oss-security mailing list - 2016/01

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	² 3	³ 4
⁴ 9	⁵ 9	⁶ 10	⁷ 11	⁸ 7	⁹ 2	¹⁰ 3
¹¹ 10	¹² 15	¹³ 8	¹⁴ 12	¹⁵ 15	¹⁶ 7	¹⁷
¹⁸ 8	¹⁹ 20	²⁰ 17	²¹ 7	²² 6	²³ 1	²⁴ 10
²⁵ 16	²⁶ 8	²⁷ 12	²⁸ 12	²⁹ 12	³⁰ 3	³¹ 1

Messages by day:

January 2 (3 messages)

CVE Request: MantisBT SOAP API can be used to disclose confidential settings (Damien Regad <dregad@...tisbt.org>)
CVE Request: PCRE Library Heap Overflow Vulnerability (Guanxing Wen <wengx522@...il.com>)
Re: CVE Request: PCRE Library Heap Overflow Vulnerability (cve-assign@...re.org)

January 3 (4 messages)

CVE request: esoTalk 1.0.0g4 cross-site scripting vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE Request: MantisBT SOAP API can be used to disclose confidential settings (cve-assign@...re.org)
phpecc/phpecc - Timing side-channel in ECDSA signature verification (Paragon Initiative Enterprises Security Team <security@...agonie.com>)
use-after-free in tidy-html5 (Gustavo Grieco <gustavo.grieco@...il.com>)

January 4 (9 messages)

CVE request Qemu: net: ne2000: OOB r/w in ioport operations (P J P <ppandit@...hat.com>)
Re: CVE request Qemu: net: ne2000: OOB r/w in ioport operations (cve-assign@...re.org)
CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash (P J P <ppandit@...hat.com>)
CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash (P J P <ppandit@...hat.com>)
Re: CVE Request: MantisBT SOAP API can be used to disclose confidential settings (Damien Regad <dregad@...tisbt.org>)
Re: CVE request Qemu: net: vmxnet3: incorrect l2 header validation leads to a crash (cve-assign@...re.org)
Re: CVE request Qemu: net: vmxnet3: reading IMR registers leads to a crash (cve-assign@...re.org)
CVE Request: cacti: SQL injection vulnerability in graphs_new.php (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: cacti: SQL injection vulnerability in graphs_new.php (cve-assign@...re.org)

January 5 (9 messages)

CVE Request: python-rsa signature forgery (Filippo Valsorda <ml@...ippo.io>)
Remote Command Injection in Ruby Gem colorscore <=0.0.4 (Reed Loden <reed@...dloden.com>)
Re: CVE Request: python-rsa signature forgery (cve-assign@...re.org)
Re: Re: CVE Request: cacti: SQL injection vulnerability in graphs_new.php (Andreas Stieger <astieger@...e.com>)
CVE Request: netfilter-persistent: (local) information leak due to world-readable rules files (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: CVE Request: cacti: SQL injection vulnerability in graphs_new.php (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request for radicale (Yves-Alexis Perez <corsac@...ian.org>)
Re: Re: CVE Request: cacti: SQL injection vulnerability in graphs_new.php (Andreas Stieger <astieger@...e.de>)
CVE request -- linux kernel: nfs: kernel panic occurs at nfs client when nfsv4.2 migration is executed (Vladis Dronov <vdronov@...hat.com>)

January 6 (10 messages)

Re: Re: CVE Request: Linux kernel: privilege escalation in user namespaces (ebiederm@...ssion.com (Eric W. Biederman))
Re: Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Serge Hallyn <serge.hallyn@...ntu.com>)
Re: CVE request -- linux kernel: nfs: kernel panic occurs at nfs client when nfsv4.2 migration is executed (cve-assign@...re.org)
Re: CVE request for radicale (cve-assign@...re.org)
CVE request -- NULL dereference in libdwarf (xiaoqixue_1 <xiaoqixue_1@....com>)
Re: Re: CVE Request: Linux kernel: privilege escalation in user namespaces (ebiederm@...ssion.com (Eric W. Biederman))
Re: CVE request for radicale (Guillaume Ayoub <guillaume.ayoub@...ea.fr>)
CVE Request: Cross Site Scripting (XSS) & Cross Site Request Forgery (CSRF) in Crony Cronjob Manager Version 0.4.4 (CSW Research Lab <disclose@...ersecuritywor…)
Re: Re: CVE Request: Linux kernel: privilege escalation in user namespaces (Serge Hallyn <serge.hallyn@...ntu.com>)
Discuss: Daily/weekly cron jobs best practices (halfdog <me@...fdog.net>)

