oss-security mailing list - 2014/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2014/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 1
² 5	³ 22	⁴ 24	⁵ 26	⁶ 23	⁷ 6	⁸ 2
⁹ 5	¹⁰ 4	¹¹ 3	¹² 3	¹³ 10	¹⁴ 1	¹⁵ 10
¹⁶ 5	¹⁷ 18	¹⁸ 17	¹⁹ 13	²⁰ 10	²¹ 1	²² 5
²³ 11	²⁴ 19	²⁵ 8	²⁶ 31	²⁷ 19	²⁸ 7	²⁹ 1
³⁰ 7

Messages by day:

June 1 (1 message)

Re: GnuTLS and libtasn1 security fixes (Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>)

June 2 (5 messages)

Re: GnuTLS and libtasn1 security fixes (mancha <mancha1@...o.com>)
CVE ID request: typo3 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE ID request: typo3 (Henri Salo <henri@...v.fi>)
Re: Linux Foundation OpenSSL audit (mancha <mancha1@...o.com>)
CVE-2014-3940 - Linux kernel - missing check during hugepage migration (cve-assign@...re.org)

June 3 (22 messages)

sendmail close-on-exec issue -- CVE assigned? (Xin Li <delphij@...phij.net>)
Re: CVE ID request: typo3 (cve-assign@...re.org)
Re: CVE ID request: typo3 (cve-assign@...re.org)
Request for linux-distros subscription ("\"VMware Security Response Center\"" <security@...are.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (David Jorm <djorm@...hat.com>)
LSE Leading Security Experts GmbH - LSE-2014-05-22 - F*EX - Multiple Issues (advisories <advisories@...xperts.de>)
CVE request: mediawiki invalid usernames on Special:PasswordReset were parsed as wikitext ("Thijs Kinkhorst" <thijs@...ian.org>)
Re: GnuTLS and libtasn1 security fixes (Tomas Hoger <thoger@...hat.com>)
Xen Security Advisory 96 - Vulnerabilities in HVM MSI injection (Xen.org security team <security@....org>)
Xen Security Advisory 54 (CVE-2013-2078) - Hypervisor crash due to missing exception recovery on XSETBV (Xen.org security team <security@....org>)
CVE-2013-6876 s3dvt Root shell (Hector Marco <hecmargi@....es>)
CVE-2013-6825 DCMTK Root Privilege escalation (Hector Marco <hecmargi@....es>)
CVE-2014-1226 s3dvt Root shell (still) (Hector Marco <hecmargi@....es>)
Bug in bash <= 4.3 [security feature bypassed] (Hector Marco <hecmargi@....es>)
Re: Bug in bash <= 4.3 [security feature bypassed] (Steve Grubb <sgrubb@...hat.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Tim <tim-security@...tinelchicken.org>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Tim <tim-security@...tinelchicken.org>)
Re: Request for linux-distros subscription (Kurt Seifried <kseifried@...hat.com>)
Operating system distribution security contact lists (Lisa Bradley <lbradley@...ibm.com>)
Re: CVE-2014-0234 Installer: OpenShift Enterprise: openshift.sh default password creation (cve-assign@...re.org)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)

June 4 (24 messages)

