oss-security mailing list - 2015/01

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 6	² 1	³ 22	⁴ 19
⁵ 18	⁶ 18	⁷ 5	⁸ 7	⁹ 10	¹⁰ 5	¹¹ 9
¹² 5	¹³ 3	¹⁴ 6	¹⁵ 5	¹⁶ 17	¹⁷ 12	¹⁸ 12
¹⁹ 3	²⁰ 12	²¹ 17	²² 11	²³ 10	²⁴ 18	²⁵ 5
²⁶ 10	²⁷ 31	²⁸ 23	²⁹ 30	³⁰ 19	³¹ 8

Messages by day:

January 1 (6 messages)

Re: CVE Request: PHP: out of bounds read crashes php-cgi (Stanislav Malyshev <smalyshev@...il.com>)
Re: CVE Request: Linux: Remote crash via batman-adv module - Linux kernel (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: xdg-utils: xdg-open: command injection vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: cve request: miniunzip directory traversal (Alexander Cherepanov <cherepan@...me.ru>)
CVE Request: libmspack: frame_end overflow which could cause infinite loop (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Imagemagick fuzzing bug (Bastien ROUCARIES <roucaries.bastien@...il.com>)

January 2 (1 message)

CVE request: Concrete5 XSS vulnerability (Henri Salo <henri@...v.fi>)

January 3 (22 messages)

Possible "new" CVE for Zoo directory traversal (Kurt Seifried <kseifried@...hat.com>)
CVE requests: Drupal contributed modules (Pere Orga <gotrunks@...il.com>)
Re: 2012 CVE request: XXE in nokogiri ruby gem (David Jorm <djorm@...p.iixpeering.net>)
Re: CVE Request: PHP: out of bounds read crashes php-cgi (cve-assign@...re.org)
CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request -- Contenido 4.9.x - 4.9.5 -- Reflecting XSS vulnerability in exception handler with deactivated AMR functi… (Steffen Rösemann <steffen.roesemann198…)
CVE Request -- CMS Absolut Engine v. 1.73 -- Multiple vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE request: file(1) DoS (Alexander Cherepanov <cherepan@...me.ru>)
Re: CVE request: dir traversal in elfutils (cve-assign@...re.org)
Re: CVE request: Unauthenticated remote disk space exhaustion in Zarafa WebAccess and WebApp (cve-assign@...re.org)
Re: parse_datetime() bug in coreutils (cve-assign@...re.org)
Re: CVE request: mpfr: buffer overflow in mpfr_strtofr (cve-assign@...re.org)
Re: CVE Request: Mediawiki security releases 1.24.1, 1.23.8, 1.22.15 and 1.19.23 (cve-assign@...re.org)
Re: CVE Request, Use after free vulnerability in Dwarfdump (cve-assign@...re.org)
Re: CVE request for emacs possibly (cve-assign@...re.org)
Re: cve request: miniunzip directory traversal (cve-assign@...re.org)
cve request: insecure temporary file usage - xbindkeys-config (Steve Kemp <steve@...ve.org.uk>)
Re: CVE request: XSS issues in Koha (cve-assign@...re.org)
Re: Re: CVE request: remote code execution vulnerability in gollum < 3.1.1 (cve-assign@...re.org)
Re: CVE Request (cve-assign@...re.org)
Re: CVE Request for illumos distributions (cve-assign@...re.org)
Re: CVE request: denial of service flaw in firebird (cve-assign@...re.org)

January 4 (19 messages)

Re: [grant.murphy@...com: CVE request for vulnerability in OpenStack Glance] (cve-assign@...re.org)
Re: CVE request: insufficient 'X-Forwarded-For' header validation in rabbitmq-server (cve-assign@...re.org)
Re: CVE Request: libpng 1.6.15 Heap Overflow (cve-assign@...re.org)
Re: Re: CVE Request: libsndfile buffer overread (cve-assign@...re.org)
Re: mpg123 CVE Assignment? (cve-assign@...re.org)
Re: CVE requests: Drupal contributed modules (cve-assign@...re.org)
Fwd: Re: CVE Request Question (Joshua Rogers <oss@...ernot.info>)
Re: CVE Request for illumos distributions (christos@...las.com (Christos Zoulas))
Re: CVE Request for illumos distributions (Joshua Rogers <oss@...ernot.info>)
【Vulnerability Report 】 - from QIHU 360 China (罗大龙 <luodalongde@...il.com>)
Re: CVE Request for illumos distributions (Dave Horsfall <dave@...sfall.org>)
Re: CVE request: denial of service flaw in firebird (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request for illumos distributions (gremlin@...mlin.ru)
Re: CVE Request for illumos distributions (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE Request: gcab: directory traversal (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request for illumos distributions (Marcus Meissner <meissner@...e.de>)
Re: CVE Request for illumos distributions ("Steven M. Christey" <coley@...re.org>)
Re: CVE Request for illumos distributions ("Steven M. Christey" <coley@...re.org>)
Assignment of CVE IDs with 5 or more digits by January 13, 2015 ("Steven M. Christey" <coley@...re.org>)

