Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list - 2015/03

Messages by day:

March 1 (4 messages)

• Re: CVE request: pngcrush 1.7.83 crash bug (most likely exploitable) (cve-assign@...re.org)
• Re: CVE-2015-0881 (Amos Jeffries <squid3@...enet.co.nz>)
• Re: CVE-2015-0881 (Jerome Athias <athiasjerome@...il.com>)
• Re: Re: CVE request: BD-J implementation in libbluray (Florian Weimer <fw@...eb.enyo.de>)

• CVE request: DokuWiki privilege escalation in RPC API (Sebastian Pipping <sebastian@...ping.org>)
• Re: CVE request: DokuWiki privilege escalation in RPC API (cve-assign@...re.org)
• Re: CVE request: Linux kernel silently ignores MS_RDONLY for bind mounts (Steven Stewart-Gallus <sstewartgallus00@...angara.bc.ca>)
• Re: CVE-2015-0881 (Kurt Seifried <kseifried@...hat.com>)
• CVE request: Maven downloads JARs via HTTP (Martin Prpic <mprpic@...hat.com>)
• Re: CVE request: Maven downloads JARs via HTTP (gremlin@...mlin.ru)
• Re: XSS In Zope (cve-assign@...re.org)
• Re: CVE request: Maven downloads JARs via HTTP (Martin Prpic <mprpic@...hat.com>)
• Re: CVE request: Maven downloads JARs via HTTP (gremlin@...mlin.ru)
• Re: CVE request: Maven downloads JARs via HTTP (Simon McVittie <smcv@...ian.org>)
• Re: CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities (cve-assign@...re.org)

• Debian / xterm #779397 (Kurt Seifried <kseifried@...hat.com>)
• Re: Debian / xterm #779397 (Thomas Dickey <dickey@....com>)
• Re: Re: Debian / xterm #779397 (Simon McVittie <smcv@...ian.org>)
• Re: validation on update (gremlin@...mlin.ru)
• Re: Re: Debian / xterm #779397 (Marcus Meissner <meissner@...e.de>)
• Re: CVE-Request: Linux ASLR mmap weakness: Reducing entropy by half (Hector Marco <hecmargi@....es>)
• Re: validation on update (Kurt Seifried <kseifried@...hat.com>)
• Re: Re: Debian / xterm #779397 (Stephane Chazelas <stephane.chazelas@...il.com>)
• Re: Possible CVE Requests: libmspack: several issues (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: CVE request: Maven downloads JARs via HTTP (cve-assign@...re.org)
• CVE request (Galen Charlton <gmc@...library.com>)
• PostgreSQL password hashing (Michael Samuel <mik@...net.net>)

• Re: CVE request - Evergreen (cve-assign@...re.org)
• Re: CVE request - Evergreen (Galen Charlton <gmc@...library.com>)
• Re: CVE request - Evergreen (cve-assign@...re.org)
• CVE request: PHPMoAdmin Unauthorized Remote Code Execution (Henri Salo <henri@...v.fi>)
• Re: CVE request: PHPMoAdmin Unauthorized Remote Code Execution (cve-assign@...re.org)
• CVE request: Invalid pointer dereference in the GNOME librest library (Florian Weimer <fweimer@...hat.com>)
• Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Donald Stufft <donald@...fft.io>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• unassigning CVE-2015-2104 (Paul McMillan <paul@...illan.ws>)

• Re: unassigning CVE-2015-2104 (Kurt Seifried <kseifried@...hat.com>)
• CVE-2014-6440: Heap Overflow in VLC Transcode Module (Bill Blough <devel@...ugh.us>)
• Re: [FD] Java 8u40 released: why? (Gsunde Orangen <gsunde.orangen@...il.com>)
• Xen Security Advisory 121 (CVE-2015-2044) - Information leak via internal x86 system device emulation (Xen.org security team <security@....org>)
• Xen Security Advisory 122 (CVE-2015-2045) - Information leak through version information hypercall (Xen.org security team <security@....org>)
• Certificate pinning and the browser PKI (Florian Weimer <fweimer@...hat.com>)
• Re: CVE Request: libarchive -- directory traversal in bsdcpio (Alessandro Ghedini <alessandro@...dini.me>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• Re: Certificate pinning and the browser PKI (Martin Hecht <hecht@...s.de>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Tomas Hoger <thoger@...hat.com>)
• Re: CVE Request: libarchive -- directory traversal in bsdcpio (Moritz Mühlenhoff <jmm@...til.org>)
• Re: unassigning CVE-2015-2104 (cve-assign@...re.org)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Michael Samuel <mik@...net.net>)

• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Re: unassigning CVE-2015-2104 (Amos Jeffries <squid3@...enet.co.nz>)
• CVE-Request: WeBid 1.1.1 Unrestricted File Upload Exploit (Prathan Phongthiproek <prathan.ptr@...il.com>)
• Re: CVE-Request: WeBid 1.1.1 Unrestricted File Upload Exploit (Henri Salo <henri@...v.fi>)
• Re: CVE-2015-0881 (Amos Jeffries <squid3@...enet.co.nz>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• CVE request: Ruby on Rails ActiveModel::Name to_json Call Infinite Loop Remote DoS (Martin Prpic <mprpic@...hat.com>)

• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Mono TLS vulnerabilities (Jo Shields <directhex@...box.org>)

• Re: Certificate pinning and the browser PKI (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• Multiple vulnerabilities in Untangle NGFW 9-11 (Hutton <c.e.hutton@...mail.com>)

• Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response. (Marek Kroemeke <kroemeke@...il.com>)
• Re: CVE Request: libarchive -- directory traversal in bsdcpio (Marcus Meissner <meissner@...e.de>)
• CVE-2014-8172 (John Haxby <john.haxby@...cle.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Please assign a CVE to this recent cups-filters vulnerability (Fabio Olive Leite <fleite@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• Instant v2.0 SQL Injection Vulnerability ("Steevee a.k.a Stefanus" <steevee.aka@...il.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)

• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Michael Samuel <mik@...net.net>)
• Xen Security Advisory 124 - Non-standard PCI device functionality may render pass-through insecure (Xen.org security team <security@....org>)
• Xen Security Advisory 120 (CVE-2015-2150) - Non-maskable interrupts triggerable by guests (Xen.org security team <security@....org>)
• Xen Security Advisory 123 (CVE-2015-2151) - Hypervisor memory corruption due to x86 emulator flaw (Xen.org security team <security@....org>)
• CVE Request: PHP 5.6.6 changelog (Francisco Alonso <falonsoe@...hat.com>)
• Re: PEP-466 common compatible implementation. (was ... CVE-2015-1777) (John Haxby <john.haxby@...cle.com>)
• Re: CVE request: Ruby on Rails ActiveModel::Name to_json Call Infinite Loop Remote DoS (cve-assign@...re.org)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE Request: Gtk2 Perl Module: incorrect memory management in Gtk2::Gdk::Display::list_devices (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: Instant v2.0 SQL Injection Vulnerability (cve-assign@...re.org)
• Re: Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response. (cve-assign@...re.org)
• Re: Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response. (Marek Kroemeke <kroemeke@...il.com>)
• less invalid memory access fixed (CVE-2014-9488) (Hanno Böck <hanno@...eck.de>)
• Re: Instant v2.0 SQL Injection Vulnerability (Solar Designer <solar@...nwall.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)

• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Michael Samuel <mik@...net.net>)
• Re: CVE Request: PHP 5.6.6 changelog (Francisco Alonso <falonsoe@...hat.com>)
• Re: CVE request: spencer regexp (Siddharth Sharma <siddharth@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (John Haxby <john.haxby@...cle.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Donald Stufft <donald@...fft.io>)
• Re: CVE request: spencer regexp (cve-assign@...re.org)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Michael Samuel <mik@...net.net>)

• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Re: CVE Request: PHP 5.6.6 changelog (Joshua Rogers <oss@...ernot.info>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Michael Samuel <mik@...net.net>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Kurt Seifried <kseifried@...hat.com>)
• Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 (Michael Samuel <mik@...net.net>)
• Xen Security Advisory 119 (CVE-2015-2152) - HVM qemu unexpectedly enabling emulated VGA graphics backends (Xen.org security team <security@....org>)
• Re: Re: CVE request: spencer regexp (Siddharth Sharma <siddharth@...hat.com>)
• Re: Re: CVE request: spencer regexp (Siddharth Sharma <siddharth@...hat.com>)
• Assign a CVE for Python's restkit Please (Donald Stufft <donald@...fft.io>)
• CVE request: lftp saves unknown host's fingerprint in known_hosts without any prompt (Vasyl Kaigorodov <vkaigoro@...hat.com>)
• Re: Re: CVE request: spencer regexp (Alistair Crooks <agc@...src.org>)
• Re: CVE Request: Gtk2 Perl Module: incorrect memory management in Gtk2::Gdk::Display::list_devices (cve-assign@...re.org)
• Re: CVE request: novnc: session hijack through insecurely set session token cookies (cve-assign@...re.org)
• Re: CVE request: glibc scanf implementation crashes on certain inputs (cve-assign@...re.org)

• Re: Vendor adoption of PIE INFO#934476 oss-security (Nick Kralevich <nnk@...gle.com>)
• Disabling reading of kernel log buffer reading for user (halfdog <me@...fdog.net>)
• Re: Disabling reading of kernel log buffer reading for user (Marek Kroemeke <kroemeke@...il.com>)
• Xen Security Advisory 98 (CVE-2014-3969) - insufficient permissions checks accessing guest memory on ARM (Xen.org security team <security@....org>)
• Re: Disabling reading of kernel log buffer reading for user (Jann Horn <jann@...jh.net>)
• Re: Disabling reading of kernel log buffer reading for user (Grandma Eubanks <tborland1@...il.com>)
• Re: Vendor adoption of PIE INFO#934476 oss-security (Solar Designer <solar@...nwall.com>)
• Xen Security Advisory 98 (CVE-2014-3969) - insufficient permissions checks accessing guest memory on ARM (Xen.org security team <security@....org>)
• Re: Vendor adoption of PIE INFO#934476 oss-security (Daniel Micay <danielmicay@...il.com>)
• [OSSA 2015-005] Nova console Cross-Site WebSocket hijacking (CVE-2015-0259) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
• CVE request: Linux kernel: tty: kobject reference leakage in tty_open (P J P <ppandit@...hat.com>)
• catdoc has bugs (Dean Pierce <pierce403@...il.com>)
• Re: Vendor adoption of PIE INFO#934476 oss-security (Nick Kralevich <nnk@...gle.com>)
• Re: CVE request: Linux kernel: tty: kobject reference leakage in tty_open (Greg KH <greg@...ah.com>)
• RE: CVE request: Linux kernel: tty: kobject reference leakage in tty_open ("Mehaffey, John" <John_Mehaffey@...tor.com>)
• Re: CVE request: Linux kernel: tty: kobject reference leakage in tty_open (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE request: Linux kernel: tty: kobject reference leakage in tty_open (cve-assign@...re.org)

• CVE-2015-2289: Serendipity CMS cross-site scripting vulnerability in 2.0 version (Henri Salo <henri@...v.fi>)
• CVE Request: XSS issue in MantisBT permalink_page.php (Damien Regad <dregad@...tisbt.org>)
• Re: CVE-2014-6316: URL redirection issue in MantisBT (Damien Regad <dregad@...tisbt.org>)
• CVE Request for python-requests session fixation vulnerability (Ian Cordasco <graffatcolmingov@...il.com>)
• CVE Request for information leak in Etherpad exports (Jeremy Stanley <fungi@...goth.org>)

• Re: CVE Request for python-requests session fixation vulnerability (cve-assign@...re.org)
• Re: CVE Request: XSS issue in MantisBT permalink_page.php (cve-assign@...re.org)
• Re: CVE Request for information leak in Etherpad exports (cve-assign@...re.org)
• Re: CVE request: vulnerabilities in libcsoap (cve-assign@...re.org)
• CVE Request - Apache Solr 4.10 (Puneeth Gowda <puneethis021@...il.com>)
• Re: CVE Request: PHP 5.6.6 changelog (cve-assign@...re.org)
• Re: CVE Request: libarchive -- directory traversal in bsdcpio (cve-assign@...re.org)

