oss-security mailing list - 2014/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2014/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 16	² 8	³ 2	⁴ 1
⁵ 11	⁶ 14	⁷ 9	⁸ 5	⁹ 8	¹⁰	¹¹
¹² 12	¹³ 7	¹⁴ 10	¹⁵ 10	¹⁶ 2	¹⁷	¹⁸ 3
¹⁹ 9	²⁰ 10	²¹ 3	²² 2	²³ 3	²⁴	²⁵ 4
²⁶ 1	²⁷ 3	²⁸ 9	²⁹ 16	³⁰ 5	³¹

Messages by day:

May 1 (16 messages)

Re: CVE request: possible miniupnpc buffer overflow (Murray McAllister <mmcallis@...hat.com>)
Re: Re: local privilege escalation due to capng_lock as used in seunshare (Steve Grubb <sgrubb@...hat.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Solar Designer <solar@...nwall.com>)
*REJECT* CVE-2013-4121 (Kurt Seifried <kseifried@...hat.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Solar Designer <solar@...nwall.com>)
Re: local privilege escalation due to capng_lock as used in seunshare (Solar Designer <solar@...nwall.com>)
Re: CVE request Linux kernel: mm: try_to_unmap_cluster() should lock_page() before mlocking (cve-assign@...re.org)
Re: CVE request: rxvt-unicode user-assisted arbitrary commands execution (cve-assign@...re.org)
Re: local privilege escalation due to capng_lock as used in seunshare (Andy Lutomirski <luto@...capital.net>)
CVE request: Python Bottle JSON content-type not restrictive enough (Murray McAllister <mmcallis@...hat.com>)
CVE-2014-3114 WordPress plugin ezpz-one-click-backup cmd parameter os command injection (Henri Salo <henri@...v.fi>)
Xen Security Advisory 91 (CVE-2014-3125) - Hardware timer context is not properly context switched on ARM (Xen.org security team <security@....org>)
Xen Security Advisory 92 (CVE-2014-3124) - HVMOP_set_mem_type allows invalid P2M entries to be created (Xen.org security team <security@....org>)
Re: local privilege escalation due to capng_lock as used in seunshare (Daniel J Walsh <dwalsh@...hat.com>)
Re: CVE request: Python Bottle JSON content-type not restrictive enough (cve-assign@...re.org)
CVE request: SKS non-persistent XSS (Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>)

May 2 (8 messages)

Re: CVE request: directory traversal in DSA-2915-1-patched dpkg in Debian squeeze (cve-assign@...re.org)
akpop3d review (Solar Designer <solar@...nwall.com>)
Erlang OTP's httpc module Denial of Service (Seba <argos83@...il.com>)
Re: akpop3d review (Jim Hull <imaginos@...nethull.com>)
CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write (Theo de Raadt <deraadt@....openbsd.org>)
Debian Bug#746579: libwww-perl: HTTPS_CA_DIR or HTTPS_CA_FILE disables peer certificate verification for IO::Socket::SSL (Kurt Seifried <kseifried@...hat.com>)

May 3 (2 messages)

Re: Ubuntu 14.04: security problem in the lock screen (cve-assign@...re.org)
ldns-keygen creates private key world readable (Kurt Seifried <kseifried@...hat.com>)

May 4 (1 message)

Re: Debian Bug#746579: libwww-perl: HTTPS_CA_DIR or HTTPS_CA_FILE disables peer certificate verification for IO::Socket… (Salvatore Bonaccorso <carnil@...ian.org…)

May 5 (11 messages)

Re: XSS in NextCellent Gallery 1.9.13 WordPress plugin (cve-assign@...re.org)
Re: CVE request: SKS non-persistent XSS (cve-assign@...re.org)
Re: akpop3d review (cve-assign@...re.org)
Re: ldns-keygen creates private key world readable (cve-assign@...re.org)
Re: Erlang OTP's httpc module Denial of Service (cve-assign@...re.org)
CVE-2014-0196: Linux kernel pty layer race condition memory corruption (Marcus Meissner <meissner@...e.de>)
Re: XSS in NextCellent Gallery 1.9.13 WordPress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE Request: libxml2 external parsed entities issue (Tomas Hoger <thoger@...hat.com>)
*Possible* ssh vulnerability (RbN <r.b.n@...eup.net>)
Re: *Possible* ssh vulnerability (Andrey Korolyov <andrey@...l.ru>)
Re: *Possible* ssh vulnerability (Mark Lee <mark@...kelee.com>)

May 6 (14 messages)

CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities (feer james <pnigos70@...il.com>)
Re: CVE-2014-0196: Linux kernel pty layer race condition memory corruption (Shawn <citypw@...il.com>)
Re: Upcoming security release of fish 2.1.1 (cve-assign@...re.org)
CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Stefan Cornelius <scorneli@...hat.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Tomas Hoger <thoger@...hat.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: Debian Bug#746579: libwww-perl: HTTPS_CA_DIR or HTTPS_CA_FILE disables peer certificate verification for IO::Socket::SSL (cve-assign@...re.org)
Re: CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities (cve-assign@...re.org)
Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write (cve-assign@...re.org)
Postfix bounces arbitrary content ("Vincent Danen" <vdanen@...hat.com>)
[CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations (Rafael Mendonça França <rafaelmfranca@...il.com>)
Unsafe Query Risk in Active Record (Rafael Mendonça França <rafaelmfranca@...il.com>)
[AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations (Rafael Mendonça França <rafaelmfranca@...il.com…)

May 7 (9 messages)

Re: Postfix bounces arbitrary content (cve-assign@...re.org)
CVE Request - Predictable temporary filenames in GNU Emacs (Steve Kemp <steve@...ve.org.uk>)
Re: Postfix bounces arbitrary content ("Vincent Danen" <vdanen@...hat.com>)
Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations (Jacob Kaplan-Moss <jacob@...oku.com>)
A note on DBus and the Hash DOS (Kurt Seifried <kseifried@...hat.com>)
Re: A note on DBus and the Hash DOS (Hanno Böck <hanno@...eck.de>)
Re: CVE Request - Predictable temporary filenames in GNU Emacs (cve-assign@...re.org)
Re: A note on DBus and the Hash DOS (Kurt Seifried <kseifried@...hat.com>)
Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations (Kurt Seifried <kseifried@...hat.com>)

May 8 (5 messages)

Re: local privilege escalation due to capng_lock as used in seunshare (cve-assign@...re.org)
CVE Request - Local File inclusion in Cobbler (Dolev Farhi <D.Farhi@...com>)
Re: CVE Request - Local File inclusion in Cobbler (cve-assign@...re.org)
Re: Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled ("Timoth D. Morgan" <tim-security@...tinelchicken.org>)

May 9 (8 messages)

Defeating memory comparison timing oracles (Solar Designer <solar@...nwall.com>)
Linux kernel floppy ioctl kernel code execution (Marcus Meissner <meissner@...e.de>)
CVE request: python-lxml clean_html() input sanitization flaw (Martin Prpic <mprpic@...hat.com>)
CVE request: Denial of Service attacks against Dovecot v1.1+ (Henri Salo <henri@...v.fi>)
CVE request Linux kernel: filter: prevent nla extensions to peek beyond the end of the message (P J P <ppandit@...hat.com>)
Re: CVE request Linux kernel: filter: prevent nla extensions to peek beyond the end of the message (cve-assign@...re.org)
Re: CVE request: python-lxml clean_html() input sanitization flaw (cve-assign@...re.org)
Re: CVE request: Denial of Service attacks against Dovecot v1.1+ (cve-assign@...re.org)

May 12 (12 messages)

CVE request: Drupal Flag 7.x-3.5 Module Vulnerability report: Arbitrary code execution due to improper input handling i… (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: Drupal Flag 7.x-3.5 Module Vulnerability report: Arbitrary code execution due to improper input handling in flag importer (cve-assign@...re.org)
Re: CVE-2014-0196: Linux kernel pty layer race condition memory corruption (Matthew Daley <mattd@...fuzz.com>)
Re: CVE-2014-0196: Linux kernel pty layer race condition memory corruption (Matthew Daley <mattd@...fuzz.com>)
Re: [FD] CVE-2014-0196: Linux kernel pty layer race condition memory corruption (Savio Bot <54v330@...il.com>)
Re: [FD] CVE-2014-0196: Linux kernel pty layer race condition memory corruption (Solar Designer <solar@...nwall.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Tomas Hoger <thoger@...hat.com>)
CVE Request: seunshare and setexeccon issues (Andy Lutomirski <luto@...capital.net>)
Re: CVE Request: seunshare and setexeccon issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request: seunshare and setexeccon issues (Andy Lutomirski <luto@...capital.net>)
Re: CVE Request: seunshare and setexeccon issues (Solar Designer <solar@...nwall.com>)
Re: CVE Request: seunshare and setexeccon issues (Andy Lutomirski <luto@...capital.net>)

May 13 (7 messages)

CVE request: various NodeJS module vulnerabilities (Paul Wise <pabs3@...edaddy.net>)
Re: Unsafe Query Risk in Active Record (Jordi Massaguer <jordimassaguerpla@...il.com>)
CVE request: Qemu: usb: fix up post load checks (P J P <ppandit@...hat.com>)
CVE-2014-0222 Qemu: qcow1: Validate L2 table size (P J P <ppandit@...hat.com>)
CVE-2014-0223 Qemu: qcow1: Validate image size (P J P <ppandit@...hat.com>)
Fwd: [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE request: Qemu: usb: fix up post load checks (cve-assign@...re.org)