January 5 (18 messages)

Re: Assignment of CVE IDs with 5 or more digits by January 13, 2015 (Kurt Seifried <kseifried@...hat.com>)
CVE-2014-8148: midgard-core configures D-Bus system bus to be insecure (Simon McVittie <simon.mcvittie@...labora.co.uk>)
Announcing D-Bus 1.8.14 (Simon McVittie <simon.mcvittie@...labora.co.uk>)
CVE-2014-8148: midgard-core configures D-Bus system bus to be insecure (Simon McVittie <simon.mcvittie@...labora.co.uk>)
Re: CVE request: denial of service flaw in firebird ("Vincent Danen" <vdanen@...hat.com>)
Re: CVE request: denial of service flaw in firebird (cve-assign@...re.org)
Re: CVE Request: gcab: directory traversal (cve-assign@...re.org)
Re: cve request: insecure temporary file usage - xbindkeys-config ("Steven M. Christey" <coley@...re.org>)
Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash ("Steven M. Christey" <coley@...re.org>)
Re: Re: 2012 CVE request: XXE in nokogiri ruby gem ("Steven M. Christey" <coley@...re.org>)
Re: CVE Request -- Contenido 4.9.x - 4.9.5 -- Reflecting XSS vulnerability in exception handler with deactivated AMR function (cve-assign@...re.org)
Re: CVE Request -- CMS Absolut Engine v. 1.73 -- Multiple vulnerabilities (cve-assign@...re.org)
Re: CVE Request(s): GnuPG 2/GPG2 (cve-assign@...re.org)
Re: CVE-2014-8148: midgard-core configures D-Bus system bus to be insecure (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Concrete5 XSS vulnerability (Henri Salo <henri@...v.fi>)
Re: Re: CVE Request(s): GnuPG 2/GPG2 (Moritz Muehlenhoff <jmm@...ian.org>)
[OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1 (Grant Murphy <grant.murphy@...com>)
Re: CVE request: Concrete5 XSS vulnerability (Korvin Szanto <Korvin@...tlandlabs.com>)

January 6 (18 messages)

CVE Revoke (Joshua Rogers <oss@...ernot.info>)
Re: CVE request: Concrete5 XSS vulnerability (Korvin Szanto <Korvin@...tlandlabs.com>)
Re: CVE request: Concrete5 XSS vulnerability (Simo Ben youssef <simo@...xploit.com>)
CVE request / advisory: Apache Traffic Server 5.0.0 - 5.1.1 (Matthew Daley <mattd@...fuzz.com>)
Dublicate CVE assignment for directory traversal in elfutils? (CVE-2014-9486 and CVE-2014-9447) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: dir traversal in elfutils (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Re: CVE Request(s): GnuPG 2/GPG2 (Joshua Rogers <oss@...ernot.info>)
Xen Security Advisory 116 (CVE-2015-0361) - xen crash due to use after free on hvm guest teardown (Xen.org security team <security@....org>)
Possible CVE request: python-pillow: potential denial-of-service in PNG decompression code (Vasyl Kaigorodov <vkaigoro@...hat.com>)
CVE-2014-9529 - Linux kernel security/keys/gc.c race condition (cve-assign@...re.org)
CVE request Linux kernel: isofs: unchecked printing of ER records (P J P <ppandit@...hat.com>)
CVE-2012-5853 (Henri Salo <henri@...v.fi>)
CVE request: Reflected XSS / Content Spoofing in FlexPaper (Francisco Alonso <rs@...skills.cz>)
CVE Request -- CMS Sefrengo v.1.6.0 -- SQL injection and XSS vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
CVE Request -- CMS Kajona v. 4.6 -- Reflecting XSS in administrative backend (Steffen Rösemann <steffen.roesemann1986@...il.com>)
CVE request for directory traversal flaw in p7zip ("Vincent Danen" <vdanen@...hat.com>)
unsubscribe mmcallis@...hat.com ("Vincent Danen" <mmcallis@...hat.com>)
Re: unsubscribe mmcallis@...hat.com ("Vincent Danen" <vdanen@...hat.com>)

