oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2014/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 4	² 4	³ 5
⁴ 2	⁵ 11	⁶ 1	⁷ 5	⁸ 34	⁹ 4	¹⁰ 2
¹¹ 3	¹² 7	¹³ 9	¹⁴ 10	¹⁵ 9	¹⁶ 7	¹⁷ 4
¹⁸ 12	¹⁹ 9	²⁰ 6	²¹ 16	²² 5	²³	²⁴ 4
²⁵ 2	²⁶ 5	²⁷ 7	²⁸ 5	²⁹ 5	³⁰ 2	³¹ 2

Messages by day:

August 1 (4 messages)

CVE Request: Enforce use of HTTPS for MathJax in IPython (Kyle Kelley <rgbkrk@...il.com>)
Possible CVE request: subversion MD5 collision authentication leak (Marcus Meissner <meissner@...e.de>)
CVE request: xcfa: Insecure use of temporary files, subject to race conditions (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Possible CVE request: subversion MD5 collision authentication leak (Ben Reser <ben@...er.org>)

August 2 (4 messages)

Re: CVE Request: XML-DT: Insecure use of temporary files (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (gremlin@...mlin.ru)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (Donald Stufft <donald@...fft.io>)

August 3 (5 messages)

Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (gremlin@...mlin.ru)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (gremlin@...mlin.ru)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (Donald Stufft <donald@...fft.io>)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (Donald Stufft <donald@...fft.io>)

August 4 (2 messages)

CVE Request -- qemu: missing field list terminator in vmstate_xhci_event (Petr Matousek <pmatouse@...hat.com>)
Re: Re: Possible CVE request: subversion MD5 collision authentication leak (Tomas Hoger <thoger@...hat.com>)

August 5 (11 messages)

Re: Re: Possible CVE request: subversion MD5 collision authentication leak (Ben Reser <ben@...er.org>)
Apache Cordova 3.5.1 (Marcel Kinard <cmarcelk@...il.com>)
Re: Re: Possible CVE request: subversion MD5 collision authentication leak (Michael Samuel <mik@...net.net>)
CVE request: issues in ISO C++ 2011 regex library (Murray McAllister <mmcallis@...hat.com>)
[CVE Requests] rsync and librsync collisions (Michael Samuel <mik@...net.net>)
Re: [CVE Requests] rsync and librsync collisions (Loganaden Velvindron <loganaden@...il.com>)
Re: [CVE Requests] rsync and librsync collisions (Michael Samuel <mik@...net.net>)
Re: Re: Possible CVE request: subversion MD5 collision authentication leak (Ben Reser <ben@...er.org>)
Re: CVE Request: Enforce use of HTTPS for MathJax in IPython (gremlin@...mlin.ru)
CVE request for vulnerability in OpenStack Keystone (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request: issues in ISO C++ 2011 regex library (Rich Felker <dalias@...c.org>)

August 6 (1 message)

Re: Re: CVE request: libressl before 2.0.2 under linux PRNG failure (Stuart Henderson <stu@...cehopper.org>)

August 7 (5 messages)

CVE request for Drupal core, and contributed modules (Forest Monsen <forest.monsen@...il.com>)
WordPress 3.9.2 release - needs CVE's (Kurt Seifried <kseifried@...hat.com>)
Re: WordPress 3.9.2 release - needs CVE's (Andrew Nacin <nacin@...dpress.org>)
Re: CVE request: issues in ISO C++ 2011 regex library (Murray McAllister <mmcallis@...hat.com>)
CVE-2014-3562: Vulnerability in 389-ds ("Vincent Danen" <vdanen@...hat.com>)

August 8 (34 messages)

BadUSB discussion (Dan Carpenter <dan.carpenter@...cle.com>)
Re: BadUSB discussion (Florian Weimer <fweimer@...hat.com>)
Re: BadUSB discussion (John Haxby <john.haxby@...cle.com>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Eddie Chapman <eddie@...k.net>)
Re: BadUSB discussion (gremlin@...mlin.ru)
Re: BadUSB discussion (gremlin@...mlin.ru)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (gremlin@...mlin.ru)
Re: BadUSB discussion (Eddie Chapman <eddie@...k.net>)
Re: BadUSB discussion (gremlin@...mlin.ru)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Dean Pierce <pierce403@...il.com>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Eddie Chapman <eddie@...k.net>)
Re: BadUSB discussion (gremlin@...mlin.ru)
Re: BadUSB discussion ("(GalaxyMaster)" <galaxy@...nwall.com>)
Re: BadUSB discussion ("(GalaxyMaster)" <galaxy@...nwall.com>)
Re: BadUSB discussion (gremlin@...mlin.ru)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Yves-Alexis Perez <corsac@...ian.org>)
Re: BadUSB discussion (Yves-Alexis Perez <corsac@...ian.org>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Yves-Alexis Perez <corsac@...ian.org>)
Re: BadUSB discussion (Eddie Chapman <eddie@...k.net>)
Re: BadUSB discussion (Greg KH <greg@...ah.com>)
Re: BadUSB discussion (Rich Felker <dalias@...c.org>)

