oss-security mailing list - 2014/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2014/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 8	² 6	³ 2	⁴ 1	⁵ 1	⁶ 2
⁷ 8	⁸ 15	⁹ 31	¹⁰ 21	¹¹ 6	¹² 1	¹³ 4
¹⁴ 7	¹⁵ 5	¹⁶ 4	¹⁷ 7	¹⁸ 14	¹⁹ 5	²⁰ 2
²¹ 2	²² 11	²³ 8	²⁴	²⁵ 7	²⁶ 2	²⁷ 1
²⁸ 7	²⁹ 11	³⁰ 12

Messages by day:

April 1 (8 messages)

Re: CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02 (cve-assign@...re.org)
CVE Request: Shaarli: Several XSS in index.php (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" (Murray McAllister <mmcallis@...hat.com>)
cups-browsed remote exploit (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE Request: Shaarli: Several XSS in index.php (cve-assign@...re.org)
Re: Re: CVE request: Linux Kernel, two security issues (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request: MediaWiki 1.22.5 login csrf (cve-assign@...re.org)
Re: CVE request: Linux Kernel, two security issues (cve-assign@...re.org)

April 2 (6 messages)

Information on CVE-2014-0158, openjpeg (Raphael Geissert <geissert@...ian.org>)
Re: Information on CVE-2014-0158, openjpeg (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Information on CVE-2014-0158, openjpeg (Raphael Geissert <geissert@...ian.org>)
Xen Security Advisory 89 (CVE-2014-2599) - HVMOP_set_mem_access is not preemptible (Xen.org security team <security@....org>)
Xen Security Advisory 90 (CVE-2014-2580) - Linux netback crash trying to disable due to malformed packet (Xen.org security team <security@....org>)
Re: cups-browsed remote exploit (cve-assign@...re.org)

April 3 (2 messages)

Re: KAuth security issues (cve-assign@...re.org)
Re: CVE request: cacti "bug#0002405: SQL injection in graph_xport.php" (cve-assign@...re.org)

April 4 (1 message)

Lots of CVEs ahead in TLS implementations (Hanno Böck <hanno@...eck.de>)

April 5 (1 message)

Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression (Salvatore Bonaccorso <carnil@...ian.org>)

April 6 (2 messages)

CVE request: redmine open redirector (Florian Weimer <fw@...eb.enyo.de>)
CVE request: Icecast world readable log/logdir (Agostino Sarubbo <ago@...too.org>)

April 7 (8 messages)

Re: CVE request: Icecast world readable log/logdir (Tim Heckman <tim+sec@...erduty.com>)
CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table (Petr Matousek <pmatouse@...hat.com>)
OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: Icecast world readable log/logdir (Agostino Sarubbo <ago@...too.org>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Reed Loden <reed@...dloden.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Alex Gaynor <alex.gaynor@...il.com>)
Re: Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression (cve-assign@...re.org)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Yves-Alexis Perez <corsac@...ian.org>)

April 8 (15 messages)

Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Marcus Meissner <meissner@...e.de>)
Re: CVE request: Icecast world readable log/logdir (Ben Corman <ben@...man.io>)
Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Georgi Guninski <guninski@...inski.com>)
Re: Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Georgi Guninski <guninski@...inski.com>)
jbigkit security flaw (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request Linux kernel: IB/core: crash while resolving passive side RoCE L2 address in cma_req_handler (P J P <ppandit@...hat.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Jussi Eronen <juhani.eronen@...ora.fi>)
[OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Yves-Alexis Perez <corsac@...ian.org>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Kurt Seifried <kseifried@...hat.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Donald Stufft <donald@...fft.io>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Yves-Alexis Perez <corsac@...ian.org>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 ("Vincent Danen" <vdanen@...hat.com>)
Re: CVE request: Icecast world readable log/logdir (Kurt Seifried <kseifried@...hat.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Florian Weimer <fw@...eb.enyo.de>)

April 9 (31 messages)

