oss-security mailing list - 2015/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 8
² 3	³ 16	⁴ 17	⁵ 16	⁶ 13	⁷ 17	⁸ 8
⁹ 14	¹⁰ 18	¹¹ 14	¹² 17	¹³ 18	¹⁴ 7	¹⁵ 4
¹⁶ 9	¹⁷ 9	¹⁸ 11	¹⁹ 9	²⁰ 21	²¹ 6	²² 16
²³ 25	²⁴ 7	²⁵ 5	²⁶ 13	²⁷ 6	²⁸ 9

Messages by day:

February 1 (8 messages)

Re: CVE request: Piwigo SQL Injection (cve-assign@...re.org)
Re: RCE, XSS and HTTP header injection in fli4l web interface (cve-assign@...re.org)
CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities (cve-assign@...re.org)
Re: RCE, XSS and HTTP header injection in fli4l web interface (cve-assign@...re.org)
Re: RCE, XSS and HTTP header injection in fli4l web interface (Felix Eckhofer <felix@...but.de>)
Re: CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
CVE request: heap buffer overflow in glibc swscanf (Paul Pluzhnikov <ppluzhnikov@...il.com>)

February 2 (3 messages)

workaround for GHOST glibc vulnerability CVE-2015-0235 (Constantine Shulyupin <const@...elinux.com>)
CVE request -- Linux kernel - net: DoS due to routing packets to too many different dsts/too fast (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request: cpio -- directory traversal (Vitezslav Cizek <vcizek@...e.cz>)

February 3 (16 messages)

Re: Linux kernel: multiple x86_64 vulnerabilities (Solar Designer <solar@...nwall.com>)
vsftpd problem in deny_hosts (Marcus Meissner <meissner@...e.de>)
Re: vsftpd problem in deny_hosts (Solar Designer <solar@...nwall.com>)
Re: workaround for GHOST glibc vulnerability CVE-2015-0235 (Florian Weimer <fweimer@...hat.com>)
Re: workaround for GHOST glibc vulnerability CVE-2015-0235 (Constantine Shulyupin <const@...elinux.com>)
Re: workaround for GHOST glibc vulnerability CVE-2015-0235 (Qualys Security Advisory <qsa@...lys.com>)
Re: vsftpd problem in deny_hosts (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: MySQL: MyISAM temporary file issue (Marcus Meissner <meissner@...e.de>)
Re: vsftpd problem in deny_hosts (Moritz Muehlenhoff <jmm@...ian.org>)
Re: vsftpd problem in deny_hosts (Chris Evans <scarybeasts@...il.com>)
Possible CVE Requests: libmspack: several issues (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Possible CVE Requests: libmspack: several issues (Hanno Böck <hanno@...eck.de>)
Re: CVE request -- Linux kernel - net: DoS due to routing packets to too many different dsts/too fast (cve-assign@...re.org)
CVE-Request -- Pragyan CMS v.3.0 -- SQL injection vulnerability (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE-Request -- Pragyan CMS v.3.0 -- SQL injection vulnerability (cve-assign@...re.org)
Re: CVE request: heap buffer overflow in glibc swscanf (Gsunde Orangen <gsunde.orangen@...il.com>)

February 4 (17 messages)

Re: CVE request: heap buffer overflow in glibc swscanf (cve-assign@...re.org)
Re: Re: CVE request: heap buffer overflow in glibc swscanf (Daniel Micay <danielmicay@...il.com>)
Re: vsftpd problem in deny_hosts ("Joshua J. Drake" <oss-sec@...p.org>)
Re: Re: CVE request: heap buffer overflow in glibc swscanf (Florian Weimer <fweimer@...hat.com>)
CVE request: NULL ptr deref in php (Johannes Segitz <jsegitz@...e.com>)
Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Mark Felder <feld@...d.me>)
Re: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Florent Daigniere <florent.daigniere@...stmatta.com>)
Re: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Mark Felder <feld@...d.me>)
Re: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Reed Loden <reed@...dloden.com>)
Re: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Mark Felder <feld@...d.me>)
Re: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Florent Daigniere <florent.daigniere@...stmatta.com>)
CVE Request: PHP/file: out-of-bounds memory access in softmagic (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic (Hanno Böck <hanno@...eck.de>)
Old nagios CVE (Kurt Seifried <kseifried@...hat.com>)
CVE request for Moodlee MDL-48980 Security: Always clean the result from min_get_slash_argument (Kurt Seifried <kseifried@...hat.com>)
CVE request for some NTP stuff (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for some NTP stuff (Gsunde Orangen <gsunde.orangen@...il.com>)