FreeBSD Security Advisory FreeBSD-SA-14:13.pam (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: FreeBSD Security Advisory FreeBSD-SA-14:13.pam (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros subscription (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros subscription (Greg KH <greg@...ah.com>)
Re: sendmail close-on-exec issue -- CVE assigned? (cve-assign@...re.org)
Re: Operating system distribution security contact lists (Solar Designer <solar@...nwall.com>)
Re: Request for linux-distros subscription (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE request: PulseAudio crash due to empty UDP packet ("Alexander E. Patrakov" <patrakov@...il.com>)
CVE-2014-0476 chkrootkit vulnerability (Giuseppe Iuculano <iuculano@...ian.org>)
Re: Bug in bash <= 4.3 [security feature bypassed] (Jose Carlos Luna Duran <jose.carlos.luna@...il.com>)
Re: Operating system distribution security contact lists (Lisa Bradley <lbradley@...ibm.com>)
Xen Security Advisory 98 - insufficient permissions checks accessing guest memory on ARM (Xen.org security team <security@....org>)
Re: Xen Security Advisory 96 - Vulnerabilities in HVM MSI injection (cve-assign@...re.org)
Re: Xen Security Advisory 98 - insufficient permissions checks accessing guest memory on ARM (cve-assign@...re.org)
Re: CVE request: mediawiki invalid usernames on Special:PasswordReset were parsed as wikitext (cve-assign@...re.org)
Re: CVE request: PulseAudio crash due to empty UDP packet (cve-assign@...re.org)
Re: CVE request: PulseAudio crash due to empty UDP packet ("Alexander E. Patrakov" <patrakov@...il.com>)
Xen Security Advisory 96 (CVE-2014-3967,CVE-2014-3968) - Vulnerabilities in HVM MSI injection (Xen.org security team <security@....org>)
Xen Security Advisory 98 (CVE-2014-3969) - insufficient permissions checks accessing guest memory on ARM (Xen.org security team <security@....org>)
Re: Xen Security Advisory 98 - insufficient permissions checks accessing guest memory on ARM (Ian Jackson <Ian.Jackson@...citrix.com>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
CVE Request: Horde_Ldap: Stricter parameter check in bind() to detect empty passwords (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: Request for linux-distros subscription (Raphael Geissert <geissert@...ian.org>)
Re: [FD] Bug in bash <= 4.3 [security feature bypassed] (Hector Marco <hecmargi@....es>)

June 5 (26 messages)

Re: Request for linux-distros subscription (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE-2014-0234 Installer: OpenShift Enterprise: openshift.sh default password creation (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE-2014-0234 Installer: OpenShift Enterprise: openshift.sh default password creation (Kurt Seifried <kseifried@...hat.com>)
Re: Request for linux-distros subscription (Greg KH <greg@...ah.com>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
Re: Request for linux-distros subscription (Greg KH <greg@...ah.com>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
Re: Request for linux-distros subscription (Greg KH <greg@...ah.com>)
Re: Request for linux-distros subscription (Russ Allbery <eagle@...ie.org>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
Re: CVE Request: Horde_Ldap: Stricter parameter check in bind() to detect empty passwords (Murray McAllister <mmcallis@...hat.com>)
Re: Request for linux-distros subscription (Ramon de C Valle <rdecvalle@...are.com>)
CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure (Murray McAllister <mmcallis@...hat.com>)
Re: [FD] Bug in bash <= 4.3 [security feature bypassed] (lists@...atla.org.uk)
[CVE request] Local privilege escalation in libfep (Florian Weimer <fweimer@...hat.com>)
OpenSSL seven security fixes (Solar Designer <solar@...nwall.com>)
Re: OpenSSL seven security fixes (Solar Designer <solar@...nwall.com>)
Re: CVE-2014-0234 Installer: OpenShift Enterprise: openshift.sh default password creation (cve-assign@...re.org)
FreeBSD Security Advisory FreeBSD-SA-14:14.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: OpenSSL seven security fixes (Solar Designer <solar@...nwall.com>)
Linux kernel futex local privilege escalation (CVE-2014-3153) (Solar Designer <solar@...nwall.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Solar Designer <solar@...nwall.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Kees Cook <kees@...ntu.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Greg KH <greg@...ah.com>)
Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write (Leon Weber <leon@...nweber.de>)

June 6 (23 messages)

Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Phil Turnbull <phil.turnbull@...cle.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (John Johansen <john.johansen@...onical.com>)
Re: [FD] Bug in bash <= 4.3 [security feature bypassed] (Jeffrey Walton <noloader@...il.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Rich Felker <dalias@...c.org>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Solar Designer <solar@...nwall.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Rich Felker <dalias@...c.org>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Thomas Gleixner <tglx@...utronix.de>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (David Jorm <djorm@...hat.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (rf@...eap.de)
Request for CVE: Bytemark Symbiosis (Patrick J Cherry <patrick@...emark.co.uk>)
Re: [CVE request] Local privilege escalation in libfep (cve-assign@...re.org)
Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure (cve-assign@...re.org)
Re: Re: [FD] Bug in bash <= 4.3 [security feature bypassed] (Simon McVittie <smcv@...ian.org>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Greg KH <greg@...ah.com>)
CVE-2014-0085 / Zookeeper (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (rf@...eap.de)
Re: CVE request: possible miniupnpc buffer overflow (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Greg KH <greg@...ah.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (rf@...eap.de)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Rich Felker <dalias@...c.org>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Greg KH <greg@...ah.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Rich Felker <dalias@...c.org>)
Requesting CVEs issued for two XSS vulnerabilities in Djblets (a set of Django helpers) (Stephen Gallagher <sgallagh@...hat.com>)

