oss-security mailing list - 2016/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 3	² 14	³ 8	⁴ 9	⁵ 2
⁶ 6	⁷ 6	⁸ 15	⁹ 8	¹⁰ 8	¹¹ 6	¹²
¹³ 4	¹⁴ 10	¹⁵ 17	¹⁶ 2	¹⁷ 5	¹⁸ 1	¹⁹
²⁰ 6	²¹ 6	²² 6	²³ 9	²⁴ 6	²⁵ 7	²⁶ 2
²⁷ 1	²⁸ 8	²⁹ 8	³⁰ 10

Messages by day:

June 1 (3 messages)

"The Blind SQL Injection Issue" explanation (Mihamina RAKOTOMANDIMBY <mihamina-rakotomandimby@...mb.org>)
Re: "The Blind SQL Injection Issue" explanation (Solar Designer <solar@...nwall.com>)
CVE update (CVE-2016-2174) - Fixed in Ranger 0.5.3 (Velmurugan Periasamy <vel@...che.org>)

June 2 (14 messages)

[OSSA-2016-008] Incorrect Audit IDs in Keystone Fernet Tokens can result in revocation bypass (CVE-2016-4911) (morgan fainberg <morgan.fainberg@...il.com>)
CVE Request Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd (P J P <ppandit@...hat.com>)
CVE Request: bad USB host adapter implementation can corrupt memory/brick machine (Marcus Meissner <meissner@...e.de>)
CVE request: DoS in phantomjs 2.1.1 rasterizing websites (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE request: mat doesn't remove metadata in embedded images in PDFs (Holger Levsen <holger@...er-acht.org>)
Re: CVE Request: bad USB host adapter implementation can corrupt memory/brick machine (Adam Maris <amaris@...hat.com>)
Re: CVE Request: bad USB host adapter implementation can corrupt memory/brick machine (Marcus Meissner <meissner@...e.de>)
Xen Security Advisory 178 (CVE-2016-4963) - Unsanitised driver domain input in libxl device handling (Xen.org security team <security@....org>)
Re: CVE Request Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd (cve-assign@...re.org)
Re: CVE request: DoS in phantomjs 2.1.1 rasterizing websites (cve-assign@...re.org)
Re: CVE request: mat doesn't remove metadata in embedded images in PDFs (cve-assign@...re.org)
Re: CVE request: mat doesn't remove metadata in embedded images in PDFs (Holger Levsen <holger@...er-acht.org>)
Re: ImageMagick CVEs (cve-assign@...re.org)
Re: CVE request: DoS in multiple versions of GraphicsMagick (cve-assign@...re.org)

June 3 (8 messages)

Xen Security Advisory 181 - arm: Host crash caused by VMID exhaustion (Xen.org security team <security@....org>)
CVE Request: tipc: an infoleak in tipc_nl_compat_link_dump (Kangjie Lu <kangjielu@...il.com>)
CVE Request: rds: fix an infoleak in rds_inc_info_copy (Kangjie Lu <kangjielu@...il.com>)
Re: CVE Request: tipc: an infoleak in tipc_nl_compat_link_dump (cve-assign@...re.org)
Re: CVE Request: rds: fix an infoleak in rds_inc_info_copy (cve-assign@...re.org)
[Announce] CVE-2016-4437: Apache Shiro information disclosure vulnerability (Brian Demers <bdemers@...che.org>)
CVE Request: Dnsmasq denial of service (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: expat hash collision fix too predictable? (Sebastian Pipping <sebastian@...ping.org>)

June 4 (9 messages)

Re: expat hash collision fix too predictable? (cve-assign@...re.org)
Re: CVE Request: Dnsmasq denial of service (cve-assign@...re.org)
Re: Re: expat hash collision fix too predictable? (Daniel Micay <danielmicay@...il.com>)
Re: expat hash collision fix too predictable? (Sebastian Pipping <sebastian@...ping.org>)
Re: expat hash collision fix too predictable? (cve-assign@...re.org)
Re: expat hash collision fix too predictable? (Sebastian Pipping <sebastian@...ping.org>)
Re: CVE request: DoS in phantomjs 2.1.1 rasterizing websites (Gustavo Grieco <gustavo.grieco@...il.com>)
three vulnerabilities in ImageMagick before 7.0.1-2 (cve-assign@...re.org)
Libtorrent http_parser.cpp denial of service (Brandon Perry <bperry.volatile@...il.com>)