August 9 (4 messages)

Re: BadUSB discussion (Yves-Alexis Perez <corsac@...ian.org>)
Re: BadUSB discussion (Willy Tarreau <willy@...roxy.com>)
Re: BadUSB discussion (lazytyped <lazytyped@...il.com>)
Re: BadUSB discussion (Yves-Alexis Perez <corsac@...ian.org>)

August 10 (2 messages)

Re: BadUSB discussion (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: issues in ISO C++ 2011 regex library (Maksymilian A <max@...t.cx>)

August 11 (3 messages)

CVE request: libgcrypt, ELGAMAL side-channel attack (Murray McAllister <mmcallis@...hat.com>)
CVE Request: Plack::App::File does not prune trailing slashes: possible code exposure / information disclosure (Salvatore Bonaccorso <carnil@...ian.org>)
Apache Cordova 3.5.1: CVE-2014-3502 update (Marcel Kinard <cmarcelk@...il.com>)

August 12 (7 messages)

[oCERT-2014-006] Ganeti insecure archive permission (Andrea Barisani <lcars@...rt.org>)
Xen Security Advisory 102 (CVE-2014-5147) - Flaws in handling traps from 32-bit userspace on 64-bit ARM (Xen.org security team <security@....org>)
Xen Security Advisory 103 (CVE-2014-5148) - Flaw in handling unknown system register access from 64-bit userspace on AR… (Xen.org security team <security@....org…)
Xen Security Advisory 97 (CVE-2014-5146,CVE-2014-5149) - Long latency virtual-mmu operations are not preemptible (Xen.org security team <security@....org>)
CVE id request: cacti remote code execution and SQL injection (Nico Golde <oss-security+ml@...lde.de>)
CVE Request: ro bind mount bypass using user namespaces (Kenton Varda <kenton@...dstorm.io>)
Re: CVE Request: ro bind mount bypass using user namespaces (Andy Lutomirski <luto@...capital.net>)

August 13 (9 messages)

Re: CVE Request: ro bind mount bypass using user namespaces (Andy Lutomirski <luto@...capital.net>)
Re: CVE Request: ro bind mount bypass using user namespaces (Andy Lutomirski <luto@...capital.net>)
Re: WordPress 3.9.2 release - needs CVE's (cve-assign@...re.org)
Re: CVE Request: ro bind mount bypass using user namespaces (cve-assign@...re.org)
Re: [CVE Request] glibc iconv_open buffer overflow (was: Re: Re: glibc locale issues) (cve-assign@...re.org)
Re: CVE Request: ro bind mount bypass using user namespaces (Kenton Varda <kenton@...dstorm.io>)
Re: CVE Request: ro bind mount bypass using user namespaces (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request: ro bind mount bypass using user namespaces (Sven Kieske <S.Kieske@...twald.de>)
Re: CVE Request: ro bind mount bypass using user namespaces (Andy Lutomirski <luto@...capital.net>)

August 14 (10 messages)

Re: WordPress 3.9.2 release - needs CVE's (Andrew Nacin <nacin@...dpress.org>)
Re: WordPress 3.9.2 release - needs CVE's (cve-assign@...re.org)
GetID3 CVE-2014-2053 XXE issue [was Re: WordPress 3.9.2 release - needs CVE's] (Murray McAllister <mmcallis@...hat.com>)
Re: CVE id request: cacti remote code execution and SQL injection (Murray McAllister <mmcallis@...hat.com>)
Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2 (cve-assign@...re.org)
Re: CVE Request: ro bind mount bypass using user namespaces (Vitaly Nikolenko <vnik5287@...il.com>)
Re: Re: [CVE Request] glibc iconv_open buffer overflow (was: Re: Re: glibc locale issues) (John Haxby <john.haxby@...cle.com>)
Re: [oCERT-2014-006] Ganeti insecure archive permission (cve-assign@...re.org)
CVE request: FFmpeg issues (Piotr Bandurski <ami_stuff@...pl>)
Re: Re: [CVE Request] glibc iconv_open buffer overflow (was: Re: Re: glibc locale issues) (Tavis Ormandy <taviso@...xchg8b.com>)

August 15 (9 messages)

