oss-security mailing list - 2015/12

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2015/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 2	² 11	³ 7	⁴ 5	⁵ 8	⁶
⁷ 2	⁸ 9	⁹ 8	¹⁰ 7	¹¹ 7	¹² 2	¹³ 2
¹⁴ 20	¹⁵ 15	¹⁶ 5	¹⁷ 15	¹⁸ 6	¹⁹ 3	²⁰ 1
²¹ 11	²² 11	²³ 10	²⁴ 5	²⁵ 2	²⁶ 7	²⁷ 2
²⁸ 8	²⁹ 4	³⁰ 5	³¹ 8

Messages by day:

December 1 (2 messages)

CVE-2015-5273 + CVE-2015-5287, abrt local root in Centos/Fedora/RHEL (Philip Pettersson <philip.pettersson@...il.com>)
Re: race condition checking digests/checksums in sudoers (Tomas Hoger <thoger@...hat.com>)

December 2 (11 messages)

CVE Request: dhcpcd 3.x, potentially other versions too (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request: dhcpcd 3.x, potentially other versions too (cve-assign@...re.org)
Re: Heap Overflow in PCRE (cve-assign@...re.org)
Re: Re: CVE Request: dhcpcd 3.x, potentially other versions too (Seth Arnold <seth.arnold@...onical.com>)
Re: Re: CVE Request: dhcpcd 3.x, potentially other versions too (Sebastian Krahmer <krahmer@...e.com>)
shellinabox - DNS rebinding attack due to HTTP fallback (Andrea Barisani <andrea@...ersepath.com>)
Re: shellinabox - DNS rebinding attack due to HTTP fallback (cve-assign@...re.org)
Re: Re: Heap Overflow in PCRE (Salvatore Bonaccorso <carnil@...ian.org>)
Command Injection in cool-video-gallery v1.9 Wordpress plugin (Larry Cashdollar <larry0@...com>)
User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (halfdog <me@...fdog.net>)
Re: Heap Overflow in PCRE (cve-assign@...re.org)

December 3 (7 messages)

Re: CVE Request: dhcpcd 3.x, potentially other versions too (cve-assign@...re.org)
Re: Re: Heap Overflow in PCRE (Jakub Wilk <jwilk@...lk.net>)
CVE request -- Ethernet flow control vulnerability in SRIOV devices (Igor Smolyar <igors@...technion.ac.il>)
OpenStack Ironic does not honor clean steps (CVE-2015-7514) (Devananda van der Veen <devananda.vdv@...il.com>)
OpenStack Ironic does not honor clean steps (CVE-2015-7514) (Devananda van der Veen <devananda.vdv@...il.com>)
Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE (Glenn Randers-Pehrson <glennrp@...il.com>)
CVE request - redmine: Issues API may disclose changeset messages that are not visible (Matthias Geerdsen <matthias@...lons.info>)

December 4 (5 messages)

CVE request - Redmine: open redirect vulnerability (fixed earlier this year) (Matthias Geerdsen <matthias@...lons.info>)
Re: Re: CVE request for keepassx password database export (Reinhard Tartler <siretart@...il.com>)
CVE Request: Magento SWF XSS (Ryan Dewhurst <ryandewhurst@...il.com>)
CVE Request: Shotwell does not verify TLS certificates (mcatanzaro <mcatanzaro@...lia.com>)
CVE Request: PHPMailer Message Injection Vulnerability (Gsunde Orangen <gsunde.orangen@...il.com>)

December 5 (8 messages)

Re: CVE Request: PHPMailer Message Injection Vulnerability (cve-assign@...re.org)
Re: CVE request - redmine: Issues API may disclose changeset messages that are not visible (cve-assign@...re.org)
Re: CVE request - Redmine: open redirect vulnerability (fixed earlier this year) (cve-assign@...re.org)
Re: CVE Request: Magento SWF XSS (cve-assign@...re.org)
Re: Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE (cve-assign@...re.org)
CVE request: Redmine: cross-site scripting vulnerability fixed in 3.0.0 and 2.6.2 (Henri Salo <henri@...v.fi>)
Re: CVE request: Redmine: cross-site scripting vulnerability fixed in 3.0.0 and 2.6.2 (cve-assign@...re.org)
Re: Re: CVE request: Redmine: cross-site scripting vulnerability fixed in 3.0.0 and 2.6.2 (Henri Salo <henri@...v.fi>)

