oss-security mailing list - 2015/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 10	² 14	³ 5
⁴ 12	⁵ 17	⁶ 3	⁷ 10	⁸ 3	⁹ 7	¹⁰ 4
¹¹ 6	¹² 10	¹³ 30	¹⁴ 16	¹⁵ 2	¹⁶ 8	¹⁷ 2
¹⁸ 10	¹⁹ 15	²⁰ 9	²¹ 13	²² 10	²³ 5	²⁴ 2
²⁵ 3	²⁶ 23	²⁷ 9	²⁸ 3	²⁹ 10	³⁰	³¹ 6

Messages by day:

May 1 (10 messages)

Re: [Pdns-announce] PowerDNS Security Advisory 2015-01 ("Peter van Dijk" <peter.van.dijk@...erdns.com>)
CVE-2015-3455 - SQUID-2015:1 Incorrect X509 server certificate validation (Amos Jeffries <squid3@...enet.co.nz>)
On sanctioned MITMs (mancha <mancha1@...o.com>)
Re: On sanctioned MITMs (Hanno Böck <hanno@...eck.de>)
Re: On sanctioned MITMs (Kurt Seifried <kseifried@...hat.com>)
Re: On sanctioned MITMs (Dean Pierce <pierce403@...il.com>)
CVE request / Advisory: Slideshow (Wordpress plugin) - Wordpress option value disclosure (Matthew Daley <mattd@...fuzz.com>)
Re: On sanctioned MITMs (Solar Designer <solar@...nwall.com>)
Re: On sanctioned MITMs (mancha <mancha1@...o.com>)
Re: On sanctioned MITMs (mancha <mancha1@...o.com>)

May 2 (14 messages)

CVE Request / Saltstack SSL verification disabling for alibabab cloud module (Michael Scherer <misc@...b.org>)
Re: On sanctioned MITMs (Lyndon Nerenberg <lyndon@...hanc.ca>)
CVE Request / Ansible: insecure permission on a directory when using spacewalk inventory (Michael Scherer <misc@...b.org>)
Re: On sanctioned MITMs (Eddie Chapman <eddie@...k.net>)
CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam (Wen Xu <hotdog3645@...il.com>)
Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam (Solar Designer <solar@...nwall.com>)
Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam (Wen Xu <hotdog3645@...il.com>)
Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam (Solar Designer <solar@...nwall.com>)
Re: CVE Request / Ansible: insecure permission on a directory when using spacewalk inventory (James Cammarata <jcammarata@...ible.com>)
Re: Re: CVE Request / Ansible: insecure permission on a directory when using spacewalk inventory (Michael Scherer <misc@...b.org>)
Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam (cve-assign@...re.org)
Re: CVE request / Advisory: Slideshow (Wordpress plugin) - Wordpress option value disclosure (cve-assign@...re.org)
Re: On sanctioned MITMs (mancha <mancha1@...o.com>)
Re: On sanctioned MITMs (Lyndon Nerenberg <lyndon@...hanc.ca>)

May 3 (5 messages)

CVE-2015-2170: clamav: crash on crafted upx packed file (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)
CVE-2015-2221: clamav: infinite loop condition on crafted y0da cryptor file (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)
CVE request - clamav - crashes on crafted upack packed file (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)
CVE request - clamav - crash during algorithmic detection on crafted PE file (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)
CVE-2015-2222: clamav: crash on crafted petite packed file (Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>)

May 4 (12 messages)

CVE request: libarchive: Out of bounds read using malformed cpio archive (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: libarchive: Out of bounds read using malformed cpio archive (Hanno Böck <hanno@...eck.de>)
Re: USBCreator D-Bus service (cve-assign@...re.org)
Re: CVE requests / Advisory: phpMyBackupPro (cve-assign@...re.org)
NetCat CMS Multiple HTTP Response Splitting (CRLF) Security Vulnerabilities - CVE Request (Jing Wang <justqdjing@...il.com>)
Re: CVE requests / Advisory: phpMyBackupPro (Matthew Daley <mattd@...fuzz.com>)
Re: CVE request: Caja / MATE Desktop Environment: caja automounts USB flash drives and CD/DVD drives while session is l… (Mike Gabriel <mike.gabriel@...-netzwerk…)
CVE request for vulnerability in OpenStack Keystone (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
PHP and some == wonkiness (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for vulnerability in OpenStack Keystone (cve-assign@...re.org)
Re: PHP and some == wonkiness (Pádraic Brady <padraic.brady@...il.com>)
Please REJECT CVE-2015-3168, I failed to notice that CVE-2015-3164 was already assigned. (Kurt Seifried <kseifried@...hat.com>)