February 5 (16 messages)

Re: Apache 2.4 mod_ssl SSLSessionTickets -- others vulnerable? (Michael Samuel <mik@...net.net>)
CVE request for Zero-day in the Fancybox-for-WordPress Plugin (Kurt Seifried <kseifried@...hat.com>)
MP3::Info file loading from cwd (Kurt Seifried <kseifried@...hat.com>)
foomatic file loading from cwd (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: NULL ptr deref in php (cve-assign@...re.org)
[oCERT-2015-002] e2fsprogs input sanitization errors (Andrea Barisani <lcars@...rt.org>)
[ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilities (Dejan Bosanac <dejan@...httale.net>)
[ANNOUNCE] CVE-2014-3579 - ActiveMQ Apollo vulnerability (Dejan Bosanac <dejan@...httale.net>)
Re: Linux kernel: multiple x86_64 vulnerabilities (Shawn <citypw@...il.com>)
Re: CVE request for Zero-day in the Fancybox-for-WordPress Plugin (cve-assign@...re.org)
Re: CVE request for Moodlee MDL-48980 Security: Always clean the result from min_get_slash_argument - Moodle (cve-assign@...re.org)
Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic (cve-assign@...re.org)
Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic (cve-assign@...re.org)
Re: Re: CVE request for Zero-day in the Fancybox-for-WordPress Plugin (Henri Salo <henri@...v.fi>)
Re: CVE request - ICU (cve-assign@...re.org)
CVE requests for Drupal contributed modules (Pere Orga <pere@...a.cat>)

February 6 (13 messages)

Re: CVE Request: cpio -- directory traversal (Alexander Cherepanov <ch3root@...nwall.com>)
Re: CVE request for Moodlee MDL-48980 Security: Always clean the result from min_get_slash_argument - Moodle (Marina Glancy <marina@...dle.com>)
CVE request: two OpenLDAP DoS issues (Ryan Tandy <ryan@...dis.ca>)
CVE request for denial-of-service vulnerability in fcgi (Till Maas <opensource@...l.name>)
Re: CVE request for denial-of-service vulnerability in fcgi (Kurt Seifried <kseifried@...hat.com>)
lynx: crash when parsing overly long links (Kurt Seifried <kseifried@...hat.com>)
older fuseiso stuff (Kurt Seifried <kseifried@...hat.com>)
some older pbm2l2030 stuff (Kurt Seifried <kseifried@...hat.com>)
older issues in libbluray (Kurt Seifried <kseifried@...hat.com>)
Re: lynx: crash when parsing overly long links (Alan Coopersmith <alan.coopersmith@...cle.com>)
byzanz: Out-of heap-based buffer write in GIF encoder (Kurt Seifried <kseifried@...hat.com>)
potrace: possible heap overflow (Kurt Seifried <kseifried@...hat.com>)
libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages (Kurt Seifried <kseifried@...hat.com>)

February 7 (17 messages)

