oss-security mailing list - 2016/08

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 7	² 13	³ 9	⁴ 5	⁵ 3	⁶	⁷ 1
⁸ 2	⁹ 2	¹⁰ 2	¹¹ 8	¹² 7	¹³ 1	¹⁴ 6
¹⁵ 9	¹⁶ 6	¹⁷ 12	¹⁸ 24	¹⁹ 10	²⁰ 4	²¹
²² 18	²³ 9	²⁴ 3	²⁵ 5	²⁶ 4	²⁷ 2	²⁸ 3
²⁹ 3	³⁰ 3	³¹ 3

Messages by day:

August 1 (7 messages)

Re: Re: CVE Request: nettle's RSA code is vulnerable to cache sharing related attacks (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Announce: OpenSSH 7.3 released (Damien Miller <djm@...nbsd.org>)
Re: cve request: systemd-machined: information exposure for docker containers (Shiz <hi@...z.me>)
Re: CVE request: Wireshark 2.0.5 and 1.12.13 security releases (cve-assign@...re.org)
CVE:Request - Path Traversal Barebone.jsp - Liferay 5.1.0 ("petrella.pietro" <petrella.pietro@...il.com>)
Re: Re: CVE request: mongodb: world-readable .dbshell history file (Grant Ridder <shortdudey123@...il.com>)
Re: CVE Request: Linux >= 4.5 double fetch leading to heap overflow (cve-assign@...re.org)

August 2 (13 messages)

Re: CVE:Request - Path Traversal Barebone.jsp - Liferay 5.1.0 (cve-assign@...re.org)
CVE Request: CSRF in Grails console (Dario Bertini <berdario@...il.com>)
CVE request: XSS vulns in Dotclear v2.9.1 (陈瑞琦 <chenruiqi@....cn>)
Re: CVE request: mongodb: world-readable .dbshell history file (Sébastien Delafond <seb@...ian.org>)
glibc: Per-thread memory leak in __res_vinit with IPv6 nameservers (CVE-2016-5417) (Florian Weimer <fweimer@...hat.com>)
CVE Request ImageMagick buffer overflow (Ibrahim el-sayed <i.elsayed92@...il.com>)
Re: Ruby:HTTP Header injection in 'net/http' (Marcus Meissner <meissner@...e.de>)
CVE Request: Denial-of-Service / Unexploitable Memory Corruption in mmap() on OpenBSD (Jesse Hertz <jesse.hertz@...group.trust>)
Multiple vulnerabilities affecting seven WordPress (XSS, CSRF, SQLi) (Summer of Pwnage <lists@...urify.nl>)
Re: CVE Request ImageMagick buffer overflow (cve-assign@...re.org)
Re: CVE Request: CSRF in Grails console (cve-assign@...re.org)
Re: CVE Request: Denial-of-Service / Unexploitable Memory Corruption in mmap() on OpenBSD (cve-assign@...re.org)
Re: CVE request: XSS vulns in Dotclear v2.9.1 (cve-assign@...re.org)

August 3 (9 messages)

Re: CVE Request: CSRF in Grails console (Dario Bertini <berdario@...il.com>)
CVE request:Heap overflow vulns in MuPDF (redrain root <rootredrain@...il.com>)
[SECURITY VULNERABILITY] curl: TLS session resumption client cert bypass (Daniel Stenberg <daniel@...x.se>)
[SECURITY VULNERABILITY] curl: Re-using connections with wrong client cert (Daniel Stenberg <daniel@...x.se>)
[SECURITY VULNERABILITY] curl: use of connection struct after free (Daniel Stenberg <daniel@...x.se>)
Re: cve request: systemd-machined: information exposure for docker containers (Daniel J Walsh <dwalsh@...hat.com>)
CVE-2016-6301: busybox: NTP server denial of service flaw (Martin Prpic <mprpic@...hat.com>)
Re: CVE request:Heap overflow vulns in MuPDF (cve-assign@...re.org)
Grails Console is still vulnerable to CSRF CVE-2016-6521 (Dario Bertini <berdario@...il.com>)

