oss-security mailing list - 2015/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 8	² 24	³ 13	⁴ 4	⁵ 2
⁶ 8	⁷ 11	⁸ 11	⁹ 12	¹⁰ 11	¹¹ 10	¹² 2
¹³ 11	¹⁴ 20	¹⁵ 22	¹⁶ 27	¹⁷ 10	¹⁸ 4	¹⁹ 6
²⁰ 11	²¹ 8	²² 12	²³ 27	²⁴ 5	²⁵ 7	²⁶ 3
²⁷ 8	²⁸ 8	²⁹ 8	³⁰ 6

Messages by day:

April 1 (8 messages)

CVE request: MediaWiki 1.24.2/1.23.9/1.19.24 (Chris Steipp <csteipp@...imedia.org>)
Remote file upload vulnerability in wordpress plugin videowhisper-video-presentation v3.31.17 ("Larry W. Cashdollar" <larry0@...com>)
Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8 ("Larry W. Cashdollar" <larry0@...com>)
Signature Bypass in several JSON Web Token Libraries (CVEs Needed?) ("Jeremy Spilman" <jeremy@...link.co>)
CVE-2015-1845, CVE-2015-1846 - unzoo - Buffer overflow & Infinite loop (William Robinet <william.robinet@...ostix.com>)
[SECURITY ANNOUNCEMENT] CVE-2015-0225 (Jake Luciani <jake@...che.org>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Roland Dreier <roland@...estorage.com>)
CVE request: Buffer overflow in das_watchdog (Florian Weimer <fw@...eb.enyo.de>)

April 2 (24 messages)

CVE Request: Linux mishandles int80 fork from 64-bit tasks (Andrew Lutomirski <luto@...nel.org>)
RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Shachar Raindel <raindel@...lanox.com>)
RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Shachar Raindel <raindel@...lanox.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
RE: membership request to the closed linux-distros security mailing list (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Shachar Raindel <raindel@...lanox.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Shachar Raindel <raindel@...lanox.com>)
RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Shachar Raindel <raindel@...lanox.com>)
Re: CVE Request: Linux mishandles int80 fork from 64-bit tasks (cve-assign@...re.org)
Re: CVE request: Buffer overflow in das_watchdog (cve-assign@...re.org)
Re: cve-assign delays (mancha <mancha1@...o.com>)
Re: Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8 ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
Re: membership request to the closed linux-distros security mailing list (Kash Pande <kash@...pleback.net>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Roland Dreier <roland@...estorage.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Haggai Eran <haggaie@...lanox.com>)
CVE Request : IPv6 Hop limit lowering via RA messages ("D.S. Ljungmark" <ljungmark@...io.se>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Haggai Eran <haggaie@...lanox.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Solar Designer <solar@...nwall.com>)
Re: membership request to the closed linux-distros security mailing list (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request : IPv6 Hop limit lowering via RA messages (Dan McDonald <danmcd@...iti.com>)

April 3 (13 messages)

Fwd: CVE Request : IPv6 Hop limit lowering via RA messages (Eitan Adler <lists@...anadler.com>)
Re: membership request to the closed linux-distros security mailing list (Daniel Micay <danielmicay@...il.com>)
Re: Re: libyaml / YAML-LibYAML DoS (Jan Rusnacko <jrusnack@...hat.com>)
Re: CVE Request : IPv6 Hop limit lowering via RA messages (Jim Thompson <jim@...gate.com>)
Re: CVE Request : IPv6 Hop limit lowering via RA messages ("D.S. Ljungmark" <ljungmark@...io.se>)
Re: CVE Request : IPv6 Hop limit lowering via RA messages (Loganaden Velvindron <loganaden@...il.com>)
Linux namespaces: It is possible to escape from bind mounts (Jann Horn <jann@...jh.net>)
Palinopsia bug (Hanno Böck <hanno@...eck.de>)
RE: membership request to the closed linux-distros security mailing list (Sona Sarmadi <sona.sarmadi@...a.com>)
Request CVE for LinuxNode - DoS vulnerability ("Iain R. Learmonth" <irl@...e.org>)
Re: membership request to the closed linux-distros security mailing list (Seth Arnold <seth.arnold@...onical.com>)
CVE request: Caja / MATE Desktop Environment: caja automounts USB flash drives and CD/DVD drives while session is locke… (Mike Gabriel <mike.gabriel@...-netzwerk…)
Re: membership request to the closed linux-distros security mailing list (Seth Arnold <seth.arnold@...onical.com>)

