oss-security mailing list - 2016/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 18	² 13	³ 13	⁴ 7	⁵ 13	⁶ 14
⁷ 16	⁸ 6	⁹ 13	¹⁰ 21	¹¹ 17	¹² 1	¹³ 2
¹⁴ 22	¹⁵ 11	¹⁶ 20	¹⁷ 6	¹⁸ 3	¹⁹	²⁰
²¹ 4	²² 5	²³ 1	²⁴	²⁵ 8	²⁶ 2	²⁷ 2
²⁸ 3	²⁹ 6	³⁰ 11	³¹ 13

Messages by day:

March 1 (18 messages)

CVE request Qemu: OOB access in address_space_rw leads to segmentation fault (P J P <ppandit@...hat.com>)
CVE Request: Linux: aio write triggers integer overflow in some network protocols (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes (Vladis Dronov <vdronov@...hat.com>)
[ANNOUNCE] Django security releases issued: 1.9.3 and 1.8.10 (Tim Graham <timograham@...il.com>)
CVE's for SSLv2 support (Kurt Seifried <kseifried@...hat.com>)
Re: CVE's for SSLv2 support (Loganaden Velvindron <loganaden@...il.com>)
Re: CVE's for SSLv2 support (Grant Ridder <shortdudey123@...il.com>)
Re: CVE's for SSLv2 support (gremlin@...mlin.ru)
Re: CVE's for SSLv2 support (Stuart Henderson <stu@...cehopper.org>)
Re: CVE request Qemu: OOB access in address_space_rw leads to segmentation fault (cve-assign@...re.org)
Re: CVE's for SSLv2 support (cve-assign@...re.org)
Re: CVE's for SSLv2 support (Kurt Seifried <kseifried@...hat.com>)
Re: CVE's for SSLv2 support (cve-assign@...re.org)
Re: CVE's for SSLv2 support (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE's for SSLv2 support (Tim <tim-security@...tinelchicken.org>)
CVE request: Kryo (Java serialization API) (Arshan Dabirsiaghi <arshan.dabirsiaghi@...trastsecurity.com>)
Re: Re: CVE's for SSLv2 support (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE's for SSLv2 support (cve-assign@...re.org)

March 2 (13 messages)

Re: Re: CVE's for SSLv2 support (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE's for SSLv2 support (Bob Beck <beck@...nbsd.org>)
Re: Re: CVE's for SSLv2 support (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE's for SSLv2 support (Bob Beck <beck@...nbsd.org>)
CVE Request(s): VTigerCRM and SugarCRM (Darren Martyn <darren.martyn@...hosresearch.co.uk>)
Re: Re: CVE's for SSLv2 support (Steve Grubb <sgrubb@...hat.com>)
[CVE-2015-7520] Apache Wicket XSS vulnerability (Martin Grigorov <mgrigorov@...che.org>)
CVE request Qemu: net: ne2000: infinite loop in ne2000_receive (P J P <ppandit@...hat.com>)
Re: CVE Request: Linux: aio write triggers integer overflow in some network protocols (cve-assign@...re.org)
Re: CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes (cve-assign@...re.org)
Re: Re: CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes (Vladis Dronov <vdronov@...hat.com>)
Re: CVE Requests: Aufs Union Filesystem Privilege Escalation In User Namespaces (Tyler Hicks <tyhicks@...onical.com>)
CVE-2015-1339: Linux Kernel: memory exhaustion via CUSE driver (Tyler Hicks <tyhicks@...onical.com>)

March 3 (13 messages)