python-rope: pickle.load of remotely supplied data with no authentication required (Kurt Seifried <kseifried@...hat.com>)
Re: lynx: crash when parsing overly long links (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: two OpenLDAP DoS issues (cve-assign@...re.org)
Re: CVE request for denial-of-service vulnerability in fcgi (cve-assign@...re.org)
Re: Multiple vulnerabilities in LibTIFF and associated tools (cve-assign@...re.org)
gcj jar manifest parsing segfault with classpath references (Kurt Seifried <kseifried@...hat.com>)
ghostscript double free and invalid read caused by embedded jbig2 data (Kurt Seifried <kseifried@...hat.com>)
CVE REJECT CVE-2009-1193 (Kurt Seifried <kseifried@...hat.com>)
Re: ghostscript double free and invalid read caused by embedded jbig2 data (Hanno Böck <hanno@...eck.de>)
kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() (Kurt Seifried <kseifried@...hat.com>)
Mozilla: Use-after-free when doing multiple nesting using bad tags (Kurt Seifried <kseifried@...hat.com>)
some really old openjdk stuff/possible java (Kurt Seifried <kseifried@...hat.com>)
Re: ghostscript double free and invalid read caused by embedded jbig2 data (Gynvael Coldwind <gynvael@...dwind.pl>)
Spencer regexp heap overflow? (Alistair Crooks <agc@...src.org>)
Fwd: ezmlm response (Constantine Shulyupin <constantine.shulyupin@...il.com>)
Re: Mozilla: Use-after-free when doing multiple nesting using bad tags (Reed Loden <reed@...dloden.com>)
Re: Mozilla: Use-after-free when doing multiple nesting using bad tags (Kurt Seifried <kseifried@...hat.com>)

February 8 (8 messages)

Re: kgb-bot can be crashed by some network traffic (cve-assign@...re.org)
CVE-Request -- eFront v. 3.6.15.2 build 18021 (Community Edition) -- Multiple CSRF vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: lynx: crash when parsing overly long links (Hanno Böck <hanno@...eck.de>)
Re: kernel: v4l: videobuf: hotfix a bug on multiple calls to mmap() - Linux kernel (cve-assign@...re.org)
CVE-2013-6501 php: predictible filename used for cache in world writable directory (Kurt Seifried <kseifried@...hat.com>)
CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2013-6501 php: predictible filename used for cache in world writable directory (Stanislav Malyshev <smalyshev@...il.com>)
please REJECT CVE-2013-4186 (Kurt Seifried <kseifried@...hat.com>)

February 9 (14 messages)

Re: CVE-Request -- eFront v. 3.6.15.2 build 18021 (Community Edition) -- Multiple CSRF vulnerabilities (cve-assign@...re.org)
Moodle security issue made public (Marina Glancy <marina@...dle.com>)
Re: CVE-Request -- Saurus CMS v.4.7 (Community Edition, released: 12.08.2014) -- Multiple reflecting XSS vulnerabilities (cve-assign@...re.org)
CVE-2014-8165: remote code execution in powerpc-utils-python (Florian Weimer <fweimer@...hat.com>)
Re: CVE request for Moodlee MDL-48980 Security: Always clean the result from min_get_slash_argument - Moodle (cve-assign@...re.org)
CVE-2015-0245: denial of service in dbus >= 1.4 systemd activation (Simon McVittie <simon.mcvittie@...labora.co.uk>)
CVE-Request -- Google Email App 4.2.2 remote denial of service (Hector Marco <hecmargi@....es>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (Alexander Cherepanov <ch3root@...nwall.com>)
Re: CVE-2013-4578 OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars (Ritwik Ghoshal <ritwik.ghoshal@...cle.com>)
CVE request: XSS in MantisBT (Damien Regad <dregad@...tisbt.org>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (cve-assign@...re.org)
CVE request: sudo TZ issue ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
CVE Request: jabberd remote information disclosure (Thijs Alkemade <me@...jsalkema.de>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service ("Mike O'Connor" <mjo@...o.mi.org>)

February 10 (18 messages)

