oss-security mailing list - 2016/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 3	² 9	³	⁴ 3
⁵ 11	⁶ 4	⁷ 9	⁸ 25	⁹ 11	¹⁰ 5	¹¹ 1
¹² 7	¹³ 12	¹⁴ 11	¹⁵ 12	¹⁶ 18	¹⁷ 4	¹⁸ 11
¹⁹ 19	²⁰ 4	²¹ 12	²² 7	²³ 9	²⁴ 1	²⁵ 3
²⁶ 15	²⁷ 9	²⁸ 14	²⁹ 28	³⁰ 10

Messages by day:

September 1 (3 messages)

cve request: docker swarm node Dos occurs when join a cluster failed using local CA certificate (张开翔 <zhangkaixiang@....cn>)
CVE Request: docker swarm node Dos occurs when join a cluster failed using local CA certificate (张开翔 <zhangkaixiang@....cn>)
Updated: XSS and SQLi in huge IT gallery v1.1.5 for Joomla ("Larry W. Cashdollar" <larry0@...com>)

September 2 (9 messages)

Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Diogo Mónica <diogo.monica@...ker.com>)
Re: Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Kurt Seifried <kseifried@...hat.com>)
Re: Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Diogo Monica <diogo.monica@...ker.com>)
Re: Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Kurt Seifried <kseifried@...hat.com>)
CVE assignment for PHP 5.6.25 and 7.0.10 (Lior Kaplan <kaplanlior@...il.com>)
Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities (Damien Miller <djm@...drot.org>)
Re: Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Diogo Mónica <diogo.monica@...ker.com>)
Re: Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Kurt Seifried <kseifried@...hat.com>)
Re: CVE assignment for PHP 5.6.25 and 7.0.10 - and libcurl (cve-assign@...re.org)

September 4 (3 messages)

Re: CVE ID Request: FOG Project Multiple Vulnerabilities (Henri Salo <henri@...v.fi>)
Re: CVE ID Request: FOG Project Multiple Vulnerabilities (Sysdream Labs <labs@...dream.com>)
CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis (anarcat@...ian.org (Antoine Beaupré))

September 5 (11 messages)

Re: [SECURITY VULNERABILITY] curl: Re-using connections with wrong client cert (Kamil Dudka <kdudka@...hat.com>)
Re: CVE request: Linux kernel mbcache lock contention denial of service. (Greg KH <greg@...ah.com>)
CVE request: Plone multiple vulnerabilities (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
Re: CVE request: Plone multiple vulnerabilities (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
Re: CVE request: Plone multiple vulnerabilities (cve-assign@...re.org)
Re: CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis (William Pitcock <nenolod@...eferenced.org>)
Re: [SECURITY VULNERABILITY] curl: Re-using connections with wrong client cert (cve-assign@...re.org)
Re: CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis (cve-assign@...re.org)
Re: CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis (cve-assign@...re.org)
Re: Re: cve request: docker swarmkit Dos occurs by repeatly joining and quitting swam cluster as a node (Diogo Mónica <diogo.monica@...ker.com>)
cve request: docker swarm node Dos occurs when join a cluster failed using local CA certificate (Diogo Mónica <diogo.monica@...ker.com>)

September 6 (4 messages)

Re: CVE request: Linux kernel mbcache lock contention denial of service. (Andreas Stieger <astieger@...e.com>)
CVE request: Qemu: scsi: pvscsi: OOB read and infinite loop while setting descriptor rings (P J P <ppandit@...hat.com>)
CVE request: Qemu: scsi: pvscsi: infintie loop when building SG list (P J P <ppandit@...hat.com>)
CVE Request Qemu: scsi: mptsas: invalid memory access while building configuration pages (P J P <ppandit@...hat.com>)

September 7 (9 messages)