June 5 (2 messages)

Re: Libtorrent http_parser.cpp denial of service (cve-assign@...re.org)
Re: CVE Request: Linux: aio write triggers integer overflow in some network protocols (Solar Designer <solar@...nwall.com>)

June 6 (6 messages)

Re: Requesting CVE for ImageMagick DoS (Jodie Cunningham <jodie.cunningham@...il.com>)
Re: Requesting CVE for ImageMagick DoS (cve-assign@...re.org)
Re: Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions (Adam Maris <amaris@...hat.com>)
Re: CVE requests: DoS in librsvg parsing SVGs with circular definitions (cve-assign@...re.org)
Xen Security Advisory 181 (CVE-2016-5242) - arm: Host crash caused by VMID exhaustion (Xen.org security team <security@....org>)
Xen Security Advisory 178 (CVE-2016-4963) - Unsanitised driver domain input in libxl device handling (Xen.org security team <security@....org>)

June 7 (6 messages)

Re: 3 bugs refer to buffer overflow in in libtiff 4.0.6 (cve-assign@...re.org)
CVE Request: GnuTLS: GNUTLS-SA-2016-1: File overwrite by setuid programs (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request Qemu: scsi: esp: OOB r/w access while processing ESP_FIFO (P J P <ppandit@...hat.com>)
Please reject duplicate CVE for libxml2 (Martin Prpic <mprpic@...hat.com>)
Re: Please reject duplicate CVE for libxml2 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: GnuTLS: GNUTLS-SA-2016-1: File overwrite by setuid programs (Adam Maris <amaris@...hat.com>)

June 8 (15 messages)

CVE Request: wireshark releases (Marcus Meissner <meissner@...e.de>)
CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Solar Designer <solar@...nwall.com>)
CVE Request Qemu: scsi: megasas: information leakage in megasas_ctrl_get_info (P J P <ppandit@...hat.com>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Alex Gaynor <alex.gaynor@...il.com>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Marcus Meissner <meissner@...e.de>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Billy Brumley <bbrumley@...il.com>)
CVE-2016-2177: OpenSSL undefined pointer arithmetic (Solar Designer <solar@...nwall.com>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Roman Drahtmueller <draht@...altsekun.de>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Roman Drahtmueller <draht@...altsekun.de>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Billy Brumley <bbrumley@...il.com>)
Re: CVE Request Qemu: scsi: megasas: information leakage in megasas_ctrl_get_info (cve-assign@...re.org)
Re: CVE Request Qemu: scsi: esp: OOB r/w access while processing ESP_FIFO (cve-assign@...re.org)
Excessive resource consumption (DOS) in JPEG (Daniel Veditz <dveditz@...illa.com>)

June 9 (8 messages)

CVE Request: ruby openssl hostname verification issue (Marcus Meissner <meissner@...e.de>)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Roman Drahtmueller <draht@...altsekun.de>)
Re: CVE Request: wireshark releases (Andreas Stieger <astieger@...e.com>)
Re: CVE Request: wireshark releases (cve-assign@...re.org)
CVE Request: haproxy remote denial of service via reqdeny (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: haproxy remote denial of service via reqdeny (cve-assign@...re.org)
Re: CVE Request: ruby openssl hostname verification issue (cve-assign@...re.org)
Re: CVE-2016-2178: OpenSSL DSA follows a non-constant time codepath for certain operations (Billy Brumley <bbrumley@...il.com>)

June 10 (8 messages)

CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Ruby gem rack-mini-profiler CVE-2016-4442 (Sam Saffron <sam.saffron@...il.com>)
Re: Ruby gem rack-mini-profiler CVE-2016-4442 (Reed Loden <reed@...dloden.com>)
Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack (cve-assign@...re.org)
CVE request for vulnerability in OpenStack Neutron (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: CVE request for vulnerability in OpenStack Neutron (cve-assign@...re.org)
Simple Machines Forums - PHP Object Injection (Scott Arciszewski <scott@...agonie.com>)
[vs-plain] Linux kernel stack overflow via ecryptfs and /proc/$pid/environ (John Johansen <john.johansen@...onical.com>)

June 11 (6 messages)

