oss-security mailing list - 2014/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2014/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 5	² 4
³ 21	⁴ 10	⁵ 5	⁶ 14	⁷ 13	⁸ 9	⁹ 1
¹⁰ 15	¹¹ 11	¹² 18	¹³ 7	¹⁴ 7	¹⁵ 4	¹⁶ 10
¹⁷ 7	¹⁸ 11	¹⁹ 15	²⁰ 20	²¹ 3	²² 2	²³ 1
²⁴ 8	²⁵ 6	²⁶ 1	²⁷ 13	²⁸ 11

Messages by day:

February 1 (5 messages)

Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (Kurt Seifried <kseifried@...hat.com>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) ("PaX Team" <pageexec@...email.hu>)
Re: linux-distros membership (Alexander Cherepanov <cherepan@...me.ru>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (Yves-Alexis Perez <corsac@...ian.org>)
Re: linux-distros membership (rf@...eap.de)

February 2 (4 messages)

Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (Solar Designer <solar@...nwall.com>)
Persistent XSS in Wordpress 3.3.1+dfsg-1 (Packaged with Ubuntu 12.04.4) ("Larry W. Cashdollar" <larry0@...com>)
Re: Persistent XSS in Wordpress 3.3.1+dfsg-1 (Packaged with Ubuntu 12.04.4) ("Larry W. Cashdollar" <larry0@...com>)
CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user (Murray McAllister <mmcallis@...hat.com>)

February 3 (21 messages)

Re: CVE request: impressCMS 1.3.5 arbitrary file deletion and XSS (Pedro Ribeiro <pedrib@...il.com>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (mancha <mancha1@...h.com>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (Solar Designer <solar@...nwall.com>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (mancha <mancha1@...h.com>)
Re: CVE request: temp file issues in python's logilab-common module (cve-assign@...re.org)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) ("mancha" <mancha1@...h.com>)
CVE request: multiple issues in Apache Cordova/PhoneGap (David Jorm <djorm@...hat.com>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (Solar Designer <solar@...nwall.com>)
CVE request: a2ps insecure temporary file use (Murray McAllister <mmcallis@...hat.com>)
Re: Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!) (Kurt Seifried <kseifried@...hat.com>)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (mancha <mancha1@...h.com>)
CVE request: PHP object insertion in Contao CMS <= 3.2.5 (Pedro Ribeiro <pedrib@...il.com>)
Re: Re: CVE request: temporary file issue in Passenger rubygem (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: PHP object insertion in Contao CMS <= 3.2.5 (cve-assign@...re.org)
Re: Persistent XSS in Wordpress 3.3.1+dfsg-1 (Packaged with Ubuntu 12.04.4) (larry Cashdollar <larry0@...com>)
Re: CVE request: a2ps insecure temporary file use (Murray McAllister <mmcallis@...hat.com>)
Re: CVE needed for libotr's support for OTR v1? (cve-assign@...re.org)
Re: OpenSSH J-PAKE vulnerability (no cause for panic! remain calm!) (mancha <mancha1@...h.com>)
Re: CVE request: enlightenment sysactions (cve-assign@...re.org)
Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038) (mancha <mancha1@...h.com>)
CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) ("Vincent Danen" <vdanen@...hat.com>)

February 4 (10 messages)

CVE request: python-gnupg before 0.3.5 shell injection (Hanno Böck <hanno@...eck.de>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Henri Salo <henri@...v.fi>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Matthew Daley <mattd@...fuzz.com>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Henri Salo <henri@...v.fi>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Henri Salo <henri@...v.fi>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: a2ps insecure temporary file use (cve-assign@...re.org)
Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) (cve-assign@...re.org)
Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) ("Vincent Danen" <vdanen@...hat.com>)

February 5 (5 messages)

Re: Re: CVE request: a2ps insecure temporary file use (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Vinay Sajip <vinay_sajip@...oo.co.uk>)
Re: Re: CVE request: python-gnupg before 0.3.5 shell injection (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Vinay Sajip <vinay_sajip@...oo.co.uk>)
Re: CVE request: a2ps insecure temporary file use (cve-assign@...re.org)

February 6 (14 messages)

Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities (Gunther <deviant.beta@...il.com>)
Mumble-SA-2014-001 and Mumble-SA-2014-002 (Mikkel Krautz <mikkel@...utz.dk>)
CVE request: f2py insecure temporary file use (Murray McAllister <mmcallis@...hat.com>)
CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools) (Arun Neelicattu <abn@...hat.com>)
Re: CVE request: python-gnupg before 0.3.5 shell injection (Hanno Böck <hanno@...eck.de>)
Xen Security Advisory 85 - Off-by-one error in FLASK_AVC_CACHESTAT hypercall (Xen.org security team <security@....org>)
Xen Security Advisory 86 - libvchan failure handling malicious ring indexes (Xen.org security team <security@....org>)
Re: [notification] CVE-2013-6888: uscan: remote code execution (Jakub Wilk <jwilk@...ian.org>)
Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls (Xen.org security team <security@....org>)
CVE Request: Capture::Tiny: insecure use of /tmp (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls (cve-assign@...re.org)
CVE Request: Linux kernel: SELinux local DoS (P J P <ppandit@...hat.com>)
Re: CVE Request: Linux kernel: SELinux local DoS (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: f2py insecure temporary file use (Murray McAllister <mmcallis@...hat.com>)

February 7 (13 messages)

Re: CVE Request: Capture::Tiny: insecure use of /tmp (cve-assign@...re.org)
Re: CVE Request: Linux kernel: SELinux local DoS (cve-assign@...re.org)
CVE Split: CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS (Arun Neelicattu <abn@...hat.com>)
Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls ("Jan Beulich" <JBeulich@...e.com>)
Re: Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls (Źmicier Januszkiewicz <gauri@....by>)
contao vulnerability - CVE assigned? (Alexandre Dulaunoy <a@....be>)
Re: contao vulnerability - CVE assigned? (Hanno Böck <hanno@...eck.de>)
oath-toolkit PAM module OTP token invalidation issue (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE request: multiple issues in Apache Cordova/PhoneGap (cve-assign@...re.org)
CVE request: multiple issues in Koha (Galen Charlton <gmc@...library.com>)
IcedTea-Web insecure temporary directory use - CVE-2013-6493 (Tomas Hoger <thoger@...hat.com>)
Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercalls (cve-assign@...re.org)
CVE request? buffer overflow in socket.recvfrom_into (Raphael Geissert <geissert@...ian.org>)

February 8 (9 messages)

Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java) (cve-assign@...re.org)
Re: Dokeos 2.1.1 Multiple Stored XSS Vulnerabilities (cve-assign@...re.org)
Re: CVE request: f2py insecure temporary file use (cve-assign@...re.org)
Re: CVEs for Android addJavascriptInterface issues (was: multiple issues in Apache Cordova/PhoneGap) ("Joshua J. Drake" <oss-sec-addjsif@...p.org>)
Fwd: Old CVE ids, public, but still "RESERVED" (Raphael Geissert <geissert@...ian.org>)
[oCERT-2014-001] MantisBT input sanitization errors (Andrea Barisani <lcars@...rt.org>)
Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools) (cve-assign@...re.org)
Re: CVEs for Android addJavascriptInterface issues (was: multiple issues in Apache Cordova/PhoneGap) (cve-assign@...re.org)
Re: Fwd: Old CVE ids, public, but still "RESERVED" (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 9 (1 message)

Re: CVE request: python-gnupg before 0.3.5 shell injection (cve-assign@...re.org)

February 10 (15 messages)

Re: (possible) CVE request: suPHP 0.7.2 release fixed a possible arbitrary code execution (cve-assign@...re.org)
Re: oath-toolkit PAM module OTP token invalidation issue (cve-assign@...re.org)
Re: CVE request: multiple issues in Koha (cve-assign@...re.org)
CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Florian Weimer <fweimer@...hat.com>)
Xen Security Advisory 85 (CVE-2014-1895) - Off-by-one error in FLASK_AVC_CACHESTAT hypercall (Xen.org security team <security@....org>)
Xen Security Advisory 86 (CVE-2014-1896) - libvchan failure handling malicious ring indexes (Xen.org security team <security@....org>)
Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Fl… (Xen.org security team <security@....org…)
Re: Re: CVE request: python-gnupg before 0.3.5 shell injection (Simon McVittie <smcv@...ian.org>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches (intrigeri <intrigeri@...m.org>)
Re: CVE request: WebKit-GTK + Puseaudio: unexpectedly high sound volume ("Alexander E. Patrakov" <patrakov@...il.com>)
Re: CVE request: WebKit-GTK + Puseaudio: unexpectedly high sound volume (cve-assign@...re.org)
Re: CVE request: parcimonie (0.6 to 0.8, included) possible correlation between key fetches (cve-assign@...re.org)
CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp (Jakub Wilk <jwilk@...ian.org>)