June 7 (6 messages)

Security advisory for musl libc - remote stack-based buffer overflow in DNS response parsing [CVE-2014-3484] (Rich Felker <dalias@...c.org>)
Re: CVE request: possible miniupnpc buffer overflow (cve-assign@...re.org)
Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure (cve-assign@...re.org)
Re: Requesting CVEs issued for two XSS vulnerabilities in Djblets (a set of Django helpers) (cve-assign@...re.org)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (mancha <mancha1@...o.com>)
Re: Linux kernel futex local privilege escalation (CVE-2014-3153) (Thomas Gleixner <tglx@...utronix.de>)

June 8 (2 messages)

transparency on message moderation (Solar Designer <solar@...nwall.com>)
Re: transparency on message moderation (Josh Bressers <bressers@...hat.com>)

June 9 (5 messages)

Re: transparency on message moderation (rea <rea@....org>)
Re: CVE Request: Horde_Ldap: Stricter parameter check in bind() to detect empty passwords (Matthew Daley <mattd@...fuzz.com>)
OpenJDK CVE duplicates (Tomas Hoger <thoger@...hat.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Tomas Hoger <thoger@...hat.com>)
Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled (Tim <tim-security@...tinelchicken.org>)

June 10 (4 messages)

Re: CVE-2014-0085 / Zookeeper (David Jorm <djorm@...hat.com>)
CVE-2014-3477 (fd.o#78979): local DoS in dbus-daemon (Simon McVittie <simon.mcvittie@...labora.co.uk>)
CVE request: Linux kernel / target information leak (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2014-4014: Linux kernel user namespace bug (Andy Lutomirski <luto@...capital.net>)

June 11 (3 messages)

Re: CVE request: Linux kernel / target information leak (cve-assign@...re.org)
Re: Request for CVE: Bytemark Symbiosis (cve-assign@...re.org)
CVE for library bug that requires application participation (Alex Gaynor <alex.gaynor@...il.com>)

June 12 (3 messages)

CVE request: OpenAFS 1.6.8 TMAY fileserver crashes (Russ Allbery <eagle@...ie.org>)
CVE request: PHP heap-based buffer overflow in DNS TXT record parsing (Murray McAllister <mmcallis@...hat.com>)
[OSSA 2014-018] Keystone privilege escalation through trust chained delegation (CVE-2014-3476) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)

June 13 (10 messages)

CVE request: scheme48: insecure use of temporary files in cmuscheme48.el (Salvatore Bonaccorso <carnil@...ian.org>)
Re: glibc - CVE for library bug that requires application participation (cve-assign@...re.org)
Re: CVE request: OpenAFS 1.6.8 TMAY fileserver crashes (cve-assign@...re.org)
Re: CVE request: PHP heap-based buffer overflow in DNS TXT record parsing (cve-assign@...re.org)
Re: CVE request: scheme48: insecure use of temporary files in cmuscheme48.el (cve-assign@...re.org)
Re: [OpenAFS-GK] Re: CVE request: OpenAFS 1.6.8 TMAY fileserver crashes (Jeffrey Altman <jaltman@...ure-endpoints.com>)
CVE request: Proxmox VE < 3.2 user enumeration vulnerability (Damien Cauquil <d.cauquil@...dream.com>)
CVE request: PowerDNS in default configuration is vulnerable to DoS attack (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Re: CVE request: Proxmox VE < 3.2 user enumeration vulnerability (cve-assign@...re.org)
CVE request: multiple /tmp races in ppc64-diag ("Vincent Danen" <vdanen@...hat.com>)

June 14 (1 message)

Re: CVE Request: Horde_Ldap: Stricter parameter check in bind() to detect empty passwords (cve-assign@...re.org)

June 15 (10 messages)