August 4 (5 messages)

Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (cve-assign@...re.org)
CVE-2016-6580, Python Priority: DoS via Unlimited Stream Insertion (Cory Benfield <cory@...asa.co.uk>)
CVE-2016-6581, Python HPACK and old Python Hyper releases: HPACK Bomb (Cory Benfield <cory@...asa.co.uk>)
Multiple Cross-Site Scripting vulnerabilities affecting seven WordPress Plugins (Summer of Pwnage <lists@...urify.nl>)
CVE-2016-0760: Hive builtin functions “reflect”, “reflect2”, and “java_method” are not blocked in Apache Sen… (Sravya Tirukkovalur <sravya@...che.org>)

August 5 (3 messages)

Fwd: CVE request - samsumg android phone SVE-2016-6244 Possible Privilege Escalation in telecom (0xr0ot <0xr0ot.sec@...il.com>)
Read out-of-bounds parsing bash code in GNU Bash 4.3 (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE Request - Samsung Exynos fimg2d NULL Pointer Dereference (Idler <idler1984@...il.com>)

August 7 (1 message)

CVE Requests: Various ImageMagick issues (as reported in the Debian BTS) (Salvatore Bonaccorso <carnil@...ian.org>)

August 8 (2 messages)

Re: Read out-of-bounds parsing bash code in GNU Bash 4.3 (Gustavo Grieco <gustavo.grieco@...il.com>)
RCE vulnerability in Openstack Murano using insecure YAML tags (CVE-2016-4972) (Kirill Zaitsev <kzaitsev@...antis.com>)

August 9 (2 messages)

MatrixSSL Bignum bugs (Hanno Böck <hanno@...eck.de>)
FreeBSD update components vulns (libarchive, bsdiff, portsnap) (Hanno Böck <hanno@...eck.de>)

August 10 (2 messages)

Re: cve request: systemd-machined: information exposure for docker containers (CAI Qian <caiqian@...hat.com>)
Re: cve request: systemd-machined: information exposure for docker containers (Daniel J Walsh <dwalsh@...hat.com>)

August 11 (8 messages)

CVE Requests Facebook HHVM ("F. Alonso" <rs@...skills.cz>)
Re: CVE Request: ipywidgets executes untrusted JavaScript (Sylvain Corlay <sylvain.corlay@...il.com>)
[CVE-2016-6316] Possible XSS Vulnerability in Action View (Aaron Patterson <tenderlove@...y-lang.org>)
[CVE-2016-6317] Unsafe Query Generation Risk in Active Record (Aaron Patterson <tenderlove@...y-lang.org>)
CVE Request Qemu: Information leak in vmxnet3_complete_packet (P J P <ppandit@...hat.com>)
Re: [CVE-2016-6316] Possible XSS Vulnerability in Action View (Aaron Patterson <tenderlove@...y-lang.org>)
CVE request Qemu: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation (P J P <ppandit@...hat.com>)
CVE request Qemu: an infinite loop during packet fragmentation (P J P <ppandit@...hat.com>)

August 12 (7 messages)

CVE request: Qemu net: vmxnet3: use after free while writing (P J P <ppandit@...hat.com>)
CVE Request - Gnu Wget 1.17 - Design Error Vulnerability ("Misra, Deapesh" <dmisra@...isign.com>)
Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (Kurt Seifried <kseifried@...hat.com>)
CVE request: XSS vuln in b2evolution v6.7.4 (陈瑞琦 <chenruiqi@....cn>)
[CVE-2016-3089] Apache OpenMeetings XSS in SWF panel (Maxim Solodovnik <solomax@...che.org>)
[CVE-2016-6671] ffmpeg buffer overflow when decoding swf (连一汉 <lianyihan@....cn>)
Re: [Bug-wget] CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (Tim Rühsen <tim.ruehsen@....de>)

August 13 (1 message)

libav: heap-based buffer overflow in ff_audio_resample (resample.c) (Agostino Sarubbo <ago@...too.org>)