February 11 (11 messages)

Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp (cve-assign@...re.org)
CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean (cve-assign@...re.org)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Re: CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean ("Joshua J. Drake" <oss-sec-addjsif@...p.org>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Michael Samuel <mik@...net.net>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
CVE-2013-6401 Jansson hash collision issue (Murray McAllister <mmcallis@...hat.com>)
Re: CVE-2013-6401 Jansson hash collision issue (Murray McAllister <mmcallis@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Vendor adoption of PIE INFO#934476 oss-security ("CERT(R) Coordination Center" <cert@...t.org>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Michael Samuel <mik@...net.net>)

February 12 (18 messages)

Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Michael Samuel <mik@...net.net>)
information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (Murray McAllister <mmcallis@...hat.com>)
CVE request for vulnerability in OpenStack Glance (Jeremy Stanley <jeremy@...nstack.org>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
[Benchmark 2014] WAVSEP Vulnerability Scanner Benchmark 2013/2014 (Shay Chen <sectooladdict.vendors@...il.com>)
cinnamon-screensaver lock bypass (tested on Fedora 20) (Clemens Fries <clemens@...oworld.de>)
Re: Old CVE ids, public, but still "RESERVED" (Raphael Geissert <geissert@...ian.org>)
Xen Security Advisory 88 - use-after-free in xc_cpupool_getinfo() under memory pressure (Xen.org security team <security@....org>)
Re: Xen Security Advisory 88 - use-after-free in xc_cpupool_getinfo() under memory pressure (cve-assign@...re.org)
Re: cinnamon-screensaver lock bypass (tested on Fedora 20) (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Glance (cve-assign@...re.org)
Re: information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (cve-assign@...re.org)
Re: [notification] CVE-2013-6888: uscan: remote code execution (cve-assign@...re.org)
Re: CVE request: python-gnupg before 0.3.5 shell injection (cve-assign@...re.org)
Re: CVE request? buffer overflow in socket.recvfrom_into (cve-assign@...re.org)
Xen Security Advisory 88 (CVE-2014-1950) - use-after-free in xc_cpupool_getinfo() under memory pressure (Xen.org security team <security@....org>)
[OSSA 2014-004] Glance Swift store backend password leak (CVE-2014-1948) (Jeremy Stanley <jeremy@...nstack.org>)

February 13 (7 messages)

CVE-2014-0079: Unauthenticated remote denial of service flaw in Zarafa (Robert Scheck <robert@...oraproject.org>)
Re: information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (Murray McAllister <mmcallis@...hat.com>)
Re: cinnamon-screensaver lock bypass (tested on Fedora 20) (Murray McAllister <mmcallis@...hat.com>)
Possible CVE Request for Weechat -- Mutex potentially not held for random number generation ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (cve-assign@...re.org)
CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) ("mancha" <mancha1@...h.com>)
Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) (cve-assign@...re.org)

February 14 (7 messages)

Re: information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (Murray McAllister <mmcallis@...hat.com>)
CVE request: MuPDF Stack-based Buffer Overflow in xps_parse_color() (Murray McAllister <mmcallis@...hat.com>)
Re: information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (cve-assign@...re.org)
Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Helmut Grohne <helmut@...divi.de>)
Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (cve-assign@...re.org)
[CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form (Tom Dale <tom@...dale.net>)
Re: Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Helmut Grohne <helmut@...divi.de>)

February 15 (4 messages)

Re: Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Florian Weimer <fw@...eb.enyo.de>)
Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Petter Reinholdtsen <pere@...gry.com>)
Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Solar Designer <solar@...nwall.com>)
Re: Vendor adoption of PIE INFO#934476 oss-security (Solar Designer <solar@...nwall.com>)

February 16 (10 messages)

CVE request: freeradius denial of service in rlm_pap hash processing (Florian Weimer <fw@...eb.enyo.de>)
Re: Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Helmut Grohne <helmut@...divi.de>)
Re: Re: Bug#738855: initscripts: Skip killing root-owned process starting with @ (Helmut Grohne <helmut@...divi.de>)
Re: Vendor adoption of PIE INFO#934476 oss-security (Stuart Henderson <stu@...cehopper.org>)
Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Vendor adoption of PIE INFO#934476 oss-security ("CERT(R) Coordination Center" <cert@...t.org>)
Re: Vendor adoption of PIE INFO#934476 oss-security (christos@...las.com (Christos Zoulas))
Re: Vendor adoption of PIE INFO#934476 oss-security (Nick Kralevich <nnk@...gle.com>)
Re: Vendor adoption of PIE INFO#934476 oss-security (Nick Kralevich <nnk@...gle.com>)
Re: Vendor adoption of PIE INFO#934476 oss-security (Stuart Henderson <stu@...cehopper.org>)