CVE-2014-1739: Kernel Infoleak vulnerability in,media_enum_entities() (Salva Peiró <speiro@....upv.es>)
CVE Request for KIO/kmail (Richard Moore <rich@....org>)
Re: CVE Request for KIO/kmail (Henri Salo <henri@...v.fi>)
Re: CVE Request for KIO/kmail (cve-assign@...re.org)
Re: CVE Request for KIO/kmail (Richard Moore <rich@....org>)
Re: CVE Request for KIO/kmail (cve-assign@...re.org)
older ffmpeg overflows/out-of-bounds-accesses/etc. (Thomas Klausner <wiz@...BSD.org>)
Re: Re: CVE Request for KIO/kmail (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: CVE Request for KIO/kmail (Richard Moore <rich@....org>)
CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE (David Jorm <djorm@...hat.com>)

June 16 (5 messages)

Re: Bug#751417: linux-image-3.2.0-4-5kc-malta: no SIGKILL after prctl(PR_SET_SECCOMP, 1, ...) on MIPS (Yves-Alexis Perez <corsac@...ian.org>)
CVE request for vulnerability in OpenStack Neutron (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request: monitorix: HTTP server 'handle_request()' session fixation & XSS vulnerabilities (clearing up confusion) (cve-assign@...re.org)
Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility (Sylvestre Ledru <sylvestre@...ian.org>)
CVE Request: iodine: authentication bypass by client (Erik Ekman <yarrick@...o.se>)

June 17 (18 messages)

Re: CVE request: multiple /tmp races in ppc64-diag (cve-assign@...re.org)
Re: Security release for mod_wsgi (version 3.5) (Tomas Hoger <thoger@...hat.com>)
Re: transparency on message moderation (Solar Designer <solar@...nwall.com>)
Re: transparency on message moderation (Henri Salo <henri@...v.fi>)
Xen Security Advisory 99 - unexpected pitfall in xenaccess API (Xen.org security team <security@....org>)
Xen Security Advisory 100 (CVE-2014-4021) - Hypervisor heap contents leaked to guests (Xen.org security team <security@....org>)
Re: Security release for mod_wsgi (version 3.5) (Graham Dumpleton <graham.dumpleton@...il.com>)
Xen Security Advisory 99 - unexpected pitfall in xenaccess API (Andres Lagar Cavilla <andres@...arcavilla.org>)
Re: transparency on message moderation (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API (Ian Campbell <Ian.Campbell@...rix.com>)
Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API (Steven Haigh <netwiz@....id.au>)
Re: Security release for mod_wsgi (version 3.5) (Tomas Hoger <thoger@...hat.com>)
Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API (Andres Lagar Cavilla <andres@...arcavilla.org>)
Re: Security release for mod_wsgi (version 3.5) (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2014-4014: Linux kernel user namespace bug (Andy Lutomirski <luto@...capital.net>)
Re: CVE request: Proxmox VE < 3.2 user enumeration vulnerability (cve-assign@...re.org)
Re: (Linux kernel) Bug#751417: linux-image-3.2.0-4-5kc-malta: no SIGKILL after prctl(PR_SET_SECCOMP, 1, ...) on MIPS (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Neutron (cve-assign@...re.org)

June 18 (17 messages)

Re: CVE Request: iodine: authentication bypass by client (cve-assign@...re.org)
CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: CVE-2014-4014: Linux kernel user namespace bug (Sven Kieske <S.Kieske@...twald.de>)
docker VMM breakout (Sebastian Krahmer <krahmer@...e.de>)
Re: Security release for mod_wsgi (version 3.5) (Matthew Daley <mattd@...fuzz.com>)
Re: Security release for mod_wsgi (version 3.5) (Solar Designer <solar@...nwall.com>)
Re: docker VMM breakout (David Jorm <djorm@...hat.com>)
Re: Security release for mod_wsgi (version 3.5) (Graham Dumpleton <graham.dumpleton@...il.com>)
Re: Security release for mod_wsgi (version 3.5) (Graham Dumpleton <graham.dumpleton@...il.com>)
[OSSA 2014-019] Neutron L3-agent DoS through IPv6 subnet (CVE-2014-4167) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
CVE-2014-4171 - Linux kernel mm/shmem.c denial of service (cve-assign@...re.org)
Re: docker VMM breakout (Yves-Alexis Perez <corsac@...ian.org>)
Re: docker VMM breakout (Sven Kieske <S.Kieske@...twald.de>)
CVE Request: Parameter Injection in jCryption 3.0 (David Tomaschik <david@...temoverlord.com>)
Re: docker VMM breakout (Daniel J Walsh <dwalsh@...hat.com>)
KMail/KIO POP3 SSL MITM Flaw (Richard Moore <rich@....org>)
Re: CVE request: multiple /tmp races in ppc64-diag ("Vincent Danen" <vdanen@...hat.com>)