January 7 (5 messages)

Re: CVE Request: libmspack: frame_end overflow which could cause infinite loop (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: libmspack: frame_end overflow which could cause infinite loop (cve-assign@...re.org)
Re: Dublicate CVE assignment for directory traversal in elfutils? (CVE-2014-9486 and CVE-2014-9447) (cve-assign@...re.org)
CVE request: roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve … (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Directory traversals in cpio and friends? (Alexander Cherepanov <cherepan@...me.ru>)

January 8 (7 messages)

CVE Request for Privoxy Version: 3.0.22 (Yury German <yurylie@...yweb.com>)
CVE Request: PHP (Joshua Rogers <oss@...ernot.info>)
CVE request (Daniel Strøm <ds@...4web.dk>)
Re: Directory traversals in cpio and friends? (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: PHP (Joshua Rogers <oss@...ernot.info>)
[OSSA 2015-001] L3 agent denial of service with radvd 2.0+ (CVE-2014-8153) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
CVE Request -- CMS BEdita v. 3.4.0 -- Multiple stored XSS vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)

January 9 (10 messages)

CVE request: local privilege escalation flaw in Red Star OS 3.0 (David Jorm <david.jorm@...il.com>)
CVE Request: kwallet: incorrect CBC encryption handling (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: kwallet: incorrect CBC encryption handling (Marcus Meissner <meissner@...e.de>)
Re: CVE request Linux kernel: isofs: unchecked printing of ER records (cve-assign@...re.org)
Re: CVE Request: kwallet: incorrect CBC encryption handling (Florian Weimer <fweimer@...hat.com>)
CVE request: local privilege escalation flaws in Red Star OS 3.0 & 2.0 desktop (Hacker Fantastic <hackerfantastic@...eup.net>)
Re: CVE Request: kwallet: incorrect CBC encryption handling (Salvatore Bonaccorso <carnil@...ian.org>)
Re: PIE bypass using VDSO ASLR weakness - Linux kernel (cve-assign@...re.org)
CVE Request -- CMS e107 v.1.0.4 -- Reflecting XSS vulnerability in filemanager functionality (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: Directory traversals in cpio and friends? (Jakub Wilk <jwilk@...lk.net>)

January 10 (5 messages)

Re: CVE Request: libpng 1.6.15 Heap Overflow (endeavor <endeavor@...nbowsandpwnies.com>)
Re: CVE Request: kwallet: incorrect CBC encryption handling (Albert Astals Cid <aacid@....org>)
Re: CVE Request: libpng 1.6.15 Heap Overflow (cve-assign@...re.org)
Re: Directory traversals in cpio and friends? (Alexander Cherepanov <cherepan@...me.ru>)
Re: CVE-2014-6316: URL redirection issue in MantisBT (Damien Regad <dregad@...tisbt.org>)

January 11 (9 messages)

Re: CVE Request for Privoxy Version: 3.0.22 (cve-assign@...re.org)
Re: CVE request for directory traversal flaw in p7zip (cve-assign@...re.org)
Re: CVE request: roundcubemail: possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins (cve-assign@...re.org)
Re: CVE request (cve-assign@...re.org)
Re: CVE Request -- CMS BEdita v. 3.4.0 -- Multiple stored XSS vulnerabilities (cve-assign@...re.org)
Re: CVE Request -- CMS e107 v.1.0.4 -- Reflecting XSS vulnerability in filemanager functionality (cve-assign@...re.org)
CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 (Henri Salo <henri@...v.fi>)
Re: Re: CVE-2014-6316: URL redirection issue in MantisBT (cve-assign@...re.org)
Re: CVE request (Daniel Strøm <ds@...4web.dk>)

January 12 (5 messages)