December 7 (2 messages)

CVE-2015-7519: Phusion Passenger Header overwriting issue (Andreas Stieger <astieger@...e.com>)
injecting environment variables into Phusion Passenger (CVE-2015-7519) (Marcus Meissner <meissner@...e.de>)

December 8 (9 messages)

Xen Security Advisory 158 (CVE-2015-8338) - long running memory operations on ARM (Xen.org security team <security@....org>)
Xen Security Advisory 159 (CVE-2015-8339,CVE-2015-8340) - XENMEM_exchange error handling issues (Xen.org security team <security@....org>)
Xen Security Advisory 160 (CVE-2015-8341) - libxl leak of pv kernel and initrd on error (Xen.org security team <security@....org>)
CVE request: Qemu: ui: vnc: avoid floating point exception (P J P <ppandit@...hat.com>)
CVE for git issue - please use CVE-2015-7545 (Kurt Seifried <kseifried@...hat.com>)
[ANNOUNCE] CVE-2015-5254 - Unsafe deserialization in ActiveMQ (Dejan Bosanac <dejan@...httale.net>)
Re: CVE request: Qemu: ui: vnc: avoid floating point exception (cve-assign@...re.org)
CVE request: Redmine - Data disclosure in atom feed (Matthias Geerdsen <matthias@...lons.info>)
Re: Re: CVE request for keepassx password database export (Felix Geyer <debfx@...os.de>)

December 9 (8 messages)

CVE request - Linux kernel - Fix handling of stored error in a negatively instantiated user key (Wade Mealing <wmealing@...hat.com>)
CVE request - Linux kernel - Fix handling of stored error in a negatively instantiated user key (xiaoqixue_1 <xiaoqixue_1@....com>)
CVE request - Android kernel - IPv6 connect cause a denial of service (郭永刚 <guoyonggang@....cn>)
Re: CVE request - Android kernel - IPv6 connect cause a denial of service (Hannes Frederic Sowa <hannes@...essinduktion.org>)
Re: CVE request - Android kernel - IPv6 connect cause a denial of service (Robert Święcki <robert@...ecki.net>)
CVE-2015-7518: Foreman stored XSS in parameter information popup (Dominic Cleal <dominic@...al.org>)
RE: CVE for git issue - please use CVE-2015-7545 ("Evans, Jonathan L." <jevans@...re.org>)
Re: CVE for git issue - please use CVE-2015-7545 (Kurt Seifried <kseifried@...hat.com>)

December 10 (7 messages)

CVE request - a out of bound read bug is found in libdwarf (xiaoqixue_1 <xiaoqixue_1@....com>)
Re: CVE request: Redmine - Data disclosure in atom feed (cve-assign@...re.org)
Re: CVE request - a out of bound read bug is found in libdwarf (cve-assign@...re.org)
Re: CVE request - Linux kernel - Fix handling of stored error in a negatively instantiated user key (cve-assign@...re.org)
Xen Security Advisory 158 (CVE-2015-8338) - long running memory operations on ARM (Xen.org security team <security@....org>)
CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) (xiaoqixue_1 <xiaoqixue_1@....com>)
Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) (Glenn Randers-Pehrson <glennrp@...il.com>)

December 11 (7 messages)

Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) (cve-assign@...re.org)
Re: Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) (Glenn Randers-Pehrson <glennrp@...il.com>)
CVE request: mail ruby gem <2.6.0 vulnerable to SMTP injection via recipient email addresses (Reed Loden <reed@...dloden.com>)
CVE request: handlebars node.js module <4.0.0 - "Quoteless attributes in templates can lead to XSS" (Reed Loden <reed@...dloden.com>)
Re: CVE request - Android kernel - IPv6 connect cause a denial of service (cve-assign@...re.org)
Re: Re: CVE request - Android kernel - IPv6 connect cause a denial of service (Hannes Frederic Sowa <hannes@...essinduktion.org>)
Re: CVE for git issue - please use CVE-2015-7545 (cve-assign@...re.org)

December 12 (2 messages)

CVE request: Remote DoS in Quassel (Pierre Schweitzer <pierre@...ctos.org>)
CVE-2015-8088: Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone (Pray3r <pray3r.z@...il.com>)

December 13 (2 messages)

Re: CVE request: Remote DoS in Quassel (cve-assign@...re.org)
CVE Request: Cups Filters/Foomatic Filters: Does not consider semicolon as an illegal shell escape character (Salvatore Bonaccorso <carnil@...ian.org>)

December 14 (20 messages)

Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (halfdog <me@...fdog.net>)
CVE-2015-7549 Qemu: pci: msi-x: null pointer dereference issue (P J P <ppandit@...hat.com>)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (Dag-Erling Smørgrav <des@....no>)
CVE Request: Local Privilege Escalation in QEMU virtfs-proxy-helper ("Jason A. Donenfeld" <Jason@...c4.com>)
CVE Request: Local Privilege Escalation in QEMU virtfs-proxy-helper ("Jason A. Donenfeld" <Jason@...c4.com>)
CVE request: Shell Injection in Pygments FontManager._get_nix_font_path (Stefan Cornelius <scorneli@...hat.com>)
CVE Request: two issues in bee2 crypto library (Lucid Lynx <luc.lynx@...dex.ru>)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (Florian Weimer <fweimer@...hat.com>)
CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS (P J P <ppandit@...hat.com>)
Chef: knife bootstrap leaks validator privkey into system logs (Jan Schaumann <jschauma@...meister.org>)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (cve-assign@...re.org)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (halfdog <me@...fdog.net>)
Re: CVE Request: Cups Filters/Foomatic Filters: Does not consider semicolon as an illegal shell escape character (cve-assign@...re.org)
Re: Chef: knife bootstrap leaks validator privkey into system logs (cve-assign@...re.org)
Re: Re: CVE request - Android kernel - IPv6 connect cause a denial of service (Hannes Frederic Sowa <hannes@...essinduktion.org>)
Re: CVE request Qemu: usb: infinite loop in ehci_advance_state results in DoS (cve-assign@...re.org)
Re: CVE request: Shell Injection in Pygments FontManager._get_nix_font_path (cve-assign@...re.org)
Re: CVE Request: Local Privilege Escalation in QEMU virtfs-proxy-helper (cve-assign@...re.org)
Re: Re: Chef: knife bootstrap leaks validator privkey into system logs (Jan Schaumann <jschauma@...meister.org>)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (Solar Designer <solar@...nwall.com>)

December 15 (15 messages)

Re: CVE Request: Cups Filters/Foomatic Filters: Does not consider semicolon as an illegal shell escape character (Till Kamppeter <till.kamppeter@...il.com>)
Re: Re: CVE request - Android kernel - IPv6 connect cause a denial of service (Robert Święcki <robert@...ecki.net>)
Re: Re: CVE request - Android kernel - IPv6 connect cause a denial of service (Hannes Frederic Sowa <hannes@...essinduktion.org>)
CVE request Qemu: net: vmxnet3: host memory leakage (P J P <ppandit@...hat.com>)
Re: Re: CVE request: Shell Injection in Pygments FontManager._get_nix_font_path (Stefan Cornelius <scorneli@...hat.com>)
Back to 28: Grub2 Authentication Bypass 0-Day [CVE-2015-8370] (Hector Marco-Gisbert <hecmargi@....es>)
CVE Request: Linux Kernel: information leak from getsockname (Marcus Meissner <meissner@...e.de>)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (Dag-Erling Smørgrav <des@....no>)
CVE-2015-8562: Joomla remote code execution vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE request Qemu: net: vmxnet3: host memory leakage (cve-assign@...re.org)
Re: CVE Request: Linux Kernel: information leak from getsockname (cve-assign@...re.org)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (halfdog <me@...fdog.net>)
Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (cve-assign@...re.org)
CVE-2015-8000: Responses with a malformed class attribute can trigger an assertion failure in db.c (Michael McNally <mcnally@....org>)
CVE-2015-8461: A race condition when handling socket errors can lead to an assertion failure in resolver.c (Michael McNally <mcnally@....org>)