May 14 (10 messages)

A number of EncFS issues (Murray McAllister <mmcallis@...hat.com>)
Re: A number of EncFS issues (cve-assign@...re.org)
CVE request: Pyplate multiple vulnerabilities (Henri Salo <henri@...v.fi>)
Xen Security Advisory 95 - input handling vulnerabilities loading guest kernel on ARM (Xen.org security team <security@....org>)
Zenoss Open Source monitoring System - Open Redirect & Stored XSS Vulnerabilities (Dolev Farhi <dolevf87@...il.com>)
CVE request Linux kernel: forbid uaddr == uaddr2 in futex_wait_requeue_pi() to avoid null dereference (P J P <ppandit@...hat.com>)
Re: CVE request Linux kernel: forbid uaddr == uaddr2 in futex_wait_requeue_pi() to avoid null dereference (Greg KH <greg@...ah.com>)
Re: CVE request Linux kernel: forbid uaddr == uaddr2 in futex_wait_requeue_pi() to avoid null dereference (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request Linux kernel: forbid uaddr == uaddr2 in futex_wait_requeue_pi() to avoid null dereference (cve-assign@...re.org)
CVE Reuest: Django: Malformed URLs from user input incorrectly validated (Salvatore Bonaccorso <carnil@...ian.org>)

May 15 (10 messages)

Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006 (Mikkel Krautz <mikkel@...utz.dk>)
Re: CVE request: various NodeJS module vulnerabilities (cve-assign@...re.org)
Re: CVE Reuest: Django: Malformed URLs from user input incorrectly validated (cve-assign@...re.org)
Re: Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006 (cve-assign@...re.org)
Re: Zenoss Open Source monitoring System - Open Redirect & Stored XSS Vulnerabilities (cve-assign@...re.org)
Re: Xen Security Advisory 95 - input handling vulnerabilities loading guest kernel on ARM (cve-assign@...re.org)
OpenFiler - Arbitrary Code Execution & Stored XSS (Dolev Farhi <dolevf87@...il.com>)
libgadu vulnerability: possible memory corruption (Marcin Owsiany <porridge@...ian.org>)
[CVE-2014-2977] DirectFB integer signedness vulnerability (Frédéric Basse <basse.frederic@...il.com>)
[CVE-2014-2978] DirectFB remote out-of-bounds write vulnerability (Frédéric Basse <basse.frederic@...il.com>)

May 16 (2 messages)

Xen Security Advisory 95 (CVE-2014-3714,CVE-2014-3715,CVE-2014-3716,CVE-2014-3717) - input handling vulnerabilities loa… (Xen.org security team <security@....org…)
Small security issue in hub, a github client ( CVE-2014-0177 ) (Michael Scherer <misc@...b.org>)

May 18 (3 messages)

CVE request: X2Go Server privilege escalation (Chris Reffett <creffett@...too.org>)
CVE requests / advisory: TeamPass <= 2.1.19 (Matthew Daley <mattd@...fuzz.com>)
CVE request for buffer overrun in CHICKEN Scheme (Peter Bex <Peter.Bex@...all.nl>)

May 19 (9 messages)

Moodle security notifications public (Michael de Raadt <michaeld@...dle.com>)
Re: OpenFiler - Arbitrary Code Execution & Stored XSS (cve-assign@...re.org)
Re: libgadu vulnerability: possible memory corruption (cve-assign@...re.org)
Re: CVE request: X2Go Server privilege escalation (cve-assign@...re.org)
Re: CVE requests / advisory: TeamPass <= 2.1.19 (cve-assign@...re.org)
Re: CVE request for buffer overrun in CHICKEN Scheme (cve-assign@...re.org)
Re: OpenFiler - Arbitrary Code Execution & Stored XSS (Dolev Farhi <dolevf87@...il.com>)
CVE request, multiple vulnerabilities in openwsman (Kent Baxley <kent.baxley@...onical.com>)
Re: Re: CVE request: X2Go Server privilege escalation (Chris Reffett <creffett@...too.org>)

May 20 (10 messages)

CVE request for vulnerability in OpenStack Heat (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Incorrect SQL identifier quotation rampant among popular web frameworks (Peter Bex <Peter.Bex@...all.nl>)
CVE Request one more openwsman issue (Kent Baxley <kent.baxley@...onical.com>)
CVE request: xbmc (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: xbmc (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Heat (cve-assign@...re.org)
CVE request: dovecot denial of service (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE request: dovecot denial of service (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE request: dovecot denial of service (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE request: dovecot denial of service (Yves-Alexis Perez <corsac@...ian.org>)

May 21 (3 messages)