• Moodle security issues made public (Marina Glancy <marina@...dle.com>)
• CVE Request: Cap'n Proto: Several issues (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: CVE request: Linux kernel: tty: kobject reference leakage in tty_open (P J P <ppandit@...hat.com>)
• CVE Request: memory leak in openssl "hostname" TLS Extension (Marcus Meissner <meissner@...e.de>)
• Re: CVE request: spencer regexp (cve-assign@...re.org)
• Re: CVE Request: memory leak in openssl "hostname" TLS Extension (Vitezslav Cizek <civ@...ma.cz>)
• Re: CVE Request: memory leak in openssl "hostname" TLS Extension (cve-assign@...re.org)
• CVE-2015-0263 and CVE-2015-0264 - Apache Camel medium disclosure vulnerability (Christian Mueller <cmueller@...che.org>)

• Fwd: [openssl-announce] Forthcoming OpenSSL releases (Solar Designer <solar@...nwall.com>)
• Re: Fwd: [openssl-announce] Forthcoming OpenSSL releases (Solar Designer <solar@...nwall.com>)
• Re: CVE Request: Cap'n Proto: Several issues (cve-assign@...re.org)
• [CVE-2015-0250] Apache Batik information disclosure vulnerability (Luis Bernardo <lbernardo@...che.org>)
• Fwd: [ANNOUNCE] X.Org Security Advisory: More BDF file parsing issues in libXfont (Alan Coopersmith <alan.coopersmith@...cle.com>)
• Re: Fwd: [ANNOUNCE] X.Org Security Advisory: More BDF file parsing issues in libXfont (Sven Schwedas <sven.schwedas@....at>)
• Re: Fwd: [ANNOUNCE] X.Org Security Advisory: More BDF file parsing issues in libXfont (Alan Coopersmith <alan.coopersmith@...cle.com>)
• Incomplete data at nvd for CVE-2014-8159 (infiniband / verbs) (Peter Kjellström <cap@....liu.se>)
• Re: Mono TLS vulnerabilities (cve-assign@...re.org)
• Re: Incomplete data at nvd for CVE-2014-8159 (infiniband / verbs) (cve-assign@...re.org)
• CVE Request: WebKitGTK+ late TLS certificate verification (Michael Catanzaro <mcatanzaro@...lia.com>)

• CVE Request: ZIP Integer Overflow leads to writing past heap boundary (Emmanuel Law <emmanuel.law@...il.com>)
• Re: Fwd: [openssl-announce] Forthcoming OpenSSL releases (Solar Designer <solar@...nwall.com>)
• Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary (cve-assign@...re.org)
• Re: CVE Request: WebKitGTK+ late TLS certificate verification (cve-assign@...re.org)
• Re: Fwd: [openssl-announce] Forthcoming OpenSSL releases (Christian Rebischke <chris.rebischke@...il.com>)
• CVE Request: Linux kernel unprivileged denial-of-service due to mis-protected xsave/xrstor instructions. (Quentin Casasnovas <quentin.casasnovas@...cle.com>)
• CVE Request: Linux kernel execution in the early microcode loader. (Quentin Casasnovas <quentin.casasnovas@...cle.com>)
• Re: Fwd: [openssl-announce] Forthcoming OpenSSL releases (Solar Designer <solar@...nwall.com>)
• Re: CVE Request: Linux kernel execution in the early microcode loader. (Florian Weimer <fweimer@...hat.com>)
• Re: CVE Request: Linux kernel execution in the early microcode loader. (Daniel Micay <danielmicay@...il.com>)
• Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary (Timo Warns <Timo.Warns@...il.com>)
• Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary (Emmanuel Law <emmanuel.law@...il.com>)
• Re: Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary (Timo Warns <Timo.Warns@...il.com>)
• Re: Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary (Emmanuel Law <emmanuel.law@...il.com>)
• CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Shachar Raindel <raindel@...lanox.com>)

• Re: CVE Request: Linux kernel execution in the early microcode loader. (Florian Weimer <fweimer@...hat.com>)
• OpenSSL sec. advisory (mancha <mancha1@...o.com>)
• cve-assign delays ("Steven M. Christey" <coley@...re.org>)
• Re: cve-assign delays (Kurt Seifried <kseifried@...hat.com>)
• CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 (Pere Orga <pere@...a.cat>)