Re: CVE request Qemu: net: ne2000: infinite loop in ne2000_receive (cve-assign@...re.org)
Mitre, reserved CVEs and oss-security? (Paul Wise <pabs3@...edaddy.net>)
Re: Mitre, reserved CVEs and oss-security? (Kurt Seifried <kseifried@...hat.com>)
According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus (Georgi Guninski <guninski@...inski.com>)
Re: According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus ("Adam D. Barratt" <adam@...m-barratt.org.uk>)
Exim CVE-2016-1531 fixed (Heiko Schlittermann <hs@...littermann.de>)
Re: According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus (Cord Beermann <cord@...ian.org>)
Re: According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus (Hanno Böck <hanno@...eck.de>)
CVE request Qemu: net: out of bounds read in net_checksum_calculate (P J P <ppandit@...hat.com>)
Re: According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus (Georgi Guninski <guninski@...inski.com>)
CVE-2004-0230 additions and Linux Kernel fix (Marcus Meissner <meissner@...e.de>)
Security issues in JasPer (CVE-2016-1577 and CVE-2016-2116) (Tyler Hicks <tyhicks@...onical.com>)
Re: According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus (Luca Filipozzi <lfilipoz@...ian.org>)

March 4 (7 messages)

CVE request Qemu: rng-random: arbitrary stack based allocation leading to corruption (P J P <ppandit@...hat.com>)
tidy-html5: infinite loop parsing an html file (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE requests for Drupal contributed modules (from 2016-009 to 2016-014) (Pere Orga <pere@...a.cat>)
Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Art Manion <amanion@...t.org>)
RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Mike Prosser <mprosser@...antec.com>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Adam Caudill <adam@...mcaudill.com>)

March 5 (13 messages)

Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Tim <tim-security@...tinelchicken.org>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("Zach W." <kestrel@...linux.us>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (mark@...phey.com)
CVE Request: Dotclear: XSS vulnerability in comments managment page and media exclusion control enforcement (Salvatore Bonaccorso <carnil@...ian.org>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Larry Cashdollar <larry0@...com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Solar Designer <solar@...nwall.com>)
Cgit XSS "vulnerability" has no CVE? (Peter Bex <peter@...e-magic.net>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Adam Caudill <adam@...mcaudill.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Solar Designer <solar@...nwall.com>)
Re: Missing fixes for CVEs in upstream dcraw (Charlemagne Lasse <charlemagnelasse@...il.com>)
Re: [exact-image] Missing fixes for CVEs in upstream dcraw (René Rebe <rene@...ctcode.de>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Tim <tim-security@...tinelchicken.org>)

March 6 (14 messages)

Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (gremlin@...mlin.ru)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Rahul Pratap Singh <techno.rps@...il.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Solar Designer <solar@...nwall.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (me@...fdog.net)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("op7ic \\x00" <op7ica@...il.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Solar Designer <solar@...nwall.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("op7ic \\x00" <op7ica@...il.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Solar Designer <solar@...nwall.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Robert Paprocki <rpaprocki@...rnothingproductions.net>)
Re: CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes (cve-assign@...re.org)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Alan Coopersmith <alan.coopersmith@...cle.com>)
Transmission BT 2.90 Mac malware. Website compromised? (Elad Alfassa <elad@...oraproject.org>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: Aufs Union Filesystem Privilege Escalation In User Namespaces (cve-assign@...re.org)

March 7 (16 messages)

Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Amos Jeffries <squid3@...enet.co.nz>)
Re: Access to /dev/pts devices via pt_chown and user namespaces (cve-assign@...re.org)
Re: CVE request Qemu: net: out of bounds read in net_checksum_calculate (cve-assign@...re.org)
Re: CVE request Qemu: rng-random: arbitrary stack based allocation leading to corruption (cve-assign@...re.org)
Re: CVE Request: Dotclear: XSS vulnerability in comments managment page and media exclusion control enforcement (cve-assign@...re.org)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Markus Vervier <markus.vervier@...-dsec.de>)
Re: CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes (Vladis Dronov <vdronov@...hat.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Simon Ward <simon+oss-sec@...ah.co.uk>)
CVE Request: The minissdpd (v 1.2.20130907-3) is affected by an improper validation of array index weakness (Salva Peiró <speirofr@...il.com>)
RE: [security-vendor] Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("Radzykewycz, T (Radzy)" <radzy@...driver.com>)
CVE Replacement Via Blockchains (was: Concerns about CVE coverage shrinking - direct impact to researchers/companies) (Tim <tim-security@...tinelchicken.org>)
Re: Cgit XSS "vulnerability" has no CVE? ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Cgit XSS "vulnerability" has no CVE? ("Jason A. Donenfeld" <Jason@...c4.com>)
Re: Cgit XSS "vulnerability" has no CVE? (Peter Bex <peter@...e-magic.net>)
Re: Cgit XSS "vulnerability" has no CVE? ("Jason A. Donenfeld" <Jason@...c4.com>)
CVE-2016-1234 in glibc glob with GLOB_ALTDIRFUNC (Florian Weimer <fweimer@...hat.com>)

