jeremy@...nstack.org>)
Re: CVE request for a vulnerability in OpenStack Nova (Kurt Seifried <kseifried@...hat.com>)
some unstracked linux kernel security fixes (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)

November 4 (24 messages)

possible CVE request: Tryton client input sanitization flaw (Murray McAllister <mmcallis@...hat.com>)
CVE Request: IBUS showing passwords during password input (Marcus Meissner <meissner@...e.de>)
Xen Security Advisory 73 (CVE-2013-4494) - Lock order reversal between page allocation and grant table locks (Xen.org security team <security@....org>)
Re: CVE Request: IBUS showing passwords during password input (Fuminobu TAKEYAMA <ftake@...ko.jp>)
CVE Request: lighttpd using vulnerable cipher suites with SNI (Stefan Bühler <stbuehler@...httpd.net>)
openssl default ciphers (Stefan Bühler <stbuehler@...httpd.net>)
Re: openssl default ciphers (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: openssl default ciphers ("Eric H. Christensen" <echriste@...hat.com>)
Re: openssl default ciphers (Hanno Böck <hanno@...eck.de>)
Re: openssl default ciphers (Russ Allbery <eagle@...ie.org>)
XSS in CollectiveAccess 1.3 and earlier (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: openssl default ciphers (Stefan Bühler <stbuehler@...httpd.net>)
Re: openssl default ciphers (Mike <mikedawg@...il.com>)
CVE-2013-4489 Remote code execution vulnerability in the code search feature of GitLab (Jacob Vosmaer <jacob@...lab.com>)
CVE-2013-4490 Remote code execution vulnerability in the SSH key upload feature of GitLab (Jacob Vosmaer <jacob@...lab.com>)
Re: openssl default ciphers ("Eric H. Christensen" <echriste@...hat.com>)
Re: openssl default ciphers (leToff <letoff@...il.com>)
Re: XSS in CollectiveAccess 1.3 and earlier (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: lighttpd using vulnerable cipher suites with SNI (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request: IBUS showing passwords during password input (Kurt Seifried <kseifried@...hat.com>)
Re: possible CVE request: Tryton client input sanitization flaw (Kurt Seifried <kseifried@...hat.com>)
Re: some unstracked linux kernel security fixes (Kurt Seifried <kseifried@...hat.com>)
Re: openssl default ciphers (Reed Loden <reed@...dloden.com>)
Re: Randomness Attacks Against PHP Applications (Solar Designer <solar@...nwall.com>)

November 5 (8 messages)

CVE request: drupalauth module for simpleSAMLphp trivial impersonation ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: openssl default ciphers (Stefan Bühler <stbuehler@...httpd.net>)
Re: openssl default ciphers (Florian Weimer <fweimer@...hat.com>)
CVE Request: additional fix for CVE-2012-2825 libxslt crash (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: additional fix for CVE-2012-2825 libxslt crash (Vincent Danen <vdanen@...hat.com>)
Re: CVE Request: additional fix for CVE-2012-2825 libxslt crash (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE Request: additional fix for CVE-2012-2825 libxslt crash (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: additional fix for CVE-2012-2825 libxslt crash (Vincent Danen <vdanen@...hat.com>)

November 6 (2 messages)

Re: CVE Request: additional fix for CVE-2012-2825 libxslt crash (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)

November 7 (1 message)

Re: Source of bad password hashing practices? MySQL manual... (John Haxby <john.haxby@...cle.com>)

November 8 (8 messages)

Advisory report - Multiple memory corruption and race condition in Goodix gt915 Android touchscreen driver (CVE-2013-47… (Jonathan Salwan <jonathan.salwan@...il.…)
CVE Request - OpenSSH ("mancha" <mancha1@...h.com>)
Re: CVE Request - OpenSSH (Kurt Seifried <kseifried@...hat.com>)
Xen Security Advisory 75 - Host crash due to guest VMX instruction execution (Xen.org security team <security@....org>)
CVE Request: bip denial of service via resource leak (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE request: drupalauth module for simpleSAMLphp trivial impersonation (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: bip denial of service via resource leak (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 75 - Host crash due to guest VMX instruction execution (Kurt Seifried <kseifried@...hat.com>)

November 10 (4 messages)