• Xerces-C Security Advisory [CVE-2015-0252] ("Cantor, Scott" <cantor.2@....edu>)
• Re: CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 (cve-assign@...re.org)
• OpenDaylight security advisory: CVE-2015-1778 authentication bypass, CVE-2015-1611 CVE-2015-1612 topology spoofing via LLDP (David Jorm <david.jorm@...il.com>)
• membership request to the closed linux-distros security mailing list (Sona Sarmadi <sona.sarmadi@...a.com>)
• Re: membership request to the closed linux-distros security mailing list (Solar Designer <solar@...nwall.com>)
• Re: membership request to the closed linux-distros security mailing list (Anthony Liguori <anthony@...emonkey.ws>)
• Re: membership request to the closed linux-distros security mailing list (Stuart Henderson <stu@...cehopper.org>)
• Re: membership request to the closed linux-distros security mailing list (Anthony Liguori <anthony@...emonkey.ws>)
• Re: membership request to the closed linux-distros security mailing list (Marcus Meissner <meissner@...e.de>)
• Re: membership request to the closed linux-distros security mailing list (Anthony Liguori <anthony@...emonkey.ws>)
• Re: membership request to the closed linux-distros security mailing list (Kurt Seifried <kseifried@...hat.com>)
• CVE request: denial of service in Quassel (Pierre Schweitzer <pierre@...ctos.org>)
• Re: membership request to the closed linux-distros security mailing list (Daniel Micay <danielmicay@...il.com>)
• CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Andrea Palazzo <andrea.palazzo@...el.it>)
• Re: membership request to the closed linux-distros security mailing list (John Haxby <john.haxby@...cle.com>)
• Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: CVE Request: Linux kernel unprivileged denial-of-service due to mis-protected xsave/xrstor instructions. (cve-assign@...re.org)
• Re: CVE Request: Linux kernel execution in the early microcode loader. (cve-assign@...re.org)
• Re: membership request to the closed linux-distros security mailing list (Alan Coopersmith <alan.coopersmith@...cle.com>)

• Possible CVE Request: dulwich: does not prevent to write files in commits with invalid paths to working tree (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: CVE Request: Linux kernel unprivileged denial-of-service due to mis-protected xsave/xrstor instructions. (Quentin Casasnovas <quentin.casasnovas@...cle.com…)
• Re: CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 (Pere Orga <pere@...a.cat>)

• Re: CVE Request: Linux kernel unprivileged denial-of-service due to mis-protected xsave/xrstor instructions. (cve-assign@...re.org)
• CVE for Kali Linux (Kurt Seifried <kseifried@...hat.com>)
• rsyslog/logs/1 minute off (another RISKS thing) (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux (Justin Steven <justin@...tinsteven.com>)
• Re: CVE for Kali Linux (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Re: CVE for Kali Linux (Russ Allbery <eagle@...ie.org>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Re: CVE for Kali Linux (Michael Samuel <mik@...net.net>)
• Re: CVE for Kali Linux (Amos Jeffries <squid3@...enet.co.nz>)
• Re: CVE for Kali Linux (Florian Weimer <fw@...eb.enyo.de>)
• Re: CVE for Kali Linux (Florian Weimer <fw@...eb.enyo.de>)
• Re: membership request to the closed linux-distros security mailing list (Florian Weimer <fw@...eb.enyo.de>)
• Re: membership request to the closed linux-distros security mailing list (Florian Weimer <fw@...eb.enyo.de>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Dulwich security issue (Jelmer Vernooij <jelmer@...ba.org>)
• Re: CVE for Kali Linux (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux (Jeremy Stanley <jeremy@...nstack.org>)
• Re: CVE for Kali Linux (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux ("David A. Wheeler" <dwheeler@...eeler.com>)
• CVE-Request -- openEMR v. 4.2.0 -- Multiple stored/reflecting XSS- and SQLi vulns (Steffen Rösemann <steffen.roesemann1986@...il.com>)
• Re: CVE for Kali Linux (Solar Designer <solar@...nwall.com>)
• Re: Possible CVE Request: dulwich: does not prevent to write files in commits with invalid paths to working tree (cve-assign@...re.org)
• Re: CVE for Kali Linux (Solar Designer <solar@...nwall.com>)
• Re: CVE for Kali Linux (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux (Donald Stufft <donald@...fft.io>)
• Re: CVE for Kali Linux ("David A. Wheeler" <dwheeler@...eeler.com>)
• Re: Assign a CVE for Python's restkit Please (Donald Stufft <donald@...fft.io>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• OpenSSL DoS tester now available (CVE-2015-0291) (mancha <mancha1@...o.com>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• CVE requests for Drupal contributed modules (Pere Orga <pere@...a.cat>)
• Re: CVE for Kali Linux (Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>)
• Re: CVE for Kali Linux (Stephen Kitt <steve@....org>)
• Re: CVE for Kali Linux (Jeremy Stanley <fungi@...goth.org>)
• Re: CVE for Kali Linux (Alexander Cherepanov <ch3root@...nwall.com>)
• Re: CVE for Kali Linux (Alexander Cherepanov <cherepan@...me.ru>)
• Re: CVE for Kali Linux (Russ Allbery <eagle@...ie.org>)
• Re: CVE for Kali Linux (Solar Designer <solar@...nwall.com>)