May 5 (17 messages)

Re: On sanctioned MITMs (Joe Malcolm <jmalcolm@...eus.com>)
Re: PHP and some == wonkiness (Florian Weimer <fweimer@...hat.com>)
Re: PHP and some == wonkiness (mancha <mancha1@...o.com>)
Re: PHP and some == wonkiness (Florian Weimer <fweimer@...hat.com>)
About PHP and CVE-2015-1353 (Remi Collet <remi@...oraproject.org>)
[CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL (Pedro Ribeiro <pedrib@...il.com>)
Re: PHP and some == wonkiness (mancha <mancha1@...o.com>)
CVE Request: GnuTLS: GNUTLS-SA-2015-2: MD5-based ServerKeyExchange signature accepted by default (Salvatore Bonaccorso <carnil@...ian.org>)
Re: PHP and some == wonkiness (mancha <mancha1@...o.com>)
Re: Problems in automatic crash analysis frameworks (Florian Weimer <fweimer@...hat.com>)
[OSSA 2015-008] Potential Keystone cache backend password leak in log (CVE-2015-3646) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Silent security fixes in virtuoso-opensource (Florian Weimer <fweimer@...hat.com>)
Re: PHP and some == wonkiness (Grandma Eubanks <tborland1@...il.com>)
Local privileges escalation in rubygem open-uri-cached (Michael Scherer <misc@...b.org>)
Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)
Re: Problems in automatic crash analysis frameworks (Florian Weimer <fweimer@...hat.com>)
Re: Problems in automatic crash analysis frameworks (Tavis Ormandy <taviso@...gle.com>)

May 6 (3 messages)

Re: PHP and some == wonkiness (Sliv TaMere <slivtamere@...il.com>)
Re: Local privileges escalation in rubygem open-uri-cached (cve-assign@...re.org)
Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam (Vasily Kulikov <segoon@...nwall.com>)

May 7 (10 messages)

Re: CVE request: Dovecot remote DoS on TLS connections (Sven Kieske <s.kieske@...twald.de>)
Re: CVE request: Dovecot remote DoS on TLS connections (Hanno Böck <hanno@...eck.de>)
Linux kernel pointer poisoning (was: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam) (Vasily Kulikov <segoon@...nwall.com>)
Re: Linux kernel pointer poisoning (was: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam… (Vasily Kulikov <segoon@...nwall.com>)
CVE request: vulnerability in wpa_supplicant and hostapd (Martin Prpic <mprpic@...hat.com>)
Re: CVE request: vulnerability in wpa_supplicant and hostapd (Solar Designer <solar@...nwall.com>)
Re: CVE-Request: AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5%. (Hector Marco-Gisbert <hecmargi@....es>)
CVE Request: zeromq downgrade attack (Alessandro Ghedini <alessandro@...dini.me>)
CVE-2015-0847 in nbd-server (Florian Weimer <fw@...eb.enyo.de>)
Docker 1.6.1 - Security Advisory [150507] (Eric Windisch <ewindisch@...ker.com>)

May 8 (3 messages)

beaker vulns fixed in version 20.1 (Kurt Seifried <kseifried@...hat.com>)
CVE-2015-3429: DOM XSS Vulnerability in Twenty Fifteen WordPress Theme (Henri Salo <henri@...v.fi>)
Re: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Sympos… (Hannes Trunde <hannes.trunde@...il.com>)

May 9 (7 messages)

