oss-security mailing list - 2015/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 10	² 10	³ 11	⁴ 4	⁵ 8	⁶ 4
⁷ 8	⁸ 9	⁹ 4	¹⁰ 4	¹¹ 5	¹² 1	¹³ 3
¹⁴ 4	¹⁵ 9	¹⁶ 5	¹⁷ 14	¹⁸ 10	¹⁹ 7	²⁰ 3
²¹ 16	²² 18	²³ 5	²⁴ 4	²⁵ 4	²⁶ 2	²⁷ 1
²⁸	²⁹ 4	³⁰ 8

Messages by day:

September 1 (10 messages)

CVE request: screen stack overflow (deep recursion) (Florian Weimer <fw@...eb.enyo.de>)
Re: Terminal escape sequences - the new XSS for admins? (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Terminal escape sequences - the new XSS for admins? (Michal Zalewski <lcamtuf@...edump.cx>)
Re: CVE Request: more php unserializing issues (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: more php unserializing issues (Marcus Meissner <meissner@...e.de>)
Re: CVE Request - LFI/Path Traversal in NextGen Gallery WordPress Plugin. (Dis close <disclose@...ersecurityworks.com>)
Re: CVE Request - LFI/Path Traversal in NextGen Gallery WordPress Plugin. (Dis close <disclose@...ersecurityworks.com>)
CSRF to RCE in Jenkins (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Xen Security Advisory 141 (CVE-2015-6654) - printk is not rate-limited in xenmem_add_to_physmap_one (Xen.org security team <security@....org>)
[OSSA 2015-017] Nova may fail to delete images in resize state (CVE-2015-3280) (Tristan Cacqueray <tdecacqu@...hat.com>)

September 2 (10 messages)

CVE REJECT CVE-2015-3287 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE REJECT CVE-2015-3287 (cve-assign@...re.org)
CVE Request : CSRF in IPython/Jupyter notebook Tree. (Matthias Bussonnier <bussonniermatthias@...il.com>)
Re: CVE Request : CSRF in IPython/Jupyter notebook Tree. (Juan Broullón <thebrowfc@...il.com>)
PowerDNS Security Advisory 2015-02 (Pieter Lexis <pieter.lexis@...erdns.com>)
Factoring RSA Keys With TLS Perfect Forward Secrecy (Florian Weimer <fweimer@...hat.com>)
CVE-2015-5239 Qemu: vnc infinite loop issue (P J P <ppandit@...hat.com>)
Re: CVE requests for Drupal contributed modules (from SA-CONTRIB-2015-100 to SA-CONTRIB-2015-131) (Pere Orga <pere@...a.cat>)
Re: CVE-2015-5239 Qemu: vnc infinite loop issue (Kurt Seifried <kseifried@...hat.com>)
Re: CVE-2015-5239 Qemu: vnc infinite loop issue (Julien Cristau <jcristau@...ian.org>)

September 3 (11 messages)

OpenSSH: CVE-2015-6565 (pty issue in 6.8-6.9) can lead to local privesc on Linux (Jann Horn <jann@...jh.net>)
Two new vulnerabilities in BIND: CVE-2015-5722 and CVE-2015-5986 are now public (ISC Security Officer <security-officer@....org>)
Re: CVE-2015-5239 Qemu: vnc infinite loop issue (P J P <ppandit@...hat.com>)
Re: CVE request: screen stack overflow (deep recursion) (cve-assign@...re.org)
AW: Re: CVE request: screen stack overflow (deep recursion) (Fiedler Roman <Roman.Fiedler@....ac.at>)
Re: CVE Request for glusterfs: fuse check return value of setuid (Siddharth Sharma <siddharth@...hat.com>)
Re: CVE request: screen stack overflow (deep recursion) (Solar Designer <solar@...nwall.com>)
CVE Request: Memory corruption in libvncserver < 0.9.8 (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request: screen stack overflow (deep recursion) (Solar Designer <solar@...nwall.com>)
Re: Two new vulnerabilities in BIND: CVE-2015-5722 and CVE-2015-5986 are now public (Florian Weimer <fweimer@...hat.com>)
Re: CVE request: screen stack overflow (deep recursion) (Kuang-che Wu <kcwu@...e.org>)

