oss-security mailing list - 2015/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 10	² 7	³ 8	⁴ 4	⁵ 1
⁶ 20	⁷ 13	⁸ 3	⁹ 12	¹⁰ 9	¹¹ 2	¹² 4
¹³ 10	¹⁴ 11	¹⁵ 5	¹⁶ 10	¹⁷ 18	¹⁸ 5	¹⁹ 1
²⁰ 2	²¹ 7	²² 8	²³ 19	²⁴ 12	²⁵ 6	²⁶ 3
²⁷ 10	²⁸ 11	²⁹ 14	³⁰ 15	³¹ 6

Messages by day:

July 1 (10 messages)

Re: Google Chrome Address Spoofing (Request For Comment) (0pc0deFR <0pc0defr@...il.com>)
Re: Google Chrome Address Spoofing (Request For Comment) (Big Whale <d0lph1n98@...oo.com>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Roney Gomes <roney477@...il.com>)
CVE request: persistent XSS in Wordpress Plugin NewStatPress v.1.0.3 (Responsive Disclosure | HSASec <disclosure@...sec.de>)
Re: Google Chrome Address Spoofing (Request For Comment) (Valentinas Bakaitis <v.bakaitis@...il.com>)
RE: Google Chrome Address Spoofing (Request For Comment) (Zak Siddiqui <Zak.Siddiqui@....edu.au>)
CVE Request: two security issues in openSSH 6.9 (Andreas Stieger <astieger@...e.de>)
Re: CVE request: persistent XSS in Wordpress Plugin NewStatPress v.1.0.3 ("Seaman, Chad" <cseaman@...mai.com>)
Re: Google Chrome Address Spoofing (Request For Comment) (David Leo <david.leo@...sen.co.uk>)
Re: CVE Request: two security issues in openSSH 6.9 (cve-assign@...re.org)

July 2 (7 messages)

Re: CVE Request: UDP checksum DoS (cve-assign@...re.org)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Mustafa Al-Bassam <mus@...albas.com>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Big Whale <d0lph1n98@...oo.com>)
CVE- Request for Wordpress Plugin Simple Ads Manager: DoS without authentication (Responsive Disclosure | HSASec <disclosure@...sec.de>)
Re: Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Tim Brown <tmb@...35.com>)
SQL Injection in easy2map wordpress plugin v1.24 ("Larry W. Cashdollar" <larry0@...com>)
Re: [FD] Google Chrome Address Spoofing (Request For Comment) (Daniel Wood <daniel.wood@...sp.org>)

July 3 (8 messages)

Re: Re: [FD] Google Chrome Address Spoofing (Request For Comment) (anidear <anidear1@...il.com>)
Re: CVE-2015-3258 CVE-2015-3279 cups-filters (Stefan Cornelius <scorneli@...hat.com>)
Re: CVE-2015-3258 CVE-2015-3279 cups-filters (Salvatore Bonaccorso <carnil@...ian.org>)
Waiting Mitre response: AMD Bulldozer, Linux ASLR mmap and Offset2lib (Hector Marco-Gisbert <hecmargi@....es>)
Re: CVE-2015-3258 CVE-2015-3279 cups-filters (Tim Waugh <twaugh@...hat.com>)
Re: CVE-2015-3258 CVE-2015-3279 cups-filters (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: GetSimple CMS: Multiple Stored XSS (Anirudh Anand <anirudhanand722@...il.com>)
Newsletter Plugin for WordPress Unvalidated Redirects and Forwards URL Vulnerability - CVE Request (Ryan King <tetraphibious@...il.com>)

July 4 (4 messages)

Follow-up on Exploiting "BadIRET" vulnerability (CVE-2014-9322) (Adam Zabrocki <pi3@....com.pl>)
please REJECT CVE-2015-3199 (Kurt Seifried <kseifried@...hat.com>)
Re: please REJECT CVE-2015-3199 (cve-assign@...re.org)
CVE requests for Drupal contributed modules (from SA-CONTRIB-2015-100 to SA-CONTRIB-2015-131) (Pere Orga <pere@...a.cat>)