January 7 (11 messages)

CVE request: Missing normalization in ruby gem rack-attack <4.3.1 when used with ruby on rails (Reed Loden <reed@...dloden.com>)
CVE-2015-7513 Kernel: kvm: divide by zero issue leads to DoS (P J P <ppandit@...hat.com>)
CVE id request: dhcpcd (Nico Golde <oss-security+ml@...lde.de>)
Re: CVE id request: dhcpcd (cve-assign@...re.org)
CVE request: WP Symposium Pro Social Network plugin XSS and Critical CSRF (Rahul Pratap Singh <techno.rps@...il.com>)
[OSSA 2016-001] Nova host data leak through snapshot (CVE-2015-7548) (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: CVE request for radicale (cve-assign@...re.org)
CVE request for vulnerability in OpenStack Nova (Grant Murphy <grant.murphy@....com>)
Re: CVE request for vulnerability in OpenStack Nova (cve-assign@...re.org)
Fwd: Integer overflow in the JasPer's jas_matrix_create() function (Solar Designer <solar@...nwall.com>)
Re: CVE request -- NULL dereference in libdwarf (cve-assign@...re.org)

January 8 (7 messages)

Re: CVE Request: netfilter-persistent: (local) information leak due to world-readable rules files (cve-assign@...re.org)
Re: Integer overflow in the JasPer's jas_matrix_create() function (cve-assign@...re.org)
CVE Request: WordPress: cross-site scripting vulnerability fixed in new 4.4.1 release (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: WordPress: cross-site scripting vulnerability fixed in new 4.4.1 release (cve-assign@...re.org)
CVE-2016-1231, CVE-2016-1232: Prosody XMPP server multiple vulnerabilities (Matthew Wild <mwild1@...il.com>)
Re: CVE Request: freeradius: the EAP-PWD module performs insufficient validation on packets received from an EAP peer (Moritz Muehlenhoff <jmm@...ian.org>)
Re: CVE Request: freeradius: the EAP-PWD module performs insufficient validation on packets received from an EAP peer (cve-assign@...re.org)

January 9 (2 messages)

Qemu: ide: ahci use-after-free vulnerability in aio port commands (P J P <ppandit@...hat.com>)
Re: Qemu: ide: ahci use-after-free vulnerability in aio port commands (cve-assign@...re.org)

January 10 (3 messages)

Re: CVE Request: netfilter-persistent: (local) information leak due to world-readable rules files (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: FireBird RDBMS: authenticated clients crash FireBird when running gbak with invalid parameter (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: FireBird RDBMS: authenticated clients crash FireBird when running gbak with invalid parameter (cve-assign@...re.org)

January 11 (10 messages)

CVE-2016-1281: TrueCrypt and VeraCrypt Windows installers allow arbitrary code execution with elevation of privilege (VeraCrypt Team <veracrypt@...ix.fr>)
CVE request: Arbitrary search execution in ruby gems auto_select2 <0.5.0 and auto_awesomeplete <=0.0.3 (Reed Loden <reed@...dloden.com>)
Re: Re: Integer overflow in the JasPer's jas_matrix_create() function (Stefan Cornelius <scorneli@...hat.com>)
CVE Request: Linux kernel - SCTP denial of service during heartbeat timeout functions. (Wade Mealing <wmealing@...hat.com>)
CVE-2015-8396: GDCM buffer overflow in ImageRegionReader::ReadIntoBuffer (Stelios Tsampas <stelios@...sus-labs.com>)
CVE-2015-8397: GDCM out-of-bounds read in JPEGLSCodec::DecodeExtent (Stelios Tsampas <stelios@...sus-labs.com>)
CVE request Qemu: nvram: OOB r/w access in processing firmware configurations (P J P <ppandit@...hat.com>)
CVE Request: click (Jamie Strandboge <jamie@...onical.com>)
Re: CVE Request: Linux kernel - SCTP denial of service during heartbeat timeout functions. (cve-assign@...re.org)
CVE requests for Drupal contributed modules (Pere Orga <pere@...a.cat>)

January 12 (15 messages)

