oss-security mailing list - 2016/05

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 6
² 5	³ 20	⁴ 28	⁵ 24	⁶ 9	⁷ 8	⁸ 3
⁹ 17	¹⁰ 15	¹¹ 15	¹² 14	¹³ 2	¹⁴ 1	¹⁵ 3
¹⁶ 2	¹⁷ 12	¹⁸ 6	¹⁹ 12	²⁰ 6	²¹ 2	²² 1
²³ 5	²⁴ 9	²⁵ 8	²⁶ 9	²⁷ 7	²⁸	²⁹ 7
³⁰ 7	³¹ 4

Messages by day:

May 1 (6 messages)

Re: CVE requests: Multiple Wireshark vulnerabilities (cve-assign@...re.org)
CVE Request: libpam-sshauth: local root privilege escalation (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: libpam-sshauth: local root privilege escalation (cve-assign@...re.org)
CVE request: DoS in multiple versions of GraphicsMagick (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE Request: Jansson: stack exhaustion parsing a JSON file (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE request: DoS in multiple versions of GraphicsMagick (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)

May 2 (5 messages)

Re: CVE Request: Jansson: stack exhaustion parsing a JSON file (cve-assign@...re.org)
CVE request: atheme: security fixes (Max Teufel <max@...felsnetz.com>)
[SECURITY ISSUES] CVE-2016-3691 and CVE-2016-3114 (Andrew Shadura <andrew@...dura.me>)
Re: CVE Request: Out-of-bands write issue found in qemu (P J P <ppandit@...hat.com>)
hostapd/wpa_supplicant - psk configuration parameter update allowing arbitrary data to be written (Jouni Malinen <j@...fi>)

May 3 (20 messages)

Re: CVE request: atheme: security fixes (cve-assign@...re.org)
Re: hostapd/wpa_supplicant - psk configuration parameter update allowing arbitrary data to be written (cve-assign@...re.org)
Re: CVE Request: Jansson: stack exhaustion parsing a JSON file (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE-2016-3627 CVE-2016-3705: libxml2: stack overflow in xml validator (parser) (Simon Lees <sflees@...e.de>)
Re: CVE Request: libpam-sshauth: local root privilege escalation (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: atheme: security fixes (Max Teufel <max@...felsnetz.com>)
OpenSSL Security Advisory [3rd May 2016] (Solar Designer <solar@...nwall.com>)
CVE request: out-of-bounds read parsing an XML in libxml2 using recover mode (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: OpenSSL Security Advisory [3rd May 2016] (Gsunde Orangen <gsunde.orangen@...il.com>)
LSE Leading Security Experts GmbH - LSE-2016-02-03 - OXID eShop Path Traversal Vulnerability (LSE-Advisories <advisories@...xperts.de>)
Re: OpenSSL Security Advisory [3rd May 2016] (Solar Designer <solar@...nwall.com>)
Re: hostapd/wpa_supplicant - psk configuration parameter update allowing arbitrary data to be written (Jouni Malinen <j@...fi>)
ImageMagick Is On Fire -- CVE-2016-3714 (Ryan Huber <rhuber@...il.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Solar Designer <solar@...nwall.com>)
Re: OpenSSL Security Advisory [3rd May 2016] (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: CVE Request: libpam-sshauth: local root privilege escalation (Vagrant Cascadian <vagrant@...ian.org>)
Re: CVE Request: libpam-sshauth: local root privilege escalation (Scott Balneaves <sbalneav@...p.org>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Karim Valiev <valievkarim@...il.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Seth Arnold <seth.arnold@...onical.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Tim <tim-security@...tinelchicken.org>)

May 4 (28 messages)