June 19 (13 messages)

TMP flaw in rackspace jclouds? (Kurt Seifried <kseifried@...hat.com>)
Re: TMP flaw in rackspace jclouds? (Alex Gaynor <alex.gaynor@...il.com>)
Re: CVE Request: Parameter Injection in jCryption 3.0 (cve-assign@...re.org)
Re: TMP flaw in rackspace jclouds? (Andrew Gaul <gaul@...che.org>)
Re: docker VMM breakout (gremlin@...mlin.ru)
Re: Re: TMP flaw in rackspace jclouds? (Kurt Seifried <kseifried@...hat.com>)
CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] (Murray McAllister <mmcallis@...hat.com>)
Re: TMP flaw in rackspace jclouds? (Ignasi Barrera <nacx@...che.org>)
Re: Re: cups-browsed remote exploit (Tomas Hoger <thoger@...hat.com>)
[OSSA 2014-020] XSS in Swift requests through WWW-Authenticate header (CVE-2014-3497) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: docker VMM breakout (Serge Hallyn <serge.hallyn@...ntu.com>)
Re: cups-browsed remote exploit (cve-assign@...re.org)
Re: TMP flaw in rackspace jclouds? (Andrew Gaul <gaul@...che.org>)

June 20 (10 messages)

CVE request: Another Linux syscall auditing bug (Andy Lutomirski <luto@...capital.net>)
Re: CVE request: Another Linux syscall auditing bug (Steve Grubb <sgrubb@...hat.com>)
possible CVE request: opendnssec and softhsm permission issue (Murray McAllister <mmcallis@...hat.com>)
CVE request: softhsm, softhsm-keyconv tool creates world-readable files (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: softhsm, softhsm-keyconv tool creates world-readable files (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: softhsm, softhsm-keyconv tool creates world-readable files (Murray McAllister <mmcallis@...hat.com>)
Re: TMP flaw in rackspace jclouds? (Ignasi Barrera <nacx@...che.org>)
Re: docker VMM breakout (Daniel J Walsh <dwalsh@...hat.com>)
Re: TMP flaw in rackspace jclouds? (Ignasi Barrera <nacx@...che.org>)
Re: CVE request: Another Linux syscall auditing bug (cve-assign@...re.org)

June 21 (1 message)

Re: XSS vulnerability in apt-cacher-ng (Yves-Alexis Perez <corsac@...ian.org>)

June 22 (5 messages)

Re: XSS vulnerability in apt-cacher-ng (cve-assign@...re.org)
Re: KMail/KIO POP3 SSL MITM Flaw (Nick Boyce <nick.boyce@...il.com>)
Re: KMail/KIO POP3 SSL MITM Flaw (Richard Moore <rich@....org>)
Re: KMail/KIO POP3 SSL MITM Flaw (David Faure <faure@....org>)
Re: KMail/KIO POP3 SSL MITM Flaw (Nick Boyce <nick.boyce@...il.com>)

June 23 (11 messages)

CVE request: XSS in coppermine gallery before 1.5.28 (Hanno Böck <hanno@...eck.de>)
CVE request: piwigo before 2.6.3 sql injection (Hanno Böck <hanno@...eck.de>)
CVE request: Piwigo before 2.6.2 ws.php Arbitrary User Creation CSRF (Henri Salo <henri@...v.fi>)
CVE-2014-3471 Qemu: hw: pci: use after free triggered via guest (P J P <ppandit@...hat.com>)
CVE ID Request for Python CGIHTTPServer File Disclosure (Till Maas <till.maas@...team-pentesting.de>)
CVE request: python: _json module is vulnerable to arbitrary process memory read (Vasyl Kaigorodov <vkaigoro@...hat.com>)
CVE request: WordPress plugin wp-gpx-maps wp-gpx-maps_admin_tracks.php Improper Admin Verification File Upload PHP Code Execution (Henri Salo <henri@...v.fi>)
CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE-2014-4014: Linux kernel user namespace bug (Andy Lutomirski <luto@...capital.net>)
Ansible CVE requests (Michael Scherer <misc@...b.org>)
Re: TMP flaw in rackspace jclouds? (Andrew Gaul <gaul@...che.org>)