March 8 (6 messages)

ISC DHCP vulnerability CVE-2016-2774 is now public (ISC Security Officer <security-officer@....org>)
Distributed Weakness Filing (DWF) System (distributed weaknessfiling <distributedweaknessfiling@...il.com>)
Re: CVE Request : Use-after-free in accel-ppp (FEIST Josselin <josselin.feist@...il.com>)
CVE request: simpleSAMLphp 1.14 information leakage (Hoz de la Hoz Enrique de la <enrique.delahoz@....es>)
[OSSA 2016-007] Nova host data leak through resize/migration (CVE-2016-2140) (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: [OSSA 2016-007] Nova host data leak through resize/migration (CVE-2016-2140) (Tristan Cacqueray <tdecacqu@...hat.com>)

March 9 (13 messages)

Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Tim Brown <tmb@...35.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Advisory X41-2016-001: Memory Corruption Vulnerability in "libotr" (X41 D-Sec GmbH Advisories <advisories@...-dsec.de>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Reed Loden <reed@...dloden.com>)
Heap use after free in Pidgin-OTR plugin (Hanno Böck <hanno@...eck.de>)
ISC BIND vulnerabilities are now public (CVE-2016-1285, CVE-2016-1286, CVE-2016-2088) ("Jeremy C. Reed" <security-officer@....org>)
RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("Boyle, Stephen V." <sboyle@...re.org>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("Timothy D. Morgan" <tim-security@...tinelchicken.org>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Re: Heap use after free in Pidgin-OTR plugin (cve-assign@...re.org)

March 10 (21 messages)

Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Carlos Alberto Lopez Perez <clopez@...lia.com>)
[OSSA 2016-007.1] Nova host data leak through resize/migration (CVE-2016-2140) ERRATA (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE Request: Linux Kernel: Linux netfilter IPT_SO_SET_REPLACE memory corruption (Marcus Meissner <meissner@...e.de>)
CVE Request: PHP last release security issues (Marcus Meissner <meissner@...e.de>)
RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (John Scott <jms3rd@...il.com>)
Re: CVE Request: Linux Kernel: Linux netfilter IPT_SO_SET_REPLACE memory corruption (Steve Beattie <steve@...w.org>)
OpenSSH Security Advisory: xauth command injection (Damien Miller <djm@...nbsd.org>)
Announce: Portable OpenSSH 7.2p2 released (Damien Miller <djm@...nbsd.org>)
[ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting (Christopher Shannon <christopher.l.shannon@...il.com>)
[ANNOUNCE] CVE-2016-0734: ActiveMQ Web Console - Clickjacking (Christopher Shannon <christopher.l.shannon@...il.com>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Carlos Alberto Lopez Perez <clopez@...lia.com>)
please assign CVE for cacti bug 2667: SQL Injection Vulnerability (Paul Gevers <elbrus@...ian.org>)
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Tim <tim-security@...tinelchicken.org>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("Timothy D. Morgan" <tim-security@...tinelchicken.org>)
Re: Announce: Portable OpenSSH 7.2p2 released (cve-assign@...re.org)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Tim <tim-security@...tinelchicken.org>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies ("Zach W." <kestrel@...linux.us>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Art Manion <amanion@...t.org>)