September 4 (4 messages)

Re: Two new vulnerabilities in BIND: CVE-2015-5722 and CVE-2015-5986 are now public (Mark Andrews <marka@....org>)
CVE request: Ganglia-web auth bypass (Ivan Novikov <in@...larm.com>)
CVE Request: PgBouncer: failed auth_query lookup leads to connection as auth_user (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request Qemu: net: e1000 infinite loop issue (P J P <ppandit@...hat.com>)

September 5 (8 messages)

Re: CVE Request for glusterfs: fuse check return value of setuid (cve-assign@...re.org)
Re: Re: CVE Request for glusterfs: fuse check return value of setuid (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request for glusterfs: fuse check return value of setuid (cve-assign@...re.org)
Some Wordpress Plugin Stuff (Scott Arciszewski <scott@...iszewski.me>)
Re: CVE Request Qemu: net: e1000 infinite loop issue (cve-assign@...re.org)
Re: CVE request: Ganglia-web auth bypass (cve-assign@...re.org)
Re: CVE Request: PgBouncer: failed auth_query lookup leads to connection as auth_user (cve-assign@...re.org)
CVE Request: Glibc Pointer guarding weakness (Hector Marco-Gisbert <hecmargi@....es>)

September 6 (4 messages)

Re: CVE Request Qemu: net: e1000 infinite loop issue (Qinghao Tang <luodalongde@...il.com>)
CVE Request: TOTP Replay Attack in Ruby library "devise-two-factor" (Justin Bull <me@...tinbull.ca>)
Re: Some Wordpress Plugin Stuff (cve-assign@...re.org)
Re: CVE Request Blind SQL Injection in wordpress plugin dukapress v2.5.9 (Larry Cashdollar <larry0@...com>)

September 7 (8 messages)

Re: Re: CVE Request Qemu: net: e1000 infinite loop issue (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Re: CVE Request Qemu: net: e1000 infinite loop issue (Qinghao Tang <luodalongde@...il.com>)
Re: CVE request: Ganglia-web auth bypass (Raphael Geissert <geissert@...ian.org>)
Heap overflow and DoS in unzip 6.0 (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE Request: PHP remote exploits (even more) (Marcus Meissner <meissner@...e.de>)
nss: SSL_ImplementedCiphers ABI incompatibility may lead to incorrect cipher suites (Florian Weimer <fweimer@...hat.com>)
Re: nss: SSL_ImplementedCiphers ABI incompatibility may lead to incorrect cipher suites (cve-assign@...re.org)
CVE request for wget (Austin English <austinenglish@...il.com>)

September 8 (9 messages)

Re: Re: CVE Request Qemu: net: e1000 infinite loop issue (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Pending CVE requests for glibc (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request: Wireshark 1.12.7 (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Wireshark 1.12.7 (Marcus Meissner <meissner@...e.de>)
CVE Request: libgcrypt hardening for RSA-CRT leak (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: libgcrypt hardening for RSA-CRT leak (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: more php unserializing issues (cve-assign@...re.org)
Re: CVE Request: PHP remote exploits (even more) (cve-assign@...re.org)
[OSSA 2015-018] Neutron firewall rules bypass through port update (CVE-2015-5240) (Tristan Cacqueray <tdecacqu@...hat.com>)

September 9 (4 messages)

Re: CVE request for wget (Victor Pereira <vpereira@...e.de>)
Re: CVE request for wget (Andreas Stieger <astieger@...e.com>)
Re: nss: SSL_ImplementedCiphers ABI incompatibility may lead to incorrect cipher suites (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request : CSRF in IPython/Jupyter notebook Tree. (Kyle Kelley <rgbkrk@...il.com>)

September 10 (4 messages)

CVE request Qemu: ide: divide by zero issue (P J P <ppandit@...hat.com>)
Re: CVE request Qemu: ide: divide by zero issue (cve-assign@...re.org)
CVE request: Use-after-free in Linux kernel with aufs mmap patch (Ben Hutchings <ben@...adent.org.uk>)
Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch (sfjro@...rs.sourceforge.net)

September 11 (5 messages)