April 4 (4 messages)

Re: Request CVE for LinuxNode - DoS vulnerability (cve-assign@...re.org)
Re: CVE Request : IPv6 Hop limit lowering via RA messages (cve-assign@...re.org)
Re: CVE request: Caja / MATE Desktop Environment: caja automounts USB flash drives and CD/DVD drives while session is locked (cve-assign@...re.org)
Re: Linux namespaces: It is possible to escape from bind mounts (cve-assign@...re.org)

April 5 (2 messages)

CVE request: XSS in WP Super Cache < 1.4.3 (Hanno Böck <hanno@...eck.de>)
Re: CVE request: XSS in WP Super Cache < 1.4.3 (Matthew Daley <mattd@...fuzz.com>)

April 6 (8 messages)

CVE request: WordPress plugin wassup cross-site scripting vulnerability (Henri Salo <henri@...v.fi>)
Re: Advisory: CVE-2014-9708: Appweb Web Server (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: Request CVE for LinuxNode - DoS vulnerability (cve-assign@...re.org)
Socat security advisory 6 - Possible DoS with fork (update: CVE-Id: CVE-2015-1379; fix for version 2) (Gerhard Rieger <gerhard@...t-unreach.org>)
CVE Request: tor: new upstream releases (0.2.6.7, 0.2.5.12 and 0.2.4.27) fixing security issues (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: tor: new upstream releases (0.2.6.7, 0.2.5.12 and 0.2.4.27) fixing security issues (cve-assign@...re.org)
Re: Linux namespaces: It is possible to escape from bind mounts (Andy Lutomirski <luto@...nel.org>)
Re: Linux namespaces: It is possible to escape from bind mounts (cve-assign@...re.org)

April 7 (11 messages)

CVE request: Module::Signature before 0.75 - multiple vulnerabilities (John Lightsey <john@...nuts.net>)
Re: Re: CVE Request : IPv6 Hop limit lowering via RA messages (Marcus Meissner <meissner@...e.de>)
Re: CVE request: MediaWiki 1.24.2/1.23.9/1.19.24 (cve-assign@...re.org)
ntp security release today (Marcus Meissner <meissner@...e.de>)
Re: ntp security release today (Kurt Seifried <kseifried@...hat.com>)
CVE-2015-1773 Apache Flex reflected XSS vulnerability (Tom Chiverton <tomc@...che.org>)
Hanno Boeck found Heartbleed using afl + ASan! ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Hanno Boeck found Heartbleed using afl + ASan! (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Hanno Boeck found Heartbleed using afl + ASan! (Seth Arnold <seth.arnold@...onical.com>)
chrony security release as well (Kurt Seifried <kseifried@...hat.com>)
redcarpet <=3.2.2 (and related ruby gems) allow for possible XSS via autolinking of untrusted markdown (Reed Loden <reed@...dloden.com>)

April 8 (11 messages)

CVE request netfilter connection tracking accounting. (Wade Mealing <wmealing@...hat.com>)
Re: Hanno Boeck found Heartbleed using afl + ASan! ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Hanno Boeck found Heartbleed using afl + ASan! (Michal Zalewski <lcamtuf@...edump.cx>)
CVE Request: libX11: buffer overflow in MakeBigReq macro (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Hanno Boeck found Heartbleed using afl + ASan! ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access (Yann Droneaud <ydroneaud@...eya.com>)
CVE Request for Icecast 2.3.3, 2.4.0, 2.4.1, fixed in 2.4.2 ("Thomas B. Rücker" <thomas@...cker.fi>)
Re: CVE Request for Icecast 2.3.3, 2.4.0, 2.4.1, fixed in 2.4.2 ("Thomas B. Rücker" <thomas@...cker.fi>)
Re: CVE request netfilter connection tracking accounting. - Linux kernel (cve-assign@...re.org)
Re: CVE Request for Icecast 2.3.3, 2.4.0, 2.4.1, fixed in 2.4.2 (cve-assign@...re.org)

April 9 (12 messages)

Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (cve-assign@...re.org)
Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Tomas Hoger <thoger@...hat.com>)
Re: Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (Florian Weimer <fweimer@...hat.com>)
Re: Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE request: ntp-keygen may generate non-random symmetric keys on big-endian systems (Martin Prpic <mprpic@...hat.com>)
Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder (Petr Matousek <pmatouse@...hat.com>)
Re: Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (Yann Droneaud <ydroneaud@...eya.com>)
Re: Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE Request for ceph-deploy world-readable keyring permissions (Andreas Stieger <astieger@...e.de>)
CVE request: Incorrect default permissions in Zarafa (zarafa-search-plus) (Robert Scheck <robert@...oraproject.org>)
Re: CVE Request for ceph-deploy world-readable keyring permissions (cve-assign@...re.org)
Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (cve-assign@...re.org)

April 10 (11 messages)

Apache Tomcat partial file upload DoS CVE-2014-0230 (Kurt Seifried <kseifried@...hat.com>)
CVE request - NodeBB Persistent XSS through Markdown (Shubham Shah <admin@...bh.am>)
CVE Request: MySQL Null Pointer Dereference (Joshua Rogers <oss@...ernot.info>)
Re: Re: [CVE Requests] rsync and librsync collisions (Vitezslav Cizek <civ@...ma.cz>)
Re: CVE Request: MySQL Null Pointer Dereference (Tomas Hoger <thoger@...hat.com>)
Kernel oops on 32 bits arch (Pierre Schweitzer <pierre@...ctos.org>)
REJECT CVE-2015-1861 (Kurt Seifried <kseifried@...hat.com>)
CVE-2015-0276: Kallithea: Lack of CSRF attack protection enables gaining unauthorised access to users' accounts (Andrew Shadura <andrew@...dura.me>)
Re: Re: [CVE Requests] rsync and librsync collisions (mancha <mancha1@...o.com>)
Re: CVE request - NodeBB Persistent XSS through Markdown (cve-assign@...re.org)
CVE Request for read-only directory traversal in Etherpad Minify (Jeremy Stanley <fungi@...goth.org>)

April 11 (10 messages)

Re: CVE Request for read-only directory traversal in Etherpad Minify (cve-assign@...re.org)
Re: Re: [CVE Requests] rsync and librsync collisions (Michael Samuel <mik@...net.net>)
Re: Re: [CVE Requests] rsync and librsync collisions (Michael Samuel <mik@...net.net>)
Re: Re: [CVE Requests] rsync and librsync collisions (mancha <mancha1@...o.com>)
Re: Re: [CVE Requests] rsync and librsync collisions (mancha <mancha1@...o.com>)
Re: Re: [CVE Requests] rsync and librsync collisions (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [CVE Requests] rsync and librsync collisions (Michael Samuel <mik@...net.net>)
Re: Re: [CVE Requests] rsync and librsync collisions (Kurt Seifried <kseifried@...hat.com>)
CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6 (Matthew Daley <mattd@...fuzz.com>)
Re: CVE Request for read-only directory traversal in Etherpad frontend tests (Jeremy Stanley <fungi@...goth.org>)

April 12 (2 messages)

Corrections to CVE-2015-3297 (Jeremy Stanley <fungi@...goth.org>)
CVE Request for incomplete fix to CVE-2015-3297 in Etherpad Minify (Jeremy Stanley <fungi@...goth.org>)

April 13 (11 messages)

net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability (罗大龙 <luodalongde@...il.com>)
Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6 (cve-assign@...re.org)
Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6 (Matthew Daley <mattd@...fuzz.com>)
CVE request for buffer overflow in ppp (Sébastien Delafond <seb@...ian.org>)
CVE request: libksba version 1.3.3 fixes multiple security issues (Vasyl Kaigorodov <vkaigoro@...hat.com>)
discourage "CVE only" use of (linux-)distros (Solar Designer <solar@...nwall.com>)
Re: CVE request: freebsd/sh stack overflow vulnerability (Mark Felder <feld@...d.me>)
Re: CVE request: libksba version 1.3.3 fixes multiple security issues (Hanno Böck <hanno@...eck.de>)
Re: discourage "CVE only" use of (linux-)distros (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6 (cve-assign@...re.org)
CVE-2015-1867 pacemaker: acl read-only access allow role assignment (Kurt Seifried <kseifried@...hat.com>)

April 14 (20 messages)