July 5 (1 message)

node.js out of band write (Mark Felder <feld@...d.me>)

July 6 (20 messages)

Re: CVE Request: UDP checksum DoS (Ben Hutchings <benh@...ian.org>)
CVE Request - Open Redirect Vulnerability in StageShow Wordpress Plugin v5.0.8 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Google Chrome Address Spoofing - Google's Opinion (David Leo <david.leo@...sen.co.uk>)
Re: node.js out of band write (Florian Weimer <fweimer@...hat.com>)
Out-of-bounds read in wget and curl using CVE-2015-2059 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE Request: UDP checksum DoS (cve-assign@...re.org)
Re: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (Stefan Cornelius <scorneli@...hat.com>)
Squid HTTP proxy CVE request (Amos Jeffries <squid3@...enet.co.nz>)
Re: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (Stefan Cornelius <scorneli@...hat.com>)
CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6 (Andreas Stieger <astieger@...e.de>)
Re: node.js out of band write (Mark Felder <feld@...d.me>)
TR : CVE request for dash 0.5.7-3 x86-64 local buffer overflow ("jean-marie.bourbon@...aturetech.com" <jean-marie.bourbon@...aturetech.com>)
How serious is undefined behavior? (Hanno Böck <hanno@...eck.de>)
Re: How serious is undefined behavior? (John Haxby <john.haxby@...cle.com>)
Re: How serious is undefined behavior? (Daniel Micay <danielmicay@...il.com>)
Re: TR : CVE request for dash 0.5.7-3 x86-64 local buffer overflow ("Adam D. Barratt" <adam@...m-barratt.org.uk>)
Re: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (a.furieri@....it)
Re: TR : CVE request for dash 0.5.7-3 x86-64 local buffer overflow (Simon McVittie <smcv@...ian.org>)
Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 ("Larry W. Cashdollar" <larry0@...com>)
Re: How serious is undefined behavior? (Solar Designer <solar@...nwall.com>)

July 7 (13 messages)

Remote file download in Wordpress Plugin mdc-youtube-downloader v2.1.0 ("Larry W. Cashdollar" <larry0@...com>)
Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6 (cve-assign@...re.org)
Re: Re: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and 1.0.6 (Andreas Stieger <astieger@...e.de>)
Re: node.js out of band write (Luca Bruno <lucab@...ian.org>)
[ANNOUNCE] Apache Directory LDAP API 1.0.0-M31 released (Emmanuel Lecharny <elecharny@...che.org>)
Follow up: PowerDNS Security Advisory 2015-01 (Pieter Lexis <pieter.lexis@...erdns.com>)
Re: [ANNOUNCE] Apache Directory LDAP API 1.0.0-M31 released (Moritz Muehlenhoff <jmm@...ian.org>)
Xen Security Advisory 137 (CVE-2015-3259) - xl command line config handling stack overflow (Xen.org security team <security@....org>)
CVE Request for sogO Open Source Groupware (www.sogo.nu) (Stefan Castille <stefan.castille@...nierdigital.se>)
CVE request CSRF in sogo (Stefan Castille <stefan.castille@...nierdigital.se>)
Re: [ANNOUNCE] Apache Directory LDAP API 1.0.0-M31 released (Yann Ylavic <ylavic.dev@...il.com>)
CVE-2015-3281 HAProxy information leak vulnerability (Solar Designer <solar@...nwall.com>)
Re: Follow up: PowerDNS Security Advisory 2015-01 (Alessandro Ghedini <alessandro@...dini.me>)

July 8 (3 messages)

Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 ("Larry W. Cashdollar" <larry0@...com>)
SQL Injection in easy2map-photos wordpress plugin v1.09 ("Larry W. Cashdollar" <larry0@...com>)
hostapd/wpa_supplicant - Incomplete WPS and P2P NFC NDEF record payload length validation (Jouni Malinen <j@...fi>)

July 9 (12 messages)