Security release for mod_wsgi (version 3.5) (Kurt Seifried <kseifried@...hat.com>)
Persistent XSS in Mayan EDMS - document management system (Dolev Farhi <dolev@...nflare.org>)
[OSSA 2014-015] Keystone user and group id mismatch (CVE-2014-0204) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)

May 22 (2 messages)

Re: CVE request, multiple vulnerabilities in openwsman (cve-assign@...re.org)
Re: Persistent XSS in Mayan EDMS - document management system (cve-assign@...re.org)

May 23 (3 messages)

Re: CVE request: Pyplate multiple vulnerabilities (cve-assign@...re.org)
Re: Upcoming security release of fish 2.1.1 (cve-assign@...re.org)
[OSSA 2014-016] Heat template URL information leakage (CVE-2014-3801) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)

May 25 (4 messages)

Re: Re: CVE request: directory traversal in DSA-2915-1-patched dpkg in Debian squeeze (Raphael Geissert <geissert@...ian.org>)
CVE request: another path traversal in dpkg-source during unpack (Raphael Geissert <geissert@...ian.org>)
CVE Request: userCake <= 2.0.2 CSRF vulnerability (Dolev Farhi <dolev@...nflare.org>)
Re: Re: CVE request: directory traversal in DSA-2915-1-patched dpkg in Debian squeeze (Guillem Jover <guillem@...ian.org>)

May 26 (1 message)

Re: CVE Request: userCake <= 2.0.2 CSRF vulnerability (cve-assign@...re.org)

May 27 (3 messages)

CVE-2014-0246 sos: md5 hash of GRUB password collected when running sosreport (Murray McAllister <mmcallis@...hat.com>)
Fwd: [ruby-core:62800] [ruby-trunk - Bug #9709] Large string causes SEGV with x64-mingw32 (Ramon de C Valle <rdecvalle@...are.com>)
CVE-2014-0234 Installer: OpenShift Enterprise: openshift.sh default password creation (Kurt Seifried <kseifried@...hat.com>)

May 28 (9 messages)

LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability ("LSE Leading Security Experts GmbH (Security Advisorie…)
freerdp: integer overflows in memory allocations in client/X11/xf_graphics.c (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Fwd: [exim-announce] Exim 4.82.1 Security Release (Phil Pennock <oss-security-phil@...dhuis.org>)
Re: Fwd: [exim-announce] Exim 4.82.1 Security Release (Phil Pennock <oss-security-phil@...dhuis.org>)
CVE request: Linux kernel DoS with syscall auditing (Andy Lutomirski <luto@...capital.net>)
Re: CVE request: Linux kernel DoS with syscall auditing (Greg KH <greg@...ah.com>)
Re: CVE request: Linux kernel DoS with syscall auditing (Andy Lutomirski <luto@...capital.net>)
Re: CVE request: Linux kernel DoS with syscall auditing (Greg KH <greg@...ah.com>)
Re: CVE request: Linux kernel DoS with syscall auditing (Andy Lutomirski <luto@...capital.net>)

May 29 (16 messages)

Re: CVE request: Linux kernel DoS with syscall auditing (Steve Grubb <sgrubb@...hat.com>)
Re: CVE request: Linux kernel DoS with syscall auditing (Andy Lutomirski <luto@...capital.net>)
Re: Fwd: [ruby-core:62800] [ruby-trunk - Bug #9709] Large string causes SEGV with x64-mingw32 (cve-assign@...re.org)
Re: CVE-2014-0234 Installer: OpenShift Enterprise: openshift.sh default password creation (cve-assign@...re.org)
Re: CVE request: Linux kernel DoS with syscall auditing (cve-assign@...re.org)
CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: Linux kernel DoS with syscall auditing (P J P <ppandit@...hat.com>)
Re: Re: CVE request: Linux kernel DoS with syscall auditing (Steve Grubb <sgrubb@...hat.com>)
Re: CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords ("Vincent Danen" <vdanen@...hat.com>)
Please REJECT CVE-2014-3463 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords (Dolev Farhi <dolev@...nflare.org>)
CVE-2013-4159 ctdb: /tmp file vulnerability issues (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords (Kurt Seifried <kseifried@...hat.com>)
[OSSA 2014-017] Nova VMWare driver leaks rescued images (CVE-2014-2573) (Jeremy Stanley <jeremy@...nstack.org>)
Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations (Reed Loden <reed@...dloden.com>)
Re: CVE request: another path traversal in dpkg-source during unpack (cve-assign@...re.org)

May 30 (5 messages)

Linux Foundation OpenSSL audit (mancha <mancha1@...o.com>)
GnuTLS and libtasn1 security fixes (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords (cve-assign@...re.org)
Re: GnuTLS and libtasn1 security fixes (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords ("Vincent Danen" <vdanen@...hat.com>)

183 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.