MantisBT: XSS in custom fields management (Damien Regad <dregad@...tisbt.org>)
CVE-Request: heap overflow in Python (Insu Yun <wuninsu@...il.com>)
Re: [vs-plain] Linux kernel stack overflow via ecryptfs and /proc/$pid/environ (Willy Tarreau <w@....eu>)
CVE Request for Denial of Service in pacman 5.0.1 (Tobias Stoeckmann <tobias@...eckmann.org>)
Re: MantisBT: XSS in custom fields management (cve-assign@...re.org)
Re: MantisBT: XSS in custom fields management (Damien Regad <dregad@...tisbt.org>)

June 13 (4 messages)

Re: Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request: several SOGo issues (DOS, XSS, information leakage) (Jens Erat <jens.erat@...-konstanz.de>)
Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack (cve-assign@...re.org)
Re: Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack (Paul Wouters <pwouters@...hat.com>)

June 14 (10 messages)

Re: AMD newest ucode 0x06000832 for Piledriver-based CPUs seems to behave in a problematic way (Robert Święcki <robert@...ecki.net>)
[OSSA-2016-009] Neutron IPTables firewall anti-spoof protection bypass (CVE-2016-5362, CVE-2016-5363, CVE-2015-8914) (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: CVE request: reads out-of-bounds with cpio 2.11 (Petter Reinholdtsen <pere@...gry.com>)
Re: Re: Linux Kernel bpf related UAF (Daniel Borkmann <daniel@...earbox.net>)
Various invalid memory reads in ImageMagick (WPG, DDS, DCM) (Hanno Böck <hanno@...eck.de>)
Re: CVE Request for Denial of Service in pacman 5.0.1 (cve-assign@...re.org)
CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (Cedric Buissart <cbuissar@...hat.com>)
Re: Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack (Paul Wouters <pwouters@...hat.com>)
Python CVE-2016-0772: smtplib StartTLS stripping attack (Cedric Buissart <cbuissar@...hat.com>)
Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (Tim <tim-security@...tinelchicken.org>)

June 15 (17 messages)

CVE-2016-5314：libtiff 4.0.6 PixarLogDecode() out-of-bound writes (张开翔 <zhangkaixiang@....cn>)
CVE-2016-5315: libtiff 4.0.6 tif_dir.c: setByteArray() Read access violation (张开翔 <zhangkaixiang@....cn>)
CVE-2016-5316: libtiff 4.0.6 tif_pixarlog.c: PixarLogCleanup() Segmentation fault (张开翔 <zhangkaixiang@....cn>)
Re: CVE request: several SOGo issues (DOS, XSS, information leakage) (cve-assign@...re.org)
CVE-2016-5317: GNOME nautilus: crash occurs when generating a thumbnail for a crafted TIFF image (张开翔 <zhangkaixiang@....cn>)
CVE-2016-5323: libtiff 4.0.6 tiffcrop _TIFFFax3fillruns(): divide by zero (张开翔 <zhangkaixiang@....cn>)
CVE-2016-5321: libtiff 4.0.6 DumpModeDecode(): Ddos (张开翔 <zhangkaixiang@....cn>)
CVE-2016-5322:libtiff 4.0.6 extractContigSamplesBytes: out-of-bounds read (张开翔 <zhangkaixiang@....cn>)
CVE-2016-5320: libtiff 4.0.6 rgb2ycbcr: command excution (张开翔 <zhangkaixiang@....cn>)
Re: CVE-2016-5317: GNOME nautilus: crash occurs when generating a thumbnail for a crafted TIFF image (Simon McVittie <smcv@...ian.org>)
CVE-2016-4470: Linux kernel Uninitialized variable in request_key handling user controlled kfree(). (Wade Mealing <wmealing@...hat.com>)
Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (Cedric Buissart <cbuissar@...hat.com>)
Re: CVE-2016-5320: libtiff 4.0.6 rgb2ycbcr: command excution (Marcus Meissner <meissner@...e.de>)
Re: CVE-2016-5323: libtiff 4.0.6 tiffcrop _TIFFFax3fillruns(): divide by zero (Marcus Meissner <meissner@...e.de>)
CVE Request: heap overflow in Python zipimport module (Insu Yun <wuninsu@...il.com>)
Re: CVE Request: ruby openssl hostname verification issue (Marcus Meissner <meissner@...e.de>)
Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (Tim <tim-security@...tinelchicken.org>)