June 24 (19 messages)

CVE request: GnuPG-1 (mancha <mancha1@...o.com>)
Re: CVE request: XSS in coppermine gallery before 1.5.28 (cve-assign@...re.org)
Re: CVE request: piwigo before 2.6.3 sql injection (cve-assign@...re.org)
Re: CVE request: GnuPG-1 (mancha <mancha1@...o.com>)
Re: CVE request: Piwigo before 2.6.2 ws.php Arbitrary User Creation CSRF (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library (cve-assign@...re.org)
Re: CVE request: python: _json module is vulnerable to arbitrary process memory read (cve-assign@...re.org)
Re: CVE request: GnuPG-1 (Werner Koch <wk@...pg.org>)
Re: CVE request: piwigo before 2.6.3 sql injection (Hanno Böck <hanno@...eck.de>)
Re: CVE request: GnuPG-1 (Olivier Levillain <olivier.levillain@....gouv.fr>)
CVE Request: Linux kernel ALSA core control API vulnerabilities (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Linux kernel ALSA core control API vulnerabilities (Marcus Meissner <meissner@...e.de>)
possible CVE request: rb_libtorrent opens UPNP port 0 ("Vincent Danen" <vdanen@...hat.com>)
Re: CVE request: GnuPG-1 (cve-assign@...re.org)
Re: CVE request: piwigo before 2.6.3 sql injection (cve-assign@...re.org)
OpenVZ simfs container filesystem breakout (Michał Grzędzicki <lazy@...pl>)
FreeBSD Security Advisory FreeBSD-SA-14:15.iconv (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:16.file (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: possible CVE request: rb_libtorrent opens UPNP port 0 ("Vincent Danen" <vdanen@...hat.com>)

June 25 (8 messages)

CVE-2014-0206 -- Linux kernel: kernel memory disclosure in io_getevents() (Petr Matousek <pmatouse@...hat.com>)
CVE request: timthumb remote code execution (Hanno Böck <hanno@...eck.de>)
Re: CVE request: timthumb remote code execution (Hanno Böck <hanno@...eck.de>)
MediaWiki releases 1.19.17, 1.21.11, 1.22.8 and 1.23.1 (Henri Salo <henri@...v.fi>)
Xen Security Advisory 101 - information leak via gnttab_setup_table on ARM (Xen.org security team <security@....org>)
[OSSA 2014-021] User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag (cve-assign@...re.org)

June 26 (31 messages)

Re: MediaWiki releases 1.19.17, 1.21.11, 1.22.8 and 1.23.1 (Chris Steipp <csteipp@...imedia.org>)
Re: CVE request: piwigo before 2.6.3 sql injection (cve-assign@...re.org)
Re: CVE ID Request for Python CGIHTTPServer File Disclosure (cve-assign@...re.org)
Re: CVE request: WordPress plugin wp-gpx-maps wp-gpx-maps_admin_tracks.php Improper Admin Verification File Upload PHP Code Execution (cve-assign@...re.org)
Re: TMP flaw in rackspace jclouds? (cve-assign@...re.org)
Re: CVE Request: Linux kernel ALSA core control API vulnerabilities (cve-assign@...re.org)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Kurt Seifried <kseifried@...hat.com>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Murray McAllister <mmcallis@...hat.com>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Henri Salo <henri@...v.fi>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Murray McAllister <mmcallis@...hat.com>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Florian Weimer <fweimer@...hat.com>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Jamie Strandboge <jamie@...onical.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Kurt Seifried <kseifried@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag (cve-assign@...re.org)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Kurt Seifried <kseifried@...hat.com>)
Re: MediaWiki releases 1.19.17, 1.21.11, 1.22.8 and 1.23.1 (Hanno Böck <hanno@...eck.de>)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Vladimir '3APA3A' Dubrovin <vlad@...urityvulns.ru>)
Re: Ansible CVE requests (cve-assign@...re.org)
LMS-2014-06-16-1: Oberhumer LZO ("Don A. Bailey" <donb@...uritymouse.com>)
LMS-2014-06-16-2: Linux Kernel LZO ("Don A. Bailey" <donb@...uritymouse.com>)
LMS-2014-06-16-3: Libav LZO ("Don A. Bailey" <donb@...uritymouse.com>)
LMS-2014-06-16-4: FFmpeg LZO ("Don A. Bailey" <donb@...uritymouse.com>)
LMS-2014-06-16-5: Linux Kernel LZ4 ("Don A. Bailey" <donb@...uritymouse.com>)
LMS-2014-06-16-6: LZ4 Core ("Don A. Bailey" <donb@...uritymouse.com>)
Re: LMS-2014-06-16-1: Oberhumer LZO (Solar Designer <solar@...nwall.com>)
Re: LMS-2014-06-16-6: LZ4 Core (Hanno Böck <hanno@...eck.de>)
Re: LMS-2014-06-16-1: Oberhumer LZO ("Don A. Bailey" <donb@...uritymouse.com>)
Re: LMS-2014-06-16-6: LZ4 Core ("Don A. Bailey" <donb@...uritymouse.com>)
Re: Re: Ansible CVE requests (Florian Weimer <fweimer@...hat.com>)
Re: LMS-2014-06-16-1: Oberhumer LZO (Yves-Alexis Perez <corsac@...ian.org>)