February 17 (7 messages)

CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext." (Murray McAllister <mmcallis@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
CVE request New-djbdns: dnscache: possible DoS (P J P <ppandit@...hat.com>)
CVE-2014-0069 -- kernel: cifs: incorrect handling of bogus user pointers during uncached writes (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Split: CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS (Arun Neelicattu <abn@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Michael Samuel <mik@...net.net>)
[OSSA 2014-005] Missing SSL certificate check in Python Swift client (CVE-2013-6396) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)

February 18 (11 messages)

CVE request for unfixed CVE-2013-6466 in openswan-2.6.40 (Paul Wouters <pwouters@...hat.com>)
Re: CVE request: MuPDF Stack-based Buffer Overflow in xps_parse_color() (cve-assign@...re.org)
Re: CVE request: freeradius denial of service in rlm_pap hash processing (cve-assign@...re.org)
CVE Request: Percona Toolkit automatic version check - remote code execution / information leak (Marcus Meissner <meissner@...e.de>)
Re: CVE request: "imapsync ignores the --tls switch and sends my authentication plaintext." (cve-assign@...re.org)
CVE request: MaraDNS DoS due to incorrect bounds checking on certain strings (Martin Prpic <mprpic@...hat.com>)
Re: CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean (Nick Kralevich <nnk@...gle.com>)
XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (CVE-2014-0081) (Aaron Patterson <tenderlove@...y-lang.org>)
Data Injection Vulnerability in Active Record (CVE-2014-0080) (Aaron Patterson <tenderlove@...y-lang.org>)
Denial of Service Vulnerability in Action View when using render :text (CVE-2014-0082) (Aaron Patterson <tenderlove@...y-lang.org>)
Re: CVE-2014-1939 searchBoxJavaBridge_ in Android Jelly Bean (cve-assign@...re.org)

February 19 (15 messages)

Re: CVE request New-djbdns: dnscache: possible DoS (P J P <ppandit@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
CVE request: remote code execution in egroupware <= 1.8.005 (Pedro Ribeiro <pedrib@...il.com>)
Re: CVE request: remote code execution in egroupware <= 1.8.005 (cve-assign@...re.org)
Xen Security Advisory 60 (CVE-2013-2212) - Excessive time to disable caching with HVM guests with PCI passthrough (Xen.org security team <security@....org>)
Xen Security Advisory 82 (CVE-2013-6885) - Guest triggerable AMD CPU erratum may cause host hang (Xen.org security team <security@....org>)
Re: CVE request: remote code execution in egroupware <= 1.8.005 (Ralf Becker <rb@...lite.de>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (cve-assign@...re.org)
Re: CVE request New-djbdns: dnscache: possible DoS (cve-assign@...re.org)
Re: CVE request: remote code execution in egroupware <= 1.8.005 (Pedro Ribeiro <pedrib@...il.com>)
CVE request for CGI::Application information disclosure flaw ("Vincent Danen" <vdanen@...hat.com>)
Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) (David Jorm <djorm@...hat.com>)
Re: information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability" (cve-assign@...re.org)
Re: CVE Request: Percona Toolkit automatic version check - remote code execution / information leak (cve-assign@...re.org)
Re: CVE request: MaraDNS DoS due to incorrect bounds checking on certain strings (cve-assign@...re.org)

February 20 (20 messages)

Re: CVE request for CGI::Application information disclosure flaw (cve-assign@...re.org)
Re: CVE request for unfixed CVE-2013-6466 in openswan-2.6.40 (cve-assign@...re.org)
Re: Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Re: CVE request New-djbdns: dnscache: possible DoS (P J P <ppandit@...hat.com>)
CVE request: Linux kernel: nfs: information leakage (P J P <ppandit@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (cve-assign@...re.org)
Re: CVE request New-djbdns: dnscache: possible DoS (cve-assign@...re.org)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Re: Re: CVE request New-djbdns: dnscache: possible DoS (P J P <ppandit@...hat.com>)
CVE Request: Linux kernel: s390: crash due to linkage stack instruction (P J P <ppandit@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (cve-assign@...re.org)
Persistent XSS in Media File Renamer V1.7.0 ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE request: Linux kernel: nfs: information leakage (cve-assign@...re.org)
Re: CVE Request: Linux kernel: s390: crash due to linkage stack instruction (cve-assign@...re.org)
Re: Persistent XSS in Media File Renamer V1.7.0 (cve-assign@...re.org)
Re: Re: CVE request: Linux kernel: nfs: information leakage (P J P <ppandit@...hat.com>)
Re: CVE Request: Linux kernel: s390: crash due to linkage stack instruction (P J P <ppandit@...hat.com>)
Request regarding posts to the lists (security curmudgeon <jericho@...rition.org>)
Re: Request regarding posts to the lists (Solar Designer <solar@...nwall.com>)
Re: Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Michael Samuel <mik@...net.net>)