Re: BadUSB discussion (Vincent Lefevre <vincent@...c17.net>)
Re: CVE request for vulnerability in OpenStack Keystone (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for vulnerability in OpenStack Keystone (cve-assign@...re.org)
Re: CVE request: xcfa: Insecure use of temporary files, subject to race conditions (cve-assign@...re.org)
CVE request for accountsservice local encrypted password disclosure flaw ("Vincent Danen" <vdanen@...hat.com>)
[OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253) (Tristan Cacqueray <tristan.cacqueray@...v…)
Re: CVE id request: cacti remote code execution and SQL injection (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE Request: XML-DT: Insecure use of temporary files (cve-assign@...re.org)
Re: CVE Request: XML-DT: Insecure use of temporary files (Alberto Simoes <ambs@...l-hackers.net>)

August 16 (7 messages)

Re: CVE Request -- qemu: missing field list terminator in vmstate_xhci_event (cve-assign@...re.org)
Re: CVE request: libgcrypt, ELGAMAL side-channel attack (cve-assign@...re.org)
Re: CVE Request: Plack::App::File does not prune trailing slashes: possible code exposure / information disclosure (cve-assign@...re.org)
Re: CVE request for Drupal core, and contributed modules (cve-assign@...re.org)
Re: CVE id request: cacti remote code execution and SQL injection (cve-assign@...re.org)
Re: CVE request: FFmpeg issues (cve-assign@...re.org)
Re: CVE request for accountsservice local encrypted password disclosure flaw (cve-assign@...re.org)

August 17 (4 messages)

FreeNAS default blank password (Kurt Seifried <kseifried@...hat.com>)
Re: FreeNAS default blank password (Kurt Seifried <kseifried@...hat.com>)
Re: FreeNAS default blank password (devzero2000 <pinto.elia@...il.com>)
Re[2]: FreeNAS default blank password ("Dolev Farhi" <dolevf@...oo.com>)

August 18 (12 messages)

Re: FreeNAS default blank password (Kurt Seifried <kseifried@...hat.com>)
Enigmail warning (Henri Salo <henri@...v.fi>)
Re: Enigmail warning (Noel Kuntze <noel@...ilie-kuntze.de>)
Re: Enigmail warning (Henri Salo <henri@...v.fi>)
CVE request / advisory: Monkey web server <= v1.5.2 (Matthew Daley <mattd@...fuzz.com>)
Re: Enigmail warning (Pedro Cunha <pedroagracio@...il.com>)
Re: Enigmail warning (Jerome Athias <athiasjerome@...il.com>)
CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack (Dirk-Willem van Gulik <dirkx@...weaving.org>)
Re: Enigmail warning (Nick Boyce <nick.boyce@...il.com>)
[Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create_with (Rafael Mendonça França <rafaelmfranca@...il.com>)
Re: [Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create_with (Kurt Seifried <kseifried@...hat.com>)
Re: [Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create_with (Rafael Mendonça França <rafaelmfranca@...il.com>)

August 19 (9 messages)

[CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability (Jacopo Cappellato <jacopoc@...che.org>)
Re: FreeNAS default blank password (cve-assign@...re.org)
CVE request: WordPress plugin wp-source-control remote path traversal file access (Henri Salo <henri@...v.fi>)
Re: Re: FreeNAS default blank password (Pierre Schweitzer <pierre@...ctos.org>)
incomplete fix for CVE-2014-4611: kernel: integer overflow in lz4_uncompress (Marcus Meissner <meissner@...e.de>)
CVE request for vulnerability in OpenStack Glance (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request for vulnerability in OpenStack Glance (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request / advisory: Monkey web server <= v1.5.2 (cve-assign@...re.org)
[OSSA 2014-027] Persistent XSS in Horizon Host Aggregates interface (CVE-2014-3594) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)

August 20 (6 messages)

Re: CVE request for vulnerability in OpenStack Glance (cve-assign@...re.org)
CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attack (David Jorm <djorm@...hat.com>)
RE: Enigmail warning (securitylists <securitylists@...ora.fi>)
Re: CVE request: WordPress plugin wp-source-control remote path traversal file access (cve-assign@...re.org)
Re: Enigmail warning (Guilherme Andrade <g@...drade.net>)
CVE Request: Multiple issues in com.ning:async-http-client (Arun Babu Neelicattu <abn@...hat.com>)

August 21 (16 messages)

CVE request: possible overflow in vararg functions (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: possible overflow in vararg functions (Murray McAllister <mmcallis@...hat.com>)
Lua CVE request [was Re: CVE request: possible overflow in vararg functions] (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: possible overflow in vararg functions (Florian Weimer <fweimer@...hat.com>)
SaltStack 2014.1.10 released ("C. R. Oldham" <cr@...tstack.com>)
[OSSA 2014-028] Glance store DoS through disk space exhaustion (CVE-2014-5356) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: SaltStack 2014.1.10 released (Kurt Seifried <kseifried@...hat.com>)
Re: SaltStack 2014.1.10 released (gremlin@...mlin.ru)
Revised: Salt 2014.1.10 released ("C. R. Oldham" <cr@...tstack.com>)
Re: SaltStack 2014.1.10 released (Kurt Seifried <kseifried@...hat.com>)
Re: SaltStack 2014.1.10 released (Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>)
Re: SaltStack 2014.1.10 released (Aaron Toponce <aaron.toponce@...il.com>)
Re: SaltStack 2014.1.10 released (gremlin@...mlin.ru)
Re: SaltStack 2014.1.10 released (Nick Boyce <nick.boyce@...il.com>)
Re: incomplete fix for CVE-2014-4611: kernel: integer overflow in lz4_uncompress (P J P <ppandit@...hat.com>)
Re: SaltStack 2014.1.10 released (Rylee Fowler <rylee@...ee.me>)