CVE Request: multiple vulnerabilities in spip (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2013-6765 CVE-2013-6766 for OpenVAS 4.0.4/1.3.2/etc. (cve-assign@...re.org)
Re: CVE Request: multiple vulnerabilities in spip (David Prévot <taffit@...ian.org>)
Re: CVE Request: multiple vulnerabilities in spip (Kurt Seifried <kseifried@...hat.com>)

November 11 (2 messages)

Xen Security Advisory 75 (CVE-2013-4551) - Host crash due to guest VMX instruction execution (Xen.org security team <security@....org>)
Security vulnerability in gitlab-shell (CVE-2013-4546) (Jacob Vosmaer <jacob@...lab.com>)

November 12 (7 messages)

Re: some unstracked linux kernel security fixes (Petr Matousek <pmatouse@...hat.com>)
CVE-2013-6780 for YUI 2.x 2013-11-11 uploader.swf issue (cve-assign@...re.org)
CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free) (Stefan Bühler <stbuehler@...httpd.net>)
Re: CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free) (Kurt Seifried <kseifried@...hat.com>)
CVE request: rubygem omniauth-facebook CSRF vurnerability (Josef Šimánek <josef.simanek@...il.com>)
Re: CVE request: rubygem omniauth-facebook CSRF vurnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: rubygem omniauth-facebook CSRF vurnerability (Josef Šimánek <josef.simanek@...il.com>)

November 13 (11 messages)

Re: Re: CVE request: rubygem omniauth-facebook CSRF vurnerability (Kurt Seifried <kseifried@...hat.com>)
perdition: ssl_outgoing_ciphers not applied to STARTTLS connections (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Microsoft Warns Customers Away From RC4 and SHA-1 (Kurt Seifried <kseifried@...hat.com>)
Re: Microsoft Warns Customers Away From RC4 and SHA-1 (Tim <tim-security@...tinelchicken.org>)
Re: Microsoft Warns Customers Away From RC4 and SHA-1 ("Eric H. Christensen" <echriste@...hat.com>)
Re: Microsoft Warns Customers Away From RC4 and SHA-1 (Tim <tim-security@...tinelchicken.org>)
cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
RE: [vs-plain] Request for CVE Identifiers (Jenny Han Donnelly <jennydonnelly@...oo-inc.com>)
CVE-2013-4563 -- Linux kernel: net: large udp packet over IPv6 over UFO-enabled device with TBF qdisc panic (Petr Matousek <pmatouse@...hat.com>)
Re: CVE-2013-4563 -- Linux kernel: net: large udp packet over IPv6 over UFO-enabled device with TBF qdisc panic (Kurt Seifried <kseifried@...hat.com>)
Re: RE: [vs-plain] Request for CVE Identifiers (Kurt Seifried <kseifried@...hat.com>)

November 14 (13 messages)

CVE request: ppthtml heap-based buffer overflow (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: ppthtml heap-based buffer overflow (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ppthtml heap-based buffer overflow (Michael Gilbert <mgilbert@...ian.org>)
Re: CVE request: ppthtml heap-based buffer overflow (Murray McAllister <mmcallis@...hat.com>)
Re: some unstracked linux kernel security fixes (Petr Matousek <pmatouse@...hat.com>)
"I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON) (Tim Brown <tmb@...35.com>)
Re: some unstracked linux kernel security fixes (Dan Carpenter <dan.carpenter@...cle.com>)
Requesting four (4) CVE identifiers for GitLab (Jacob Vosmaer <jacob@...lab.com>)
Re: some unstracked linux kernel security fixes (Petr Matousek <pmatouse@...hat.com>)
[OSSA 2013-030] XenAPI security groups not kept through migrate or resize (CVE-2013-4497) (Jeremy Stanley <jeremy@...nstack.org>)
CVE-2013-6282 - linux kernel: missing access checks in get_user/put_user on ARM (Nico Golde <oss-security+ml@...lde.de>)
mod_nss FakeBasicAuth authentication bypass (Tomas Hoger <thoger@...hat.com>)
CVE request: ath9k_htc improperly updates MAC address ("Mathy Vanhoef" <Mathy.Vanhoef@...kuleuven.be>)

November 15 (20 messages)