March 11 (17 messages)

debbugs for cve-assign@...re.org? (Paul Wise <pabs3@...edaddy.net>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (halfdog <me@...fdog.net>)
ProFTPD before 1.3.5b/1.3.6rc2 uses 1024 bit Diffie Hellman parameters for TLS even if user sets manual parameters (Hanno Böck <hanno@...eck.de>)
Re: Re: Announce: Portable OpenSSH 7.2p2 released (Gsunde Orangen <gsunde.orangen@...il.com>)
CVE request -- linux kernel: crash on invalid USB device descriptors (mct_u232 driver) (Vladis Dronov <vdronov@...hat.com>)
CVE request -- linux kernel: crash on invalid USB device descriptors (cypress_m8 driver) (Vladis Dronov <vdronov@...hat.com>)
CVE request -- linux kernel: crash on invalid USB device descriptors (cdc_acm driver) (Vladis Dronov <vdronov@...hat.com>)
CVE request -- linux kernel: crash on invalid USB device descriptors (wacom driver) (Vladis Dronov <vdronov@...hat.com>)
CVE request -- linux kernel: crash on invalid USB device descriptors (digi_acceleport driver) (Vladis Dronov <vdronov@...hat.com>)
WebKitGTK+ Security Advisory WSA-2016-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Several out of bounds reads in ProFTPD (Hanno Böck <hanno@...eck.de>)
Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies (Kurt Seifried <kseifried@...hat.com>)
Re: ProFTPD before 1.3.5b/1.3.6rc2 uses 1024 bit Diffie Hellman parameters for TLS even if user sets manual parameters (cve-assign@...re.org)
Re: ProFTPD before 1.3.5b/1.3.6rc2 uses 1024 bit Diffie Hellman parameters for TLS even if user sets manual parameters (Hanno Böck <hanno@...eck.de>)
two udhcpc (busybox) issues (Nico Golde <oss-security+ml@...lde.de>)
Re: Several out of bounds reads in ProFTPD (Moritz Mühlenhoff <jmm@...til.org>)

March 12 (1 message)

Re: CVE request: XSS in WP Super Cache < 1.4.3 (Henri Salo <henri@...v.fi>)

March 13 (2 messages)

CVE Request: PHP-5.5.33: Use after free in WDDX Deserialize when processing XML data (Dmitry Kasyanov <dkasyanov@...udlinux.com>)
CVE Request: PHP-5.5.33: Out-of-Bound Read in phar_parse_zipfile (Dmitry Kasyanov <dkasyanov@...udlinux.com>)

March 14 (22 messages)