• Re: CVE for Kali Linux (Russ Allbery <eagle@...ie.org>)
• Re: CVE for Kali Linux (cve-assign@...re.org)
• Re: CVE for Kali Linux ("David A. Wheeler" <dwheeler@...eeler.com>)
• Re: CVE for Kali Linux (Daniel Micay <danielmicay@...il.com>)
• Re: CVE for Kali Linux (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux (Solar Designer <solar@...nwall.com>)
• Re: Assign a CVE for Python's restkit Please (cve-assign@...re.org)
• Re: CVE request: Invalid pointer dereference in the GNOME librest library (cve-assign@...re.org)
• Re: CVE for Kali Linux (Alexander Cherepanov <ch3root@...nwall.com>)
• Re: CVE for Kali Linux (Alexander Cherepanov <ch3root@...nwall.com>)
• Re: CVE for Kali Linux (Marcus Meissner <meissner@...e.de>)
• CVE requests for shibboleth service provider (Yves-Alexis Perez <corsac@...ian.org>)
• CVE Request: gd buffer read overflow in gd_gif_in.c (Francisco Alonso <falonsoe@...hat.com>)
• CVE Request: Linux kernel: sys_sendto/sys_recvfrom does not validate the user provided ubuf pointer (Petr Matousek <pmatouse@...hat.com>)
• Re: CVE requests for shibboleth service provider (cve-assign@...re.org)
• Re: CVE Request: gd buffer read overflow in gd_gif_in.c (Moritz Muehlenhoff <jmm@...ian.org>)
• CVE request: Two vulnerabilities in Tor (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: CVE Request: gd buffer read overflow in gd_gif_in.c (cve-assign@...re.org)
• CVE request: Chamilo LMS 1.9.10 Multiple XSS & CSRF Vulnerabilities (Henri Salo <henri@...v.fi>)
• CVE-2015-0841: off-by-one error in network code of monopd/libcapsinetwork (Florian Weimer <fw@...eb.enyo.de>)
• Re: CVE for Kali Linux (Alexander Cherepanov <ch3root@...nwall.com>)
• Re: CVE Request: Linux kernel: sys_sendto/sys_recvfrom does not validate the user provided ubuf pointer (cve-assign@...re.org)
• Re: CVE requests for shibboleth service provider (Yves-Alexis Perez <corsac@...ian.org>)
• Re: CVE for Kali Linux (Marcus Meissner <meissner@...e.de>)
• Re: CVE Request: ZIP Integer Overflow leads to writing past heap boundary (Thomas Klausner <tk@...a.or.at>)