CVE Request: grub-mkconfig (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request: grub-mkconfig (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ath9k_htc improperly updates MAC address (Kurt Seifried <kseifried@...hat.com>)
Re: Requesting four (4) CVE identifiers for GitLab (Kurt Seifried <kseifried@...hat.com>)
Re: "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON) (Kurt Seifried <kseifried@...hat.com>)
Re: perdition: ssl_outgoing_ciphers not applied to STARTTLS connections (Kurt Seifried <kseifried@...hat.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Tim <tim-security@...tinelchicken.org>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Kurt Seifried <kseifried@...hat.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Chris Palmer <snackypants@...il.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Kurt Seifried <kseifried@...hat.com>)
CVE request: Linux kernel: net: ipvs stack buffer overflow (P J P <ppandit@...hat.com>)
Re: CVE request: Linux kernel: net: ipvs stack buffer overflow (Kurt Seifried <kseifried@...hat.com>)
CVE request for graphicsmagick DoS (Vincent Danen <vdanen@...hat.com>)
Re: CVE request for graphicsmagick DoS (Kurt Seifried <kseifried@...hat.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Chris Palmer <snackypants@...il.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Seth Arnold <seth.arnold@...onical.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Kurt Seifried <kseifried@...hat.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Marcus Meissner <meissner@...e.de>)
CVE request: RubyGem omniauth-facebook access token security vulnerability (Josef Šimánek <josef.simanek@...il.com>)
Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] (Tim <tim-security@...tinelchicken.org>)

November 18 (7 messages)

CVE request for Drupal contributed modules (Forest Monsen <forest.monsen@...il.com>)
CVE-2013-4591 -- Linux kernel: kernel: nfs: missing check for buffer length in __nfs4_get_acl_uncached (Petr Matousek <pmatouse@...hat.com>)
CVE-2013-4592 -- Linux kernel: kvm: memory leak when memory slot is moved with assigned device (Petr Matousek <pmatouse@...hat.com>)
Re: Requesting four (4) CVE identifiers for GitLab (Jacob Vosmaer <jacob@...lab.com>)
Re: CVE request: RubyGem omniauth-facebook access token security vulnerability (Josef Šimánek <josef.simanek@...il.com>)
Re: Re: CVE request: RubyGem omniauth-facebook access token security vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)

November 19 (2 messages)

CVE requests for three Linux kernel issues (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE requests for three Linux kernel issues (Petr Matousek <pmatouse@...hat.com>)

November 20 (3 messages)

Re: CVE requests for three Linux kernel issues (P J P <ppandit@...hat.com>)
Re: CVE requests for three Linux kernel issues (Daniel Borkmann <dborkman@...hat.com>)
Xen Security Advisory 78 - Insufficient TLB flushing in VT-d (iommu) code (Xen.org security team <security@....org>)

November 21 (3 messages)

Re: Xen Security Advisory 78 - Insufficient TLB flushing in VT-d (iommu) code (Kurt Seifried <kseifried@...hat.com>)
Xen Security Advisory 78 (CVE-2013-6375) - Insufficient TLB flushing in VT-d (iommu) code (Xen.org security team <security@....org>)
389-ds DoS due to improper handling of ger attr searches (CVE-2013-4485) (Vincent Danen <vdanen@...hat.com>)

November 22 (5 messages)

Please REJECT CVE-2013-6377 (Kurt Seifried <kseifried@...hat.com>)
CVE request for a vulnerability in OpenStack Ceilometer (Thierry Carrez <thierry@...nstack.org>)
Re: CVE request for a vulnerability in OpenStack Ceilometer (Kurt Seifried <kseifried@...hat.com>)
SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
Linux kernel CVE fixes (Kees Cook <keescook@...omium.org>)

November 25 (4 messages)

Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c (Jonathan Salwan <jonathan.salwan@...il.com>)
[OSSA 2013-031] Ceilometer DB2/MongoDB backend password leak (CVE-2013-6384) (Thierry Carrez <thierry@...nstack.org>)
Re: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c (Kurt Seifried <kseifried@...hat.com>)

November 26 (15 messages)