Re: ImageMagick Is On Fire -- CVE-2016-3714 (Seth Arnold <seth.arnold@...onical.com>)
CVE Request: information leak in devio of Linux kernel (Kangjie Lu <kangjielu@...il.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Seth Arnold <seth.arnold@...onical.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Brandon Dees <brandon@...tta.com>)
Re: CVE Request: information leak in devio of Linux kernel (cve-assign@...re.org)
Re: CVE request: out-of-bounds read parsing an XML in libxml2 using recover mode (cve-assign@...re.org)
Re: OpenSSL Security Advisory [3rd May 2016] (Albert Veli <albert.veli@...il.com>)
Dotclear 2.9.1 XSS vulnerability by SVG (limingxing <limingxing@....cn>)
Re: OpenSSL Security Advisory [3rd May 2016] (iwnwi1owfl@...ie.me.uk(Alan J. Wylie))
libonion 0.8 contains security fixes (Solar Designer <solar@...nwall.com>)
Re: OpenSSL Security Advisory [3rd May 2016] (Albert Veli <albert.veli@...il.com>)
CVE-2016-4338: Zabbix Agent 3.0.1 mysql.size shell command injection (Timo Juhani Lindfors <timo.lindfors@....fi>)
A few Hesiod issues (Florian Weimer <fweimer@...hat.com>)
Re: libonion 0.8 contains security fixes (Adrien Nader <adrien@...k.org>)
Re: Dotclear 2.9.1 XSS vulnerability by SVG (Aymeric <mulx@...u.fr>)
broken RSA keys (Solar Designer <solar@...nwall.com>)
CVE Request: information leak in wilc1000 module of Linux kernel (Kangjie Lu <kangjielu@...il.com>)
Re: CVE Request: information leak in wilc1000 module of Linux kernel (Greg KH <greg@...ah.com>)
Re: libonion 0.8 contains security fixes (Solar Designer <solar@...nwall.com>)
Older OpenSSL RSA key/64 bit bug (now with added CVE!) (Kurt Seifried <kseifried@...hat.com>)
Re: broken RSA keys (Solar Designer <solar@...nwall.com>)
Re: broken RSA keys (Solar Designer <solar@...nwall.com>)
Re: broken RSA keys (Alexander Cherepanov <ch3root@...nwall.com>)
Re: broken RSA keys (Alexander Cherepanov <ch3root@...nwall.com>)
CVE Request: kernel information leak vulnerability in llc module (Kangjie Lu <kangjielu@...il.com>)
CVE Request: kernel information leak vulnerability in rtnetlink (Kangjie Lu <kangjielu@...il.com>)
Re: broken RSA keys (Alexander Cherepanov <ch3root@...nwall.com>)

May 5 (24 messages)

Re: CVE Request: kernel information leak vulnerability in llc module (cve-assign@...re.org)
Re: CVE Request: kernel information leak vulnerability in rtnetlink (cve-assign@...re.org)
CVE Request: No Demangling During Analysis of Untrusted Binaries (Marcel Böhme <boehme.marcel@...il.com>)
Re: broken RSA keys (Stanislav Datskovskiy <stas@...er-os.org>)
Re: CVE Request: No Demangling During Analysis of Untrusted Binaries (cve-assign@...re.org)
Re: broken RSA keys (Solar Designer <solar@...nwall.com>)
Re: broken RSA keys (Hanno Böck <hanno@...eck.de>)
Re: broken RSA keys (Solar Designer <solar@...nwall.com>)
Re: broken RSA keys (Hanno Böck <hanno@...eck.de>)
Re: broken RSA keys (Solar Designer <solar@...nwall.com>)
Re: broken RSA keys (Simon McVittie <smcv@...ian.org>)
Re: broken RSA keys (Alexander Cherepanov <ch3root@...nwall.com>)
Re: broken RSA keys (Stanislav Datskovskiy <stas@...er-os.org>)
Re: broken RSA keys (Stanislav Datskovskiy <stas@...er-os.org>)
Re: broken RSA keys (Hanno Böck <hanno@...eck.de>)
Re: broken RSA keys (Stanislav Datskovskiy <stas@...er-os.org>)
CVE Request: OpenAFS: OPENAFS-SA-2016-002 - various client functionality leak stack data onto the wire in the clear (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request - samsumg android phone com.samsung.android.jam.IAndroidShm binder service DoS (Vinc3nt4H <pengdawei521@....com>)
CVE request - samsumg android phone TvoutService_C binder service DoS (Vinc3nt4H <pengdawei521@....com>)
Re: broken RSA keys (Alexander Cherepanov <ch3root@...nwall.com>)
CVE Request: PHP: several issues fixed with 7.0.6, 5.6.21 and 5.5.35 (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2016-1236 - XSS Vulnerability in websvn 2.3.3-1.2+deb8u1 (Nitin Venkatesh <venkatesh.nitin@...il.com>)
Re: CVE Request: OpenAFS: OPENAFS-SA-2016-002 - various client functionality leak stack data onto the wire in the clear (cve-assign@...re.org)
Re: CVE Request: PHP: several issues fixed with 7.0.6, 5.6.21 and 5.5.35 (cve-assign@...re.org)