Re: (Openfire M-Link Metronome Prosody Tigase) Possible CVE Request: Uncontrolled Resource Consumption with XMPP-Layer Compression (cve-assign@...re.org)
Other instances of CVE-2014-0160 - mod_spdy from Google (Kurt Seifried <kseifried@...hat.com>)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google (Kurt Seifried <kseifried@...hat.com>)
RE: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Bobby Broughton <bobby@...ehosting.com>)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google (mancha <mancha1@...o.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Solar Designer <solar@...nwall.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Two security flaws with json-c (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Yves-Alexis Perez <corsac@...ian.org>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172) (Florian Weimer <fweimer@...hat.com>)
Session IP check bypass in Roundcube 1.0 (Felix Eckhofer <felix@...but.de>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Marcus Meissner <meissner@...e.de>)
Heartbleed, clients and Android (Hanno Böck <hanno@...eck.de>)
Re: Heartbleed, clients and Android (Yves-Alexis Perez <corsac@...ian.org>)
Re: Heartbleed, clients and Android (Hanno Böck <hanno@...eck.de>)
Re: Heartbleed, clients and Android (Yves-Alexis Perez <corsac@...ian.org>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google (Arrigo Triulzi <arrigo@...hemistowl.org>)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (mancha <mancha1@...o.com>)
CVE request for vulnerability in OpenStack Keystone (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
pam_cifscreds stack overflow (Sebastian Krahmer <krahmer@...e.de>)
Request for linux-distros list membership (Anthony Liguori <anthony@...emonkey.ws>)
[OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: Heartbleed, clients and Android (Nick Kralevich <nnk@...gle.com>)
Re: Heartbleed, clients and Android (Hanno Böck <hanno@...eck.de>)
Re: Heartbleed, clients and Android (Eric Lacombe <goretux@...il.com>)
Cauterizing OpenSSL's heartbleed (the aftermath) ("mancha" <mancha1@...h.com>)
Re: Cauterizing OpenSSL's heartbleed (the aftermath) (Seth Arnold <seth.arnold@...onical.com>)

April 10 (21 messages)

Re: Request for linux-distros list membership (Kurt Seifried <kseifried@...hat.com>)
Re: Request for linux-distros list membership (Anthony Liguori <anthony@...emonkey.ws>)
Re: Request for linux-distros list membership (Anthony Liguori <aliguori@...zon.com>)
Re: Cauterizing OpenSSL's heartbleed (the aftermath) (Yves-Alexis Perez <corsac@...ian.org>)
Re: Request for linux-distros list membership (Kurt Seifried <kseifried@...hat.com>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros list membership (Matt Wilson <msw@...zon.com>)
Re: Should openssl accept weak DSA/DH keys with g = +/- 1 ? (Georgi Guninski <guninski@...inski.com>)
Re: CVE request Linux kernel: IB/core: crash while resolving passive side RoCE L2 address in cma_req_handler (cve-assign@...re.org)
CVE-2013-7353 CVE-2013-7354 libpng integer overflows (cve-assign@...re.org)
Re: CVE request: redmine open redirector (cve-assign@...re.org)
Re: Request for linux-distros list membership (Anthony Liguori <aliguori@...zon.com>)
[OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: Request for linux-distros list membership (Max Spevack <spevack@...zon.com>)
Re: CVE request for vulnerability in OpenStack Keystone (cve-assign@...re.org)
Re: pam_cifscreds stack overflow (cve-assign@...re.org)
Re: Re: pam_cifscreds stack overflow (Kurt Seifried <kseifried@...hat.com>)
Re: Request for linux-distros list membership (Seth Arnold <seth.arnold@...onical.com>)
Re: Session IP check bypass in Roundcube 1.0 (cve-assign@...re.org)
[OSSA 2014-013] Keystone DoS through V3 API authentication chaining (CVE-2014-2828) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: Request for linux-distros list membership (Tyler Hicks <tyhicks@...onical.com>)

April 11 (6 messages)

REJECT of CVE-2014-2750 (an extra CVE ID for Prosody) (cve-assign@...re.org)
Re: pam_cifscreds stack overflow (cve-assign@...re.org)
CVE request -- Linux kernel: net: ping: refcount issue in ping_init_sock() function (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- Linux kernel: net: ping: refcount issue in ping_init_sock() function (cve-assign@...re.org)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google ("Vincent Danen" <vdanen@...hat.com>)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google (Carlos Alberto Lopez Perez <clopez@...lia.com>)

April 12 (1 message)

Re: Cauterizing OpenSSL's heartbleed (the aftermath) (mancha <mancha1@...o.com>)

April 13 (4 messages)

Use-after-free race condition,in OpenSSL's read buffer (Scotty Bauer <sbauer@....utah.edu>)
Re: Use-after-free race condition,in OpenSSL's read buffer (Solar Designer <solar@...nwall.com>)
Re: Use-after-free race condition,in OpenSSL's read buffer (mancha <mancha1@...o.com>)
Re: Other instances of CVE-2014-0160 - mod_spdy from Google (mancha <mancha1@...o.com>)