RE: CVE request: XSS in MantisBT ("P Richards" <paul@...tisforge.org>)
Current outstanding CVE requests (Kurt Seifried <kseifried@...hat.com>)
CVE-Request -- Linux kernel - panic on nftables rule flush (Wade Mealing <wmealing@...hat.com>)
Re: libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages (Florian Weimer <fweimer@...hat.com>)
Two new security advisories released for Apache WSS4J (Colm O hEigeartaigh <coheigea@...che.org>)
Re: CVE-Request -- Linux kernel - panic on nftables rule flush (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: sudo TZ issue (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: Info-ZIP unzip 6.0 (Tomas Hoger <thoger@...hat.com>)
Re: Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (Hector Marco <hecmargi@....es>)
eCryptfs key wrapping help to crack user password (Sylvain Pelissier <sylvain.pelissier@...il.com>)
wordexp(3) (Solar Designer <solar@...nwall.com>)
Re: wordexp(3) (Rich Felker <dalias@...c.org>)
Re: CVE-Request -- Linux kernel - panic on nftables rule flush (cve-assign@...re.org)
Re: CVE request: sudo TZ issue ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
CVE Request: Cups: cupsRasterReadPixels buffer overflow (Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>)
Re: eCryptfs key wrapping help to crack user password (Tyler Hicks <tyhicks@...onical.com>)
CVE-2015-0260: Kallithea: API key of repository's creator exposed by get_repo API method (Andrew Shadura <andrew@...dura.me>)
Fwd: X.Org Security Advisory: CVE-2015-0255: Information leak in the XkbSetGeometry request of X servers (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 11 (14 messages)

Re: CVE Request: Info-ZIP unzip 6.0 ("Steven M. Schweda" <sms@...inode.info>)
Re: CVE request: sudo TZ issue (cve-assign@...re.org)
Re: wordexp(3) (Rich Felker <dalias@...c.org>)
Re: Re: CVE request: sudo TZ issue (Florian Weimer <fweimer@...hat.com>)
Re: wordexp(3) (John Haxby <john.haxby@...cle.com>)
Re: wordexp(3) (Stuart Henderson <sthen@...nbsd.org>)
Re: CVE Request: Info-ZIP unzip 6.0 (mancha <mancha1@...o.com>)
Re: wordexp(3) (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: Info-ZIP unzip 6.0 ("Steven M. Schweda" <sms@...inode.info>)
Re: Re: CVE request: sudo TZ issue ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
Re: wordexp(3) (Tim <tim-security@...tinelchicken.org>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (cve-assign@...re.org)
Re: heap overflow in procmail (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (Hector Marco <hecmargi@....es>)

February 12 (17 messages)

Re: wordexp(3) (Daniel Micay <danielmicay@...il.com>)
CVE request: MovableType before 5.2.12 (John Lightsey <john@...nuts.net>)
Re: heap overflow in procmail (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-Request -- CMS PHPKit WCMS v.1.6.6 -- Reflecting XSS vulnerability in administrative backend (poll archive) (cve-assign@...re.org)
Re: CVE-Request -- CMS Croogo v.2.2.0 -- Reflecting XSS in filemanager in the administrative backend (cve-assign@...re.org)
Re: CVE-Request -- CMS b2evolution v.5.2.0 -- Reflecting XSS vulnerability in filemanager functionality (cve-assign@...re.org)
Re: kamailio: multiple /tmp file vulnerabilities (cve-assign@...re.org)
CVE request: lame (Moritz Muehlenhoff <jmm@...ian.org>)
CVE request: archmage directory traversal (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Possible CVE request: python-pillow: potential denial-of-service in PNG decompression code (cve-assign@...re.org)
Re: CVE request: Reflected XSS / Content Spoofing in FlexPaper (cve-assign@...re.org)
Re: CVE Request: Cups: cupsRasterReadPixels buffer overflow (cve-assign@...re.org)
Re: CVE request: sudo TZ issue (cve-assign@...re.org)
Xen Security Advisory 117 (CVE-2015-0268) - arm: vgic-v2: GICD_SGIR is not properly emulated (Xen.org security team <security@....org>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (cve-assign@...re.org)
Re: CVE request: archmage directory traversal (cve-assign@...re.org)
Re: CVE request: MovableType before 5.2.12 - Movable Type (cve-assign@...re.org)

February 13 (18 messages)