RE: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c ("Christey, Steven M." <coley@...re.org>)
Re: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c (Ramon de C Valle <rdecvalle@...are.com>)
CVE request: XSS flaw in Ganglia web interface (Murray McAllister <mmcallis@...hat.com>)
CVE Request: static IV used in Percona XtraBackup (Marcus Meissner <meissner@...e.de>)
kernel: uio: CVE-2013-6763 [was: Re: some unstracked linux kernel security fixes] (Petr Matousek <pmatouse@...hat.com>)
CVE Request: FFmpeg 2.1 multiple problems (Michael Niedermayer <michaelni@....at>)
Xen Security Advisory 74 (CVE-2013-4553) - Lock order reversal between page_alloc_lock and mm_rwlock (Xen.org security team <security@....org>)
Xen Security Advisory 76 (CVE-2013-4554) - Hypercalls exposed to privilege rings 1 and 2 of HVM guests (Xen.org security team <security@....org>)
Re: CVE Request: FFmpeg 2.1 multiple problems (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: static IV used in Percona XtraBackup (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: XSS flaw in Ganglia web interface (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: static IV used in Percona XtraBackup (Florian Weimer <fweimer@...hat.com>)
CVE request: Apache Solr 4.6.0 (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: CVE Request: static IV used in Percona XtraBackup (Michael Samuel <mik@...net.net>)

November 27 (6 messages)

Re: CVE request: Apache Solr 4.6.0 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: static IV used in Percona XtraBackup (P J P <ppandit@...hat.com>)
Re: Linux kernel CVE fixes (Marcus Meissner <meissner@...e.de>)
CVE request: hplip insecure temporary file handling in pkit.py (Ratul Gupta <ratulg@...hat.com>)
Re: CVE request: hplip insecure temporary file handling in pkit.py (Raphael Geissert <geissert@...ian.org>)
Re: CVE request: hplip insecure temporary file handling in pkit.py (Sebastian Krahmer <krahmer@...e.de>)

November 28 (17 messages)

CVE-2013-6885 AMD Publ. 51810 Errata 793 system hang (cve-assign@...re.org)
CVE Request: Quassel IRC - manipulated clients can access backlog of all users on a shared core (Manuel Nickschas <sputnick@...ssel-irc.org>)
Re: CVE request: hplip insecure temporary file handling in pkit.py (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: hplip insecure temporary file handling in pkit.py (Kurt Seifried <kseifried@...hat.com>)
CVE Request: ownCloud security bypass on admin page (Murray McAllister <mmcallis@...hat.com>)
Re: CVE Request: ownCloud security bypass on admin page (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: FFmpeg 2.1 multiple problems (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Quassel IRC - manipulated clients can access backlog of all users on a shared core (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: FFmpeg 2.1 multiple problems (Michael Niedermayer <michaelni@....at>)
CVE Request: adequate: privilege escalation via tty hijacking (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request: incorrect parsing of access control file in nbd-server (Wouter Verhelst <wouter@...ian.org>)
CVE Request: Linux kernel: net: uninitialised memory leakage (P J P <ppandit@...hat.com>)
Re: CVE Request: Linux kernel: net: uninitialised memory leakage (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Linux kernel: net: uninitialised memory leakage (Hannes Frederic Sowa <hannes@...essinduktion.org>)
Re: CVE Request: Linux kernel: net: uninitialised memory leakage (P J P <ppandit@...hat.com>)
http://nvd.nist.gov/nvd.cfm?cvename=CVE-XXX URLs result in 404 (Alex Legler <a3li@...too.org>)
CVE request for OpenTTD (Rubidium <rubidium@...nttd.org>)

November 29 (10 messages)

CVE Request: Apache Solr XXE (David Jorm <djorm@...hat.com>)
Re: CVE Request: Apache Solr XXE (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for OpenTTD (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: incorrect parsing of access control file in nbd-server (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: adequate: privilege escalation via tty hijacking (Kurt Seifried <kseifried@...hat.com>)
CVE request: ClamAV vulnerabilities (Sergey Popov <pinkbyte@...too.org>)
CVE request: UnrealIRCd remote DoS (Henri Salo <henri@...v.fi>)
RE: http://nvd.nist.gov/nvd.cfm?cvename=CVE-XXX URLs result in 404 ("Izadjoo, Meisam" <meisam.izadjoo@...t.gov>)
Re: CVE request: ClamAV vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
RE: http://nvd.nist.gov/nvd.cfm?cvename=CVE-XXX URLs result in 404 ("Izadjoo, Meisam" <meisam.izadjoo@...t.gov>)

November 30 (2 messages)

Re: CVE request: UnrealIRCd remote DoS (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ClamAV vulnerabilities (George Theall <gtheall@...able.com>)

182 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.