February 21 (3 messages)

Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) (Garth Mollett <gmollett@...hat.com>)
Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) (cve-assign@...re.org)
Re: Request regarding posts to the lists (Raphael Geissert <geissert@...ian.org>)

February 22 (2 messages)

Fwd: temporary file creation vulnerability in Redis (Matthew Hall <mhall@...omputing.net>)
Re: Fwd: temporary file creation vulnerability in Redis (Michael Samuel <mik@...net.net>)

February 23 (1 message)

Re: Fwd: temporary file creation vulnerability in Redis (cve-assign@...re.org)

February 24 (8 messages)

Re: Fwd: temporary file creation vulnerability in Redis (Matthew Hall <mhall@...omputing.net>)
xfe: directory masks ignored when creating new files on Samba and NFS (Murray McAllister <mmcallis@...hat.com>)
CVE request: XSS in MODX Revolution before 2.2.11 (Hanno Böck <hanno@...eck.de>)
Re: Fwd: temporary file creation vulnerability in Redis (cve-assign@...re.org)
Re: xfe: directory masks ignored when creating new files on Samba and NFS (cve-assign@...re.org)
Re: CVE request: XSS in MODX Revolution before 2.2.11 (cve-assign@...re.org)
CVE request for catfish program ("Vincent Danen" <vdanen@...hat.com>)
CVE request: hexchat buffer overflow (Henri Salo <henri@...v.fi>)

February 25 (6 messages)

Re: CVE request: hexchat buffer overflow (cve-assign@...re.org)
Re: CVE request for catfish program (cve-assign@...re.org)
Re: CVE request for catfish program ("Vincent Danen" <vdanen@...hat.com>)
Re: CVE request for catfish program (cve-assign@...re.org)
Re: Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) (Tomas Hoger <thoger@...hat.com>)
Re: CVE request for catfish program ("Vincent Danen" <vdanen@...hat.com>)

February 26 (1 message)

CVE request: POSH multiple vulnerabilities (Damien Cauquil <d.cauquil@...dream.com>)

February 27 (13 messages)

REJECT CVE-2014-0070 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) (cve-assign@...re.org)
CVE request: PLOGGER 1.0RC1 multiple vulnerabilities (Damien Cauquil <d.cauquil@...dream.com>)
[CVE assignment notification] Multiple vulnerabilities in POSH (Damien Cauquil <d.cauquil@...dream.com>)
Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x) (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities (cve-assign@...re.org)
Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities (Damien Cauquil <d.cauquil@...dream.com>)
Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities (cve-assign@...re.org)
Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities (Damien Cauquil <d.cauquil@...dream.com>)
Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request New-djbdns: dnscache: potential cache poisoning (Florian Weimer <fweimer@...hat.com>)
CVE Request?: konqueror - https uses all ciphers, even weak ones (Marcus Meissner <meissner@...e.de>)
CVE request: askbot xss (Tomas Hoger <thoger@...hat.com>)

February 28 (11 messages)

CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release (Murray McAllister <mmcallis@...hat.com>)
CVE request for vulnerability in OpenStack Keystone (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
CVE request: MantisBT 1.2.13 SQL injection vulnerability (Damien Regad <dregad@...tisbt.org>)
Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release (cve-assign@...re.org)
Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release ("Vincent Danen" <vdanen@...hat.com>)
Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release (Chris Steipp <csteipp@...imedia.org>)
Re: Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release (Simon McVittie <smcv@...ian.org>)
Re: CVE request: askbot xss (cve-assign@...re.org)
Re: CVE request: MantisBT 1.2.13 SQL injection vulnerability (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Keystone (cve-assign@...re.org)
Re: Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 release (Chris Steipp <csteipp@...imedia.org>)

252 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.