Wordpress Roomcloud plugin v1.1(rev @1115307) XSS vulnerability (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Request for CVE - XSS Vulnerabilities in Wordpress Roomcloud plugin v1.1(rev @1115307) (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Re: CVE request: vulnerability in wpa_supplicant and hostapd (Jouni Malinen <j@...fi>)
CVE request: hostapd/wpa_supplicant - WPS UPnP vulnerability with HTTP chunked transfer encoding (Jouni Malinen <j@...fi>)
CVE request: hostapd/wpa_supplicant - Integer underflow in AP mode WMM Action frame processing (Jouni Malinen <j@...fi>)
Re: CVE request: vulnerability in wpa_supplicant and hostapd (Jouni Malinen <j@...fi>)
CVE requests: didjvu, pdf2djvu: insecure use of /tmp (Jakub Wilk <jwilk@...lk.net>)

May 10 (4 messages)

CVE for Jentu (Kash Pande <kash@...pleback.net>)
openwall phpass fallback mode (Kash Pande <kash@...pleback.net>)
Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE for Jentu (cve-assign@...re.org)

May 11 (6 messages)

Re: CVE Request: zeromq downgrade attack (Salvatore Bonaccorso <carnil@...ian.org>)
Re: About PHP and CVE-2015-1353 - please REJECT (Remi Collet <remi@...oraproject.org>)
Re: openwall phpass fallback mode (Solar Designer <solar@...nwall.com>)
[oCERT-2015-006] dcraw input sanitization errors (Andrea Barisani <lcars@...rt.org>)
CVE Request: wireshark: crash on a sample capture file genbroad.snoop (Mgr. Martin Žember <zember@...il.com>)
CVE Request: Insufficient TLS Protection in Composer (PHP) (Pádraic Brady <padraic.brady@...il.com>)

May 12 (10 messages)

CVE request: libinfinity did not correctly check certificates for validity (Philipp Kern <pkern@...ian.org>)
CVE Request: phpbb open redirect (Alessandro Ghedini <alessandro@...dini.me>)
Re: CVE Request: wireshark: crash on a sample capture file genbroad.snoop (Martin Prpic <mprpic@...hat.com>)
Re: CVE Request: wireshark: crash on a sample capture file genbroad.snoop (Stuart Henderson <stu@...cehopper.org>)
Re: CVE Request: phpbb open redirect (Hanno Böck <hanno@...eck.de>)
CVE request for proxychains-ng : current path as the first directory for the library search path (Mamoru TASAKA<mtasaka@...oraproject.org>)
Two invalid read errors / heap overflows in SQLite (TFPA 006/2015) (Hanno Böck <hanno@...eck.de>)
Re: [oCERT-2015-006] dcraw input sanitization errors (cve-assign@...re.org)
CVE request for vulnerability in OpenStack Horizon (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
Re: CVE Request: phpbb open redirect (cve-assign@...re.org)

May 13 (30 messages)

CVE Request: OSSIM multiple vulnerabilities (Damien Cauquil <d.cauquil@...dream.com>)
Xen Security Advisory 133 (CVE-2015-3456) - Privilege escalation via emulated floppy disk drive (Xen.org security team <security@....org>)
VENOM - CVE-2015-3456 (Jason Geffner <jason@...wdstrike.com>)
CVE request for vhost/scsi possible memory corruption. (Wade Mealing <wmealing@...hat.com>)
Request 2 CVE-IDs for Zeus Voting System (DaKnOb <daknob.mac@...il.com>)
Re: VENOM - CVE-2015-3456 (Solar Designer <solar@...nwall.com>)
QEMU 2.3.0 tmp vulns CVE request (Kurt Seifried <kseifried@...hat.com>)
Re: VENOM - CVE-2015-3456 (Sebastian Pipping <sebastian@...ping.org>)
CVE Request: t1utils: buffer overflow in set_cs_start (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: libinfinity did not correctly check certificates for validity (Philipp Kern <pkern@...ian.org>)
Re: CVE request for proxychains-ng : current path as the first directory for the library search path (cve-assign@...re.org)
[PATCH 1/4] ozwpan: Use proper check to prevent heap overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 3/4] ozwpan: divide-by-zero leading to panic ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 4/4] ozwpan: unchecked signed subtraction leads to DoS ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 2/4] ozwpan: Use unsigned ints to prevent heap overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: [PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities (Greg KH <greg@...ah.com>)
Re: [PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: [PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities (Greg KH <greg@...ah.com>)
[PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 1/4] ozwpan: Use proper check to prevent heap overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 3/4] ozwpan: divide-by-zero leading to panic ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 4/4] ozwpan: unchecked signed subtraction leads to DoS ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH 2/4] ozwpan: Use unsigned ints to prevent heap overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: [PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: [PATCH 0/4] ozwpan: Four remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
CVE requests: Remote packet-of-death vulnerabilities in Linux Kernel ozwpan driver ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: VENOM - CVE-2015-3456 (Solar Designer <solar@...nwall.com>)
Re: VENOM - CVE-2015-3456 (Marcus Meissner <meissner@...e.de>)
RE: VENOM - CVE-2015-3456 (Jason Geffner <jason@...wdstrike.com>)