August 14 (6 messages)

gorgeous (squid3 <squid3@...enet.co.nz>)
Re: gorgeous (Solar Designer <solar@...nwall.com>)
CVE request for buffer overrun in CHICKEN process-execute and process-spawn posix procedures (Peter Bex <peter@...e-magic.net>)
Re: [Bug-wget] CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (Tim Rühsen <tim.ruehsen@....de>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Greg KH <greg@...ah.com>)

August 15 (9 messages)

Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (Marco Grassi <marco.gra@...il.com>)
RE: CVE-2016-5696: linux kernel - challange ack information leak. (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Greg KH <greg@...ah.com>)
Re: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (Greg KH <greg@...ah.com>)
Re: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (Marco Grassi <marco.gra@...il.com>)
Re: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (Greg KH <greg@...ah.com>)
Re: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (Marco Grassi <marco.gra@...il.com>)
Multiple vulnerabilities affecting eleven WordPress Plugins (XSS, CSRF, LFI & object injection) (Summer of Pwnage <lists@...urify.nl>)
Fwd: Security vulnerability - read out-of-bounds leads to memory leak (Ibrahim el-sayed <i.elsayed92@...il.com>)

August 16 (6 messages)

CVE Request: Default password in openstack / crowbar trove (Marcus Meissner <meissner@...e.de>)
cracklib: Stack-based buffer overflow when parsing large GECOS field (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
firewalld: Firewall configuration can be modified by any logged in user (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (Greg KH <greg@...ah.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Greg KH <greg@...ah.com>)

August 17 (12 messages)

RE: CVE-2016-5696: linux kernel - challange ack information leak. (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Greg KH <greg@...ah.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Gsunde Orangen <gsunde.orangen@...il.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Greg KH <greg@...ah.com>)
Re: CVE-2016-5696: linux kernel - challange ack information leak. (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2016-4973 gcc: Targets using libssp for SSP are missing -D_FORTIFY_SOURCE functionality (Cedric Buissart <cbuissar@...hat.com>)
Libgcrypt and GnuPG 1.4 RNG output prediction (Solar Designer <solar@...nwall.com>)
Re: Libgcrypt and GnuPG 1.4 RNG output prediction (Remi Gacogne <rgacogne@...hlinux.org>)
CVE-2016-5404 freeipa: Insufficient privileges check in certificate revocation (Cedric Buissart <cbuissar@...hat.com>)
Re: Libgcrypt and GnuPG 1.4 RNG output prediction (Werner Koch <wk@...pg.org>)
ModSecurity's OWASP CRS v3.0.0-rc1 Released. (Chaim Sanders <chaim@...imsanders.com>)
MantisBT: XSS in view_all_bug_page.php (Damien Regad <dregad@...tisbt.org>)

August 18 (24 messages)

Re: libav: heap-based buffer overflow in ff_audio_resample (resample.c) (cve-assign@...re.org)
Re: CVE request for buffer overrun in CHICKEN process-execute and process-spawn posix procedures (cve-assign@...re.org)
Re: CVE request: Qemu net: vmxnet3: use after free while writing (cve-assign@...re.org)
Re: CVE request Qemu: buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device emulation (cve-assign@...re.org)
Re: CVE Request Qemu: Information leak in vmxnet3_complete_packet (cve-assign@...re.org)
Re: Linux tcp_xmit_retransmit_queue use after free on 4.8-rc1 / master (cve-assign@...re.org)
Re: CVE request Qemu: an infinite loop during packet fragmentation (cve-assign@...re.org)
Re: MantisBT: XSS in view_all_bug_page.php (cve-assign@...re.org)
Re: CVE Request: Default password in openstack / crowbar trove (cve-assign@...re.org)
Re: CVE Request - Samsung Exynos fimg2d NULL Pointer Dereference (cve-assign@...re.org)
potrace: multiple crashes (Agostino Sarubbo <ago@...too.org>)
CVE-2016-6323: Missing unwind information on ARM EABI (32-bit) causes backtrace generation to hang (Florian Weimer <fweimer@...hat.com>)
CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Greg KH <greg@...ah.com>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Greg KH <greg@...ah.com>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Marcus Meissner <meissner@...e.de>)
Re: Re: Libgcrypt and GnuPG 1.4 RNG output prediction (Andrew Gallagher <andrewg@...rewg.com>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Ben Hutchings <ben@...adent.org.uk>)
Re: Libgcrypt and GnuPG 1.4 RNG output prediction (Solar Designer <solar@...nwall.com>)
Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Adam Maris <amaris@...hat.com>)
CVE request - slock, all versions NULL pointer dereference (Eric Pruitt <eric.pruitt@...il.com>)
Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Willy Tarreau <w@....eu>)
Re: CVE request - slock, all versions NULL pointer dereference (cve-assign@...re.org)