Re: Re: CVE request: sudo TZ issue (Rich Felker <dalias@...c.org>)
Re: Re: CVE request: sudo TZ issue (Simon McVittie <smcv@...ian.org>)
CVE Requests - glibc overflows (strxfrm) (mancha <mancha1@...o.com>)
CVE-Request -- Linux ASLR integer overflow (Hector Marco <hecmargi@....es>)
Re: Re: CVE request: sudo TZ issue ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
CVE Request : Several Bugs Found on Libflac 1.3.1 and Libtta++-2.2 (Zhenghao Hu <zhenghaohuu@...il.com>)
Re: CVE-Request -- Linux ASLR integer overflow (Hector Marco <hecmargi@....es>)
Re: CVE Request -- CMS Sefrengo v.1.6.0 -- SQL injection and XSS vulnerabilities (cve-assign@...re.org)
Re: CVE Request -- CMS Kajona v. 4.6 -- Reflecting XSS in administrative backend (cve-assign@...re.org)
Re: CVE Request - dns-sync node module (cve-assign@...re.org)
CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and und… (Steffen Rösemann <steffen.roesemann198…)
CVE requests for Drupal contributed modules (Pere Orga <pere@...a.cat>)
Re: CVE-Request -- Linux ASLR integer overflow (cve-assign@...re.org)
Multiple issues in GnuPG found through keyring fuzzing (TFPA 001/2015) (Hanno Böck <hanno@...eck.de>)
Re: CVE request: XSS in MantisBT (Damien Regad <dregad@...tisbt.org>)
RE: Re: CVE request: XSS in MantisBT ("P Richards" <paul@...tisforge.org>)
Re: Multiple issues in GnuPG found through keyring fuzzing (TFPA 001/2015) (cve-assign@...re.org)
Re: Multiple issues in GnuPG found through keyring fuzzing (TFPA 001/2015) (Hanno Böck <hanno@...eck.de>)

February 14 (7 messages)

Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF (cve-assign@...re.org)
Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and … (Steffen Rösemann <steffen.roesemann198…)
Possible vulnerability fixed in ZPAQ v7.02 (Matt Mahoney <mattmahoneyfl@...il.com>)
Re: CVE Request : Several Bugs Found on Libflac 1.3.1 and Libtta++-2.2 (Hanno Böck <hanno@...eck.de>)
Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF (cve-assign@...re.org)
Re: Multiple issues in GnuPG found through keyring fuzzing (TFPA 001/2015) (cve-assign@...re.org)
Re: CVE-Request -- Linux ASLR integer overflow (Kees Cook <keescook@...omium.org>)

February 15 (4 messages)

CVE-Request - Offset2lib (Hector Marco <hecmargi@....es>)
Re: CVE-Request - Offset2lib (Daniel Micay <danielmicay@...il.com>)
End of the m0n0wall project (Henri Salo <henri@...v.fi>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (cve-assign@...re.org)

February 16 (9 messages)

Re: CVE request: XSS in MantisBT (Damien Regad <dregad@...tisbt.org>)
RE: Re: CVE request: XSS in MantisBT ("P Richards" <paul@...tisforge.org>)
Re: CVE Request : Several Bugs Found on Libflac 1.3.1 and Libtta++-2.2 (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Re: CVE-Request -- Google Email App 4.2.2 remote denial of service (Hector Marco <hecmargi@....es>)
CVE-Request - bitbake (Maxin John <maxin@...inbjohn.info>)
Re: CVE Request : Several Bugs Found on Libflac 1.3.1 and Libtta++-2.2 (Zhenghao Hu <zhenghaohuu@...il.com>)
Re: CVE request: XSS in MantisBT (Damien Regad <dregad@...tisbt.org>)
CVE request: spencer regexp (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks (Josh Boyer <jwboyer@...oraproject.org>)

February 17 (9 messages)

CVE request: novnc: session hijack through insecurely set session token cookies (Vasyl Kaigorodov <vkaigoro@...hat.com>)
CVE request: vulnerabilities in libcsoap (Patrick Coleman <blinken@...il.com>)
Re: CVE request: vulnerabilities in libcsoap (Patrick Coleman <blinken@...il.com>)
CVE-2015-1315 - Info-ZIP UnZip - Out-of-bounds Write (William Robinet <william.robinet@...ostix.com>)
CVE-2014-9328: clamav: special crafted upack files may lead to segfault (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)
CVE-2015-1463: clamav: special crafted petite can lead to a crash (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)
CVE request: Linux kernel ecryptfs 1-byte overwrite (Kees Cook <keescook@...omium.org>)
Re: CVE-Request - bitbake (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE request: Linux kernel ecryptfs 1-byte overwrite (cve-assign@...re.org)