Re: CVE Request: Linux Kernel: Linux netfilter IPT_SO_SET_REPLACE memory corruption (cve-assign@...re.org)
Re: CVE request -- linux kernel: crash on invalid USB device descriptors (mct_u232 driver) (cve-assign@...re.org)
Re: CVE request -- linux kernel: crash on invalid USB device descriptors (cypress_m8 driver) (cve-assign@...re.org)
Re: CVE request -- linux kernel: crash on invalid USB device descriptors (cdc_acm driver) (cve-assign@...re.org)
Re: CVE request -- linux kernel: crash on invalid USB device descriptors (wacom driver) (cve-assign@...re.org)
Re: CVE request -- linux kernel: crash on invalid USB device descriptors (digi_acceleport driver) (cve-assign@...re.org)
Re: CVE Request: PHP-5.5.33: Use after free in WDDX Deserialize when processing XML data (cve-assign@...re.org)
Re: CVE Request: PHP-5.5.33: Out-of-Bound Read in phar_parse_zipfile (cve-assign@...re.org)
CVE-Request - GNU Awk. (Steve Kemp <steve@...ve.org.uk>)
CVE request (Loganaden Velvindron <loganaden@...il.com>)
Re: CVE request (Marcus Meissner <meissner@...e.de>)
CVE request - OpenJPEG : Out-Of-Bounds Read in opj_tcd_free_tile function (winsonliu(刘科) <winsonliu@...cent.com>)
CVE request - OpenJPEG : Heap Corruption in opj_free function (winsonliu(刘科) <winsonliu@...cent.com>)
CVE request - OpenJPEG : Out-Of-Bounds Read in sycc422_to_rgb function (winsonliu(刘科) <winsonliu@...cent.com>)
Re: CVE-Request - GNU Awk. (Tomas Hoger <thoger@...hat.com>)
Re: WebKitGTK+ Security Advisory WSA-2016-0002 (Tomas Hoger <thoger@...hat.com>)
Re: CVE-Request - GNU Awk. (Steve Kemp <steve@...ve.org.uk>)
Re: CVE-Request - GNU Awk. ("Yuriy M. Kaminskiy" <yumkam@...il.com>)
Re: Re: CVE-Request - GNU Awk. (Kurt Seifried <kseifried@...hat.com>)
Re: WebKitGTK+ Security Advisory WSA-2016-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: Re: CVE-Request - GNU Awk. (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
CVE request: DoS vulnerability in Ruby gem Paperclip (Bart de Water <bart@...nilocode.nl>)

March 15 (11 messages)

Re: CVE Request: The minissdpd (v 1.2.20130907-3) is affected by an improper validation of array index weakness (Salva Peiró <speirofr@...il.com>)
CVE request - SPIP: 2 vulnerabilities (Sébastien Delafond <seb@...ian.org>)
CVE request: ipv4: Don't do expensive useless work during inetdev destroy (Vasily Averin <vvs@...tuozzo.com>)
Re: CVE request - SPIP: 2 vulnerabilities (cve-assign@...re.org)
server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄ… (Laël Cellier <lael.cellier@...oste.net…)
Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished cve… (Solar Designer <solar@...nwall.com>)
Re: CVE request: ipv4: Don't do expensive useless work during inetdev destroy (cve-assign@...re.org)
Re: please assign CVE for cacti bug 2667: SQL Injection Vulnerability (Tim Zingelman <tez@...src.org>)
[ANNOUNCE][CVE-2016-0779] Apache TomEE 1.7.4 and 7.0.0-M3 releases (Romain Manni-Bucau <rmannibucau@...che.org>)
Re: CVE requests for Drupal core (SA-CORE-2016-001) (cve-assign@...re.org)
Re: please assign CVE for cacti bug 2667: SQL Injection Vulnerability (cve-assign@...re.org)

March 16 (20 messages)

Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄ… (Tyler Hicks <tyhicks@...onical.com>)
Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished… (Laël Cellier <lael.cellier@...oste.net…)
Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished… (Laël Cellier <lael.cellier@...oste.net…)
Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished… (Laël Cellier <lael.cellier@...oste.net…)
Re: Re: Announce: Portable OpenSSH 7.2p2 released (Tomas Hoger <thoger@...hat.com>)
CVE Request : Use-after-free in gifcolor (FEIST Josselin <josselin.feist@...il.com>)
CVE-2016-2117 memory disclosure to ethernet due to unchecked scatter/gather IO (Justin Yackoski <jyackoski@...pto-nite.com>)
Re: Exploitability of Git's CVE-2016-2315 (Laël Cellier <lael.cellier@...oste.net>)
Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished… (Laël Cellier <lael.cellier@...oste.net…)
Re: Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublishe… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: ipv4: Don't do expensive useless work during inetdev destroy (Vladis Dronov <vdronov@...hat.com>)
Re: CVE Request : Use-after-free in gifcolor (cve-assign@...re.org)
Re: CVE Request: The minissdpd (v 1.2.20130907-3) is affected by an improper validation of array index weakness (cve-assign@...re.org)
Xen Security Advisory 171 (CVE-2016-3157) - I/O port access privilege escalation in x86-64 Linux (Xen.org security team <security@....org>)
Re: CVE request - OpenJPEG : Out-Of-Bounds Read in opj_tcd_free_tile function (cve-assign@...re.org)
Re: CVE request - OpenJPEG : Heap Corruption in opj_free function (cve-assign@...re.org)
Re: CVE request - OpenJPEG : Out-Of-Bounds Read in sycc422_to_rgb function (cve-assign@...re.org)
Re: CVE Request: PHP last release security issues (cve-assign@...re.org)
Three CVE requests for PHP (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Three CVE requests for PHP (cve-assign@...re.org)