CVE-Request -- CMS PHPKit WCMS v.1.6.6 -- Reflecting XSS vulnerability in administrative backend (poll archive) (Steffen Rösemann <steffen.roesemann1986@...il…)
CVE-Request -- CMS Croogo v.2.2.0 -- Reflecting XSS in filemanager in the administrative backend (Steffen Rösemann <steffen.roesemann1986@...il.com>)
CVE request for buffer overrun in CHICKEN Scheme's substring-index[-ci] procedures (Moritz Heidkamp <moritz.heidkamp@...uta.com>)
CVE request: pigz, kgb, pax: directory traversal (Thijs Kinkhorst <thijs@...ian.org>)
CVE request for vulnerability in OpenStack Glance (Tristan Cacqueray <tristan.cacqueray@...vance.com>)

January 13 (3 messages)

CVE request: httpd: IP address spoofing in mod_remoteip (Vasyl Kaigorodov <vkaigoro@...hat.com>)
CVE-Request -- CMS b2evolution v.5.2.0 -- Reflecting XSS vulnerability in filemanager functionality (Steffen Rösemann <steffen.roesemann1986@...il.com>)
CVE request: lhasa: directory traversals (Alexander Cherepanov <cherepan@...me.ru>)

January 14 (6 messages)

CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not set for cookies with Jenkins on Tomcat (Kurt Seifried <kseifried@...hat.com>)
Node.js "serve-static" module Open Redirect (Kurt Seifried <kseifried@...hat.com>)
CVE-2014-8160 Linux Kernel: SCTP firewalling fails until SCTP module is loaded (Wade Mealing <wmealing@...hat.com>)
CVE request: directory traversal flaw in patch (Martin Prpic <mprpic@...hat.com>)
Re: Node.js "serve-static" module Open Redirect (Adam Baldwin <baldwin@...yet.net>)
Re: CVE request: lhasa: directory traversals (Henri Salo <henri@...v.fi>)

January 15 (5 messages)

Re: CVE-Request -- CMS b2evolution v.5.2.0 -- Reflecting XSS vulnerability in filemanager functionality (Henri Salo <henri@...v.fi>)
[OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request: httpd: IP address spoofing in mod_remoteip (cve-assign@...re.org)
Re: CVE-Request -- CMS b2evolution v.5.2.0 -- Reflecting XSS vulnerability in filemanager functionality (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: CVE-Request -- CMS b2evolution v.5.2.0 -- Reflecting XSS vulnerability in filemanager functionality (Hanno Böck <hanno@...eck.de>)

January 16 (17 messages)

CVE Request: cpio -- directory traversal (Alexander Cherepanov <ch3root@...nwall.com>)
jar(1) -- directory traversal (Alexander Cherepanov <ch3root@...nwall.com>)
CVE Request: ha -- directory traversals (Alexander Cherepanov <ch3root@...nwall.com>)
CVE Request: ppmd -- directory traversals (Alexander Cherepanov <ch3root@...nwall.com>)
CVE Request: pxz -- race condition in setting permissions (Alexander Cherepanov <ch3root@...nwall.com>)
Re: CVE Request: cpio -- directory traversal (Lyndon Nerenberg <lyndon@...hanc.ca>)
CVE Request: libarchive -- directory traversal in bsdcpio (Alexander Cherepanov <ch3root@...nwall.com>)
Re: CVE Request: cpio -- directory traversal (Alexander Cherepanov <ch3root@...nwall.com>)
Re: Re: CVE request: httpd: IP address spoofing in mod_remoteip (Amos Jeffries <squid3@...enet.co.nz>)
Re: CVE-Request -- CMS b2evolution v.5.2.0 -- Reflecting XSS vulnerability in filemanager functionality (Henri Salo <henri@...v.fi>)
Re: CVE request: file(1) DoS (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE request: file(1) DoS (Alexander Cherepanov <ch3root@...nwall.com>)
Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: file(1) DoS (jmm@...ian.org)
KDE Plasma vulnerabilities: need CVE (Albert Astals Cid <aacid@....org>)
CVE request for vulnerability in OpenStack Glance (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
CVE-2015-1042: URL redirection issue in MantisBT (Damien Regad <dregad@...tisbt.org>)

January 17 (12 messages)