Re: CVE request Qemu: ide: divide by zero issue (P J P <ppandit@...hat.com>)
CVE Request: OpenLDAP: ber_get_next denial of service vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request Qemu: ide: divide by zero issue (Qinghao Tang <luodalongde@...il.com>)
CVE Request: 2 FreeType issues (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: CVE Request: OpenLDAP: ber_get_next denial of service vulnerability (cve-assign@...re.org)

September 12 (1 message)

CVE request: Flash based XSS in FileAPI.flash.swf (mala <mala@...la>)

September 13 (3 messages)

Re: libxml2 issue: out-of-bounds memory access when parsing an unclosed HTML comment (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2015-0854: Insecure use of system() in shutter (Luke Faraone <lfaraone@...ian.org>)
CVE-2015-0853: insecure use of os.system() in svn-workbench (Luke Faraone <lfaraone@...ian.org>)

September 14 (4 messages)

CVE-Request for stored WCI (a.k.a XSS) in Visual Form Builder 2.7.5 - 2.8.4 (Anti Räis <antirais@...il.com>)
Re: CVE Request : CSRF in IPython/Jupyter notebook Tree. (cve-assign@...re.org)
CVE-2015-6937 - Linux kernel - NULL pointer dereference in net/rds/connection.c (cve-assign@...re.org)
Re: CVE Request: Linux x86_64 NT flag issue - Linux kernel (cve-assign@...re.org)

September 15 (9 messages)

CVE-2015-6584: XSS in DataTables (Martin Prpic <mprpic@...hat.com>)
CVE-2015-5278 Qemu: net: avoid infinite loop when receiving packets (P J P <ppandit@...hat.com>)
CVE-2015-5279 Qemu: net: add checks to validate ring buffer pointers (P J P <ppandit@...hat.com>)
CVE Request : Use-after-free in openjpeg (FEIST Josselin <josselin.feist@...il.com>)
Re: Heap overflow and DoS in unzip 6.0 (Stefan Cornelius <scorneli@...hat.com>)
Re: Heap overflow and DoS in unzip 6.0 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Heap overflow and DoS in unzip 6.0 (Hanno Böck <hanno@...eck.de>)
Re: Heap overflow and DoS in unzip 6.0 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE-2015-6584: XSS in DataTables (Kurt Grutzmacher <grutz@...gojango.net>)

September 16 (5 messages)

CVE Request: Use-after-free in optipng 0.6.4 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE Request: TOTP Replay Attack in Ruby library "devise-two-factor" (Justin Bull <me@...tinbull.ca>)
CVE Request: Maliciously crafted text files in IPython/Jupyter editor (MinRK <benjaminrk@...il.com>)
CVE-2015-5155 - openslp 1.2.1 ParseExtension() DoS vulnerability (Qinghao Tang <luodalongde@...il.com>)
New release (2.6.) of testssl.sh (Dirk Wetter <dirk@...tssl.sh>)

September 17 (14 messages)

CVE Request: remote triggerable use-after-free in rpcbind (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: TOTP Replay Attack in Ruby library "devise-two-factor" (cve-assign@...re.org)
Re: CVE Request: Use-after-free in optipng 0.6.4 (Mark Felder <feld@...d.me>)
Re: CVE-2015-0854: Insecure use of system() in shutter (Mark Felder <feld@...d.me>)
s/party/hack like it's 1999 (up201407890@...nos.dcc.fc.up.pt)
Re: CVE Request: remote triggerable use-after-free in rpcbind (cve-assign@...re.org)
Re: Heap overflow and DoS in unzip 6.0 (Mark Felder <feld@...d.me>)
Re: s/party/hack like it's 1999 (Manuel Gómez <targen@...il.com>)
Re: CVE Request: remote triggerable use-after-free in rpcbind (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: remote triggerable use-after-free in rpcbind (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: remote triggerable use-after-free in rpcbind (Steve Dickson <SteveD@...hat.com>)
Re: CVE Request: remote triggerable use-after-free in rpcbind (Steve Dickson <SteveD@...hat.com>)
Re: Re: CVE Request: remote triggerable use-after-free in rpcbind (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: remote triggerable use-after-free in rpcbind (Steve Dickson <SteveD@...hat.com>)