May 14 (16 messages)

Re: Request 2 CVE-IDs for Zeus Voting System (DaKnOb <daknob.mac@...il.com>)
Moving in the wrong direction [was: Re: VENOM - CVE-2015-3456] (mancha <mancha1@...o.com>)
Cross-site scripting flaw in AskBot (Martin Prpic <mprpic@...hat.com>)
security hardening in dbus 1.8.18, 1.9.16: avoiding weak PRNG (Simon McVittie <simon.mcvittie@...labora.co.uk>)
Potential issue in NTP -A option (Kurt Seifried <kseifried@...hat.com>)
Re: Request 2 CVE-IDs for Zeus Voting System (DaKnOb <daknob.mac@...il.com>)
Re: Potential issue in NTP -A option (cve-assign@...re.org)
Read heap overflow / invalid memory access in Wireshark (Hanno Böck <hanno@...eck.de>)
Re: Potential issue in NTP -A option (Harlan Stenn <stenn@....org>)
re: CVE for Jentu (Kash Pande <kashpande@...il.com>)
Re: re: CVE for Jentu (Solar Designer <solar@...nwall.com>)
RE: VENOM - CVE-2015-3456 (Jason Geffner <jason@...wdstrike.com>)
Still unfixed? Re: Linux namespaces: It is possible to escape from bind mounts (Jann Horn <jann@...jh.net>)
Re: CVE request for vulnerability in OpenStack Horizon (cve-assign@...re.org)
Re: CVE Request: Insufficient TLS Protection in Composer (PHP) (Kevin McArthur <kevin@...rmtide.ca>)
Re: re: CVE for Jentu (Kash Pande <kashpande@...il.com>)

May 15 (2 messages)

coreutils sort heap overflow (Pádraig Brady <P@...igBrady.com>)
Re: CVE Request: zeromq downgrade attack (Alessandro Ghedini <alessandro@...dini.me>)

May 16 (8 messages)

CVE Request - CSRF and XSS in Encrypted Contact Form Wordpress Plugin v1.0.4 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Re: QEMU 2.3.0 tmp vulns CVE request (Michael Tokarev <mjt@....msk.ru>)
about this openssh heap overflow (Hanno Böck <hanno@...eck.de>)
Re: CVE Request - CSRF and XSS in Encrypted Contact Form Wordpress Plugin v1.0.4 (cve-assign@...re.org)
Re: QEMU 2.3.0 tmp vulns CVE request (Jakub Wilk <jwilk@...lk.net>)
Re: about this openssh heap overflow (mancha <mancha1@...o.com>)
Re: about this openssh heap overflow (Hanno Böck <hanno@...eck.de>)
Re: about this openssh heap overflow (mancha <mancha1@...o.com>)

May 17 (2 messages)

Netty/Play's Security Updates (CVE-2015-2156) (Luca Carettoni <luca.carettoni@...isoft.com>)
[CVE Request/Advisory] Multiple vulnerabilities in PHP's handling of Phar files (Emmanuel Law <emmanuel.law@...il.com>)

May 18 (10 messages)