May 6 (9 messages)

Re: CVE request - samsumg android phone com.samsung.android.jam.IAndroidShm binder service DoS (cve-assign@...re.org)
Re: CVE request - samsumg android phone TvoutService_C binder service DoS (cve-assign@...re.org)
CVE Request: Squid HTTP caching proxy (Amos Jeffries <squid3@...enet.co.nz>)
CVE Requests: Linux: BPF flaws (one use-after-free / local root privilege escalation) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Squid HTTP caching proxy (cve-assign@...re.org)
CVE request: an invalid pointer read in mini-xml 2.7 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE Requests: Linux: BPF flaws (one use-after-free / local root privilege escalation) (cve-assign@...re.org)
CVE Request: ikiwiki: HTML-escape error messages to prevent cross-site scripting attack (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: ikiwiki: HTML-escape error messages to prevent cross-site scripting attack (cve-assign@...re.org)

May 7 (8 messages)

CVE Request: Linux: IB/security: Restrict use of the write() interface' (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: wordpress and mediaelement (Craig Small <csmall@....com.au>)
Re: broken RSA keys (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
CVE Request: Linux: [media] videobuf2-v4l2: Verify planes array in buffer dequeueing (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: Linux: [media] videobuf2-v4l2: Verify planes array in buffer dequeueing (cve-assign@...re.org)
Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' (cve-assign@...re.org)
Re: CVE Request: wordpress and mediaelement (cve-assign@...re.org)
CVE requested: two stack exhaustation parsing xml files using mxml (Gustavo Grieco <gustavo.grieco@...il.com>)

May 8 (3 messages)

Re: CVE requested: two stack exhaustation parsing xml files using mxml (Gustavo Grieco <gustavo.grieco@...il.com>)
dosfstools / fsck.vfat: Several invalid memory accesses (Hanno Böck <hanno@...eck.de>)
CVE Request: kernel information leak vulnerability in Linux sound module (Kangjie Lu <kangjielu@...il.com>)

May 9 (17 messages)

GraphicsMagick Response To "ImageTragick" (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Xen Security Advisory 179 (CVE-2016-3710,CVE-2016-3712) - QEMU: Banked access to VGA memory (VBE) uses inconsistent bou… (Xen.org security team <security@....org…)
CVE-2016-3710 Qemu: vga: out-of-bounds r/w access issue (P J P <ppandit@...hat.com>)
CVE-2016-3712 Qemu: vga: out-of-bounds read and integer overflow issues (P J P <ppandit@...hat.com>)
GraphicsMagick Response To "ImageTragick" (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: GraphicsMagick Response To "ImageTragick" (Simon McVittie <smcv@...ian.org>)
CVE-2016-2099: use-after-free in Xerces 3.1.3 (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Re: CVE Requests: Linux: BPF flaws (one use-after-free / local root privilege escalation) (Jann Horn <jannh@...gle.com>)
Re: GraphicsMagick Response To "ImageTragick" (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: GraphicsMagick Response To "ImageTragick" (John Lightsey <john@...nuts.net>)
Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' (Yann Droneaud <ydroneaud@...eya.com>)
Re: GraphicsMagick Response To "ImageTragick" (Simon McVittie <smcv@...ian.org>)
Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' (Jann Horn <jann@...jh.net>)
Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' (Yann Droneaud <ydroneaud@...eya.com>)
Re: GraphicsMagick Response To "ImageTragick" (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: CVE requested: two stack exhaustation parsing xml files using mxml (cve-assign@...re.org)
Re: CVE Request: kernel information leak vulnerability in Linux sound module (cve-assign@...re.org)

May 10 (15 messages)