April 14 (7 messages)

two more interesting notes on heartbleed (Kurt Seifried <kseifried@...hat.com>)
CVE request: cross-site scripting issue fixed in CUPS 1.7.2 (Murray McAllister <mmcallis@...hat.com>)
Re: pam_cifscreds stack overflow (Sebastian Krahmer <krahmer@...e.de>)
Remote code execution in Pimcore CMS (Pedro Ribeiro <pedrib@...il.com>)
CVE Request: rsync denial of service (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Use-after-free race condition,in OpenSSL's read buffer (cve-assign@...re.org)
TrueCrypt audit report (Kurt Seifried <kseifried@...hat.com>)

April 15 (5 messages)

Re: CVE Request: rsync denial of service (cve-assign@...re.org)
CVE request - node-connect: methodOverride middleware reflected cross-site scripting (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: cross-site scripting issue fixed in CUPS 1.7.2 (cve-assign@...re.org)
CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART (P J P <ppandit@...hat.com>)
CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target (P J P <ppandit@...hat.com>)

April 16 (4 messages)

Remote Command Injection in Ruby Gem sfpagent 0.4.14 ("Larry W. Cashdollar" <larry0@...com>)
CVE request: insecure temporary file handling in clang's scan-build utility (Murray McAllister <mmcallis@...hat.com>)
libmms heap-based buffer overflow fix (Źmicier Januszkiewicz <gauri@....by>)
CVE request: openssl: missing critical flag for extended key usage not always detected in time-stamp verification (Raphael Geissert <geissert@...ian.org>)

April 17 (7 messages)

CVE Request - XXS in phpMyID (openid_error) (Adam Caudill <adam@...mcaudill.com>)
Re: CVE request: openssl: missing critical flag for extended key usage not always detected in time-stamp verification (Florian Weimer <fweimer@...hat.com>)
CVE Request: systemd stack-based buffer overflow in systemd-ask-password (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: systemd stack-based buffer overflow in systemd-ask-password (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE ids for CyaSSL 2.9.4? (Raphael Geissert <geissert@...ian.org>)
Re: CVE ids for CyaSSL 2.9.4? (Todd A Ouska <todd@...fssl.com>)
Re: TrueCrypt audit report (cve-assign@...re.org)

April 18 (14 messages)

CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (Eduardo Tongson <propolice@...il.com>)
Re: CVE ids for CyaSSL 2.9.4? (cve-assign@...re.org)
Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (gremlin@...mlin.ru)
Re: Remote Command Injection in Ruby Gem sfpagent 0.4.14 (cve-assign@...re.org)
Re: CVE request Qemu: out of bounds buffer access, guest triggerable via IDE SMART (cve-assign@...re.org)
Re: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target (cve-assign@...re.org)
Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (John Haxby <john.haxby@...cle.com>)
Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (Reed Loden <reed@...dloden.com>)
Re: Request for linux-distros list membership (Anthony Liguori <aliguori@...zon.com>)
Re: Request for linux-distros list membership (rf@...eap.de)
CVE Request for Drupal Core (Forest Monsen <forest.monsen@...il.com>)
Re: Request for linux-distros list membership (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - XXS in phpMyID (openid_error) (cve-assign@...re.org)
Re: libmms heap-based buffer overflow fix (cve-assign@...re.org)

April 19 (5 messages)

CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) (Matthew Daley <mattd@...fuzz.com>)
Re: CVE request: insecure temporary file handling in clang's scan-build utility (cve-assign@...re.org)
Re: Request for linux-distros list membership (rf@...eap.de)
CVE request: Fwd: Remote code execution in Pimcore CMS (Pedro Ribeiro <pedrib@...il.com>)
Re: Remote code execution in Pimcore CMS (cve-assign@...re.org)

April 20 (2 messages)

Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility (Sylvestre Ledru <sylvestre@...ian.org>)
Re: Remote code execution in Pimcore CMS (Pedro Ribeiro <pedrib@...il.com>)

April 21 (2 messages)

Re: Remote code execution in Pimcore CMS (cve-assign@...re.org)
Re: CVE request - node-connect: methodOverride middleware reflected cross-site scripting (cve-assign@...re.org)

April 22 (11 messages)

Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) (cve-assign@...re.org)
Re: CVE Request for Drupal Core (cve-assign@...re.org)
Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (cve-assign@...re.org)
Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (Martin Carpenter <mcarpenter@...e.fr>)
Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution (Eduardo Tongson <propolice@...il.com>)
Re: Re: CVE Request New-djbdns: dnscache: potential cache poisoning (P J P <ppandit@...hat.com>)
Re: X.509 name constraints and potential interpretation conflict (Florian Weimer <fweimer@...hat.com>)
[OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Xen Security Advisory 93 - Hardware features unintentionally exposed to guests on ARM (Xen.org security team <security@....org>)
Re: Xen Security Advisory 93 - Hardware features unintentionally exposed to guests on ARM (cve-assign@...re.org)
CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks (Andy Lutomirski <luto@...capital.net>)