CVE for node.js websockets (ws) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE for node.js websockets (ws) (cve-assign@...re.org)
Re: Discuss: Daily/weekly cron jobs best practices (Tim Brown <tmb@...35.com>)
CVE Request: Vtiger CRM 6.4 Authenticated Remote Code Execution (Benjamin Daniel Mussler <sec@...fl7.de>)
Re: CVE Request: click (Jamie Strandboge <jamie@...onical.com>)
CVE Request: WP Symposium Pro Social Network Plugin 16.1 XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Re: CVE Request: Vtiger CRM 6.4 Authenticated Remote Code Execution (cve-assign@...re.org)
Re: CVE Request: click (cve-assign@...re.org)
CVE request for Kubernetes api server: patch operation should use patched object to check admission control (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations (cve-assign@...re.org)
Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations (P J P <ppandit@...hat.com>)
CVE request for Kubernetes api server: build config to a strategy that isn't allowed by policy (Kurt Seifried <kseifried@...hat.com>)
[OSSA 2016-002] Xen connection password leak in logs via StorageError (CVE-2015-8749) (Grant Murphy <grant.murphy@....com>)
GRR <= 3.0.0-RC1 (all versions) RCE with privilege escalation through file upload filter bypass (authenficated) (Jean-Marie Bourbon <mail.bourbon@...il.com>)
ISC DHCP CVE-2015-8605: UDP payload length not properly checked (ISC Security Officer <security-officer@....org>)

January 13 (8 messages)

Re: Discuss: Daily/weekly cron jobs best practices ("David W. Hodgins" <davidwhodgins@...il.com>)
Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (limingxing <limingxing@....cn>)
Fwd: FFmpeg: stealing local files with HLS+concat (Vladimir Dubrovin <vlad@...urityvulns.ru>)
Re: Fwd: FFmpeg: stealing local files with HLS+concat (Alexander Cherepanov <ch3root@...nwall.com>)
CVE Request: Commentator WordPress Plugin 2.5.2 XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Re: Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (cve-assign@...re.org)
[security] Go security release v1.5.3 (Jason Buberel <jbuberel@...gle.com>)
Overlayfs ovl_setattr missing permission checks (CVE-2015-8660) (halfdog <me@...fdog.net>)

January 14 (12 messages)

Re: Fwd: FFmpeg: stealing local files with HLS+concat (cve-assign@...re.org)
Re: [security] Go security release v1.5.3 (Solar Designer <solar@...nwall.com>)
CVE Request: CGit - Multiple vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: CVE Request: CGit - Multiple vulnerabilities ("Jason A. Donenfeld" <Jason@...c4.com>)
nodejs Buffer(number) is unsafe #4660 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: CGit - Multiple vulnerabilities (cve-assign@...re.org)
Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Qualys Security Advisory <qsa@...lys.com>)
[CVE Request] Multiple PHP issues (Emmanuel Law <emmanuel.law@...il.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Jan Schaumann <jschauma@...meister.org>)
Re: [CVE Request] Multiple PHP issues (cve-assign@...re.org)
Re: CVE request for Kubernetes api server: build config to a strategy that isn't allowed by policy (Kurt Seifried <kseifried@...hat.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Qualys Security Advisory <qsa@...lys.com>)

January 15 (15 messages)

Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Jan Schaumann <jschauma@...meister.org>)
Re: CVE request for Kubernetes api server: patch operation should use patched object to check admission control (cve-assign@...re.org)
Re: CVE request for Kubernetes api server: build config to a strategy that isn't allowed by policy (cve-assign@...re.org)
Security issues in GOsa (Mike Gabriel <mike.gabriel@...-netzwerkteam.de>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Florian Weimer <fweimer@...hat.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Yann Droneaud <ydroneaud@...eya.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Yves-Alexis Perez <corsac@...ian.org>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (cve-assign@...re.org)
Re: Security issues in GOsa (cve-assign@...re.org)
Re: Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Kurt Seifried <kseifried@...hat.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (cve-assign@...re.org)
Re: Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Tomas Hoger <thoger@...hat.com>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Rich Felker <dalias@...c.org>)

January 16 (7 messages)

CVE request Qemu: i386: null pointer dereference in vapic_write (P J P <ppandit@...hat.com>)
Re: Discuss: Daily/weekly cron jobs best practices (halfdog <me@...fdog.net>)
It essentially wins crypto vulnerability bingo! gilfether/phpcrypt (Scott Arciszewski <scott@...agonie.com>)
Re: CVE Request: Commentator WordPress Plugin 2.5.2 XSS Vulnerability (Henri Salo <henri@...v.fi>)
Setgid/Setuid binary writing privilege escalation (halfdog <me@...fdog.net>)
Re: CVE request Qemu: i386: null pointer dereference in vapic_write (cve-assign@...re.org)
Re: Setgid/Setuid binary writing privilege escalation (Simon McVittie <smcv@...ian.org>)