CVE-2014-9571: XSS in install.php (Damien Regad <dregad@...tisbt.org>)
CVE-2014-9573: SQL Injection in manage_user_page.php (Damien Regad <dregad@...tisbt.org>)
CVE-2014-9572: Improper Access Control in install.php (Damien Regad <dregad@...tisbt.org>)
CVE-2014-9571, -9572 and -9573 affect MantisBT (Damien Regad <dregad@...tisbt.org>)
CVE request: CAPTCHA bypass in MantisBT (Damien Regad <dregad@...tisbt.org>)
Re: CVE request: Reflected XSS / Content Spoofing in FlexPaper (Francisco Alonso <rs@...skills.cz>)
CVE-2005-2096 and gamera (Raphael Geissert <geissert@...ian.org>)
Re: Imagemagick fuzzing bug (Yury German <yury@...hnologysecure.com>)
Re: CVE request: file(1) DoS (cve-assign@...re.org)
Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability (cve-assign@...re.org)
Re: Node.js "serve-static" module Open Redirect (cve-assign@...re.org)
[RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Ben Hutchings <ben@...adent.org.uk>)

January 18 (12 messages)

Re: CVE request: lhasa: directory traversals (Alexander Cherepanov <ch3root@...nwall.com>)
Re: PIE bypass using VDSO ASLR weakness - Linux kernel (Andy Lutomirski <luto@...capital.net>)
Re: CVE request: pigz, kgb, pax: directory traversal (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Glance (cve-assign@...re.org)
Re: [OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme (cve-assign@...re.org)
Re: CVE request: directory traversal flaw in patch (cve-assign@...re.org)
Re: CVE Request: cpio -- directory traversal (cve-assign@...re.org)
Re: CVE Request: ha -- directory traversals (cve-assign@...re.org)
Re: CVE Request: ppmd -- directory traversals (cve-assign@...re.org)
Re: CVE Request: pxz -- race condition in setting permissions (cve-assign@...re.org)
Re: CVE request: CAPTCHA bypass in MantisBT (cve-assign@...re.org)
CVE request: grep heap buffer overrun (Jim Meyering <jim@...ering.net>)

January 19 (3 messages)

Moodle security issues are now public (Marina Glancy <marina@...dle.com>)
New Apache Santuario security advisory CVE-2014-8152 (Colm O hEigeartaigh <coheigea@...che.org>)
CVE Request: Webmin & Usermin - Read Mail Module Vulnerability (Patrick William <pat@...k911labs.com>)

January 20 (12 messages)

CVE Request: Linux kernel information leak in event device handling (Marcus Meissner <meissner@...e.de>)
[OSSA 2015-002.1] Glance v2 API unrestricted path traversal through filesystem:// scheme (CVE-2015-1195) ERRATA 1 (Tristan Cacqueray <tristan.cacqueray@...vanc…)
RE: CVE Request: Linux kernel information leak in event device handling ("Mehaffey, John" <John_Mehaffey@...tor.com>)
Possible CVE request: sympa: vulnerability in the web interface (Salvatore Bonaccorso <carnil@...ian.org>)
Vulnerabilities in VLC 2.1.5 (Fabian Yamaguchi <fabian.yamaguchi@...uni-goettingen.de>)
ping on CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not, set for cookies with Jenkins on Tomcat (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: directory traversal flaw in patch (Martin Prpic <mprpic@...hat.com>)
CVE Request: PHP int overflow (Joshua Rogers <oss@...ernot.info>)
Re: CVE Request: Info-ZIP unzip 6.0 (mancha <mancha1@...o.com>)
Xen Security Advisory 109 (CVE-2014-8594) - Insufficient restrictions on certain MMU update hypercalls (Xen.org security team <security@....org>)
Re: Vulnerabilities in VLC 2.1.5 (cve-assign@...re.org)
Re: Vulnerabilities in VLC 2.1.5 (Fabian Yamaguchi <fabian.yamaguchi@...uni-goettingen.de>)

January 21 (17 messages)

Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (James Morris <jmorris@...ei.org>)
Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Casey Schaufler <casey@...aufler-ca.com>)
Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Solar Designer <solar@...nwall.com>)
Re: CVE Request: Linux kernel information leak in event device handling (Petr Matousek <pmatouse@...hat.com>)
CVE request: two issues in vorbis-tools (Martin Prpic <mprpic@...hat.com>)
Re: CVE request: two issues in vorbis-tools (Hanno Böck <hanno@...eck.de>)
Re: CVE Request: Linux kernel information leak in event device handling (Pavel Machek <pavel@....cz>)
Re: CVE Request: Linux kernel information leak in event device handling (Petr Matousek <pmatouse@...hat.com>)
Re: heap overflow in procmail (Jakub Wilk <jwilk@...lk.net>)
Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Stephen Smalley <sds@...ho.nsa.gov>)
CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. ("J. Tozo" <juniorbsd@...il.com>)
Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Casey Schaufler <casey@...aufler-ca.com>)
CVE Request: XSS and response-splitting bugs in rabbitmq management plugin (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Ben Hutchings <ben@...adent.org.uk>)
CVE or not: 2x grml-debootstrap (Sebastian Pipping <sebastian@...ping.org>)
[oCERT-2015-001] JasPer input sanitization errors (Andrea Barisani <lcars@...rt.org>)
Re: KDE Plasma vulnerabilities: need CVE (Albert Astals Cid <aacid@....org>)

January 22 (11 messages)

Defense4all security advisory: CVE-2014-8149 users can export report data to an arbitrary file on the server's filesystem (David Jorm <david.jorm@...il.com>)
Re: CVE request / advisory: Apache Traffic Server 5.0.0 - 5.1.1 (Matthew Daley <mattd@...fuzz.com>)
Re: ping on CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not, set for cookies with Jenkins on Tomcat (cve-assign@...re.org)
Re: Possible CVE request: sympa: vulnerability in the web interface (cve-assign@...re.org)
Re: CVE Request: Info-ZIP unzip 6.0 (cve-assign@...re.org)
Re: KDE Plasma vulnerabilities: need CVE (cve-assign@...re.org)
Re: CVE request: directory traversal flaw in patch (cve-assign@...re.org)
Re: heap overflow in procmail (cve-assign@...re.org)
Re: CVE request: two issues in vorbis-tools (cve-assign@...re.org)
Re: CVE request: grep heap buffer overrun (cve-assign@...re.org)
Re: KDE Plasma vulnerabilities: need CVE (Albert Astals Cid <aacid@....org>)

January 23 (10 messages)

CVE Request: Linux kernel - Denial of service in notify_change for xattrs. (Wade Mealing <wmealing@...hat.com>)
CVE requests for nodejs marked VBScript Content Injection and sequelize SQL Injection in Order (Kurt Seifried <kseifried@...hat.com>)
CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file u… (Steffen Rösemann <steffen.roesemann198…)
Re: CVE request: two issues in vorbis-tools (Hanno Böck <hanno@...eck.de>)
Re: CVE request: two issues in vorbis-tools (Paris Z <paris8105@...il.com>)
Re: CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload (Henri Salo <henri@...v.fi>)
CVE Request: Linux kernel crypto api unprivileged arbitrary module load (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE request for BZ (Kurt Seifried <kseifried@...hat.com>)
[perl #119505] Segfault from bad backreference (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for BZ (David Lawrence <dkl@...illa.com>)

January 24 (18 messages)

Re: [perl #119505] Segfault from bad backreference (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: patch: directory traversal via file rename (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: patch: CVE needed for incomplete fix for CVE-2015-1196? (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load (cve-assign@...re.org)
Re: CVE Request: Linux kernel - Denial of service in notify_change for xattrs. (cve-assign@...re.org)
Socat security advisory 6 - Possible DoS with fork (Gerhard Rieger <gerhard@...t-unreach.org>)
Re: Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load (Mathias Krause <minipli@...glemail.com>)
Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load (cve-assign@...re.org)
Re: CVE Request: PHP (cve-assign@...re.org)
Re: CVE Request: PHP int overflow (cve-assign@...re.org)
SEANux 1.0 remote back door ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE Request: PHP (Joshua Rogers <oss@...ernot.info>)
Re: Re: CVE Request: PHP (Joshua Rogers <oss@...ernot.info>)
Re: Re: CVE Request: PHP (Joshua Rogers <oss@...ernot.info>)
Multiple vulnerabilities in LibTIFF and associated tools (William Robinet <william.robinet@...ostix.com>)
Re: Multiple vulnerabilities in LibTIFF and associated tools (Michal Zalewski <lcamtuf@...edump.cx>)
Re: SEANux 1.0 remote back door ("Larry W. Cashdollar" <larry0@...com>)
Re: Re: CVE request / advisory: Apache Traffic Server 5.0.0 - 5.1.1 (Moritz Muehlenhoff <jmm@...ian.org>)