Re: Kernel oops on 32 bits arch (cve-assign@...re.org)
Re: CVE request for some NTP stuff (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: discourage "CVE only" use of (linux-)distros (cve-assign@...re.org)
Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 1… ("Hannes Trunde" <hannes.trunde@...il.co…)
Re: Problems in automatic crash analysis frameworks (cve-assign@...re.org)
Re: Re: Problems in automatic crash analysis frameworks (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Re: CVE Request: libX11: buffer overflow in MakeBigReq macro (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Kurt Seifried <kseifried@...hat.com>)
[OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
[CVE-2015-1866] Ember.js XSS Vulnerability With {{view "select"}} Options ("Matthew Beale" <mbeale@...tlabs.com>)
CVE-2015-1864: Multiple HTML and Javascript injections (Andrew Shadura <andrew@...dura.me>)
[OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
TCP Fast Open local DoS in some Linux stable branches (Ben Hutchings <ben@...adent.org.uk>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Buffer overruns in Linux kernel RFC4106 implementation using AESNI (Ben Hutchings <ben@...adent.org.uk>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tyler Hicks <tyhicks@...onical.com>)
Re: Re: Problems in automatic crash analysis frameworks (Marc Deslauriers <marc.deslauriers@...onical.com>)

April 15 (22 messages)

Re: Re: Problems in automatic crash analysis frameworks (Michael Samuel <mik@...net.net>)
proftpd: Unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy (Hanno Böck <hanno@...eck.de>)
Re: Re: Problems in automatic crash analysis frameworks (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: proftpd: Unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy (cve-assign@...re.org)
Re: jar(1) -- directory traversal (Moritz Muehlenhoff <jmm@...ian.org>)
double-free in gnutls (CRL distribution points parsing) (Robert Święcki <robert@...ecki.net>)
Re: Problems in automatic crash analysis frameworks (Florian Weimer <fweimer@...hat.com>)
Re: Re: Problems in automatic crash analysis frameworks (Florian Weimer <fweimer@...hat.com>)
Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tyler Hicks <tyhicks@...onical.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tyler Hicks <tyhicks@...onical.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: CVE request: 2 issues in inspircd (Salvatore Bonaccorso <carnil@...ian.org>)
Re: TCP Fast Open local DoS in some Linux stable branches (Ben Hutchings <ben@...adent.org.uk>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Problems in automatic crash analysis frameworks (Hanno Böck <hanno@...eck.de>)
Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Problems in automatic crash analysis frameworks (Jakub Filak <jfilak@...hat.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)

April 16 (27 messages)

Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Problems in automatic crash analysis frameworks (cve-assign@...re.org)
Re: Re: Problems in automatic crash analysis frameworks (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Problems in automatic crash analysis frameworks (cve-assign@...re.org)
Re: Re: Problems in automatic crash analysis frameworks (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: double-free in gnutls (CRL distribution points parsing) (cve-assign@...re.org)
Re: CVE request for buffer overflow in ppp (cve-assign@...re.org)
Re: CVE Request for incomplete fix to CVE-2015-3297 in Etherpad Minify (cve-assign@...re.org)
Re: cve-assign delays (cve-assign@...re.org)
Re: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1 (cve-assign@...re.org)
Potential CVE request: flaw in comment handling (Martin Prpic <mprpic@...hat.com>)
Re: Problems in automatic crash analysis frameworks (cve-assign@...re.org)
AW: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposi… ("Hannes Trunde" <hannes.trunde@...il.co…)
Re: Kernel oops on 32 bits arch (Pierre Schweitzer <pierre@...ctos.org>)
Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability (Stefan Cornelius <scorneli@...hat.com>)
kernel: fs.suid_dumpable=2 privilege escalation (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1 (cve-assign@...re.org)
Re: Re: Problems in automatic crash analysis frameworks (Tyler Hicks <tyhicks@...onical.com>)
Re: kernel: fs.suid_dumpable=2 privilege escalation (cve-assign@...re.org)
Re: kernel: fs.suid_dumpable=2 privilege escalation (Kees Cook <keescook@...omium.org>)
CVE Request: Arbitary Code Execution in Apache Spark Cluster (Akhil Das <akhil@...moidanalytics.com>)
[CVE Request] Multiple vulnerabilities in PHP's Phar handling (Emmanuel Law <emmanuel.law@...il.com>)
Re: Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Potential CVE request: flaw in comment handling (cve-assign@...re.org)
Re: CVE Request: Arbitary Code Execution in Apache Spark Cluster (cve-assign@...re.org)
Re: Re: CVE Request: Arbitary Code Execution in Apache Spark Cluster (Kurt Seifried <kseifried@...hat.com>)
Re: Re: cve-assign delays (Reed Loden <reed@...dloden.com>)