January 18 (8 messages)

[vs] moodle security release (Marina Glancy <marina@...dle.com>)
Re: [FD] It essentially wins crypto vulnerability bingo! gilfether/phpcrypt (Bart van Tuil <bvantuil@...argroup.nl>)
Buffer Overflow in lha compression utility (Paris Zoumpouloglou <pariszoump@...il.com>)
Out-of-bounds Read in the OpenJpeg's opj_j2k_update_image_data and opj_tgt_reset function (limingxing <limingxing@....cn>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Florian Weimer <fweimer@...hat.com>)
Re: [FD] It essentially wins crypto vulnerability bingo! gilfether/phpcrypt (Scott Arciszewski <scott@...agonie.com>)
Re: Out-of-bounds Read in the OpenJpeg's opj_j2k_update_image_data and opj_tgt_reset function (cve-assign@...re.org)
Re: Buffer Overflow in lha compression utility (cve-assign@...re.org)

January 19 (20 messages)

Security bugs in Linux kernel sound subsystem (Johannes Segitz <jsegitz@...e.com>)
Linux kernel: use after free in keyring facility. (Wade Mealing <wmealing@...hat.com>)
Re:Re: Buffer Overflow in lha compression utility (xiaoqixue_1 <xiaoqixue_1@....com>)
CVE request: out-of-bounds write with cpio 2.11 (Gustavo Grieco <gustavo.grieco@...il.com>)
[OSSA 2016-003] Heat denial of service through template-validate (CVE-2015-5295) (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: [FD] It essentially wins crypto vulnerability bingo! gilfether/phpcrypt (Bart van Tuil <bvantuil@...argroup.nl>)
CVE Request: Quick CMS v 6.1 XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
CVE Request: Quick Cart v6.6 XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
Fwd: out of bound write in libdwarf -20151114 (Qixue Xiao <s2exqx@...il.com>)
CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines (P J P <ppandit@...hat.com>)
CVE assignment request for security bugs fixed in glibc 2.23 (Florian Weimer <fweimer@...hat.com>)
Re: CVE assignment request for security bugs fixed in glibc 2.23 (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: out-of-bounds write with cpio 2.11 (Hanno Böck <hanno@...eck.de>)
Re: CVE request: out-of-bounds write with cpio 2.11 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE-2015-8088: Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone (Pray3r <pray3r.z@...il.com>)
OpenCart users, switch to OpenCart-CE immediately (Scott Arciszewski <scott@...agonie.com>)
Overlayfs and devpts issues in namespaces (halfdog <me@...fdog.net>)
Re: CVE for node.js websockets (ws) (Kurt Seifried <kseifried@...hat.com>)
CVE-2015-8704: Specific APL data could trigger an INSIST in apl_42.c causing BIND named to exit ("Jeremy C. Reed" <jreed@....org>)
CVE-2015-8705: Problems converting OPT resource records and ECS options to text format can cause BIND to terminate. ("Jeremy C. Reed" <jreed@....org>)

January 20 (17 messages)

Re: CVE assignment request for security bugs fixed in glibc 2.23 (cve-assign@...re.org)
Re: CVE assignment request for security bugs fixed in glibc 2.23 (Florian Weimer <fweimer@...hat.com>)
Xen Security Advisory 167 (CVE-2016-1570) - PV superpage functionality missing sanity checks (Xen.org security team <security@....org>)
Xen Security Advisory 168 (CVE-2016-1571) - VMX: intercept issue with INVLPG on non-canonical address (Xen.org security team <security@....org>)
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 (Yann Droneaud <ydroneaud@...eya.com>)
Security issue in eCryptfs-utils (CVE-2016-1572) (Tyler Hicks <tyhicks@...onical.com>)
Re: Prime example of a can of worms (Kurt Seifried <kseifried@...hat.com>)
Re: Prime example of a can of worms (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Prime example of a can of worms (Kurt Seifried <kseifried@...hat.com>)
imlib2 may need some CVEs assigned (Mark Felder <feld@...d.me>)
Re: Prime example of a can of worms (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Prime example of a can of worms (Kurt Seifried <kseifried@...hat.com>)
Re: Prime example of a can of worms (Hanno Böck <hanno@...eck.de>)
CVE request: Two vulnerabilities in git-fastclone ruby gem (Reed Loden <reed@...dloden.com>)
CVE Request: RESTBase 0.9.2 (security release) (Chris Steipp <csteipp@...imedia.org>)
CVE request: Two vulnerabilities in mapbox.js node module (Reed Loden <reed@...dloden.com>)
[OSSA 2016-004] Swift proxy-server DoS through Large Object (CVE-2016-0737, CVE-2016-0738) (Tristan Cacqueray <tdecacqu@...hat.com>)