January 25 (5 messages)

Re: SEANux 1.0 remote back door (Alexander Cherepanov <ch3root@...nwall.com>)
Re: SEANux 1.0 remote back door ("Larry W. Cashdollar" <larry0@...com>)
CVE for SEANux 1.0? (Larry Cashdollar <larry0@...com>)
Re: SEANux 1.0 remote back door (Alexander Cherepanov <ch3root@...nwall.com>)
CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities (Henri Salo <henri@...v.fi>)

January 26 (10 messages)

busybox CVE-2014-9645 (Kurt Seifried <kseifried@...hat.com>)
unshield directory traversal (Kurt Seifried <kseifried@...hat.com>)
Reject CVE-2012-3878? (Florian Weimer <fweimer@...hat.com>)
CVE request for Privoxy (Fabian Keil <freebsd-listen@...iankeil.de>)
[OSSA 2015-003] Glance user storage quota bypass (CVE-2014-9623) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
WebKitGTK+ Security Advisory WSA-2015-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: CVE Request: XSS and response-splitting bugs in rabbitmq management plugin (Marc Deslauriers <marc.deslauriers@...onical.com>)
kamailio: multiple /tmp file vulnerabilities (Helmut Grohne <helmut@...divi.de>)
CVE HOWTO - updated and moved to github (Kurt Seifried <kseifried@...hat.com>)
Re: CVE HOWTO - updated and moved to github (Seth Arnold <seth.arnold@...onical.com>)

January 27 (31 messages)

Re: CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload (cve-assign@...re.org)
Re: CVE requests for nodejs marked VBScript Content Injection and sequelize SQL Injection in Order (cve-assign@...re.org)
Re: [perl #119505] Segfault from bad backreference (cve-assign@...re.org)
GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Hanno Böck <hanno@...eck.de>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
KVM SYSENTER emulation vulnerability - CVE-2015-0239 (Nadav Amit <nadav.amit@...il.com>)
CVE request: XSS in search functionality for Geo Mashup Wordpress plugin (Paolo Perego <paolo@...oredcode.com>)
Re: CVE Request: XSS and response-splitting bugs in rabbitmq management plugin (cve-assign@...re.org)
Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Qualys Security Advisory <qsa@...lys.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Pierre Schweitzer <pierre@...ctos.org>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Marek Kroemeke <kroemeke@...il.com>)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Michal Zalewski <lcamtuf@...edump.cx>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE Request: Webmin & Usermin - Read Mail Module Vulnerability (cve-assign@...re.org)
Re: CVE or not: 2x grml-debootstrap (cve-assign@...re.org)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Qualys Security Advisory <qsa@...lys.com>)
Re: Socat security advisory 6 - Possible DoS with fork (cve-assign@...re.org)
Re: CVE request for Privoxy (cve-assign@...re.org)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Sven Kieske <svenkieske@...il.com>)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Michal Zalewski <lcamtuf@...edump.cx>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Filip Palian <s3810@...stk.edu.pl>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
CVE-2014-8156: freesmartphone.org stack configures D-Bus system bus to be insecure (Simon McVittie <simon.mcvittie@...labora.co.uk>)
Re: CVE request: XSS in search functionality for Geo Mashup Wordpress plugin (cve-assign@...re.org)
Re: unshield directory traversal (cve-assign@...re.org)
Re: CVE Request: patch: directory traversal via file rename (cve-assign@...re.org)
Re: CVE Request: patch: CVE needed for incomplete fix for CVE-2015-1196? (cve-assign@...re.org)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (endrazine <endrazine@...il.com>)
Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 (cve-assign@...re.org)

January 28 (23 messages)

Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Qualys Security Advisory <qsa@...lys.com>)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Amos Jeffries <squid3@...enet.co.nz>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Qualys Security Advisory <qsa@...lys.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (endrazine <endrazine@...il.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Jonathan Brossard <endrazine@...il.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Qualys Security Advisory <qsa@...lys.com>)
CVE-Request -- Saurus CMS v.4.7 (Community Edition, released: 12.08.2014) -- Multiple reflecting XSS vulnerabilities (Steffen Rösemann <steffen.roesemann1986@…)
kgb-bot can be crashed by some network traffic (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for buffer overrun in CHICKEN Scheme's substring-index[-ci] procedures (Peter Bex <peter@...e-magic.net>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request - ICU (Tomas Hoger <thoger@...hat.com>)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Stephane Chazelas <stephane.chazelas@...il.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Hanno Böck <hanno@...eck.de>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Raphael Geissert <geissert@...ian.org>)
the other glibc issue (Hanno Böck <hanno@...eck.de>)
Re: CVE request for buffer overrun in CHICKEN Scheme's substring-index[-ci] procedures (Moritz Muehlenhoff <jmm@...ian.org>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (cve-assign@...re.org)
Re: CVE request for buffer overrun in CHICKEN Scheme's substring-index[-ci] procedures (cve-assign@...re.org)
Re: the other glibc issue (cve-assign@...re.org)
Re: kgb-bot can be crashed by some network traffic (Pierre Schweitzer <pierre@...ctos.org>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Florian Weimer <fw@...eb.enyo.de>)
CVEs for Drupal contributed modules - January 2015 (Pere Orga <pere@...a.cat>)

January 29 (30 messages)

Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Paul Pluzhnikov <ppluzhnikov@...il.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Kurt Seifried <kseifried@...hat.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Yves-Alexis Perez <corsac@...ian.org>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Sven Kieske <s.kieske@...twald.de>)
Re: CVEs for Drupal contributed modules - January 2015 (Pere Orga <pere@...a.cat>)
Re: the other glibc issue (Solar Designer <solar@...nwall.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Kurt Seifried <kseifried@...hat.com>)
Xen Security Advisory 118 - arm: vgic: incorrect rate limiting of guest triggered logging (Xen.org security team <security@....org>)
Re: Re: CVEs for Drupal contributed modules - January 2015 (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Hanno Böck <hanno@...eck.de>)
CVE-2015-1420 - Linux kernel fs/fhandle.c race condition (cve-assign@...re.org)
CVE request -- Linux kernel - net: sctp: slab corruption from use after free on INIT collisions (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request - ICU (cve-assign@...re.org)
Re: CVE request -- Linux kernel - net: sctp: slab corruption from use after free on INIT collisions (cve-assign@...re.org)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Paul Pluzhnikov <ppluzhnikov@...il.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Hanno Böck <hanno@...eck.de>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Qualys Security Advisory <qsa@...lys.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Kurt Seifried <kseifried@...hat.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (cve-assign@...re.org)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Jan Schaumann <jschauma@...meister.org>)
CVE request: xchat/hexchat don't properly verify SSL certificates ("Vincent Danen" <vdanen@...hat.com>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Marc Deslauriers <marc.deslauriers@...onical.com>)
Fwd: ClamAV® blog: ClamAV 0.98.6 has been released! (Alexander Cherepanov <ch3root@...nwall.com>)
Re: Re: CVE request - ICU (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Sam Dodrill <shadow.h511@...il.com>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Reed Loden <reed@...dloden.com>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow (Solar Designer <solar@...nwall.com>)

January 30 (19 messages)

Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Hanno Böck <hanno@...eck.de>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Hanno Böck <hanno@...eck.de>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Kees Cook <keescook@...omium.org>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Alexander Cherepanov <ch3root@...nwall.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Florian Weimer <fweimer@...hat.com>)
R: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (linkbc02 <linkbc02@...look.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Michael Samuel <mik@...net.net>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Sven Schwedas <sven.schwedas@....at>)
R: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (linkbc02 <linkbc02@...look.com>)
Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Solar Designer <solar@...nwall.com>)
R: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (linkbc02 <linkbc02@...look.com>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (Kurt Seifried <kseifried@...hat.com>)
CVE request: Xymon (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (TingPing <tingping@...gping.se>)
Re: the other glibc issue (Rich Felker <dalias@...c.org>)

January 31 (8 messages)

Re: R: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) (Ammar Brohi <brohiammar@...il.com>)
CVE request: phpbb3 CSRF and CSS injection (Henri Salo <henri@...v.fi>)
CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5 (Henri Salo <henri@...v.fi>)
Re: CVE request: Xymon (cve-assign@...re.org)
Re: CVE request: phpbb3 CSRF and CSS injection (cve-assign@...re.org)
Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5 (cve-assign@...re.org)
CVE request: Piwigo SQL Injection (Achref Akremi <ach.n30@...il.com>)
RCE, XSS and HTTP header injection in fli4l web interface (Felix Eckhofer <felix@...but.de>)

377 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.