Re: CVE request: Qemu: scsi: pvscsi: OOB read and infinite loop while setting descriptor rings (cve-assign@...re.org)
Re: CVE request: Qemu: scsi: pvscsi: infintie loop when building SG list (cve-assign@...re.org)
Re: CVE Request Qemu: scsi: mptsas: invalid memory access while building configuration pages (cve-assign@...re.org)
GraphicsMagick 1.3.25 fixes some security issues (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Re: CVE Request Qemu: scsi: mptsas: invalid memory access while building configuration pages (P J P <ppandit@...hat.com>)
[SECURITY ADVISORY] curl: Incorrect reuse of client certificates (Daniel Stenberg <daniel@...x.se>)
CVE Request - Portable UPnP SDK 1.6.19 through 1.8.x (Scott Tenaglia <scott.tenaglia@...incea.com>)
ADOdb PDO driver: incorrect quoting may allow SQL injection (Damien Regad <dregad@...tisbt.org>)
CVE Request: File Roller path traversal (Tyler Hicks <tyhicks@...onical.com>)

September 8 (25 messages)

CVE Request : Libtorrent 1.1.0 inflate_gzip denial of service (yi <yi@...i.me>)
CVE Request: OpenJPEG Heap Buffer Overflow Issue (winsonliu(刘科) <winsonliu@...cent.com>)
CVE Request: OpenJPEG Integer Overflow Issue (winsonliu(刘科) <winsonliu@...cent.com>)
Re: CVE Request: File Roller path traversal (cve-assign@...re.org)
Re: CVE Request: OpenJPEG Heap Buffer Overflow Issue (cve-assign@...re.org)
Re: CVE Request: OpenJPEG Integer Overflow Issue (cve-assign@...re.org)
Re: CVE Request : Libtorrent 1.1.0 inflate_gzip denial of service (cve-assign@...re.org)
Re: Re: CVE Request: OpenJPEG Heap Buffer Overflow Issue(Internet mail) (winsonliu(刘科) <winsonliu@...cent.com>)
Xen Security Advisory 185 (CVE-2016-7092) - x86: Disallow L3 recursive pagetable for 32-bit PV guests (Xen.org security team <security@....org>)
Xen Security Advisory 186 (CVE-2016-7093) - x86: Mishandling of instruction pointer truncation during emulation (Xen.org security team <security@....org>)
Xen Security Advisory 188 (CVE-2016-7154) - use after free in FIFO event channel code (Xen.org security team <security@....org>)
Xen Security Advisory 187 (CVE-2016-7094) - x86 HVM: Overflow of sh_ctxt->seg_reg[] (Xen.org security team <security@....org>)
CVE request - Samsumg Mobile Phone SVE-2016-6248: SystemUI Security issue (0xr0ot <0xr0ot.sec@...il.com>)
Fwd: [scr231911] SVE-2016-6248: SystemUI Security issue (0xr0ot <0xr0ot.sec@...il.com>)
CVE request: libarchive (pre 3.2.0) denial of service with gzip quine (Doran Moppert <dmoppert@...hat.com>)
CVE for Sentry / OpenCFP (Andreas Lindh <addelindh@...il.com>)
CVEs for public Kibana / logstash issues (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: libarchive (pre 3.2.0) denial of service with gzip quine (cve-assign@...re.org)
Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names (Summer of Pwnage <lists@...urify.nl>)
New security advisory for Apache CXF Fediz - CVE-2016-4464 (Colm O hEigeartaigh <coheigea@...che.org>)
CVE Request: Heap Overflow Portable UPnP SDK 1.6.19 through 1.8.x (Scott Tenaglia <scott.tenaglia@...incea.com>)
CVE request - Airmail URLScheme render and file:// xss vulnerability (redrain root <rootredrain@...il.com>)
multiple crashes in radare2/radiff2 (Vahagn Vardanyan <vvvaagn@...il.com>)
Re: Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names (cve-assign@...re.org)
Re: multiple crashes in radare2/radiff2 (Solar Designer <solar@...nwall.com>)