September 18 (10 messages)

CVE Request: Squid HTTP Proxy Denial of Service (Amos Jeffries <squid3@...enet.co.nz>)
CVE Request: Squid HTTP Proxy Denial of Service (Amos Jeffries <squid3@...enet.co.nz>)
CVE Request: Squid HTTP Proxy Denial of Service (Amos Jeffries <squid3@...enet.co.nz>)
CVE request - ldapauth-fork versions < 2.3.3 are vulnerable to ldap injection. (David Black <dblack@...assian.com>)
CVE request Qemu: net: virtio-net possible remote DoS (P J P <ppandit@...hat.com>)
Re: s/party/hack like it's 1999 (up201407890@...nos.dcc.fc.up.pt)
Re: Re: CVE Request: remote triggerable use-after-free in rpcbind (Olaf Kirch <okir@...e.com>)
Re: CVE request - ldapauth-fork versions < 2.3.3 are vulnerable to ldap injection. (cve-assign@...re.org)
Re: CVE request Qemu: net: virtio-net possible remote DoS (cve-assign@...re.org)
Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch (sfjro@...rs.sourceforge.net)

September 19 (7 messages)

Re: CVE-2015-5155 - openslp 1.2.1 ParseExtension() DoS vulnerability (Stefan Cornelius <scorneli@...hat.com>)
CVE Request: Plone Unauthorized user creation (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
CVE Request: Plone XSS (Nathan Van Gheem <vangheem@...il.com>)
CVE Request: Plone Privilege Escalation (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
CVE Request: Plone header injection (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
Re: CVE Request: Use-after-free in optipng 0.6.4 (Stefan Cornelius <scorneli@...hat.com>)
Re: s/party/hack like it's 1999 (Solar Designer <solar@...nwall.com>)

September 20 (3 messages)

Re: s/party/hack like it's 1999 (Rich Felker <dalias@...c.org>)
Re: s/party/hack like it's 1999 (Solar Designer <solar@...nwall.com>)
CVE Request: gollum information disclosure vulnerability (Dawa Ometto <d.ometto@...il.com>)

September 21 (16 messages)

Moodle security release (Marina Glancy <marina@...dle.com>)
Re: CVE request - ldapauth-fork versions < 2.3.3 are vulnerable to ldap injection. (David Black <dblack@...assian.com>)
CVE-2015-5282: Foreman stored XSS in parameter hide checkbox (Dominic Cleal <dominic@...al.org>)
Samsung S4 (GT-I9500) multiple kernel vulnerabilities (Jonathan Salwan <jsalwan@...rkslab.com>)
CVE request: zarafa-autorespond suffers from a potential local privilege escalation (Martin Prpic <mprpic@...hat.com>)
Re: Heap overflow and DoS in unzip 6.0 (Stefan Cornelius <scorneli@...hat.com>)
DoS in libtiff (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: zarafa-autorespond suffers from a potential local privilege escalation (Christian Hoffmann <christian@...fie.info>)
Re: s/party/hack like it's 1999 (David Holland <dholland-oss-security@...bsd.org>)
Re: s/party/hack like it's 1999 (Greg KH <greg@...ah.com>)
Re: CVE request: zarafa-autorespond suffers from a potential local privilege escalation (Christian Hoffmann <christian@...fie.info>)
Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities (Daniel Micay <danielmicay@...il.com>)
Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities (Daniel Micay <danielmicay@...il.com>)
Re: s/party/hack like it's 1999 (Florian Weimer <fw@...eb.enyo.de>)
Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities (Daniel Micay <danielmicay@...il.com>)

September 22 (18 messages)