Re: Follow-up on Exploiting "BadIRET" vulnerability (CVE-2014-9322) (Andy Lutomirski <luto@...capital.net>)
[ANNOUNCE] Django security releases issued (1.4.21, 1.7.9, and 1.8.3) (Tim Graham <timograham@...il.com>)
Re: Squid HTTP proxy CVE request (Amos Jeffries <squid3@...enet.co.nz>)
Re: CVE request: pure-ftpd denial of service in glob_() (Vasyl Kaigorodov <vkaigoro@...hat.com>)
CVE request: XEE in ruby gem ruby-saml <1.0.0 (Reed Loden <reed@...dloden.com>)
Re: TR : CVE request for dash 0.5.7-3 x86-64 local buffer overflow (Jann Horn <jann@...jh.net>)
Re: node.js out of band write (cve-assign@...re.org)
Re: How serious is undefined behavior? (Alexander Cherepanov <ch3root@...nwall.com>)
CVE request: Command injection in ruby gem ruby-saml <1.0.0 (Reed Loden <reed@...dloden.com>)
Remote file download vulnerability in ibs-Mappro v0.6 Wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Remote file download vulnerability in ibs-Mappro v0.6 Wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: Squid HTTP proxy CVE request (Reed Black <reed@...afeword.org>)

July 10 (9 messages)

OpenSSL CVE-2015-1793 tester (alt.chain.fail) (mancha <mancha1@...o.com>)
Re: Squid HTTP proxy CVE request (Amos Jeffries <squid3@...enet.co.nz>)
Re: Re: CVE Request: UDP checksum DoS (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 (cve-assign@...re.org)
Re: Remote file download in Wordpress Plugin mdc-youtube-downloader v2.1.0 (cve-assign@...re.org)
Re: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 (cve-assign@...re.org)
Re: Remote file download vulnerability in ibs-Mappro v0.6 Wordpress plugin (cve-assign@...re.org)
Re: Follow up: PowerDNS Security Advisory 2015-01 (cve-assign@...re.org)
Re: CVE request CSRF in sogo (cve-assign@...re.org)

July 11 (2 messages)

Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (Fernando Muñoz <fernando@...l-life.com>)
CVE Request - Cross-Site Request Forgery, Cross-Site Scripting and SQL Injection in CP Contact Form with Paypal Wordpre… (Nitin Venkatesh <venkatesh.nitin@...il.…)

July 12 (4 messages)

The Census Project (CII) (Luca Carettoni <luca.carettoni@...isoft.com>)
Re: Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (Mark Felder <feld@...d.me>)
Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 ("Larry W. Cashdollar" <larry0@...com>)
CVE request: IPython CSRF validation (Kyle Kelley <rgbkrk@...il.com>)

July 13 (10 messages)

Re: How serious is undefined behavior? (Solar Designer <solar@...nwall.com>)
moodle security announcements (Marina Glancy <marina@...dle.com>)
Re: How serious is undefined behavior? (Alexander Cherepanov <ch3root@...nwall.com>)
Re: How serious is undefined behavior? (Xi Wang <xi.wang@...il.com>)
Retroactive CVE request for Ruby 1.9.2-p330 (Tony Arcieri <bascule@...il.com>)
Re: Retroactive CVE request for Ruby 1.9.2-p330 (cve-assign@...re.org)
Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (cve-assign@...re.org)
Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (Alessandro Ghedini <ghedo@...ian.org>)
Re: Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (Alessandro Ghedini <ghedo@...ian.org>)
Remote file download vulnerability in Wordpress Plugin image-export v1.1 ("Larry W. Cashdollar" <larry0@...com>)

July 14 (11 messages)

Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (Fernando Muñoz <fernando@...l-life.com>)
Re: Squid HTTP proxy CVE request (Amos Jeffries <squid3@...enet.co.nz>)
CVE request: ansible zone/chroot/jail escape (Martin Carpenter <mcarpenter@...e.fr>)
[CVE-2015-3908] Improper TLS Certificate Validation in Ansible (Cory Benfield <cory@...asa.co.uk>)
CVE Request: SQLite array overrun in the skip-scan optimization (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE Request: AWS s2n (Markus Vervier <markus.vervier@...xperts.de>)
Re: CVE Request: AWS s2n (Kurt Seifried <kseifried@...hat.com>)
siege: off-by-one in load_conf() (Agostino Sarubbo <ago@...too.org>)
Re: siege: off-by-one in load_conf() (Seth Arnold <seth.arnold@...onical.com>)
Re: siege: off-by-one in load_conf() (Agostino Sarubbo <ago@...too.org>)
Remote file download vulnerability in recent-backups v0.7 wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)

July 15 (5 messages)

Re: CVE Request: AWS s2n (Markus Vervier <markus.vervier@...xperts.de>)
Re: CVE Request: AWS s2n (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow (cve-assign@...re.org)
Re: CVE Request: SQLite array overrun in the skip-scan optimization (cve-assign@...re.org)
CVE Request: kmail: Attachments are not encrypted when "automatic encryption" is selected (Salvatore Bonaccorso <carnil@...ian.org>)

July 16 (10 messages)

CVE Request - Arbitrary File Download vulnerability in WP Attachment Export Wordpress Plugin v0.2.3 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
CVE Request: use after free in PHP 5.6 and 7 (possibly others) (Brian Carpenter <brian.carpenter@...il.com>)
[CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure (Cédric Champeau <cchampeau@...che.org>)
libav: divide-by-zero in ff_h263_decode_mba() (Agostino Sarubbo <ago@...too.org>)
CVE request: Zenphoto before 1.4.9 multiple vulnerabilities (Henri Salo <henri@...v.fi>)
CVE request: WordPress plugin sp-client-document-manager Blind SQL Injection (Henri Salo <henri@...v.fi>)
Re: CVE Request: use after free in PHP 5.6 and 7 (possibly others) (Mark Felder <feld@...d.me>)
Re: libav: divide-by-zero in ff_h263_decode_mba() (Mark Felder <feld@...d.me>)
Re: libav: divide-by-zero in ff_h263_decode_mba() (Agostino Sarubbo <ago@...too.org>)
Re: CVE Request: kmail: Attachments are not encrypted when "automatic encryption" is selected (cve-assign@...re.org)

July 17 (18 messages)

Remote file upload vulnerability in mailcwp v1.99 wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: ezmlm warning (Grant Ridder <shortdudey123@...il.com>)
Re: CVE Request: AWS s2n (Anthony Liguori <aliguori@...n.com>)
Re: CVE Request: AWS s2n ("MacCarthaigh, Colm" <colmmacc@...zon.com>)
Re: Re: ezmlm warning (Reed Loden <reed@...dloden.com>)
Re: ezmlm warning (Solar Designer <solar@...nwall.com>)
Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin ("Larry W. Cashdollar" <larry0@...com>)
Re: Re: ezmlm warning (Florian Weimer <fw@...eb.enyo.de>)
Re: Re: ezmlm warning (Reed Loden <reed@...dloden.com>)
Re: Re: ezmlm warning (Florian Weimer <fw@...eb.enyo.de>)
Re: Squid HTTP proxy CVE request (Mark Felder <feld@...d.me>)
CVE request: php - segmentation fault in Phar::convertToData; buffer overflow in phar_fix_filepath; (Vasyl Kaigorodov <vkaigoro@...hat.com>)
Re: Squid HTTP proxy CVE request (cve-assign@...re.org)
Re: CVE Request: Graphviz format string vuln (Tomas Hoger <thoger@...hat.com>)
Re: Re: Squid HTTP proxy CVE request (Amos Jeffries <squid3@...enet.co.nz>)
CVE Request: gdk-pixbuf heap overflow and DoS (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Squid HTTP proxy CVE request (cve-assign@...re.org)

July 18 (5 messages)