September 9 (11 messages)

CVE request for webp:index overflow,used by memcpy later (ChenQin <chenqin@...sec.com.cn>)
Fwd: multiple crashes in radare2/radiff2 (Vahagn Vardanyan <vvvaagn@...il.com>)
PowerDNS Security Advisory 2016-01: Crafted queries can cause unexpected backend load (Remi Gacogne <remi.gacogne@...erdns.com>)
CVE Request Qemu: vmware_vga: OOB stack memory access when processing svga command (P J P <ppandit@...hat.com>)
Re: GraphicsMagick 1.3.25 fixes some security issues (Agostino Sarubbo <ago@...too.org>)
ettercap: etterlog: multiple crashes (Agostino Sarubbo <ago@...too.org>)
Re: CVE Request Qemu: vmware_vga: OOB stack memory access when processing svga command (cve-assign@...re.org)
Re: CVE request for webp:index overflow,used by memcpy later (cve-assign@...re.org)
Re: GraphicsMagick 1.3.25 fixes some security issues (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: CVEs for public Kibana / logstash issues (Kurt Seifried <kseifried@...hat.com>)
Re: ettercap: etterlog: multiple crashes (cve-assign@...re.org)

September 10 (5 messages)

Re: multiple crashes in radare2/radiff2 (Tavis Ormandy <taviso@...gle.com>)
autotrace: out-of-bounds write (Agostino Sarubbo <ago@...too.org>)
Re: autotrace: out-of-bounds write (cve-assign@...re.org)
libav: out-of-bounds stack read (Agostino Sarubbo <ago@...too.org>)
Re: libav: out-of-bounds stack read (cve-assign@...re.org)

September 11 (1 message)

Possible CVE request for Redis docker container (Kurt Seifried <kseifried@...hat.com>)

September 12 (7 messages)

CVE Request: XSS vulns in b2evolution v6.7.5 (陈瑞琦 <chenruiqi@....cn>)
nfsd-ganesha allows anyone to call into DBUS? (Sebastian Krahmer <krahmer@...e.com>)
CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Dawid Golunski <dawid@...alhackers.com>)
Re: CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Solar Designer <solar@...nwall.com>)
Re: CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Dawid Golunski <dawid@...alhackers.com>)
Re: CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (Fried Wil <wilfried.pascault@...il.com>)
Re: autotrace: out-of-bounds write (Brian May <brian@...uxpenguins.xyz>)

September 13 (12 messages)

Re: CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day ) (HW42 <hw42@...umj.de>)
CVE-2016-6299 mock: privilige escalation via mock-scm (Martin Prpic <mprpic@...hat.com>)
[ANNOUNCE][CVE-2016-6802] Apache Shiro 1.3.2 released (Brian Demers <bdemers@...che.org>)
Heapoverflow in giflib5.1.4 (vul@...safe <vul@...safe.com>)
CVE request -libdwarf 20160613 heap-buffer-overflow (vul@...safe <vul@...safe.com>)
Re: Heapoverflow in giflib5.1.4 (Hanno Böck <hanno@...eck.de>)
Re: Heapoverflow in giflib5.1.4 (Solar Designer <solar@...nwall.com>)
libxml with CGI fix (watashiwaher <watashiwaher@...il.com>)
Re: Heapoverflow in giflib5.1.4 (Seth Arnold <seth.arnold@...onical.com>)
Re: Heapoverflow in giflib5.1.4 (Hanno Böck <hanno@...eck.de>)
Re: libxml with CGI fix (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Heapoverflow in giflib5.1.4 (Seth Arnold <seth.arnold@...onical.com>)

September 14 (11 messages)