Moodle security advisories [vs] (Marina Glancy <marina@...dle.com>)
Re: CVE Request: various issues in PHP (Lior Kaplan <kaplanlior@...il.com>)
CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Andrea Palazzo <andrea.palazzo@...el.it>)
Re: CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Stanislav Malyshev <smalyshev@...il.com>)
Re: CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Andrea Palazzo <andrea.palazzo@...el.it>)
CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix (Martin Prpic <mprpic@...hat.com>)
CVE request: xzgrep 4.999.9beta arbitrary code execution vulnerability (Bart Dopheide <dopheide@....nl>)
CVE request: SQLi in FeedWordPress - WordPress plugin (Adrián M. F. <adrimf85@...il.com>)
Re: CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Stanislav Malyshev <smalyshev@...il.com>)
Re: CVE request: SQLi in FeedWordPress - WordPress plugin (cve-assign@...re.org)

May 19 (15 messages)

Re: About PHP and CVE-2015-1353 (cve-assign@...re.org)
Re: [saltstack-security] CVE Request / Saltstack SSL verification disabling for alibabab cloud module (Colton Myers <colton@...tstack.com>)
CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) (Tomas Hoger <thoger@...hat.com>)
CVE request: python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Re: [oCERT-2015-006] dcraw input sanitization errors (Stefan Cornelius <scorneli@...hat.com>)
CVE Request: nbd denial of service (Alessandro Ghedini <alessandro@...dini.me>)
Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) (Alessandro Ghedini <alessandro@...dini.me>)
Re: CVE reject request CVE-2015-8146/8147 (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Andrea Palazzo <andrea.palazzo@...el.it>)
Re: Re: CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Dennis <shr3kst3r@...il.com>)
Re: CVE reject request CVE-2015-8146/8147 (was: [CVE-2014-8146/8147] - ICU heap and integer overflows / I-C-U-FAIL) (cve-assign@...re.org)
Re: CVE Request + Advisory: PHP str_repeat() sign mismatch based memory corruption (Stanislav Malyshev <smalyshev@...il.com>)
Re: CVE request: xzgrep 4.999.9beta arbitrary code execution vulnerability (cve-assign@...re.org)
Re: CVE request: python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) (cve-assign@...re.org)
Re: coreutils sort heap overflow (cve-assign@...re.org)

May 20 (9 messages)

CVE Request: ipsec-tools (Seth Arnold <seth.arnold@...onical.com>)
Logjam attack / Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: CVE Request: various issues in PHP (Vasyl Kaigorodov <vkaigoro@...hat.com>)
JSON-based SQL query construction (Sequelize as an example) (Florian Weimer <fweimer@...hat.com>)
CVE Request: SuiteCRM Post Auth RCE (Darren Martyn <darren.martyn@...hosresearch.co.uk>)
CVE request: Multiple SQL injection vulnerabilities in GigPress - WordPress plugins. (Adrián M. F. <adrimf85@...il.com>)
Re: Logjam attack / Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice (Paul Wouters <pwouters@...hat.com>)
CVE-2015-4000 - TLS does not properly convey server's ciphersuite choice (cve-assign@...re.org)
Re: CVE-2015-4000 - TLS does not properly convey server's ciphersuite choice (Yves-Alexis Perez <corsac@...ian.org>)

May 21 (13 messages)

Re: Logjam attack / Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE Request: pgbouncer: DoS/remote crash: invalid packet order causes lookup of NULL pointer (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2015-3206 python-kerberos: checkPassword() does not verify KDC authenticity (Martin Prpic <mprpic@...hat.com>)
Re: CVE Request: zeromq downgrade attack (cve-assign@...re.org)
Re: CVE Request: nbd denial of service (cve-assign@...re.org)
[ANNOUNCE] Apache Jackrabbit 2.10.1 released (Marcel Reutegger <mreutegg@...che.org>)
CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) (Julian Reschke <julian.reschke@...enbytes.de>)
Re: CVE request for vhost/scsi possible memory corruption. (cve-assign@...re.org)
CVE-2015-3202 fuse privilege escalation (Tavis Ormandy <taviso@...gle.com>)
CVE-2015-1325 apport race conditions / ubuntu local root (Philip Pettersson <p.pettersson@...sung.com>)
Re: CVE Request: ipsec-tools (cve-assign@...re.org)
Re: CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix (cve-assign@...re.org)
CVE Request for ceph-deploy copying keyring to /etc/ceph which is world readable (Siddharth Sharma <sisharma@...hat.com>)