August 19 (10 messages)

Re: CVE Requests Facebook HHVM (cve-assign@...re.org)
[CVE-2016-6582] Doorkeeper gem does not revoke tokens & uses wrong auth/auth method (Justin Bull <me@...tinbull.ca>)
Re: Re: CVE request - slock, all versions NULL pointer dereference (x ksi <s3810@...stk.edu.pl>)
CVE-2016-6327 | Linux kernel crash in infiniband subsystem. (Wade Mealing <wmealing@...hat.com>)
Re: CVE-2016-6327 | Linux kernel crash in infiniband subsystem. (Greg KH <greg@...ah.com>)
CVE Request: Qemu: net: vmxnet: integer overflow in packet initialisation (P J P <ppandit@...hat.com>)
Re: CVE request: MatrixSSL lack of RSA-CRT hardening (cve-assign@...re.org)
Re: CVE request: MatrixSSL lack of RSA-CRT hardening (cve-assign@...re.org)
Re: MatrixSSL Bignum bugs (cve-assign@...re.org)
Re: CVE Request: Qemu: net: vmxnet: integer overflow in packet initialisation (cve-assign@...re.org)

August 20 (4 messages)

Path traversal vulnerability in WordPress Core Ajax handlers (Summer of Pwnage <lists@...urify.nl>)
Path traversal vulnerability in WordPress Core Ajax handlers (Summer of Pwnage <lists@...urify.nl>)
memory issues in libksba 1.3.4 and git (Pascal Cuoq <cuoq@...st-in-soft.com>)
TLS testing results - OS distro vulnerabilities (Mauri Miettinen <Mauri.Miettinen@...dent.oulu.fi>)

August 22 (18 messages)

Re: TLS testing results - OS distro vulnerabilities (Kurt Seifried <kseifried@...hat.com>)
CVE request: Linux kernel mbcache lock contention denial of service. (Wade Mealing <wmealing@...hat.com>)
Re: Path traversal vulnerability in WordPress Core Ajax handlers (cve-assign@...re.org)
Re: CVE-2016-5404 freeipa: Insufficient privileges check in certificate revocation (Cedric Buissart <cbuissar@...hat.com>)
Re: TLS testing results - OS distro vulnerabilities (Jakub Wilk <jwilk@...lk.net>)
Re: memory issues in libksba 1.3.4 and git (Werner Koch <wk@...pg.org>)
Re: memory issues in libksba 1.3.4 and git (Solar Designer <solar@...nwall.com>)
Re: TLS testing results - OS distro vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: TLS testing results - OS distro vulnerabilities (Jani Kenttala <jkenttal@...oulu.fi>)
Re: memory issues in libksba 1.3.4 and git (Werner Koch <wk@...pg.org>)
Re: memory issues in libksba 1.3.4 and git (Solar Designer <solar@...nwall.com>)
CVE update (CVE-2016-5395) - Fixed in Apache Ranger 0.6.1 (Velmurugan Periasamy <vel@...che.org>)
Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Marcus Meissner <meissner@...e.de>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (cve-assign@...re.org)
CVE Request: lshell: shell outbreak vulnerabilities via bad syntax parse and multiline commands (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Greg KH <greg@...ah.com>)
Re: CVE Request: lshell: shell outbreak vulnerabilities via bad syntax parse and multiline commands (cve-assign@...re.org)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (cve-assign@...re.org)