[SECURITY VULNERABILITY] curl escape and unescape integer overflows (Daniel Stenberg <daniel@...x.se>)
Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Damien Regad <dregad@...tisbt.org>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Andreas Stieger <astieger@...e.com>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Anonymous <dregad@...tisbt.org>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Moritz Muehlenhoff <jmm@...ian.org>)
CVE-2016-6801: CSRF in Jackrabbit-Webdav using empty content-type (Julian Reschke <reschke@...che.org>)
CVE request for Dropbear SSH <2016.74 (Matt Johnston <matt@....asn.au>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Kurt Seifried <kseifried@...hat.com>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Jeremy Stanley <fungi@...goth.org>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Seth Arnold <seth.arnold@...onical.com>)
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Kurt Seifried <kseifried@...hat.com>)

September 15 (12 messages)

Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (cve-assign@...re.org)
Re: CVE request for Dropbear SSH <2016.74 (cve-assign@...re.org)
Re: CVE request -libdwarf 20160613 heap-buffer-overflow (cve-assign@...re.org)
Re: CVE Request: XSS vulns in b2evolution v6.7.5 (cve-assign@...re.org)
Re: ADOdb PDO driver: incorrect quoting may allow SQL injection (Damien Regad <dregad@...tisbt.org>)
CVE assignment for PHP 5.6.26 and 7.0.11 (Lior Kaplan <kaplanlior@...il.com>)
CVE-2016-6519: openstack-manila: Persistent XSS in Metadata field (Marcus Meissner <meissner@...e.de>)
Libarchive/bsdtar: multiple crashes (Agostino Sarubbo <ago@...too.org>)
Re: CVE request -libdwarf 20160613 heap-buffer-overflow (Agostino Sarubbo <ago@...too.org>)
Re: CVE assignment for PHP 5.6.26 and 7.0.11 (cve-assign@...re.org)
Does a documentation bug elevate to CVE status? (Jeffrey Walton <noloader@...il.com>)
Re: Does a documentation bug elevate to CVE status? - Crypto++ (cve-assign@...re.org)

September 16 (18 messages)

Re: Does a documentation bug elevate to CVE status? - Crypto++ (Jeffrey Walton <noloader@...il.com>)
Re: Libarchive/bsdtar: multiple crashes (Gulshan Singh <gsingh2011@...il.com>)
CVE Request: Qemu: scsi: pvscsi: infinite loop when processing IO requests (P J P <ppandit@...hat.com>)
CVE request Qemu: virtio: null pointer dereference in virtqueu_map_desc (P J P <ppandit@...hat.com>)
CVE request Qemu: scsi: mptsas: OOB access when freeing MPTSASRequest object (P J P <ppandit@...hat.com>)
Out of bounds heap bugs in glib, heap buffer overflow in gnome-session (Hanno Böck <hanno@...eck.de>)
Fwd: CVE-2016-7420 and dev-brach 'trap' ready for testing (Jeffrey Walton <noloader@...il.com>)
CVE-2016-0634 -- bash prompt expanding $HOSTNAME (John Haxby <john.haxby@...cle.com>)
Re: CVE Request: Qemu: scsi: pvscsi: infinite loop when processing IO requests (cve-assign@...re.org)
Re: CVE request Qemu: virtio: null pointer dereference in virtqueu_map_desc (cve-assign@...re.org)
Re: CVE request Qemu: scsi: mptsas: OOB access when freeing MPTSASRequest object (cve-assign@...re.org)
Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Jan Schaumann <jschauma@...meister.org>)
[SECURITY] CVE-2016-5017: Buffer overflow vulnerability in ZooKeeper C cli shell (Flavio Junqueira <fpj@...che.org>)
Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Chet Ramey <chet.ramey@...e.edu>)
linux kernel SCSI arcmsr driver: buffer overflow in arcmsr_iop_message_xfer() (Marco Grassi <marco.gra@...il.com>)
Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Chet Ramey <chet.ramey@...e.edu>)
libav: NULL pointer dereference in put_no_rnd_pixels8_xy2_mmx (rnd_template.c) (Agostino Sarubbo <ago@...too.org>)
Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Chet Ramey <chet.ramey@...e.edu>)