August 22 (5 messages)

Re: Enigmail warning (cve-assign@...re.org)
Re: SaltStack 2014.1.10 released (Phil Pennock <oss-security-phil@...dhuis.org>)
CVE request Qemu: out of bounds memory access (P J P <ppandit@...hat.com>)
FYI, change to Secunia vuln db EULA (ken <ken@...williams.us>)
Re: CVE request Qemu: out of bounds memory access (cve-assign@...re.org)

August 24 (4 messages)

Re: FYI, change to Secunia vuln db EULA (ken <ken@...williams.us>)
Re: Re: FYI, change to Secunia vuln db EULA (Rich Felker <dalias@...c.org>)
CVE-2014-5443: Seafile local horizontal privilege escalation vulnerability (Henri Salo <henri@...v.fi>)
CVE request: Multiple incorrect default permissions in Zarafa (Robert Scheck <robert@...oraproject.org>)

August 25 (2 messages)

Re: CVE request: Multiple incorrect default permissions in Zarafa (cve-assign@...re.org)
Re: Lua CVE request [was Re: CVE request: possible overflow in vararg functions] (cve-assign@...re.org)

August 26 (5 messages)

Re: CVE Request: Multiple issues in com.ning:async-http-client (cve-assign@...re.org)
CVE-2014-5119 glibc __gconv_translit_find() exploit (Tavis Ormandy <taviso@...gle.com>)
CVE request: php-pear, pear's insecure /tmp/ use for cache data (Murray McAllister <mmcallis@...hat.com>)
CVE Request: Linux Kernel unbound recursion in ISOFS (Marcus Meissner <meissner@...e.de>)
Re: Lua CVE request [was Re: CVE request: possible overflow in vararg functions] (Florian Weimer <fweimer@...hat.com>)

August 27 (7 messages)

Re: CVE Request: Linux Kernel unbound recursion in ISOFS (cve-assign@...re.org)
Re: Lua CVE request [was Re: CVE request: possible overflow in vararg functions] (cve-assign@...re.org)
Re: CVE request: php-pear, pear's insecure /tmp/ use for cache data (cve-assign@...re.org)
XRMS SQLi to RCE 0day ("Benjamin Harris" <bch@...h.ai>)
PHP-Wiki Command Injection ("Benjamin Harris" <bch@...h.ai>)
Open Source only? (Solar Designer <solar@...nwall.com>)
Re: Open Source only? (Kurt Seifried <kseifried@...hat.com>)

August 28 (5 messages)

Re: Open Source only? (Tim <tim-security@...tinelchicken.org>)
Re: Open Source only? (Hanno Böck <hanno@...eck.de>)
CVE-2014-0485: unsafe Python pickle in s3ql (Florian Weimer <fw@...eb.enyo.de>)
Zarafa WebApp < 1.6 affected by CVE-2010-4207 or CVE-2012-5881 (Robert Scheck <robert@...oraproject.org>)
Full disclosure: denial of service in srvx (Pierre Schweitzer <pierre@...ctos.org>)

August 29 (5 messages)

Re: XRMS SQLi to RCE 0day (cve-assign@...re.org)
Re: PHP-Wiki Command Injection (cve-assign@...re.org)
CVE request: glibc character set conversion from IBM code pages (Florian Weimer <fweimer@...hat.com>)
CVE Request: Clipboard Perl module: clipedit: insecure use of temporary files (Salvatore Bonaccorso <carnil@...ian.org>)
RE: CVE requests for 2 separate vulns in torrentflux 2.4.5-1 (debian stable) (Nicolas Guigo <nguigo@...cpartners.com>)

August 30 (2 messages)

Re: Full disclosure: denial of service in srvx (cve-assign@...re.org)
Re: CVE Request: Clipboard Perl module: clipedit: insecure use of temporary files (cve-assign@...re.org)

August 31 (2 messages)

Fwd: ezmlm warning ("Jorge Manuel B. S. Vicetto" <jmbsvicetto@...il.com>)
Re: Fwd: ezmlm warning (Jeremy Stanley <fungi@...goth.org>)

201 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.