WordPress plugin nelio-ab-testing path traversal vulnerability (Henri Salo <henri.salo@...u.com>)
Xen Security Advisory 179 (CVE-2016-3710,CVE-2016-3712) - QEMU: Banked access to VGA memory (VBE) uses inconsistent bou… (Xen.org security team <security@....org…)
Re: Re: CVE request: three issues in libksba (Andreas Stieger <astieger@...e.com>)
Re: CVE request: three issues in libksba (cve-assign@...re.org)
BitKeeper /tmp vulns (Kurt Seifried <kseifried@...hat.com>)
Re: BitKeeper /tmp vulns (Michael Scherer <misc@...b.org>)
Re: BitKeeper /tmp vulns (Kurt Seifried <kseifried@...hat.com>)
CVE request: libksba out-of-bouds read remote DOS issue fixed in 1.3.4 (Andreas Stieger <astieger@...e.com>)
CVE Request: alsa: kernel information leak vulnerability in Linux sound/core/timer (Kangjie Lu <kangjielu@...il.com>)
Re: BitKeeper /tmp vulns (Michael Scherer <misc@...b.org>)
CVE Request: ALSA: Another information leak vulnerability in sound/core/timer (Kangjie Lu <kangjielu@...il.com>)
CVE Request: x25: a kernel infoleak in x25_negotiate_facilities() (Kangjie Lu <kangjielu@...il.com>)
Re: BitKeeper /tmp vulns (Larry McVoy <lm@...oy.com>)
Re: Re: CVE Request: kernel information leak vulnerability in Linux sound module (Steve Beattie <steve.beattie@...onical.com>)
Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions (Brian May <brian@...uxpenguins.xyz>)

May 11 (15 messages)

Re: BitKeeper /tmp vulns (Michael Scherer <misc@...b.org>)
CVE request: Mishandling the first propagated copy being a slave (Adam Maris <amaris@...hat.com>)
ImageMagick heap overflow and out of bounds read (Hanno Böck <hanno@...eck.de>)
Re: CVE Request: alsa: kernel information leak vulnerability in Linux sound/core/timer (Takashi Iwai <tiwai@...e.de>)
Re: CVE Request: alsa: kernel information leak vulnerability in Linux sound/core/timer (cve-assign@...re.org)
Re: CVE Request: alsa: kernel information leak vulnerability in Linux sound/core/timer (Takashi Iwai <tiwai@...e.de>)
Re: CVE request: Mishandling the first propagated copy being a slave - Linux kernel (cve-assign@...re.org)
CVE Requests: Linux: use-after-free issue for ppp channel (Baozeng Ding <sploving1@...il.com>)
Re: CVE Request: alsa: kernel information leak vulnerability in Linux sound/core/timer (Kangjie Lu <kangjielu@...il.com>)
Re: CVE request: libksba out-of-bouds read remote DOS issue fixed in 1.3.4 (cve-assign@...re.org)
Re: broken RSA keys (Ben Laurie <benl@...gle.com>)
Reflected XSS in three Wordpress plugins. ("Larry W. Cashdollar" <larry0@...com>)
Request CVE ID for Simple Photo Gallery 1.8.0 - Stored XSS (Oliveira Lima <oliveiralimajr@...il.com>)
Re: CVE requested: two stack exhaustation parsing xml files using mxml (Gustavo Grieco <gustavo.grieco@...il.com>)
Jenkins - multiple fixes (Daniel Beck <ml@...kweb.net>)

May 12 (14 messages)