April 17 (10 messages)

Re: CVE Request: Arbitary Code Execution in Apache Spark Cluster (Akhil Das <akhil@...moidanalytics.com>)
Re: kernel: fs.suid_dumpable=2 privilege escalation (Florian Weimer <fweimer@...hat.com>)
CVE Request: PHP potential remote code execution with apache 2.4 apache2handler (Marc Deslauriers <marc.deslauriers@...onical.com>)
USERNS allows circumventing MNT_LOCKED (Eric Windisch <eric@...disch.us>)
Re: Problems in automatic crash analysis frameworks (Florian Weimer <fweimer@...hat.com>)
Re: [CVE Request] Multiple vulnerabilities in PHP's Phar handling (cve-assign@...re.org)
Re: CVE Request: PHP potential remote code execution with apache 2.4 apache2handler (cve-assign@...re.org)
Re: Problems in automatic crash analysis frameworks (Grandma Eubanks <tborland1@...il.com>)
Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)

April 18 (4 messages)

Re: Buffer overruns in Linux kernel RFC4106 implementation using AESNI (cve-assign@...re.org)
Re: TCP Fast Open local DoS in some Linux stable branches - Linux kernel (cve-assign@...re.org)
Re: USERNS allows circumventing MNT_LOCKED - Linux kernel (cve-assign@...re.org)
Exploit for VideoWhisper WP plugins file upload incomplete fix. ("Larry W. Cashdollar" <larry0@...com>)

April 19 (6 messages)

Wolf CMS 0.8.2 Arbitrary File Upload Vulnerability (Henri Salo <henri@...v.fi>)
Remote file inclusion in django-markupfield (Paul Tagliamonte <paultag@...il.com>)
Pharaoh - PHAR Comparison Tool (Scott Arciszewski <scott@...agonie.com>)
libxml2 issue: out-of-bounds memory access when parsing an unclosed HTML comment (Reed Loden <reed@...dloden.com>)
Re: libxml2 issue: out-of-bounds memory access when parsing an unclosed HTML comment (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Remote file inclusion in django-markupfield (Salvatore Bonaccorso <carnil@...ian.org>)

April 20 (11 messages)

Linux: chown() was racy relative to execve() (Jann Horn <jann@...jh.net>)
CVE request (Dan McDonald <danmcd@...iti.com>)
Re: CVE request (Solar Designer <solar@...nwall.com>)
Re: CVE request Qemu: malicious PRDT flow from guest to host (P J P <ppandit@...hat.com>)
Re: Linux: chown() was racy relative to execve() - Linux kernel (cve-assign@...re.org)
Re: redcarpet <=3.2.2 (and related ruby gems) allow for possible XSS via autolinking of untrusted markdown (cve-assign@...re.org)
Re: CVE request Qemu: malicious PRDT flow from guest to host (cve-assign@...re.org)
Re: CVE request - illumos (cve-assign@...re.org)
Re: CVE request - illumos (Dan McDonald <danmcd@...iti.com>)
Xen Security Advisory 132 - Information leak through XEN_DOMCTL_gettscinfo (Xen.org security team <security@....org>)
Re: Xen Security Advisory 132 - Information leak through XEN_DOMCTL_gettscinfo (cve-assign@...re.org)

April 21 (8 messages)

Re: Buffer overruns in Linux kernel RFC4106 implementation using AESNI (Ben Hutchings <ben@...adent.org.uk>)
use-after-free in src/libnetfilter_cthelper.c (Seth Arnold <seth.arnold@...onical.com>)
Re: Re: CVE request Qemu: malicious PRDT flow from guest to host (P J P <ppandit@...hat.com>)
CVE-2015-1781 in glibc (Florian Weimer <fweimer@...hat.com>)
Re: CVE request Qemu: malicious PRDT flow from guest to host (cve-assign@...re.org)
Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability (罗大龙 <luodalongde@...il.com>)
Re: Re: CVEs for Drupal contributed modules - January 2015 (cve-assign@...re.org)
Re: Re: CVEs for Drupal contributed modules - January 2015 (Pere Orga <pere@...a.cat>)

April 22 (12 messages)