April 23 (8 messages)

Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks (Andy Lutomirski <luto@...capital.net>)
Xen Security Advisory 93 (CVE-2014-2915) - Hardware features unintentionally exposed to guests on ARM (Xen.org security team <security@....org>)
Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access (Xen.org security team <security@....org>)
Re: Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access (cve-assign@...re.org)
Xen Security Advisory 94 (CVE-2014-2986) - ARM hypervisor crash on guest interrupt controller access (Xen.org security team <security@....org>)
Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks (cve-assign@...re.org)
Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks (Andy Lutomirski <luto@...capital.net>)
Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks (ebiederm@...ssion.com (Eric W. Biederman))

April 25 (7 messages)

Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros list membership (rf@...eap.de)
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 (Jussi Eronen <juhani.eronen@...ora.fi>)
Re: Request for linux-distros list membership (Anthony Liguori <aliguori@...zon.com>)
Re: Request for linux-distros list membership (Solar Designer <solar@...nwall.com>)
Re: Re: cups-browsed remote exploit (Jamie Strandboge <jamie@...onical.com>)

April 26 (2 messages)

Ubuntu 14.04: security problem in the lock screen (Kurt Seifried <kseifried@...hat.com>)
Re: Ubuntu 14.04: security problem in the lock screen (Dave Walker <davewalker@...ntu.com>)

April 27 (1 message)

XSS in NextCellent Gallery 1.9.13 WordPress plugin ("Larry W. Cashdollar" <larry0@...com>)

April 28 (7 messages)

CVE-2014-0190: NULL pointer dereference in GIF image handler in QtGui (Murray McAllister <mmcallis@...hat.com>)
CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords) (Murray McAllister <mmcallis@...hat.com>)
CVE-2014-0469: xbuffy stack-based buffer overflow in subject processing (Yves-Alexis Perez <corsac@...ian.org>)
Upcoming security release of fish 2.1.1 (David Adam <zanchey@....gu.uwa.edu.au>)
Re: Upcoming security release of fish 2.1.1 (David Adam <zanchey@....gu.uwa.edu.au>)
super unchecked setuid (CVE-2014-0470) (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks (Andy Lutomirski <luto@...capital.net>)

April 29 (11 messages)

Xen Security Advisory 92 - HVMOP_set_mem_type allows invalid P2M entries to be created (Xen.org security team <security@....org>)
Re: Ubuntu 14.04: security problem in the lock screen (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE Request: indicator-datetime issue (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE request: directory traversal in DSA-2915-1-patched dpkg in Debian squeeze (Raphael Geissert <geissert@...ian.org>)
Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185) (Christian Hoffmann <christian@...fie.info>)
CVE Request - XSS in FOG open imaging system (Dolev Farhi <D.Farhi@...com>)
local privilege escalation due to capng_lock as used in seunshare (Andy Lutomirski <luto@...capital.net>)
Re: local privilege escalation due to capng_lock as used in seunshare (Steve Grubb <sgrubb@...hat.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Solar Designer <solar@...nwall.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Steve Grubb <sgrubb@...hat.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Solar Designer <solar@...nwall.com>)

April 30 (12 messages)

Re: CVE Request: indicator-datetime issue (cve-assign@...re.org)
Re: CVE Request - XSS in FOG open imaging system (cve-assign@...re.org)
CVE request: possible miniupnpc buffer overflow (Murray McAllister <mmcallis@...hat.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (John Haxby <john.haxby@...cle.com>)
Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM (Xen.org security team <security@....org>)
CVE request: rxvt-unicode user-assisted arbitrary commands execution (Conor McCarthy <mr.spuratic@...il.com>)
CVE request Linux kernel: mm: try_to_unmap_cluster() should lock_page() before mlocking (P J P <ppandit@...hat.com>)
Re: XSS in NextCellent Gallery 1.9.13 WordPress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Steve Grubb <sgrubb@...hat.com>)
Re: Xen Security Advisory 92 - HVMOP_set_mem_type allows invalid P2M entries to be created (cve-assign@...re.org)
Re: Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM (cve-assign@...re.org)
Re: local privilege escalation due to capng_lock as used in seunshare (Andy Lutomirski <luto@...capital.net>)

211 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.