Re: CVE Request: Maliciously crafted text files in IPython/Jupyter editor (MinRK <benjaminrk@...il.com>)
Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities (Florian Weimer <fweimer@...hat.com>)
Xen Security Advisory 142 - libxl fails to honour readonly flag on disks with qemu-xen (Xen.org security team <security@....org>)
CVE Request: Arm Mali gpu driver Dos vulnerability (Gengjia Chen <chengjia4574@...il.com>)
Xen Security Advisory 142 (CVE-2015-7311) - libxl fails to honour readonly flag on disks with qemu-xen (Xen.org security team <security@....org>)
CVE requests - Contact Form 7, eZPublish (EZSA-2015-001), Prestashop (us3r777 <us3r777@...0.so>)
CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege (VeraCrypt Team <veracrypt@...ix.fr>)
CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android (Joe Bowser <bowserj@...il.com>)
[OSSA-2015-019] Glance image status manipulation (CVE-2015-5251) (Grant Murphy <grant.murphy@....com>)
Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch (cve-assign@...re.org)
Re: DoS in libtiff (cve-assign@...re.org)
Re: CVE Request: gollum information disclosure vulnerability (cve-assign@...re.org)
Re: CVE Request: Plone Unauthorized user creation (cve-assign@...re.org)
Re: CVE Request: Plone XSS (cve-assign@...re.org)
Re: CVE Request: Plone Privilege Escalation (cve-assign@...re.org)
Re: CVE Request: Plone header injection (cve-assign@...re.org)
CVE-2015-5232: various /tmp races in opa-fm, opa-ff (Florian Weimer <fweimer@...hat.com>)
Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities (Daniel Micay <danielmicay@...il.com>)

September 23 (5 messages)

Vulnerability in WhiteHEAT Linux Driver-CVE-2015-5257 (Moein Ghasemzadeh <moein@...uary.com>)
Re: Vulnerability in WhiteHEAT Linux Driver-CVE-2015-5257 (Greg KH <greg@...ah.com>)
Re: DoS in libtiff (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE Request: Buffer overflow in global memory affecting optipng 0.7.5 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Vulnerability in WhiteHEAT Linux Driver-CVE-2015-5257 (Greg KH <greg@...ah.com>)

September 24 (4 messages)

Re: CVE Request: Maliciously crafted text files in IPython/Jupyter editor (cve-assign@...re.org)
Re: CVE request: BD-J implementation in libbluray (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege (cve-assign@...re.org)
Pulp 2.6.4 released for CVE-2015-5263 (Randy Barlow <rbarlow@...hat.com>)

September 25 (4 messages)

Re: CVE request for wget (Austin English <austinenglish@...il.com>)
VuFind 1.0 Web Application Reflected XSS (Cross-site Scripting) 0-Day Bug Security Issue (Jing Wang <justqdjing@...il.com>)
Re: CVE request for wget (cve-assign@...re.org)
Re: CVE Request: 2 FreeType issues (cve-assign@...re.org)

September 26 (2 messages)

Re: s/party/hack like it's 1999 (David Holland <dholland-oss-security@...bsd.org>)
Re: s/party/hack like it's 1999 (Daniel Micay <danielmicay@...il.com>)

September 27 (1 message)

DoS attack through Email-Address perl module v1.907 (CVE id request) (Pali Rohár <pali.rohar@...il.com>)

September 29 (4 messages)

Re: CVE request for wget (Austin English <austinenglish@...il.com>)
CVE request: urlfetch range handling flaw in Cyrus IMAP (Martin Prpic <mprpic@...hat.com>)
Re: Re: CVE request for wget (Andreas Stieger <astieger@...e.com>)
Security issue in LXC (CVE-2015-1335) (Tyler Hicks <tyhicks@...onical.com>)

September 30 (8 messages)

Re: s/party/hack like it's 1999 (Rich Felker <dalias@...c.org>)
Re: DoS attack through Email-Address perl module v1.907 (CVE id request) (cve-assign@...re.org)
Re: CVE request: urlfetch range handling flaw in Cyrus IMAP (Florian Weimer <fweimer@...hat.com>)
Re: CVE Request: cacti multiple SQL injections (Alessandro Ghedini <alessandro@...dini.me>)
Re: CVE Request: twig remote code execution (Alessandro Ghedini <alessandro@...dini.me>)
CVE Request: zendframework SQL injections (Alessandro Ghedini <alessandro@...dini.me>)
Apache James Server 2.3.2 security vulnerability fixed (Eric Charles <eric@...che.org>)
Re: CVE Request: zendframework SQL injections (Alessandro Ghedini <alessandro@...dini.me>)

195 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.