March 17 (6 messages)

Re: CVE requests for Drupal contributed modules (from 2016-009 to 2016-014) (cve-assign@...re.org)
Re: [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting (Derek Mahar <derek.mahar@...il.com>)
Re: [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting (Christopher Shannon <christopher.l.shannon@...il.com>)
[cairo] Out-of-bounds read in _fill_xrgb32_lerp_opaque_spans (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: [cairo] Out-of-bounds read in _fill_xrgb32_lerp_opaque_spans (cve-assign@...re.org)
Re: Re: Three CVE requests for PHP (Moritz Muehlenhoff <jmm@...ian.org>)

March 18 (3 messages)

Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished… (Laël Cellier <lael.cellier@...oste.net…)
Re: AMD newest ucode 0x06000832 for Piledriver-based CPUs seems to behave in a problematic way (Robert Święcki <robert@...ecki.net>)
Re: expat hash collision fix too predictable? (Sebastian Pipping <sebastian@...ping.org>)

March 21 (4 messages)

moodle security release (Marina Glancy <marina@...dle.com>)
CVE request: Stack exhaustion in libxml2 parsing xml files in recover mode (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE request: Stack exhaustion in libxml2 parsing xml files in recover mode (cve-assign@...re.org)
Re: Re: CVE request: Stack exhaustion in libxml2 parsing xml files in recover mode ("Murphy, Grant" <grant.murphy@....com>)

March 22 (5 messages)

Re: CVE-2015-1805 Linux kernel: pipe: iovec overrun leading to memory corruption (Solar Designer <solar@...nwall.com>)
Re: CVE-2015-1805 Linux kernel: pipe: iovec overrun leading to memory corruption (Scotty Bauer <sbauer@....utah.edu>)
Re: Re: CVE Request: PHP last release security issues (Tyler Hicks <tyhicks@...onical.com>)
Re: CVE-2015-1805 Linux kernel: pipe: iovec overrun leading to memory corruption (Daniel Micay <danielmicay@...il.com>)
Re: CVE-2015-1805 Linux kernel: pipe: iovec overrun leading to memory corruption (Solar Designer <solar@...nwall.com>)

March 23 (1 message)

Remaining CVE IDs for Drupal contributed modules (2014) (Pere Orga <pere@...a.cat>)

March 25 (8 messages)

[CVE-2016-0783] Predictable password reset token (Maxim Solodovnik <solomax@...che.org>)
[CVE-2016-0784] ZIP file path traversal (Maxim Solodovnik <solomax@...che.org>)
[CVE-2016-2163] Stored Cross Site Scripting in Event description (Maxim Solodovnik <solomax@...che.org>)
[CVE-2016-2164] Arbitrary file read via SOAP API (Maxim Solodovnik <solomax@...che.org>)
Re: CVE Request: PHP last release security issues (cve-assign@...re.org)
[ANNOUNCE] Linux Security Summit 2016 - CFP (James Morris <jmorris@...ei.org>)
Re: [ANNOUNCE] Linux Security Summit 2016 - CFP (Solar Designer <solar@...nwall.com>)
CVE request - XStream: XXE vulnerability (Jörg Schaible <joerg.schaible@....de>)

March 26 (2 messages)