September 17 (4 messages)

Re: libav: NULL pointer dereference in put_no_rnd_pixels8_xy2_mmx (rnd_template.c) (cve-assign@...re.org)
Re: linux kernel SCSI arcmsr driver: buffer overflow in arcmsr_iop_message_xfer() (cve-assign@...re.org)
[SECURITY] CVE-2016-5017: Buffer overflow vulnerability in ZooKeeper C cli shell (Flavio Junqueira <fpj@...che.org>)
Re: Re: libav: NULL pointer dereference in put_no_rnd_pixels8_xy2_mmx (rnd_template.c) (Agostino Sarubbo <ago@...too.org>)

September 18 (11 messages)

CVE request：Exponent CMS 2.3.9 SQL injection vulnerability (felix k3y <felixk3y@...il.com>)
CVE request：Exponent CMS 2.3.9 SQL injection vulnerabilities (felix k3y <felixk3y@...il.com>)
CVE Request: GnuTLS: OCSP validation issue (GNUTLS-SA-2016-3) (Salvatore Bonaccorso <carnil@...ian.org>)
CVE request - openjpeg null ptr dereference (vul@...safe <vul@...safe.com>)
Re: CVE request - openjpeg null ptr dereference (Robert Święcki <robert@...ecki.net>)
Re: CVE request - openjpeg null ptr dereference (cve-assign@...re.org)
Re: CVE Request: GnuTLS: OCSP validation issue (GNUTLS-SA-2016-3) (cve-assign@...re.org)
Re: GraphicsMagick 1.3.25 fixes some security issues (cve-assign@...re.org)
Re: CVE request : Exponent CMS 2.3.9 SQL injection vulnerability (cve-assign@...re.org)
Re: CVE request : Exponent CMS 2.3.9 SQL injection vulnerabilities (cve-assign@...re.org)
Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (John Haxby <john.haxby@...cle.com>)

September 19 (19 messages)

CVE Request: Multiple security issues in OpenJPEG (winsonliu(刘科) <winsonliu@...cent.com>)
Re: Libarchive/bsdtar: multiple crashes (Agostino Sarubbo <ago@...too.org>)
Exponent CMS 2.3.9 SQL injection vulnerabilities (east wu <ylgaaaaa@...il.com>)
Exponent CMS 2.3.9 SQL injection vulnerabilities (王禹哲 <0xtom4to@...il.com>)
CVE request - Exponent CMS 2.3.9 SQL injection (王禹哲 <0xtom4to@...il.com>)
Fwd: CVE-2016-7420 (Info Disclosure due to assert), Crypto++ and down level remediation (Jeffrey Walton <noloader@...il.com>)
Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Seth Arnold <seth.arnold@...onical.com>)
CVE Request Qemu: usb: xhci memory leakage during device unplug (P J P <ppandit@...hat.com>)
CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Mike Santillana <michael.santillana@...ork.com>)
Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Mike Santillana <michael.santillana@...ork.com>)
Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Brandon Perry <bperry.volatile@...il.com>)
Possible CVE for TLS protocol issue (Kurt Seifried <kseifried@...hat.com>)
Re: Possible CVE for TLS protocol issue (Reed Loden <reed@...dloden.com>)
Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Reed Loden <reed@...dloden.com>)
Re: Re: ezmlm warning (Reed Loden <reed@...dloden.com>)
Re: Re: ezmlm warning (Solar Designer <solar@...nwall.com>)
Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Mike Santillana <michael.santillana@...ork.com>)
Re: ezmlm warning (Brad Knowles <brad@...b-internet.org>)

September 20 (4 messages)

Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (John Haxby <john.haxby@...cle.com>)
libav: NULL pointer dereference in ff_put_pixels8_xy2_mmx (rnd_template.c) (Agostino Sarubbo <ago@...too.org>)
Re: CVE Request Qemu: usb: xhci memory leakage during device unplug (cve-assign@...re.org)
Re: Possible CVE for TLS protocol issue (cve-assign@...re.org)