June 16 (2 messages)

Re: CVE Request: heap overflow in Python zipimport module (cve-assign@...re.org)
Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (cve-assign@...re.org)

June 17 (5 messages)

Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (Cedric Buissart <cbuissar@...hat.com>)
Many invalid memory access issues in libarchive (Hanno Böck <hanno@...eck.de>)
Re: Various invalid memory reads in ImageMagick (WPG, DDS, DCM) (cve-assign@...re.org)
[OSSA-2016-010] XSS in Horizon client side template (CVE-2016-4428) (Tristan Cacqueray <tdecacqu@...hat.com>)
Re: Many invalid memory access issues in libarchive (cve-assign@...re.org)

June 18 (1 message)

Re: Simple Machines Forums - PHP Object Injection (cve-assign@...re.org)

June 20 (6 messages)

CVE-2016-3189: bzip2 use-after-free on bzip2recover (Cedric Buissart <cbuissar@...hat.com>)
CVE Request: 2015 squidguard reflected XSS (Marcus Meissner <meissner@...e.de>)
CVE request for PHP bug #68978: "XSS in header() with Internet Explorer" (2015) (Lukas Reschke <lukas@...tcloud.com>)
Jenkins plugins -- multiple fixes (Daniel Beck <ml@...kweb.net>)
Re: Jenkins plugins -- multiple fixes (Daniel Beck <ml@...kweb.net>)
RE: CVE Request: 2015 squidguard reflected XSS (CVE ID Requests <cve-assign@...re.org>)

June 21 (6 messages)

SELinux troubles (Sebastian Krahmer <krahmer@...e.com>)
Re: SELinux troubles (Tomas Hoger <thoger@...hat.com>)
Re: CVE request for PHP bug #68978: "XSS in header() with Internet Explorer" (2015) (cve-assign@...re.org)
CVE Request Openstack-infra puppet-gerrit module xss vulnerability (Gregory Haynes <greg@...ghaynes.net>)
Re: CVE Request: 2015 squidguard reflected XSS (cve-assign@...re.org)
Ironic node information including credentials exposed to unathenticated users (Jim Rollenhagen <jim@...rollenhagen.com>)

June 22 (6 messages)

Re: [vs-plain] Linux kernel stack overflow via ecryptfs and /proc/$pid/environ (Solar Designer <solar@...nwall.com>)
Re: CVE Request Openstack-infra puppet-gerrit module xss vulnerability (cve-assign@...re.org)
CVE request: SQL injection in MovableType xml-rpc interface (John Lightsey <john@...nuts.net>)
Re: [vs-plain] Linux kernel stack overflow via ecryptfs and /proc/$pid/environ (henrix@...andro.org)
Re: CVE request: SQL injection in MovableType xml-rpc interface (cve-assign@...re.org)
Re: CVE request: SQL injection in MovableType xml-rpc interface (John Lightsey <john@...nuts.net>)

June 23 (9 messages)

Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE (Ibrahim el-sayed <i.elsayed92@...il.com>)
CVE for PHP 5.5.37 issues (Lior Kaplan <kaplanlior@...il.com>)
Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (Marcus Meissner <meissner@...e.de>)
Re: CVE for PHP 5.5.37 issues (cve-assign@...re.org)
Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client (cve-assign@...re.org)
Out of bounds read and signed integer overflow in libarchive (Hanno Böck <hanno@...eck.de>)
CVE Requests: WordPress: 4.5.3 maintenance and security release: several issues (Salvatore Bonaccorso <carnil@...ian.org>)
RCE vulnerability in Openstack Murano using insecure YAML tags (CVE-2016-4972) (Kirill Zaitsev <k.zaitsev@...com>)
Re: CVE Requests: WordPress: 4.5.3 maintenance and security release: several issues (cve-assign@...re.org)

June 24 (6 messages)