December 16 (5 messages)

Re: Re: CVE request Qemu: net: vmxnet3: host memory leakage (P J P <ppandit@...hat.com>)
Re: Re: CVE Request: Linux Kernel: information leak from getsockname (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Linux Kernel: information leak from getsockname (cve-assign@...re.org)
libnsbmp: heap overflow (CVE-2015-7508) and out-of-bounds read (CVE-2015-7507) (Hans Jerry Illikainen <hji@...topia.com>)
libnsgif: stack overflow (CVE-2015-7505) and out-of-bounds read (CVE-2015-7506) (Hans Jerry Illikainen <hji@...topia.com>)

December 17 (15 messages)

Cross site scripting vulnerability (XSS) in SilverStripe CMS & Framework v3.2.0 (CSW Research Lab <disclose@...ersecurityworks.com>)
CVE-2015-5348 - Apache Camel medium disclosure vulnerability (Claus Ibsen <claus.ibsen@...il.com>)
Xen Security Advisory 155 (CVE-2015-8550) - paravirtualized drivers incautious about shared memory contents (Xen.org security team <security@....org>)
Xen Security Advisory 157 (CVE-2015-8551,CVE-2015-8552) - Linux pciback missing sanity checks leading to crash (Xen.org security team <security@....org>)
Xen Security Advisory 164 (CVE-2015-8554) - qemu-dm buffer overrun in MSI-X handling (Xen.org security team <security@....org>)
Xen Security Advisory 165 (CVE-2015-8555) - information leak in legacy x86 FPU/XMM initialization (Xen.org security team <security@....org>)
Xen Security Advisory 166 - ioreq handling possibly susceptible to multiple read issue (Xen.org security team <security@....org>)
Xen Security Advisory 155 (CVE-2015-8550) - paravirtualized drivers incautious about shared memory contents (Xen.org security team <security@....org>)
[oCERT 2015-011] PyAMF input sanitization errors (XXE) (Daniele Bianco <danbia@...rt.org>)
Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) (Glenn Randers-Pehrson <glennrp@...il.com>)
Re: Cross site scripting vulnerability (XSS) in SilverStripe CMS & Framework v3.2.0 (cve-assign@...re.org)
CVE Request: Linux kernel: privilege escalation in user namespaces (John Johansen <john.johansen@...onical.com>)
Re: CVE-2015-8088: Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Jann Horn <jann@...jh.net>)
Re: Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Serge Hallyn <serge.hallyn@...ntu.com>)

December 18 (6 messages)

Out of bounds read in OpenVPN before 2.3.9 (Hanno Böck <hanno@...eck.de>)
Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Solar Designer <solar@...nwall.com>)
AW: CVE Request: Linux kernel: privilege escalation in user namespaces (Fiedler Roman <Roman.Fiedler@....ac.at>)
Re: AW: CVE Request: Linux kernel: privilege escalation in user namespaces (Marc Deslauriers <marc.deslauriers@...onical.com>)
[FD] [CVE-2015-8606] SilverStripe CMS & Framework v3.2.0 - Cross-Site Scripting Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
CVE request: Blueman: Privilege escalation in blueman dbus API (Salvatore Bonaccorso <carnil@...ian.org>)

December 19 (3 messages)

Re: CVE request: Blueman: Privilege escalation in blueman dbus API (cve-assign@...re.org)
Cross site vulnerability (XSS) in OcPortal CMS 9.0.20 (CSW Research Lab <disclose@...ersecurityworks.com>)
CVE-2009-0689 discovered in Mono prior to 4.2 (Jo Shields <directhex@...box.org>)