February 18 (11 messages)

FreeBSD: URGENT: RNG broken for last 4 months (Kurt Seifried <kseifried@...hat.com>)
Re: FreeBSD: URGENT: RNG broken for last 4 months (Loganaden Velvindron <loganaden@...il.com>)
CVE Request: cabextract -- directory traversal (Alexander Cherepanov <ch3root@...nwall.com>)
CVE-Request: Linux ASLR mmap weakness: Reducing entropy by half (Hector Marco <hecmargi@....es>)
Re: CVE-Request: Linux ASLR mmap weakness: Reducing entropy by half (Loganaden Velvindron <loganaden@...il.com>)
Re: CVE-Request: Linux ASLR mmap weakness: Reducing entropy by half (Hector Marco <hecmargi@....es>)
CVE Request: xdg-utils: xdg-open: command injection vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-Request -- Piwigo <= v. 2.7.3 -- Reflecting XSS- and SQLi-vulnerability in administrative backend (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability (cve-assign@...re.org)
CVE request: xrdp (mancha <mancha1@...o.com>)
Re: foomatic file loading from cwd (Kurt Seifried <kseifried@...hat.com>)

February 19 (9 messages)

Re: CVE request: xrdp (mancha <mancha1@...o.com>)
Re: Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: FreeBSD: URGENT: RNG broken for last 4 months (cve-assign@...re.org)
Re: FreeBSD: URGENT: RNG broken for last 4 months (Kurt Seifried <kseifried@...hat.com>)
CVE request for vulnerability in OpenStack Glance (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request for vulnerability in OpenStack Glance (cve-assign@...re.org)
Re: CVE request for vulnerability in OpenStack Glance (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE request for vulnerability in OpenStack Glance (cve-assign@...re.org)
Fixing the glibc runtime linker (Tim Brown <tmb@...35.com>)

February 20 (21 messages)

Re: Fixing the glibc runtime linker (Stuart Gathman <stuart@...hman.org>)
Re: CVE-Request -- Piwigo <= v. 2.7.3 -- Reflecting XSS- and SQLi-vulnerability in administrative backend (cve-assign@...re.org)
Re: Fixing the glibc runtime linker (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Requesting CVE for ImageMagick DoS (Jodie Cunningham <jodie.cunningham@...il.com>)
Re: Fixing the glibc runtime linker (Tim Brown <tmb@...35.com>)
Re: Fixing the glibc runtime linker (Tim Brown <tmb@...35.com>)
Re: Fixing the glibc runtime linker (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Re: Fixing the glibc runtime linker (Rich Felker <dalias@...c.org>)
Re: Fixing the glibc runtime linker (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Re: Fixing the glibc runtime linker (Rich Felker <dalias@...c.org>)
Re: Fixing the glibc runtime linker (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Re: Fixing the glibc runtime linker (Tim Brown <tmb@...35.com>)
Re: Fixing the glibc runtime linker (Casper.Dik@...cle.com)
CVE Request: Gtk2 Perl Module: incorrect memory management in Gtk2::Gdk::Display::list_devices (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Fixing the glibc runtime linker (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Re: Fixing the glibc runtime linker (Rich Felker <dalias@...c.org>)
Re: Fixing the glibc runtime linker (Paul Pluzhnikov <ppluzhnikov@...gle.com>)
Re: Fixing the glibc runtime linker (Rich Felker <dalias@...c.org>)
CVE-2015-2041 - Linux kernel - incorrect data type in llc2_timeout_table (cve-assign@...re.org)
CVE-2015-2042 - Linux kernel - incorrect data type in rds_sysctl_rds_table (cve-assign@...re.org)
CVE Request: jabberd remote information disclosure (Joe Malcolm <jmalcolm@...eus.com>)

February 21 (6 messages)