January 21 (7 messages)

Re: Prime example of a can of worms (gremlin@...mlin.ru)
Re: CVE for node.js websockets (ws) (cve-assign@...re.org)
Re: Prime example of a can of worms (Florent Daigniere <florent.daigniere@...stmatta.com>)
CVE request for Privoxy 3.0.24 (Fabian Keil <fk@...iankeil.de>)
Re: Prime example of a can of worms (Steve Grubb <sgrubb@...hat.com>)
Re: Prime example of a can of worms (Florent Daigniere <florent.daigniere@...stmatta.com>)
ntp.org stats data logrotation script privilege escalation (halfdog <me@...fdog.net>)

January 22 (6 messages)

Re: CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines (cve-assign@...re.org)
Re: Prime example of a can of worms (Andrew Gallagher <andrewg@...rewg.com>)
Re: CVE request for Privoxy 3.0.24 (cve-assign@...re.org)
Re: CVE request: out-of-bounds write with cpio 2.11 (cve-assign@...re.org)
Re: Re: Prime example of a can of worms (Steve Grubb <sgrubb@...hat.com>)
Re: imlib2 may need some CVEs assigned (cve-assign@...re.org)

January 23 (1 message)

CVE request for prima wlan driver: Address buffer overflow due to invalid length (Shawn <citypw@...il.com>)

January 24 (10 messages)

CVE Request: Linux: fuse: possible denial of service in fuse_fill_write_pages() (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: Host based account hijack attack on php-openid (Zemn mez <zemnmez@...il.com>)
CVE Request: tiff: Out-of-bounds write for invalid images using LogL compression (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: tiff: potential out-of-bound write in NeXTDecode() (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Host based account hijack attack on php-openid (cve-assign@...re.org)
Re: CVE Request: Linux: fuse: possible denial of service in fuse_fill_write_pages() (cve-assign@...re.org)
Re: CVE Request: tiff: Out-of-bounds write for invalid images using LogL compression (cve-assign@...re.org)
Re: CVE Request: tiff: potential out-of-bound write in NeXTDecode() (cve-assign@...re.org)
Re: CVE request for prima wlan driver: Address buffer overflow due to invalid length (Nico Golde <oss-security+ml@...lde.de>)
PSA: Don't use RNCryptor (Scott Arciszewski <scott@...agonie.com>)

January 25 (16 messages)

CVE Request: x86 Linux TLB flush bug (Andy Lutomirski <luto@...nel.org>)
Linux kernel : Denial of service with specially crafted key file. (Wade Mealing <wmealing@...hat.com>)
Re: Fwd: out of bound write in libdwarf -20151114 (cve-assign@...re.org)
Re: Linux kernel : Denial of service with specially crafted key file. (cve-assign@...re.org)
Linux potential division by zero in TCP code (Florian Weimer <fw@...eb.enyo.de>)
Out-of-bounds Read in the libxml2's htmlParseNameComplex() function (limingxing <limingxing@....cn>)
Re: use-after-free in tidy-html5 (Gustavo Grieco <gustavo.grieco@...il.com>)
[CVE-2015-7576] Timing attack vulnerability in basic authentication in Action Controller. (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2015-7577] Nested attributes rejection proc bypass in Active Record. (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2015-7578] Possible XSS vulnerability in rails-html-sanitizer (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2015-7579] XSS vulnerability in rails-html-sanitizer (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2016-0752] Possible Information Leak Vulnerability in Action View (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2016-0753] Possible Input Validation Circumvention in Active Model (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2015-7580] Possible XSS vulnerability in rails-html-sanitizer (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2015-7581] Object leak vulnerability for wildcard controller routes in Action Pack (Aaron Patterson <tenderlove@...y-lang.org>)

January 26 (8 messages)