December 20 (1 message)

Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness (halfdog <me@...fdog.net>)

December 21 (11 messages)

OcPortal CMS 9.0.21 – Cross-site Request Forgery (CSRF) Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Fiedler Roman <Roman.Fiedler@....ac.at>)
Xen Security Advisory 169 - x86: unintentional logging upon guest changing callback method (Xen.org security team <security@....org>)
giflib: heap overflow in giffix (CVE-2015-7555) (Hans Jerry Illikainen <hji@...topia.com>)
CVE-2015-7557, CVE-2015-7558 librsvg2: Out-of-bounds heap read and stack exhaustion (Adam Maris <amaris@...hat.com>)
CVE request for math/big.Exp (Jason Buberel <jbuberel@...gle.com>)
CVE request: Qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info (P J P <ppandit@...hat.com>)
CVE requests for MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 (Chris Steipp <csteipp@...imedia.org>)
php preg_replace() flaw - is this even CVE worthy? (Kurt Seifried <kseifried@...hat.com>)
mail-client/claws-mail-3.13.1: Stack Overflow - CVE needed? (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request for math/big.Exp (Florian Weimer <fweimer@...hat.com>)

December 22 (11 messages)

Re: CVE request: Qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info (cve-assign@...re.org)
Re: mail-client/claws-mail-3.13.1: Stack Overflow - CVE needed? (cve-assign@...re.org)
CVE Request: Reflected XSS in OpenMRS Login Page (David Dworken <david@...iddworken.com>)
CVE Request: Use after free in PHP Collator::sortWithSortKeys function (Emmanuel Law <emmanuel.law@...il.com>)
Symphony CMS 2.6.3 - Multiple Reflected Cross-site Scripting Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
Re: CVE Request: Use after free in PHP Collator::sortWithSortKeys function (cve-assign@...re.org)
Xen Security Advisory 169 (CVE-2015-8615) - x86: unintentional logging upon guest changing callback method (Xen.org security team <security@....org>)
CVE request Qemu: hmp: stack based OOB write in hmp_sendkey routine (P J P <ppandit@...hat.com>)
Re: CVE request for math/big.Exp (cve-assign@...re.org)
Re: CVE request for math/big.Exp (Jason Buberel <jbuberel@...gle.com>)
New vulnerability in Kea DHCP servers (CVE-2015-8373) is now public (ISC Security Officer <security-officer@....org>)

December 23 (10 messages)

Re: CVE request Qemu: hmp: stack based OOB write in hmp_sendkey routine (cve-assign@...re.org)
Re: Re: CVE request for math/big.Exp (Jessie Frazelle <jess@...ker.com>)
CVE-request: ~/.t_coffee/ is world-writable (Henri Salo <henri@...v.fi>)
Re: CVE-request: ~/.t_coffee/ is world-writable (cve-assign@...re.org)
CVE request -- linux kernel: overlay: fix permission checking for setattr (Vladis Dronov <vdronov@...hat.com>)
Use after free in nghttp2 (Hanno Böck <hanno@...eck.de>)
Re: CVE requests for MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 (cve-assign@...re.org)
pitivi: CVE-2015-0855: Insecure use of os.system() (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request -- linux kernel: overlay: fix permission checking for setattr (cve-assign@...re.org)
Re: Use after free in nghttp2 (cve-assign@...re.org)

December 24 (5 messages)

CVE request Qemu: acpi: heap based buffer overrun during VM migration (P J P <ppandit@...hat.com>)
CVE request -- Out-of-bounds Read in libtiff (limingxing <limingxing@....cn>)
Re: CVE request Qemu: acpi: heap based buffer overrun during VM migration (cve-assign@...re.org)
Re: CVE request -- Out-of-bounds Read in libtiff (cve-assign@...re.org)
Re: Re: CVE request for wget (Austin English <austinenglish@...il.com>)

December 25 (2 messages)