Re: CVE request: php - segmentation fault in Phar::convertToData; buffer overflow in phar_fix_filepath; (cve-assign@...re.org)
CVE-2014-8873 was fixed in DSA-3235-1 (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE request: Zenphoto before 1.4.9 multiple vulnerabilities (cve-assign@...re.org)
CVE Request: cacti multiple SQL injections (Alessandro Ghedini <alessandro@...dini.me>)
Re: Re: ezmlm warning (Solar Designer <solar@...nwall.com>)

July 19 (1 message)

CVE Request - Information Exposure Vulnerability in WordPress Mobile Pack Wordpress Plugin v2.1.2 (and certain versions… (Nitin Venkatesh <venkatesh.nitin@...il.…)

July 20 (2 messages)

Re: Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 (cve-assign@...re.org)
Re: siege: off-by-one in load_conf() ("Jason A. Donenfeld" <zx2c4@...too.org>)

July 21 (7 messages)

Re: Remote file download vulnerability in Wordpress Plugin image-export v1.1 (cve-assign@...re.org)
CVE Request for OpenSSH vulnerability - authentication limits bypass (king cope <isowarez.isowarez.isowarez@...glemail.com>)
Re: CVE request: IPython CSRF validation (cve-assign@...re.org)
CVE Request - Cross-Site Request Forgery Vulnerability in Portfolio Plugin Wordpress Plugin v1.0 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
CVE Request: October CMS - Stored XSS in image caption tag ("Abhishek J.M" <jmabhishek4@...il.com>)
Re: CVE request: IPython CSRF validation (Kyle Kelley <rgbkrk@...il.com>)
Re: CVE request: php - segmentation fault in Phar::convertToData; buffer overflow in phar_fix_filepath; (Tomas Hoger <thoger@...hat.com>)

July 22 (8 messages)

Re: CVE Request for OpenSSH vulnerability - authentication limits bypass ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE Request: AWS s2n (Markus Vervier <markus.vervier@...xperts.de>)
Re: CVE Request: October CMS - Stored XSS in image caption tag (cve-assign@...re.org)
Security issues in LXC (CVE-2015-1331 and CVE-2015-1334) (Tyler Hicks <tyhicks@...onical.com>)
Re: Security issues in LXC (CVE-2015-1331 and CVE-2015-1334) (Fiedler Roman <Roman.Fiedler@....ac.at>)
Multiple memory corruption vulnerabilities in SoX 14.4.2 (Michele Spagnuolo <mikispag@...il.com>)
Linux x86_64 NMI security issues (Andy Lutomirski <luto@...capital.net>)
Re: CVE Request for OpenSSH vulnerability - authentication limits bypass (mancha <mancha1@...o.com>)

July 23 (19 messages)

Re: Linux x86_64 NMI security issues (Solar Designer <solar@...nwall.com>)
Re: Security issues in LXC (CVE-2015-1331 and CVE-2015-1334) (Solar Designer <solar@...nwall.com>)
Re: Multiple memory corruption vulnerabilities in SoX 14.4.2 (Solar Designer <solar@...nwall.com>)
Re: CVE Request for OpenSSH vulnerability - authentication limits bypass (cve-assign@...re.org)
Re: Linux x86_64 NMI security issues (Kurt Seifried <kseifried@...hat.com>)
CVE-2015-5158 Qemu: scsi stack buffer overflow (P J P <ppandit@...hat.com>)
Re: Re: CVE Request for OpenSSH vulnerability - authentication limits bypass (mancha <mancha1@...o.com>)
Re: CVE Request for OpenSSH vulnerability - authentication limits bypass (cve-assign@...re.org)
Re: Linux x86_64 NMI security issues (Petr Matousek <pmatouse@...hat.com>)
Re: Linux x86_64 NMI security issues (Andy Lutomirski <luto@...capital.net>)
Re: Linux x86_64 NMI security issues (Petr Matousek <pmatouse@...hat.com>)
CVE-2012-2150 xfsprogs: xfs_metadump information disclosure flaw (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request for OpenSSH vulnerability - authentication limits bypass (mancha <mancha1@...o.com>)
CVE-2015-3228 - Ghostscript - Integer overflow (William Robinet <william.robinet@...ostix.com>)
CVE request: WordPress 4.2.2 and earlier cross-site scripting vulnerability (Henri Salo <henri@...v.fi>)
Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Qualys Security Advisory <qsa@...lys.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Leif Nixon <nixon@...ator.liu.se>)
Re: CVE request: WordPress 4.2.2 and earlier cross-site scripting vulnerability (cve-assign@...re.org)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Philip Pettersson <philip.pettersson@...il.com>)