August 23 (9 messages)

Re: CVE Request: libgd: Out-Of-Bounds Read in function read_image_tga of gd_tga.c (cve-assign@...re.org)
Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Willy Tarreau <w@....eu>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Greg KH <greg@...ah.com>)
Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (Kurt Seifried <kseifried@...hat.com>)
RE: [security-vendor] Re: Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices ("Radzykewycz, T (Radzy)" <radzy@...driver.com>)
Fuzzing jasper (Agostino Sarubbo <ago@...too.org>)
Re: CVE Request: Linux kernel crash of OHCI when plugging in malicious USB devices (cve-assign@...re.org)
Re: cracklib: Stack-based buffer overflow when parsing large GECOS field (Salvatore Bonaccorso <carnil@...ian.org>)
cve request: overlayfs: Fix dentry reference leak (CAI Qian <caiqian@...hat.com>)

August 24 (3 messages)

CVE request - sudoers on Red Hat, Fedora, Mageia information disclosure (Doran Moppert <dmoppert@...hat.com>)
CVE-2016-6319: Foreman stored XSS in form label helpers (Dominic Cleal <dominic@...al.org>)
CVE-2016-6320: Foreman stored XSS in network interface device identifiers (Dominic Cleal <dominic@...al.org>)

August 25 (5 messages)

WebKitGTK+ Security Advisory WSA-2016-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: CVE request - sudoers on Red Hat, Fedora, Mageia information disclosure (cve-assign@...re.org)
Re: cve request: overlayfs: Fix dentry reference leak (cve-assign@...re.org)
Re: CVE request: Linux kernel mbcache lock contention denial of service. (cve-assign@...re.org)
Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (Jordan Bettis <jordanb@...d.org>)

August 26 (4 messages)

CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit (Vladis Dronov <vdronov@...hat.com>)
Multiple vulnerabilities in RPM – and a rant (Hanno Böck <hanno@...eck.de>)
Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit (cve-assign@...re.org)
Re: Multiple vulnerabilities in RPM – and a rant (Kurt Seifried <kseifried@...hat.com>)

August 27 (2 messages)

CVE Request - Intelliants Subrion CMS Arbitrary Files Delete (曾鸿坤 <hongkun.zeng@...ppsecurity.com.cn>)
Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (cve-assign@...re.org)

August 28 (3 messages)

MantisBT weakened CSP when using bundled Gravatar plugin (Damien Regad <dregad@...tisbt.org>)
Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability ("Misra, Deapesh" <dmisra@...isign.com>)
Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (cve-assign@...re.org)

August 29 (3 messages)

Re: CVE request -- linux kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit (Vladis Dronov <vdronov@...hat.com>)
Re: MantisBT weakened CSP when using bundled Gravatar plugin (cve-assign@...re.org)
Re: Re: MantisBT weakened CSP when using bundled Gravatar plugin (Reed Loden <reed@...dloden.com>)

August 30 (3 messages)

CVE request: Qemu: 9p: directory traversal flaw in 9p virtio backend (P J P <ppandit@...hat.com>)
Re: CVE request: Qemu: 9p: directory traversal flaw in 9p virtio backend (P J P <ppandit@...hat.com>)
Re: CVE request: Qemu: 9p: directory traversal flaw in 9p virtio backend (cve-assign@...re.org)

August 31 (3 messages)

CVE request: Kernel Oops when issuing fcntl on an AUFS directory (Ben Hutchings <ben@...adent.org.uk>)
Re: MantisBT weakened CSP when using bundled Gravatar plugin (Damien Regad <dregad@...tisbt.org>)
Re: CVE request: Kernel Oops when issuing fcntl on an AUFS directory (cve-assign@...re.org)

184 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.