Re: CVE Request: x86 Linux TLB flush bug (cve-assign@...re.org)
Re: Linux potential division by zero in TCP code (cve-assign@...re.org)
Flaw in mariadb clients SSL certificate validation (Sergei Golubchik <serg@...iadb.org>)
CVE Request: WP Easy Gallery v4.1.4 Stored XSS Vulnerability (Rahul Pratap Singh <techno.rps@...il.com>)
a bug in gif2rgb.c in giflib-5.1.2 (xiaoqixue_1 <xiaoqixue_1@....com>)
Re: Out-of-bounds Read in the libxml2's htmlParseNameComplex() function (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Out-of-bounds Read in the libxml2's htmlParseNameComplex() function (cve-assign@...re.org)
Re: Re: Out-of-bounds Read in the libxml2's htmlParseNameComplex() function (Salvatore Bonaccorso <carnil@...ian.org>)

January 27 (12 messages)

Re: a bug in gif2rgb.c in giflib-5.1.2 (cve-assign@...re.org)
shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Luca BRUNO <lucab@...ian.org>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Loganaden Velvindron <loganaden@...il.com>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Thomas B. Rücker <thomas@...cker.fi>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Kurt Seifried <kseifried@...hat.com>)
CVE Request: Linux: NULL pointer dereference netfilter/nf_nat_redirect.c in nf_nat_redirect_ipv4 function (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack (Justin Bull <me@...tinbull.ca>)
RE: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Adam Jacobs <AJacobs@...ana.com>)
Re: CVE Request: Linux: NULL pointer dereference netfilter/nf_nat_redirect.c in nf_nat_redirect_ipv4 function (cve-assign@...re.org)
CVE-2016-0756: Prosody XMPP server: insecure dialback key generation/validation algorithm (Matthew Wild <mwild1@...il.com>)
Heap buffer overflow in fgetwln function of libbsd (Hanno Böck <hanno@...eck.de>)
CVE request for Drupal contributed module (Open Atrium - Access Bypass - SA-CONTRIB-2016-003) (Pere Orga <pere@...a.cat>)

January 28 (12 messages)

Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Rob Janssen <rob@...ware.nl.eu.org>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes ("Zach W." <kestrel@...linux.us>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Richard Johnson <rdump@...er.com>)
invalid Read in the JasPer's jas_matrix_clip() function (limingxing <limingxing@....cn>)
Re: Heap buffer overflow in fgetwln function of libbsd (cve-assign@...re.org)
Re: invalid Read in the JasPer's jas_matrix_clip() function (cve-assign@...re.org)
CVE request: Synology Photo Station command injection and privilege escalation ("lucas_leong@...nd.com.tw" <lucas_leong@...nd.com.tw>)
Re: an out of bound read is found in libdwarf -20151114 (cve-assign@...re.org)
Re: Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes ("Zach W." <kestrel@...linux.us>)
Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Ask Bjørn Hansen <ask@...pool.org>)
Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Rob Janssen <pe1chl@...at.org>)
CVE-2015-7521: Apache Hive authorization bug disclosure (khorgath@...che.org (Sushanth Sowmyan))

January 29 (12 messages)

Re:Re: a bug in gif2rgb.c in giflib-5.1.2 (xiaoqixue_1 <xiaoqixue_1@....com>)
CVE request Qemu: ide: ahci null pointer dereference when using FIS CLB engines (P J P <ppandit@...hat.com>)
Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Asbjorn Hojmark <lists@...mark.org>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Hazel <hazel@...dlingmojo.com>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (enki <enki@...k.pl>)
CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write (P J P <ppandit@...hat.com>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Scott Herbert <scott.a.herbert@...glemail.com>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Daniel Micay <danielmicay@...il.com>)
Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes (Daniel Micay <danielmicay@...il.com>)
[OSSA 2016-005] Potential reuse of revoked Identity tokens (CVE-2015-7546) (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: CVE request: out-of-bounds write with cpio 2.11 (anarcat <anarcat@...ngeseeds.org>)
Re: Re: CVE request: out-of-bounds write with cpio 2.11 (Gustavo Grieco <gustavo.grieco@...il.com>)

January 30 (3 messages)

Re: CVE request Qemu: ide: ahci null pointer dereference when using FIS CLB engines (cve-assign@...re.org)
Re: CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write (cve-assign@...re.org)
CVE-2015-5344 - Apache Camel medium disclosure vulnerability (Claus Ibsen <claus.ibsen@...il.com>)

January 31 (1 message)

ArpON (ARP handler inspection) 3.0-ng release (Andrea Di Pasquale <spikey.it@...il.com>)

258 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.