July 24 (12 messages)

Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Jamie Strandboge <jamie@...onical.com>)
CVE-2015-3208 hornetq: XXE/SSRF in XPath selector (Kurt Seifried <kseifried@...hat.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Kurt Seifried <kseifried@...hat.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Leif Nixon <nixon@...ator.liu.se>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Martino Dell'Ambrogio <tillo@...lo.ch>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Joshua Rogers <oss@...ernot.info>)
Re: Linux x86_64 NMI security issues (Josh Boyer <jwboyer@...oraproject.org>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (mancha <mancha1@...o.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Brandon Perry <bperry.volatile@...il.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Stephan Wiesand <stephan.wiesand@...il.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Leif Nixon <nixon@...ator.liu.se>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Brad Knowles <brad@...b-internet.org>)

July 25 (6 messages)

Re: Linux x86_64 NMI security issues (Andy Lutomirski <luto@...capital.net>)
CVE Request - Open Redirect Vulnerability in Music Store Wordpress Plugin v1.0.14 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
CVE Request - Cross-Site Request Forgery & SQL Injection Vulnerabilities in Unite Gallery Lite Wordpress Plugin v1.4.6 (Nitin Venkatesh <venkatesh.nitin@...il.…)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Leif Nixon <nixon@...ator.liu.se>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Dave Horsfall <dave@...sfall.org>)

July 26 (3 messages)

Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Brad Knowles <brad@...b-internet.org>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (gremlin@...mlin.ru)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Hanno Böck <hanno@...eck.de>)

July 27 (10 messages)

Re: Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 ("Larry W. Cashdollar" <larry0@...com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (mancha <mancha1@...o.com>)
Xen Security Advisory 138 (CVE-2015-5154) - QEMU heap overflow flaw while processing certain ATAPI commands. (Xen.org security team <security@....org>)
CVE request: Easy!Appointments 1.0 cross-site scripting vulnerability (Henri Salo <henri@...v.fi>)
CVE request: Easy!Appointments 1.0 Cross-Site Request Forgery and Insufficiently Protected Credentials vulnerabilities (Henri Salo <henri@...v.fi>)
CVE request: Easy!Appointments 1.0 Missing HTTPOnly flag (Henri Salo <henri@...v.fi>)
Security issue in Linux Kernel Keyring (CVE-2015-1333) (Tyler Hicks <tyhicks@...onical.com>)
Re: Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 (cve-assign@...re.org)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Ankeet Presswala <mythic.boost@...il.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Jeff Collins <jeffcollins@...lforce.net>)

July 28 (11 messages)

CVE request: Two ruby 'dl' vulnerabilities fixed in ruby-1.9.1-p129 (Reed Loden <reed@...dloden.com>)
CVE request: Linux kernel - information leak in md driver (Benjamin Randazzo <benjamin@...dazzo.fr>)
Re: CVE request: Two ruby 'dl' vulnerabilities fixed in ruby-1.9.1-p129 (cve-assign@...re.org)
Re: CVE request: Two ruby 'dl' vulnerabilities fixed in ruby-1.9.1-p129 (Jan Rusnacko <jrusnack@...hat.com>)
CVE request: mktexlsr/texlive: insecure use of /tmp (Vasyl Kaigorodov <vkaigoro@...hat.com>)
[OSSA 2015-013] Glance task flow may fail to delete image from backend (CVE-2015-3289) (Grant Murphy <grant.murphy@...com>)
CVE Request - OpenStack Designate mDNS DoS through incorrect handling of large RecordSets (Kiall Mac Innes <kiall@...innes.ie>)
Re: Security issue in Linux Kernel Keyring (CVE-2015-1333) (Tyler Hicks <tyhicks@...onical.com>)
Re: CVE Request - OpenStack Designate mDNS DoS through incorrect handling of large RecordSets (cve-assign@...re.org)
Re: CVE Request - OpenStack Designate mDNS DoS through incorrect handling of large RecordSets (Kiall Mac Innes <kiall@...innes.ie>)
Re: CVE Request - OpenStack Designate mDNS DoS through incorrect handling of large RecordSets (cve-assign@...re.org)