• CVE request for OpenStack Compute (nova) (Garth Mollett <gmollett@...hat.com>)
• CVE-2014-8166 cups: code execution via unescape ANSI escape sequences (Kurt Seifried <kseifried@...hat.com>)
• CVE-2015-1820: ruby rest-client session fixation vulnerability (Andy Brody <andy@...ody.com>)
• CVE request Qemu: malicious PRDT flow from guest to host (P J P <ppandit@...hat.com>)
• Re: CVE-2014-8166 cups: code execution via unescape ANSI escape sequences (Dave Horsfall <dave@...sfall.org>)
• 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE request: Two vulnerabilities in Tor (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: CVE request: Two vulnerabilities in Tor (Kurt Seifried <kseifried@...hat.com>)
• CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder (Petr Matousek <pmatouse@...hat.com>)
• Re: CVE request for OpenStack Compute (nova) (cve-assign@...re.org)
• CVE request Linux kernel: fs: btrfs: non-atomic xattr replace operation (P J P <ppandit@...hat.com>)
• Re: CVE request for OpenStack Compute (nova) (Garth Mollett <gmollett@...hat.com>)
• Re: CVE for Kali Linux (Marcus Meissner <meissner@...e.de>)
• Re: Re: CVE request for OpenStack Compute (nova) (Jeremy Stanley <jeremy@...nstack.org>)
• Re: CVE-2014-8166 cups: code execution via unescape ANSI escape sequences (Florian Weimer <fw@...eb.enyo.de>)
• Re: CVE request: Two vulnerabilities in Tor (Kurt Seifried <kseifried@...hat.com>)
• Re: CVE for Kali Linux (Alexander Cherepanov <ch3root@...nwall.com>)
• Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier (Florian Weimer <fw@...eb.enyo.de>)
• Re: CVE request Linux kernel: fs: btrfs: non-atomic xattr replace operation (cve-assign@...re.org)
• CVE-2013-1666 description still missing (Henri Salo <henri@...v.fi>)
• Re: CVE request: Two vulnerabilities in Tor (cve-assign@...re.org)
• Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier (Kurt Seifried <kseifried@...hat.com>)
• Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier (Eric Windisch <ewindisch@...ker.com>)

• CVE Request: Multiple vulnerabilities in freexl 1.0.0g (Jodie Cunningham <jodie.cunningham@...il.com>)
• Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier (Trevor Jay <tjay@...hat.com>)
• Re: CVE request for OpenStack Compute (nova) (cve-assign@...re.org)
• CVS-Request: realmd code execution/auth bypass (Sebastian Krahmer <krahmer@...e.de>)
• Re: CVE request for OpenStack Compute (nova) (Jeremy Stanley <jeremy@...nstack.org>)
• Re: CVS-Request: realmd code execution/auth bypass (Sebastian Krahmer <krahmer@...e.de>)
• Re: CVS-Request: realmd code execution/auth bypass (cve-assign@...re.org)

• Fwd: setroubleshoot root exploit (CVE-Request) (Sebastian Krahmer <krahmer@...e.de>)
• Re: Fwd: setroubleshoot root exploit (CVE-Request) (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
• Re: Fwd: setroubleshoot root exploit (CVE-Request) (Solar Designer <solar@...nwall.com>)
• Re: CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 (cve-assign@...re.org)

• Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (cve-assign@...re.org)
• Re: CVE request: denial of service in Quassel (Pierre Schweitzer <pierre@...ctos.org>)
• Re: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (Alexander Cherepanov <ch3root@...nwall.com>)
• CVE-Request: AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5%. (Hector Marco <hecmargi@....es>)
• Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (Jodie Cunningham <jodie.cunningham@...il.com>)
• CVE request: Erlang POODLE TLS vulnerability (Hanno Böck <hanno@...eck.de>)
• Fwd: Insecure file upload in Berta CMS (Simon Waters <simon.waters@...evine.com>)
• Re: CVE-Request: AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5%. (Solar Designer <solar@...nwall.com>)
• Re: CVE request: Erlang POODLE TLS vulnerability (cve-assign@...re.org)
• Re: CVE request: denial of service in Quassel (cve-assign@...re.org)
• Re: CVE request: denial of service in Quassel (Pierre Schweitzer <pierre@...ctos.org>)
• Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (cve-assign@...re.org)
• Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (cve-assign@...re.org)