CVE Request: pcre: Segmentation fault on certain input to regular expressions with nested alternatives when JIT is used (Salvatore Bonaccorso <carnil@...ian.org…)
Re: CVE-2015-1805 Linux kernel: pipe: iovec overrun leading to memory corruption (Solar Designer <solar@...nwall.com>)

March 27 (2 messages)

Re: older fuseiso stuff (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: pcre: Segmentation fault on certain input to regular expressions with nested alternatives when JIT is … (Salvatore Bonaccorso <carnil@...ian.org…)

March 28 (3 messages)

Re: CVE request - XStream: XXE vulnerability (cve-assign@...re.org)
Re: CVE Request: pcre: Segmentation fault on certain input to regular expressions with nested alternatives when JIT is used (cve-assign@...re.org)
CVE update (CVE-2016-0735) - Fixed in Ranger 0.5.2 (Velmurugan Periasamy <vel@...che.org>)

March 29 (6 messages)

CVE-2016-2074: MPLS buffer overflow vulnerabilities in Open vSwitch (Ben Pfaff <blp@....org>)
Xen Security Advisory 172 (CVE-2016-3158,CVE-2016-3159) - broken AMD FPU FIP/FDP/FOP leak workaround (Xen.org security team <security@....org>)
Re: Partial SMAP bypass on 64-bit Linux kernels (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS ("Hugues ANGUELKOV" <hugues.anguelkov@....univ-nantes.fr>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Andreas Dilger <adilger@...ger.ca>)

March 30 (11 messages)

Re: older fuseiso stuff (cve-assign@...re.org)
Two flaws - libjpeg and libtiff (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE-2016-2385 Kamailio SEAS module heap buffer overflow (Stelios Tsampas <stelios@...sus-labs.com>)
CVE request -- linux kernel: crash on invalid USB device descriptors (ims-pcu driver) (Vladis Dronov <vdronov@...hat.com>)
[OSSA 2016-007.2] Nova host data leak through resize/migration (CVE-2016-2140) ERRATA #2 (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: CVE request -- linux kernel: crash on invalid USB device descriptors (ims-pcu driver) (cve-assign@...re.org)
Re: Xen Security Advisory 172 (CVE-2016-3158, CVE-2016-3159) - broken AMD FPU FIP/FDP/FOP leak workaround (yumkam@...il.com (Yuriy M. Kaminskiy))
CVE request: Heap overflow in VLC 2.1.6 processing wav files (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE request: Heap overflow in VLC 2.1.6 processing wav files (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Re: CVE request: Heap overflow in VLC 2.1.6 processing wav files (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE request: Heap overflow in VLC 2.1.6 processing wav files (cve-assign@...re.org)

March 31 (13 messages)

Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Theodore Ts'o <tytso@....edu>)
CVE-2016-2100: Foreman private bookmarks can be viewed and edited (Dominic Cleal <dominic@...al.org>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Eric Sandeen <sandeen@...hat.com>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Kurt Seifried <kseifried@...hat.com>)
ext4 data corruption due to punch hole races (Johannes Segitz <jsegitz@...e.com>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS ("Hugues ANGUELKOV" <hugues.anguelkov@....univ-nantes.fr>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Andreas Dilger <adilger@...ger.ca>)
Re: CVE Request - Linux kernel (multiple versions) ext2/ext3 filesystem DoS (Theodore Ts'o <tytso@....edu>)
WebKitGTK+ Security Advisory WSA-2016-0003 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE Clarification: Mysqlnd / CVE-2015-3152 (Seth Arnold <seth.arnold@...onical.com>)
Re: Partial SMAP bypass on 64-bit Linux kernels (cve-assign@...re.org)
Re: Re: Partial SMAP bypass on 64-bit Linux kernels (Steve Grubb <sgrubb@...hat.com>)
Re: CVE Clarification: Mysqlnd / CVE-2015-3152 (cve-assign@...re.org)

271 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.