CVE Request - OpenJPEG: Security Fixes (winsonliu(刘科) <winsonliu@...cent.com>)
Re: CVE Request - OpenJPEG: Security Fixes (Moritz Muehlenhoff <jmm@...ian.org>)
Possible CVE request: gdk-pixbuf: Additional fixes to protect against overlows in pixops_* functions (similar to CVE-20… (Salvatore Bonaccorso <carnil@...ian.org…)
Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' ("ira.weiny" <ira.weiny@...el.com>)
Re: GraphicsMagick Response To "ImageTragick" (David Chan <david@...anm.com>)
Linux Kernel bpf related UAF (Marco Grassi <marco.gra@...il.com>)
Re: Re: CVE Request - OpenJPEG: Security Fixes (WinsonLiu <stackexploit@...il.com>)
Re: Reflected XSS in three Wordpress plugins. (Henri Salo <henri@...v.fi>)
CVE-2016-0758 - Linux kernel - Flaw in ASN.1 DER decoder for x509 certificate DER files. (Wade Mealing <wmealing@...hat.com>)
Re: Linux Kernel bpf related UAF (cve-assign@...re.org)
Re: Linux Kernel bpf related UAF (Marco Grassi <marco.gra@...il.com>)
Re: broken RSA keys (Solar Designer <solar@...nwall.com>)
Re: CVE Request : Use-after-free in openjpeg (Moritz Muehlenhoff <jmm@...ian.org>)
CVE Request for VirIT Explorer v.8.1.68 Local Privilege Escalation (VoidSec <voidsec@...dsec.com>)

May 13 (2 messages)

Re: CVE Request : Use-after-free in openjpeg (cve-assign@...re.org)
Re: CVE Request - OpenJPEG: Security Fixes (cve-assign@...re.org)

May 14 (1 message)

Re: dosfstools / fsck.vfat: Several invalid memory accesses (cve-assign@...re.org)

May 15 (3 messages)

Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE Requests: Linux: use-after-free issue for ppp channel (Baozeng Ding <sploving1@...il.com>)
Re: CVE Requests: Linux: use-after-free issue for ppp channel (cve-assign@...re.org)

May 16 (2 messages)

Re: CVE Request: gdk-pixbuf: Additional fixes to protect against overlows in pixops_* functions (similar to CVE-2015-76… (Salvatore Bonaccorso <carnil@...ian.org…)
CVE-2016-3713 Linux kernel: kvm: OOB r/w access issue with MSR 0x2F8 (P J P <ppandit@...hat.com>)

May 17 (12 messages)

CVE-2016-3707 : kernel-rt - Sending SysRq command via ICMP echo request (Wade Mealing <wmealing@...hat.com>)
[CVE-2016-0731] Apache Ambari: Ambari File Browser View security vulnerability (Yusaku Sako <yusaku@...tonworks.com>)
Re: ImageMagick heap overflow and out of bounds read (Andrej Nemec <anemec@...hat.com>)
Moodle security release 3.0.4, 2.9.6, 2.8.12, 2.7.14 (Marina Glancy <marina@...dle.com>)
Please REJECT CVE-2016-2189 (Petr Matousek <pmatouse@...hat.com>)
Xen Security Advisory 176 (CVE-2016-4480) - x86 software guest page walk PS bit handling flaw (Xen.org security team <security@....org>)
Re: CVE Request: gdk-pixbuf: Additional fixes to protect against overlows in pixops_* functions (similar to CVE-2015-7674) (cve-assign@...re.org)
CVE-2016-3091 Diego log encoding vulnerability (Molly Crowther <mcrowther@...otal.io>)
RHSA-2016:1086 libndp: denial of service due to insufficient validation of source of NDP messages (Cedric Buissart <cbuissar@...hat.com>)
CVE request for vulnerability in OpenStack Keystone (morgan fainberg <morgan.fainberg@...il.com>)
Re: CVE request for vulnerability in OpenStack Keystone (cve-assign@...re.org)
CVE-2016-0718: Expat XML Parser Crashes on Malformed Input (Gustavo Grieco <gustavo.grieco@...il.com>)

May 18 (6 messages)

CVE Request: null pointer deref in openslp, can be triggered remotely (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
[SECURITY ADVISORY] curl: TLS certificate check bypass with mbedTLS/PolarSSL (Daniel Stenberg <daniel@...x.se>)
CVE Request: Linux: information leak in Rock Ridge Extensions to iso9660 -- fs/isofs/rock.c (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2016-3698 libndp: denial of service due to insufficient validation of source of NDP messages (Cedric Buissart <cbuissar@...hat.com>)
Re: CVE Request: Linux: information leak in Rock Ridge Extensions to iso9660 -- fs/isofs/rock.c (cve-assign@...re.org)
Re: CVE Request: null pointer deref in openslp, can be triggered remotely (cve-assign@...re.org)

May 19 (12 messages)