July 29 (14 messages)

Re: Re: Linux x86_64 NMI security issues (Luis Henriques <luis.henriques@...onical.com>)
CVE request - remind 3.1.14 and earlier - buffer overflow (Dianne Skoll <dfs@...ringpenguin.com>)
[BIND] CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure (Michael McNally <mcnally@....org>)
Re: [BIND] CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure (Solar Designer <solar@...nwall.com>)
Re: CVE request: Linux kernel - information leak in md driver (cve-assign@...re.org)
Re: Re: CVE Request - OpenStack Designate mDNS DoS through incorrect handling of large RecordSets (Kiall Mac Innes <kiall@...innes.ie>)
CVE Request - Go net/http library - HTTP smuggling (Jason Buberel <jbuberel@...gle.com>)
CVE request: Froxlor - information leak (oss-security-list@...lak.de)
Re: CVE Request - Go net/http library - HTTP smuggling (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request - Go net/http library - HTTP smuggling (Jason Buberel <jbuberel@...gle.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (z80 <z80@...ealchemy.be>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Solar Designer <solar@...nwall.com>)
Re: CVE request: Two ruby 'dl' vulnerabilities fixed in ruby-1.9.1-p129 (Reed Loden <reed@...dloden.com>)
Re: CVE request: Two ruby 'dl' vulnerabilities fixed in ruby-1.9.1-p129 (Reed Loden <reed@...dloden.com>)

July 30 (15 messages)

[CVE Request] WP Slimstat < 4.1.6 - Referer Header XSS (Sam Pizzey <sam@...zey.me>)
Re: Linux x86_64 NMI security issues (Solar Designer <solar@...nwall.com>)
Re: CVE-2012-2150 xfsprogs: xfs_metadump information disclosure flaw (Dave Chinner <david@...morbit.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Solar Designer <solar@...nwall.com>)
Re: Linux x86_64 NMI security issues (Daniel Micay <danielmicay@...il.com>)
Re: CVE request: mktexlsr/texlive: insecure use of /tmp (cve-assign@...re.org)
Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability (Stefan Cornelius <scorneli@...hat.com>)
Re: Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g (Stefan Cornelius <scorneli@...hat.com>)
CVE-2015-1416: vulnerability in patch(1) (Adam Maris <amaris@...hat.com>)
CVE Request: PHP v7 - Code execution vulnerability (Fourny Dimitri <fourny.d@...il.com>)
Re: CVE Request: PHP v7 - Code execution vulnerability (cve-assign@...re.org)
A new class of security vulns? (Kurt Seifried <kseifried@...hat.com>)
Re: A new class of security vulns? (Scott Arciszewski <scott@...agonie.com>)
Re: A new class of security vulns? (cve-assign@...re.org)
Re: A new class of security vulns? (Joshua Rogers <oss@...ernot.info>)

July 31 (6 messages)

Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability (cve-assign@...re.org)
CVE Request: freeradius: the EAP-PWD module performs insufficient validation on packets received from an EAP peer (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser (Qualys Security Advisory <qsa@...lys.com>)
CVE for crypto_get_random() from libsrtp (Adam Maris <amaris@...hat.com>)
Re: CVE for crypto_get_random() from libsrtp (Scott Arciszewski <scott@...agonie.com>)
Re: RE: strings /libbfd crash (Tyler Hicks <tyhicks@...onical.com>)

266 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.