Re: CVE request: XSS in MantisBT (cve-assign@...re.org)
RE: CVE request: XSS in MantisBT ("P Richards" <paul@...tisforge.org>)
CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
CVE-Request -- MyBB v. 1.8.3 -- Multiple stored XSS-vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE request: XSS in MantisBT (cve-assign@...re.org)
Re: Fixing the glibc runtime linker (Rich Felker <dalias@...c.org>)

February 22 (16 messages)

CVE-2015-0881 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2015-0881 (C Peters <chuck.peters@...il.com>)
Re: CVE-2015-0881 (Kurt Seifried <kseifried@...hat.com>)
CVE Request: TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2015-0881 (Amos Jeffries <squid3@...enet.co.nz>)
Re: heap overflow in procmail (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: mod-gnutls: GnuTLSClientVerify require is ignored (Sébastien Delafond <seb@...ian.org>)
Re: CVE Request: TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5 (cve-assign@...re.org)
Re: older issues in libbluray (Moritz Mühlenhoff <jmm@...til.org>)
Re: libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Possible CVE Requests: libmspack: several issues (Moritz Mühlenhoff <jmm@...til.org>)
Re: CVE request: xchat/hexchat don't properly verify SSL certificates (jmm@...ian.org)
Re: CVE Request: libarchive -- directory traversal in bsdcpio (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE Request: jabberd remote information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)
CVE request: glibc PR 17269 _IO_wstr_overflow integer overflow (Paul Pluzhnikov <ppluzhnikov@...il.com>)
Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities (cve-assign@...re.org)

February 23 (25 messages)

Re: older issues in libbluray (Kurt Seifried <kseifried@...hat.com>)
CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE Request: cabextract -- directory traversal (cve-assign@...re.org)
Re: CVE Request: jabberd remote information disclosure (cve-assign@...re.org)
Re: older issues in libbluray (Florian Weimer <fweimer@...hat.com>)
Re: [videolan] older issues in libbluray (Jean-Baptiste Kempf <jb@...eolan.org>)
CVE request: BD-J implementation in libbluray (Florian Weimer <fweimer@...hat.com>)
Re: older issues in libbluray (Florian Weimer <fweimer@...hat.com>)
Re: older fuseiso stuff (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: BD-J implementation in libbluray (Jean-Baptiste Kempf <jb@...eolan.org>)
Re: CVE request: BD-J implementation in libbluray (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: BD-J implementation in libbluray (Jean-Baptiste Kempf <jb@...eolan.org>)
Re: Re: CVE request: BD-J implementation in libbluray (Sven Schwedas <sven.schwedas@....at>)
CVE-2015-0275 -- Linux kernel: fs: ext4: fallocate zero range page size > block size BUG() (Petr Matousek <pmatouse@...hat.com>)
Re: CVE Request: mod-gnutls: GnuTLSClientVerify require is ignored (Sébastien Delafond <seb@...ian.org>)
Re: Re: CVE Request: cabextract -- directory traversal (Alexander Cherepanov <ch3root@...nwall.com>)
Re: CVE-2015-0881 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: jabberd remote information disclosure (Thijs Alkemade <me@...jsalkema.de>)
Re: [videolan] older issues in libbluray (Kurt Seifried <kseifried@...hat.com>)
Re: [videolan] older issues in libbluray (Jean-Baptiste Kempf <jb@...eolan.org>)
[OSSA 2015-004] Glance import task leaks image in backend (CVE-2014-9684, CVE-2015-1881) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
CVE request: unace (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities (Steffen Rösemann <steffen.roesemann1986@...il.com>)
Re: CVE Request: cabextract -- directory traversal (cve-assign@...re.org)
Re: CVE Request: jabberd remote information disclosure (cve-assign@...re.org)

February 24 (7 messages)

Re: CVE request: unace (cve-assign@...re.org)
Re: Summer bug cleaning - rpcbind -h option - REJECT CVE-2012-3541 (Kurt Seifried <kseifried@...hat.com>)
Please REJECT CVE-2012-6686 (Florian Weimer <fweimer@...hat.com>)
Re: Re: [videolan] older issues in libbluray (Tavis Ormandy <taviso@...gle.com>)
Re: Re: [videolan] older issues in libbluray (Jean-Baptiste Kempf <jb@...eolan.org>)
Re: Re: [videolan] older issues in libbluray (Tavis Ormandy <taviso@...gle.com>)
Re: CVE Request: Linux kernel information leak in event device handling (Moritz Muehlenhoff <jmm@...ian.org>)