CVE Request for ZFS on Linux (Kash Pande <kash@...pleback.net>)
Re: CVE Request for ZFS on Linux (cve-assign@...re.org)
Re: CVE Request for ZFS on Linux (Kash Pande <kash@...pleback.net>)
Re: CVE Request for ZFS on Linux (cve-assign@...re.org)
Re: use-after-free in src/libnetfilter_cthelper.c (Pablo Neira Ayuso <pablo@...filter.org>)
Re: CVE request: ntp-keygen may generate non-random symmetric keys on big-endian systems (Martin Prpic <mprpic@...hat.com>)
Xen Security Advisory 132 (CVE-2015-3340) - Information leak through XEN_DOMCTL_gettscinfo (Xen.org security team <security@....org>)
wpa_supplicant P2P SSID processing vulnerability (Jouni Malinen <j@...fi>)
Re: CVE requests for Drupal contributed modules (cve-assign@...re.org)
Re: CVE requests for Drupal contributed modules (cve-assign@...re.org)
Re: Re: CVEs for Drupal contributed modules - January 2015 (cve-assign@...re.org)
USBCreator D-Bus service (Tavis Ormandy <taviso@...gle.com>)

April 23 (27 messages)

Re: USBCreator D-Bus service (Solar Designer <solar@...nwall.com>)
Re: USBCreator D-Bus service (Tavis Ormandy <taviso@...gle.com>)
Re: USBCreator D-Bus service (Seth Arnold <seth.arnold@...onical.com>)
Re: USBCreator D-Bus service (Tavis Ormandy <taviso@...gle.com>)
Re: USBCreator D-Bus service (Solar Designer <solar@...nwall.com>)
Re: Re: USBCreator D-Bus service (Seth Arnold <seth.arnold@...onical.com>)
Re: USBCreator D-Bus service (Tavis Ormandy <taviso@...gle.com>)
Re: Re: USBCreator D-Bus service (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: USBCreator D-Bus service (Solar Designer <solar@...nwall.com>)
Re: Re: USBCreator D-Bus service (Tavis Ormandy <taviso@...gle.com>)
Re: CVE request: Module::Signature before 0.75 - multiple vulnerabilities (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: USBCreator D-Bus service (Kurt Seifried <kseifried@...hat.com>)
Re: USBCreator D-Bus service (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ntp-keygen may generate non-random symmetric keys on big-endian systems (cve-assign@...re.org)
PowerDNS Security Advisory 2015-01 (Peter van Dijk <peter.van.dijk@...erdns.com>)
Incorrect handling of self signed certificates in OpenFire XMPP Server (Simon Waters <simon.waters@...evine.com>)
Re: CVE request: Module::Signature before 0.75 - multiple vulnerabilities (cve-assign@...re.org)
open(2) with side effects (Florian Weimer <fweimer@...hat.com>)
Re: open(2) with side effects (Stephane Chazelas <stephane.chazelas@...il.com>)
Re: Re: open(2) with side effects (Florian Weimer <fweimer@...hat.com>)
AW: Re: open(2) with side effects (Fiedler Roman <Roman.Fiedler@....ac.at>)
CVE Request: texlive: insecure use of /tmp in mktexlsr (Vasyl Kaigorodov <vkaigoro@...hat.com>)
tlsdate havoc ahead - default host randomizes tls timestamps (Hanno Böck <hanno@...eck.de>)
Re: tlsdate havoc ahead - default host randomizes tls timestamps (Sven Kieske <svenkieske@...il.com>)
Re: open(2) with side effects (Jann Horn <jann@...jh.net>)
Re: Problems in automatic crash analysis frameworks (Florian Weimer <fweimer@...hat.com>)
WordPress Newsletter Plug-in URL Redirection Vulnerability - CVE Request (Jing Wang <justqdjing@...il.com>)

April 24 (5 messages)

Re: tlsdate havoc ahead - default host randomizes tls timestamps (Florian Weimer <fweimer@...hat.com>)
CVE request: X server crash by client (Marcus Meissner <meissner@...e.de>)
Re: Abusing TZ for fun (and little profit) (Florian Weimer <fweimer@...hat.com>)
CVE Request: vBulletin 5 - Private Messages Input Validation Failure (Patrick William <pat@...k911labs.com>)
Re: USBCreator D-Bus service (Grandma Eubanks <tborland1@...il.com>)