CVE request libtiff: out-of-bounds read in CIE Lab image format ("范祚至(库特)" <zuozhi.fzz@...baba-inc.com>)
Re: CVE request libtiff: out-of-bounds read in CIE Lab image format (Solar Designer <solar@...nwall.com>)

December 26 (7 messages)

Re: CVE request libtiff: out-of-bounds read in CIE Lab image format (cve-assign@...re.org)
Being vulnerable to POODLE (Sevan Janiyan <venture37@...klan.co.uk>)
Re: Being vulnerable to POODLE (gremlin@...mlin.ru)
Re: Being vulnerable to POODLE (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: Being vulnerable to POODLE (Sevan Janiyan <venture37@...klan.co.uk>)
Local root vulnerability in DeleGate v9.9.13 ("Larry W. Cashdollar" <larry0@...com>)
libtiff: invalid write (CVE-2015-7554) (Hans Jerry Illikainen <hji@...topia.com>)

December 27 (2 messages)

CVE Request: Stalin: Insecure use of temporary files (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Stalin: Insecure use of temporary files (cve-assign@...re.org)

December 28 (8 messages)

Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Salvatore Bonaccorso <carnil@...ian.org>)
Bedita CMS 3.6.0 Cross site Vulnerability (CSW Research Lab <disclose@...ersecurityworks.com>)
CVE request: flexlay: Insecure use of temporary files (Max Teufel <max@...felsnetz.com>)
Re: Being vulnerable to POODLE (Florian Weimer <fweimer@...hat.com>)
Re: Being vulnerable to POODLE (Sevan Janiyan <venture37@...klan.co.uk>)
CVE request Qemu net: rocker: fix an incorrect array bounds check (P J P <ppandit@...hat.com>)
Re: Being vulnerable to POODLE (Florian Weimer <fweimer@...hat.com>)
WebKitGTK+ Security Advisory WSA-2015-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

December 29 (4 messages)

Re: CVE request Qemu net: rocker: fix an incorrect array bounds check (cve-assign@...re.org)
Re: Being vulnerable to POODLE (Sevan Janiyan <venture37@...klan.co.uk>)
Inspircd <2.0.19 DoS (Mark Felder <feld@...d.me>)
Re: Inspircd <2.0.19 DoS (cve-assign@...re.org)

December 30 (5 messages)

CVE request rtmpdump: the 6 vulnerabilities have been fixed (limingxing <limingxing@....cn>)
[oCERT 2015-012] Ganeti multiple issues (Daniele Bianco <danbia@...rt.org>)
CVE Request: Squashfs 4.2 Race Condition (Jihyeok Seo <limeburst@...ber.fsf.org>)
Re: CVE Request: Squashfs 4.2 Race Condition (cve-assign@...re.org)
Re: CVE Request: Squashfs 4.2 Race Condition (Jihyeok Seo <limeburst@...ber.fsf.org>)

December 31 (8 messages)

Re: mail-client/claws-mail-3.13.1: Stack Overflow - CVE needed? (Ben Hutchings <ben@...adent.org.uk>)
Re: Re: CVE Request: Squashfs 4.2 Race Condition (Jeremy Stanley <jeremy@...nstack.org>)
Re: mail-client/claws-mail-3.13.1: Stack Overflow - CVE needed? (cve-assign@...re.org)
CVE request: pngcrush-1.3.35 through 1.7.88 segfault when run with "-loco" option (Glenn Randers-Pehrson <glennrp@...il.com>)
Re: CVE Request: Linux kernel: privilege escalation in user namespaces (cve-assign@...re.org)
Re: CVE request: pngcrush-1.3.35 through 1.7.88 segfault when run with "-loco" option (cve-assign@...re.org)
Re: libxml2 issue: out-of-bounds memory access when parsing an unclosed HTML comment (cve-assign@...re.org)
Re: CVE request: pngcrush-1.3.35 through 1.7.88 segfault when run with "-loco" option (Glenn Randers-Pehrson <glennrp@...il.com>)

208 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.