February 25 (5 messages)

Re: CVE request: vulnerabilities in libcsoap (Patrick Coleman <blinken@...il.com>)
CVE-2015-2080 - Jetty remote unauthenticated credential exposure (cve-assign@...re.org)
Xen Security Advisory 118 (CVE-2015-1563) - arm: vgic: incorrect rate limiting of guest triggered logging (Xen.org security team <security@....org>)
Re: Fixing the glibc runtime linker (John Haxby <john.haxby@...cle.com>)
Re: CVE Request : Several Bugs Found on Libflac 1.3.1 and Libtta++-2.2 (Zhenghao Hu <zhenghaohuu@...il.com>)

February 26 (13 messages)

Re: CVE Request: mod-gnutls: GnuTLSClientVerify require is ignored (cve-assign@...re.org)
CVE request: glibc scanf implementation crashes on certain inputs (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: mod-gnutls: GnuTLSClientVerify require is ignored (Sébastien Delafond <sdelafond@...il.com>)
CVE request: Joomla Google Maps Plugin (Hanno Böck <hanno@...eck.de>)
CVE request: glibc: potential application crash due to overread in fnmatch (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: mod-gnutls: GnuTLSClientVerify require is ignored (cve-assign@...re.org)
XSS In Zope (Kurt Seifried <kseifried@...hat.com>)
CVE request: Linux kernel silently ignores MS_RDONLY for bind mounts (Daniel Micay <danielmicay@...il.com>)
CVE Request: null ptr deref in lame v3.99.5 (Brian Carpenter <brian.carpenter@...il.com>)
Re: CVE Request: null ptr deref in lame v3.99.5 (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE request: Joomla Google Maps Plugin (cve-assign@...re.org)
Re: CVE request: Linux kernel silently ignores MS_RDONLY for bind mounts (Daniel Micay <danielmicay@...il.com>)
Re: Requesting CVE for ImageMagick DoS (Jodie Cunningham <jodie.cunningham@...il.com>)

February 27 (6 messages)

Re: eCryptfs key wrapping help to crack user password (Tyler Hicks <tyhicks@...onical.com>)
Re: libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages - Linux kernel (cve-assign@...re.org)
Re: Re: CVE request: Joomla Google Maps Plugin (Hanno Böck <hanno@...eck.de>)
CVE request: RFC 4253 section 8 wooes (Florent Daigniere <florent.daigniere@...stmatta.com>)
dropbear and PuTTY missing DHE sanity checks [was: Re: CVE request: RFC 4253 section 8 wooes] (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE-2015-0296 preinstall scriptlet in texlive-base rpm of fedora allows unprivileged user to delete arbitrary files(maybe… (Siddharth Sharma <sisharma@...hat.com>)

February 28 (9 messages)

Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities (cve-assign@...re.org)
Re: CVE-Request -- MyBB v. 1.8.3 -- Multiple stored XSS-vulnerabilities (cve-assign@...re.org)
Re: eCryptfs key wrapping help to crack user password (cve-assign@...re.org)
CVE Request: PuTTY fails to clear private key information from memory (Patrick Coleman <blinken@...il.com>)
Re: CVE Request: PuTTY fails to clear private key information from memory (cve-assign@...re.org)
CVE request: pngcrush 1.7.83 crash bug (most likely exploitable) (Brian Carpenter <brian.carpenter@...il.com>)
Re: Re: CVE request: Linux kernel silently ignores MS_RDONLY for bind mounts (Rich Felker <dalias@...c.org>)
Re: Re: CVE request: Linux kernel silently ignores MS_RDONLY for bind mounts (Daniel Micay <danielmicay@...il.com>)
Re: CVE Request: PuTTY fails to clear private key information from memory (Zubin Mithra <zubin.mithra@...il.com>)

336 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.