June 27 (19 messages)

Re: LMS-2014-06-16-6: LZ4 Core (Solar Designer <solar@...nwall.com>)
Re: LMS-2014-06-16-6: LZ4 Core ("Don A. Bailey" <donb@...uritymouse.com>)
Re: LMS-2014-06-16-1: Oberhumer LZO (Solar Designer <solar@...nwall.com>)
Re: LMS-2014-06-16-1: Oberhumer LZO ("Don A. Bailey" <donb@...uritymouse.com>)
Re: LMS-2014-06-16-6: LZ4 Core ("Don A. Bailey" <donb@...uritymouse.com>)
Re: LMS-2014-06-16-5: Linux Kernel LZ4 (Eddie Chapman <eddie@...k.net>)
Re: LMS-2014-06-16-5: Linux Kernel LZ4 ("Don A. Bailey" <donb@...uritymouse.com>)
Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE (Arun Babu Neelicattu <abn@...hat.com>)
Re: LMS-2014-06-16-5: Linux Kernel LZ4 (P J P <ppandit@...hat.com>)
CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem (cve-assign@...re.org)
Re: Xen Security Advisory 101 - information leak via gnttab_setup_table on ARM (cve-assign@...re.org)
Re: CVE request: timthumb remote code execution (cve-assign@...re.org)
Re: Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag (Kurt Seifried <kseifried@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag (cve-assign@...re.org)
Re: MediaWiki releases 1.19.17, 1.21.11, 1.22.8 and 1.23.1 (cve-assign@...re.org)
Re: LMS-2014-06-16-1: Oberhumer LZO ("H. Peter Anvin" <hpa@...or.com>)

June 28 (7 messages)

Re: Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
CVE request / advisory: Cherokee (Matthew Daley <mattd@...fuzz.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag (cve-assign@...re.org)
Re: Re: Question regarding CVE applicability of missing HttpOnly flag (Kurt Seifried <kseifried@...hat.com>)
Re: LMS-2014-06-16-1: Oberhumer LZO (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE request / advisory: Cherokee (cve-assign@...re.org)

June 29 (1 message)

CVE-2014-0103: Zarafa WebAccess/WebApp store passwords in cleartext on server (Robert Scheck <robert@...oraproject.org>)

June 30 (7 messages)

Confusion on CVE-2014-0235 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Confusion on CVE-2014-0235 (cve-assign@...re.org)
CVE requests: nagios check_dhcp plug-in: read parts of INI config files belonging to root (Murray McAllister <mmcallis@...hat.com>)
Re: Question regarding CVE applicability of missing HttpOnly flag ("Vincent Danen" <vdanen@...hat.com>)
Xen Security Advisory 101 (CVE-2014-4022) - information leak via gnttab_setup_table on ARM (Xen.org security team <security@....org>)
Re: CVE requests: nagios check_dhcp plug-in: read parts of INI config files belonging to root (cve-assign@...re.org)
changing CVE ID for RH Bugzilla 1098222 (from CVE-2014-0235) (cve-assign@...re.org)

317 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.