• Advisory: CVE-2014-9707: GoAhead Web Server 3.0.0 - 3.4.1 (Matthew Daley <mattd@...fuzz.com>)
• Advisory: CVE-2014-9708: Appweb Web Server (Matthew Daley <mattd@...fuzz.com>)
• Re: CVE request: denial of service in Quassel (cve-assign@...re.org)
• Re: Fwd: Insecure file upload in Berta CMS (cve-assign@...re.org)
• CVE Request: arj: free on invalid pointer due to to buffer overflow (Salvatore Bonaccorso <carnil@...ian.org>)
• New Rootkit - Lightweight rootkit implemented by bash shell scripts v0.10 (wzt wzt <wzt.wzt@...il.com>)
• CVE request (Debian specific): slapd: dangerous access rule in default config (Yves-Alexis Perez <corsac@...ian.org>)

• Re: CVE Request: arj: free on invalid pointer due to to buffer overflow (cve-assign@...re.org)
• Re: CVE request (Debian specific): slapd: dangerous access rule in default config (cve-assign@...re.org)
• CVE request: XSS in roundcube before 1.1.0 (Hanno Böck <hanno@...eck.de>)
• Fw: GNU Libtasn1 4.4 released ( fixes stack overflow in asn1_der_decoding) (Hanno Böck <hanno@...eck.de>)
• CVE request: 2 issues in inspircd (Sébastien Delafond <sdelafond@...il.com>)
• Re: CVE request: XSS in roundcube before 1.1.0 (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: potrace: possible heap overflow (cve-assign@...re.org)
• Re: byzanz: Out-of heap-based buffer write in GIF encoder (cve-assign@...re.org)
• Re: some older pbm2l2030 stuff (cve-assign@...re.org)

• CVE Request: CSRF in Realms Wiki (Javantea <jvoss@...sci.com>)
• CVE Request: Remote Code Execution in Realms Wiki install.sh (Javantea <jvoss@...sci.com>)
• Security advisory for musl libc - stack-based buffer overflow in ipv6 literal parsing [CVE-2015-1817] (Rich Felker <dalias@...c.org>)
• CVE Request: DBD-Firebird: Buffer Overflow in dbdimp.c (Salvatore Bonaccorso <carnil@...ian.org>)
• CVE Request: ikiwiki: cross-site scripting via openid_identifier (Salvatore Bonaccorso <carnil@...ian.org>)
• Re: some older pbm2l2030 stuff (Vasyl Kaigorodov <vkaigoro@...hat.com>)
• Re: Insecure file upload in Berta CMS (Simon Waters <simon.waters@...evine.com>)
• CVE Request: ikiwiki: cross-site scripting via openid_identifier (Vasyl Kaigorodov <vkaigoro@...hat.com>)
• Re: CVS-Request: realmd code execution/auth bypass (Sebastian Krahmer <krahmer@...e.de>)
• Re: CVE Request: DBD-Firebird: Buffer Overflow in dbdimp.c (cve-assign@...re.org)
• Re: CVS-Request: realmd code execution/auth bypass (cve-assign@...re.org)
• Re: CVE Request: ikiwiki: cross-site scripting via openid_identifier (Simon McVittie <smcv@...ian.org>)
• Fwd: CVE-2015-0249: Apache Roller allows admin users to execute arbitrary Java code (Dave <snoopdave@...il.com>)
• Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Tomas Hoger <thoger@...hat.com>)
• Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Tyler Hicks <tyhicks@...onical.com>)

• Re: CVE Request: ikiwiki: cross-site scripting via openid_identifier (cve-assign@...re.org)
• Re: Fw: GNU Libtasn1 4.4 released ( fixes stack overflow in asn1_der_decoding) (cve-assign@...re.org)
• Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Lior Kaplan <kaplanlior@...il.com>)
• CVE request: freebsd/sh stack overflow vulnerability (wzt wzt <wzt.wzt@...il.com>)
• Xen Security Advisory 125 (CVE-2015-2752) - Long latency MMIO mapping operations are not preemptible (Xen.org security team <security@....org>)
• Xen Security Advisory 127 (CVE-2015-2751) - Certain domctl operations may be abused to lock up the host (Xen.org security team <security@....org>)
• Xen Security Advisory 126 (CVE-2015-2756) - Unmediated PCI command register access in qemu (Xen.org security team <security@....org>)
• Xen Security Advisory 120 (CVE-2015-2150) - Non-maskable interrupts triggerable by guests (Xen.org security team <security@....org>)
• Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier (Florian Weimer <fw@...eb.enyo.de>)

355 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.