April 25 (7 messages)

CVE requests / Advisory: phpMyBackupPro (Matthew Daley <mattd@...fuzz.com>)
CVE request: Perl XML::LibXML (Tilmann Haak <tilmann.haak@...g.com>)
Re: CVE Request: vBulletin 5 - Private Messages Input Validation Failure (cve-assign@...re.org)
Re: CVE request: X server crash by client (cve-assign@...re.org)
Re: Re: CVE request: X server crash by client (Marcus Meissner <meissner@...e.de>)
CVE requests for Drupal contributed modules (from SA-CONTRIB-2015-034 to SA-CONTRIB-2015-099) (Pere Orga <pere@...a.cat>)
Insufficient TLS Protection in Composer (PHP) (Pádraic Brady <padraic.brady@...il.com>)

April 26 (3 messages)

CVE request - TelescopeJS Information Leakage: User BCrypt password hash post-authentication (Shubham Shah <admin@...bh.am>)
Possible CVE Request: Wordpress 4.1.2 security release (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request: Dovecot remote DoS on TLS connections (Hanno Böck <hanno@...eck.de>)

April 27 (8 messages)

Re: CVE request: Dovecot remote DoS on TLS connections (cve-assign@...re.org)
CVE request: incomplete fix for CVE-2013-4422 (Pierre Schweitzer <pierre@...ctos.org>)
Re: CVE request: incomplete fix for CVE-2013-4422 (cve-assign@...re.org)
WordPress 4.2.1 security update - CVE please (Kurt Seifried <kseifried@...hat.com>)
Re: WordPress 4.2.1 security update - CVE please (Salvatore Bonaccorso <carnil@...ian.org>)
Re: WordPress 4.2.1 security update - CVE please (Alessandro Ghedini <alessandro@...dini.me>)
Re: WordPress 4.2.1 security update - CVE please (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: X server crash by client (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 28 (8 messages)

CVE request: kernel overestimates the available entropy in random pools (Wade Mealing <wmealing@...hat.com>)
Re: CVE request: kernel overestimates the available entropy in random pools (Solar Designer <solar@...nwall.com>)
CVE request libaxl <= 0.6.9 ("J. M. Bogaard" <martijn@...aard.eu>)
Re: Re: CVE request: Dovecot remote DoS on TLS connections (Hanno Böck <hanno@...eck.de>)
Limited DoS in mailman (requires non standard config) (Kurt Seifried <kseifried@...hat.com>)
Re: Limited DoS in mailman (requires non standard config) (Mark Sapiro <mark@...piro.net>)
Re: Possible CVE Request: Wordpress 4.1.2 security release (cve-assign@...re.org)
Re: Re: Possible CVE Request: Wordpress 4.1.2 security release (Hanno Böck <hanno@...eck.de>)

April 29 (8 messages)

Re: Limited DoS in mailman (requires non standard config) (Kurt Seifried <kseifried@...hat.com>)
Re: Limited DoS in mailman (requires non standard config) (Mark Sapiro <mark@...piro.net>)
CVE policy clarification request (Amos Jeffries <squid3@...enet.co.nz>)
[oCERT-2015-003] MySQL SSL/TLS downgrade (Andrea Barisani <lcars@...rt.org>)
Re: [oCERT-2015-003] MySQL SSL/TLS downgrade (Michał Staruch <msta@...kciarz.pl>)
Re: CVE policy clarification request (cve-assign@...re.org)
Re: CVE request libaxl <= 0.6.9 (cve-assign@...re.org)
Re: CVE request - TelescopeJS Information Leakage: User BCrypt password hash post-authentication (cve-assign@...re.org)

April 30 (6 messages)

Re: CVE request: Perl XML::LibXML (cve-assign@...re.org)
Re: Re: CVE policy clarification request (Amos Jeffries <squid3@...enet.co.nz>)
Heap overflow / invalid read in Libtasn1 before 4.5 (TFPA 005/2015) (Hanno Böck <hanno@...eck.de>)
Re: CVE policy clarification request - Squid 3.5.4 etc. (cve-assign@...re.org)
Re: [oCERT-2015-003] MySQL SSL/TLS downgrade (Jon Oberheide <jon@...rheide.org>)
Re: Heap overflow / invalid read in Libtasn1 before 4.5 (TFPA 005/2015) (cve-assign@...re.org)

319 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.