May 22 (10 messages)

Re: CVE Request for ceph-deploy copying keyring to /etc/ceph which is world readable (cve-assign@...re.org)
CVE request: Multiple vulnerabilities in some WordPress plugins: NewStatPress & WordPress Landing Pages. (Adrián M. F. <adrimf85@...il.com>)
Re: CVE Request: zeromq downgrade attack (Alessandro Ghedini <alessandro@...dini.me>)
Re: CVE request: Multiple SQL injection vulnerabilities in GigPress - WordPress plugins. (cve-assign@...re.org)
Re: CVE Request: pgbouncer: DoS/remote crash: invalid packet order causes lookup of NULL pointer (cve-assign@...re.org)
Feed2JS v1.7 XSS Web Security Vulnerabilities - CVE Request (Jing Wang <justqdjing@...il.com>)
Innovative WebPAC Pro 2.0 Open Redirect Web Security Vulnerabilities - CVE Request (Jing Wang <justqdjing@...il.com>)
Re: CVE Request: OSSIM multiple vulnerabilities (cve-assign@...re.org)
Re: Wordpress Roomcloud plugin v1.1(rev @1115307) XSS vulnerability (cve-assign@...re.org)
Re: CVE Request: t1utils: buffer overflow in set_cs_start (cve-assign@...re.org)

May 23 (5 messages)

Re: CVE request: Multiple vulnerabilities in some WordPress plugins: NewStatPress & WordPress Landing Pages. (cve-assign@...re.org)
Re: CVE request: Multiple SQL injection vulnerabilities in GigPress - WordPress plugins. (cve-assign@...re.org)
Re: Wordpress Roomcloud plugin v1.1(rev @1115307) XSS vulnerability (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Re: QEMU 2.3.0 tmp vulns CVE request (cve-assign@...re.org)
Re: Re: CVE Request for read-only directory traversal in Etherpad frontend tests (Jeremy Stanley <fungi@...goth.org>)

May 24 (2 messages)

CVE Request for WP Fastest Cache plugin (0pc0deFR <0pc0defr@...il.com>)
Re: [PATCH 1/4] ozwpan: Use proper check to prevent heap overflow (Greg Kroah-Hartman <gregkh@...uxfoundation.org>)

May 25 (3 messages)

CVE-2015-3200 Log injection in Lighttpd (Jaanus <jaanus.kaap@...il.com>)
[OSSA 2015-009] Persistent XSS in Horizon metadata dashboard (CVE-2015-3988) (Tristan Cacqueray <tristan.cacqueray@...vance.com>)
CVE request for attic : encrypted backups attack (Raphaël Rigo <ml-oss@...call.eu>)

May 26 (23 messages)

CVE request: vulnerability in the kernel tty subsystem. (Wade Mealing <wmealing@...hat.com>)
ELF PLT changes in gcc/binutils/glibc (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request for read-only directory traversal in Etherpad frontend tests (cve-assign@...re.org)
[PATCH v2 0/4] ozwpan: Four remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH v2 2/4] ozwpan: Use unsigned ints to prevent heap overflow ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH v2 3/4] ozwpan: divide-by-zero leading to panic ("Jason A. Donenfeld" <Jason@...c4.com>)
[PATCH v2 4/4] ozwpan: unchecked signed subtraction leads to DoS ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE-2015-4000 - TLS does not properly convey server's ciphersuite choice (Florian Weimer <fweimer@...hat.com>)
hwclock(8) SUID privilege escalation (up201407890@...nos.dcc.fc.up.pt)
CVE Request: CSRF vulnerability in OmniAuth request phase (Douwe Maan <douwe@...lab.com>)
Re: hwclock(8) SUID privilege escalation ("Larry W. Cashdollar" <larry0@...com>)
Re: [PATCH v2 1/4] ozwpan: Use proper check to prevent heap overflow (Dan Carpenter <dan.carpenter@...cle.com>)
Re: hwclock(8) SUID privilege escalation (Stephane Chazelas <stephane.chazelas@...il.com>)
Re: [PATCH v2 4/4] ozwpan: unchecked signed subtraction leads to DoS (Dan Carpenter <dan.carpenter@...cle.com>)
Re: CVE request: vulnerability in the kernel tty subsystem. (Greg KH <greg@...ah.com>)
FreeRDP tmp flaws (Kurt Seifried <kseifried@...hat.com>)
Re: FreeRDP tmp flaws (Kurt Seifried <kseifried@...hat.com>)
Question about tmp flaws in non-default build options (e.g. Kerberos DEBUG_ASN1) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for WP Fastest Cache plugin (cve-assign@...re.org)
Re: Re: hwclock(8) SUID privilege escalation (Tavis Ormandy <taviso@...gle.com>)
Re: Re: hwclock(8) SUID privilege escalation (up201407890@...nos.dcc.fc.up.pt)
Re: Re: hwclock(8) SUID privilege escalation (Stephane Chazelas <stephane.chazelas@...il.com>)