Re: Re: CVE Request: null pointer deref in openslp, can be triggered remotely (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE-2016-3728: remote code execution in Foreman smart proxy TFTP API (Dominic Cleal <dominic@...al.org>)
CVE-2016-4439 Qemu: scsi: esp: OOB write while writing to 's->cmdbuf' in esp_reg_write (P J P <ppandit@...hat.com>)
CVE-2016-4441 Qemu: scsi: esp: OOB write while writing to 's-cmdbuf' in get_cmd (P J P <ppandit@...hat.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Jeremy Stanley <fungi@...goth.org>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Kurt Seifried <kseifried@...hat.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Simon McVittie <smcv@...ian.org>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Thomas Klausner <wiz@...BSD.org>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (John Lightsey <jd@...nel.net>)

May 20 (6 messages)

Pulp 2.8.3 Released to address multiple CVEs (Randy Barlow <randy@...ctronsweatshop.com>)
CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to MSR access (P J P <ppandit@...hat.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Sven Kieske <s.kieske@...twald.de>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
CVE Request -Vulnerabilitie XSS in brafton WordPress Plugin (Mehrdad Linux <mehrdadlinux@...il.com>)
Re: ImageMagick Is On Fire -- CVE-2016-3714 (Simon Lees <sflees@...e.de>)

May 21 (2 messages)

CVE request: -- Linux kernel: Null pointer dereference in tipc_nl_publ_dump (Baozeng Ding <sploving1@...il.com>)
Re: CVE request: -- Linux kernel: Null pointer dereference in tipc_nl_publ_dump (cve-assign@...re.org)

May 22 (1 message)

CVE Request -XSS Vulnerabilitie in Collectd-web (Mehrdad Linux <mehrdadlinux@...il.com>)

May 23 (5 messages)

CVE request: Qemu: scsi: pvscsi: out-of-bounds access issue in pvsci_ring_init_msg/data routines (P J P <ppandit@...hat.com>)
CVE request: OpenNTPD not verifying CN during HTTPS constraints request ("Luis M. Merino" <luismiguelmerino@...il.com>)
Xen Security Advisory 180 (CVE-2014-3672) - Unrestricted qemu logging (Xen.org security team <security@....org>)
Re: CVE request: Qemu: scsi: pvscsi: out-of-bounds access issue in pvsci_ring_init_msg/data routines (cve-assign@...re.org)
CVE request: /tmp usage race condition in onionshare (Michael Scherer <misc@...b.org>)

May 24 (9 messages)

CVE request: Multiple vunerabilities in libdwarf & dwarfdump (Yue Liu <liuyue0310@...il.com>)
[ANNOUNCE] CVE-2016-3088: ActiveMQ Fileserver web application vulnerabilities (Dejan Bosanac <dejan@...httale.net>)
Re: CVE request: Multiple vunerabilities in libdwarf & dwarfdump (Solar Designer <solar@...nwall.com>)
CVE Request: Qemu: scsi: mptsas infinite loop in mptsas_fetch_requests (P J P <ppandit@...hat.com>)
CVE-2014-3672 libvirt: DoS via excessive logging (P J P <ppandit@...hat.com>)
Re: [ANNOUNCE] CVE-2016-3088: ActiveMQ Fileserver web application vulnerabilities (Dejan Bosanac <dejan@...httale.net>)
Re: CVE Request: Qemu: scsi: mptsas infinite loop in mptsas_fetch_requests (cve-assign@...re.org)
Re: [ANNOUNCE] CVE-2016-3088: ActiveMQ Fileserver web application vulnerabilities (Tim Bain <tbain@...mni.duke.edu>)
Re: CVE request: /tmp usage race condition in onionshare (cve-assign@...re.org)

May 25 (8 messages)

Re: CVE request: Multiple vunerabilities in libdwarf & dwarfdump (cve-assign@...re.org)
3 libxml2 issues (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Fwd: CVE for PHP 5.5.36 issues (Lior Kaplan <kaplanlior@...il.com>)
CVE-Request: TYPO3 Extbase Missing Access Check (Stefan Horlacher <stefan.horlacher@...us-security.ch>)
CVE Request Qemu: scsi: megasas: stack information leakage while reading configuration (P J P <ppandit@...hat.com>)
CVE Request Qemu: scsi: megasas: out-of-bounds write while setting controller properties (P J P <ppandit@...hat.com>)
CVE Request Qemu: scsi: megasas: out-of-bounds read in megasas_lookup_frame() function (P J P <ppandit@...hat.com>)
CVE Request: roundcube: XSS vulnerability in mail content page (Salvatore Bonaccorso <carnil@...ian.org>)