CVE Request: Linux: powerpc/tm: Always reclaim in start_thread() for exec() class syscalls (Michael Ellerman <mpe@...erman.id.au>)
libical 0.47 SEGV on unknown address (Brandon Perry <bperry.volatile@...il.com>)
[CVE-2016-5697] signature wrapping attack vulnerability in ruby-saml prior to version 1.3.0 (Alvaro Hoyos <alvaro.hoyos@...login.com>)
Re: Out of bounds read and signed integer overflow in libarchive (cve-assign@...re.org)
Linux CVE-2016-4997 (local privilege escalation) and CVE-2016-4998 (out of bounds memory access) (Jesse Hertz <Jesse.Hertz@...group.trust>)
Re: [CVE-2016-5697] signature wrapping attack vulnerability in ruby-saml prior to version 1.3.0 (Alvaro Hoyos <alvaro.hoyos@...login.com>)

June 25 (7 messages)

Ruby:HTTP Header injection in 'net/http' (redrain root <rootredrain@...il.com>)
Linux CVE-2016-1237: nfsd: any user can set a file's ACL over NFS and grant access to it (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Fwd: out-of-bounds read in MagickCore/property.c:1396 could lead to memory leak/ Integer overflow read to RCE - ImageMagick (cve-assign@...re.org)
Re: libical 0.47 SEGV on unknown address (cve-assign@...re.org)
Re: libical 0.47 SEGV on unknown address (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: libical 0.47 SEGV on unknown address (Brandon Perry <bperry.volatile@...il.com>)
Re: CVE Request: Linux: powerpc/tm: Always reclaim in start_thread() for exec() class syscalls - Linux kernel (cve-assign@...re.org)

June 26 (2 messages)

CVE Request: Linux kernel HID: hiddev buffer overflows (Scotty <sbauer@...donthack.me>)
Re: CVE Request: Linux kernel HID: hiddev buffer overflows (cve-assign@...re.org)

June 27 (1 message)

CVE request: MatrixSSL lack of RSA-CRT hardening (Florian Weimer <fw@...eb.enyo.de>)

June 28 (8 messages)

Apache Xerces getLastExtEntityInfo Use-After-Free (Marco Grassi <marco.gra@...il.com>)
Re: Apache Xerces getLastExtEntityInfo Use-After-Free (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Apache Xerces getLastExtEntityInfo Use-After-Free (Marco Grassi <marco.gra@...il.com>)
Re: Apache Xerces getLastExtEntityInfo Use-After-Free (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE Request: integer overflow in ALSA snd_compress_check_input (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: integer overflow in ALSA snd_compress_check_input (cve-assign@...re.org)
CVE request - python-docx 0.8.5 - XXE (Pierre Ernst <pernst@...esforce.com>)
Re: CVE request - python-docx 0.8.5 - XXE (cve-assign@...re.org)

June 29 (8 messages)

CVE Request - PECL-HTTP 3.0.0 Buffer overflow (_rc0r <hlt99@...nkenshell.org>)
Re: CVE request: MatrixSSL lack of RSA-CRT hardening (Hanno Böck <hanno@...eck.de>)
CVE Request: uclibc-ng (and uclibc): ARM arch: code execution (Lucian Cojocar <lucian@...ocar.com>)
Re: CVE Request - PECL-HTTP 3.0.0 Buffer overflow (cve-assign@...re.org)
CVE request: Heap-based buffer overflow in LibTIFF when using the PixarLog compression format (Mathias Svensson <idolf@...gle.com>)
Re: CVE request: Heap-based buffer overflow in LibTIFF when using the PixarLog compression format (cve-assign@...re.org)
CVE-2016-4463: Apache Xerces-C XML Parser Crashes on Malformed DTD ("Cantor, Scott" <cantor.2@....edu>)
CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) (Salvatore Bonaccorso <carnil@...ian.org>)

June 30 (10 messages)

Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) (cve-assign@...re.org)
Debian Exim Spool Local Root (halfdog <me@...fdog.net>)
Re: Re: CVE request: Heap-based buffer overflow in LibTIFF when using the PixarLog compression format ("ncl@...k.li" <ncl@...k.li>)
CVE Request: No demangling of untrusted binaries (2) (Marcel Böhme <boehme.marcel@...il.com>)
Re: Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: A read out-of-bands was found in the parsing of TGA files using libgd (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: CVE Request: No demangling of untrusted binaries (2) (cve-assign@...re.org)
Re: CVE Request: No demangling of untrusted binaries (2) (Marcel Böhme <boehme.marcel@...il.com>)
Re: Debian Exim Spool Local Root (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request: A read out-of-bands was found in the parsing of TGA files using libgd (cve-assign@...re.org)

193 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.