May 27 (9 messages)

Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() (Tomas Hoger <thoger@...hat.com>)
Re: CVE request: vulnerability in wpa_supplicant and hostapd (Tomas Hoger <thoger@...hat.com>)
Re: Question about tmp flaws in non-default build options (e.g. Kerberos DEBUG_ASN1) (cve-assign@...re.org)
Re: FreeRDP tmp flaws (cve-assign@...re.org)
CVE Request: Linux Kernel Ozwpan Driver - Remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
CVE Request, multiple WordPress plugins and themes ("Seaman, Chad" <cseaman@...mai.com>)
CVE-2015-1835: Remote exploit of secondary configuration variables in Apache Cordova on Android (Joe Bowser <bowserj@...il.com>)
Re: Re: FreeRDP tmp flaws (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request, multiple WordPress plugins and themes ("Seaman, Chad" <cseaman@...mai.com>)

May 28 (3 messages)

Re: CVE Request, multiple WordPress plugins and themes (Henri Salo <henri@...v.fi>)
Re: CVE Request, multiple WordPress plugins and themes (cve-assign@...re.org)
Re: Re: CVE Request, multiple WordPress plugins and themes ("Seaman, Chad" <cseaman@...mai.com>)

May 29 (10 messages)

CVE request: XSS and CSRF in WP Smiley plugin for WordPress (Henri Salo <Henri.Salo@...u.com>)
[CVE-2015-0839] hp-plugin binary driver verification (Enrico Zini <enrico@...icozini.org>)
wow-moodboard-lite v1.1.1.1 Wordpress plugin has an open redirect ("Larry W. Cashdollar" <larry0@...com>)
Re: Re: CVE Request: various issues in PHP (Tomas Hoger <thoger@...hat.com>)
CVE request Linux kernel: ns: user namespaces panic (P J P <ppandit@...hat.com>)
StrongSwan VPN client for Android leaks username to rouge server ("Alexander E. Patrakov" <patrakov@...il.com>)
Re: StrongSwan VPN client for Android leaks username to rouge server (Noel Kuntze <noel@...ilie-kuntze.de>)
Re: CVE request: vulnerability in the kernel tty subsystem. (Henri Salo <henri@...v.fi>)
Re: CVE request: vulnerability in the kernel tty subsystem. (Greg KH <greg@...ah.com>)
Re: CVE request Linux kernel: ns: user namespaces panic (Andy Lutomirski <luto@...nel.org>)

May 31 (6 messages)

Re: CVE Request: Linux Kernel Ozwpan Driver - Remote packet-of-death vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE request: XSS and CSRF in WP Smiley plugin for WordPress (cve-assign@...re.org)
Re: CVE request for attic : encrypted backups attack (cve-assign@...re.org)
CVE Request:PCRE Call Stack Overflow Vulnerability ("wen_guanxing" <wen_guanxing@...ustech.com.cn>)
CVE Request: PCRE Library Stack Overflow Vulnerability ("wen_guanxing" <wen_guanxing@...ustech.com.cn>)
Re: CVE request: vulnerability in wpa_supplicant and hostapd (cve-assign@...re.org)

277 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.