May 26 (9 messages)

CVE Requests: libimobiledevice and libusbmuxd (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-Request: TYPO3 Extbase Missing Access Check (cve-assign@...re.org)
Re: Fwd: CVE for PHP 5.5.36 issues (cve-assign@...re.org)
[CVE-2016-4434] Apache Tika XML External Entity vulnerability (Tim Allison <tallison@...che.org>)
Re: CVE Request: roundcube: XSS vulnerability in mail content page (cve-assign@...re.org)
Re: CVE Requests: libimobiledevice and libusbmuxd (cve-assign@...re.org)
Re: CVE Request Qemu: scsi: megasas: stack information leakage while reading configuration (cve-assign@...re.org)
Re: CVE Request Qemu: scsi: megasas: out-of-bounds write while setting controller properties (cve-assign@...re.org)
Re: CVE Request Qemu: scsi: megasas: out-of-bounds read in megasas_lookup_frame() function (cve-assign@...re.org)

May 27 (7 messages)

[CVE-2016-2175] Apache PDFBox XML External Entity vulnerability (Andreas Lehmkuehler <lehmi@...che.org>)
CVE-2016-4451: Privileges escalation through Organization and Locations Foreman API (Marek Hulán <mhulan@...hat.com>)
CVE request: VLC - crash and potential code execution when processing QuickTime IMA files (Patrick Coleman <blinken@...il.com>)
Security issues addressed in GraphicsMagick SVG reader (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
[CVE-2016-3094] Apache Qpid Java Broker denial of service vulnerability (Lorenz Quack <quack.lorenz@...il.com>)
[CVE-2016-4432] Apache Qpid Java Broker - authentication bypass (Keith W <keith.wall@...il.com>)
Re: CVE request: VLC - crash and potential code execution when processing QuickTime IMA files (cve-assign@...re.org)

May 29 (7 messages)

Re: Fwd: PHP-FPM fpm_log.c memory leak and buffer overflow (cve-assign@...re.org)
CVE request: Mplayer/Mencoder read out-of-bounds parsing a mp3 file (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE Request: libgd - gdCtxPrintf memory leak (Fernando Muñoz <fernando@...l-life.com>)
Re: CVE request: Mplayer/Mencoder read out-of-bounds parsing a mp3 file (cve-assign@...re.org)
Re: CVE Request: libgd - gdCtxPrintf memory leak (cve-assign@...re.org)
Re: CVE request: OpenNTPD not verifying CN during HTTPS constraints request (cve-assign@...re.org)
CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerability via filename (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)

May 30 (7 messages)

Re: CVE Request: GraphicsMagick and ImageMagick popen() shell vulnerability via filename (cve-assign@...re.org)
CVE-2016-4453 Qemu: display: vmsvga: infinite loop in vmsvga_fifo_run() routine (P J P <ppandit@...hat.com>)
CVE-2016-4454 Qemu: display: vmsvga: out-of-bounds read in vmsvga_fifo_read_raw() routine (P J P <ppandit@...hat.com>)
[oCERT 2016-001] Jetty path sanitization issues (Daniele Bianco <danbia@...rt.org>)
WebKitGTK+ Security Advisory WSA-2016-0004 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE Request Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl (P J P <ppandit@...hat.com>)
Re: CVE Request Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl (cve-assign@...re.org)

May 31 (4 messages)

Re: Security issues addressed in GraphicsMagick SVG reader (Stefan Cornelius <scorneli@...hat.com>)
ImageMagick CVEs (Stefan Cornelius <scorneli@...hat.com>)
Re: Security issues addressed in GraphicsMagick SVG reader (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
CVE Request: Reflected Cross-Site Scripting in TYPO3 Formhandler (Lubomir Stroetmann <lubomir.stroetmann@...tscheck.com>)

267 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.