September 21 (12 messages)

CVE request for vulnerability in OpenStack Nova (Tristan Cacqueray <tdecacqu@...hat.com>)
CVE request：Exponent CMS 2.3.9 xss vulnerability in worldpay (Carl Peng <felixk3y@...il.com>)
CVE request：Exponent CMS 2.3.9 Arbitrary File Upload vulnerability in expFile.php (Carl Peng <felixk3y@...il.com>)
CVE request：Exponent CMS 2.3.9 Unrestricted File Upload RCE and Local File include vulnerability ("DM_" <contact@...ay.me>)
CVE request - mujs Heap-Buffer-Overflow write and OOB Read (Puzzor <puzzorsj@...il.com>)
Re: libav: NULL pointer dereference in ff_put_pixels8_xy2_mmx (rnd_template.c) (cve-assign@...re.org)
libav: divide-by-zero in sbr_make_f_master (aacsbr.c) (Agostino Sarubbo <ago@...too.org>)
Re: CVE request for vulnerability in OpenStack Nova (cve-assign@...re.org)
Re: libav: divide-by-zero in sbr_make_f_master (aacsbr.c) (cve-assign@...re.org)
Re: CVE Request: ipywidgets executes untrusted JavaScript (Jamie Whitacre <whitacre@...keley.edu>)
Irssi Security Advisory CVE-2016-7044+CVE-2016-7045 ("A.N." <ailin@...io.us>)
Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla ("Larry W. Cashdollar" <larry0@...com>)

September 22 (7 messages)

CVE Request: XSS Vulnerability in Exponent CMS 2.3.9 (王畅 <fyth.cnss@...il.com>)
Re: CVE Requests: Various ImageMagick issues (as reported in the Debian BTS) (cve-assign@...re.org)
CVE Request: VLC: Potential divide-by-zero issue (ajax secure <ajax4sec@...mail.com>)
kernel: ACPI table override is allowed when securelevel is enabled (Vladis Dronov <vdronov@...hat.com>)
Re: CVE Request: VLC: Potential divide-by-zero issue (Moritz Muehlenhoff <jmm@...ian.org>)
CVE Request - Exponent CMS 2.3.9 multi-vulnerabilities in install code (Carl Peng <felixk3y@...il.com>)
mupdf: use-after-free in pdf_to_num (pdf-object.c) (Agostino Sarubbo <ago@...too.org>)

September 23 (9 messages)

[OSSA 2016-011] Nova may fail to delete images in resize state regression (CVE-2016-7498) (Tristan Cacqueray <tdecacqu@...hat.com>)
Unauthenticated SQL Injection in Huge-IT Portfolio Gallery ("Larry W. Cashdollar" <larry0@...com>)
Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla ("Larry W. Cashdollar" <larry0@...com>)
[CVE-2016-4978] Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability (Martyn Taylor <mtaylor@...hat.com>)
CVE Assignment for Crypto++ and "AES and incorrect argument to _freea() under Microsoft compilers" (Jeffrey Walton <noloader@...il.com>)
CVE request Qemu: hw: net: Fix a heap overflow in xlnx.xps-ethernetlite (Hu Chaojian <chaojianhu@...mail.com>)
CVEs for vulnerabilities listed in MySQL 5.6.33 release note (Thomas Deutschmann <whissi@...too.org>)
Re: CVE request Qemu: hw: net: Fix a heap overflow in xlnx.xps-ethernetlite (cve-assign@...re.org)
Re: CVE Assignment for Crypto++ and "AES and incorrect argument to _freea() under Microsoft compilers" (cve-assign@...re.org)

September 24 (1 message)

CVE Request: irssi: information disclosure vulnerabilit in buf.pl (Salvatore Bonaccorso <carnil@...ian.org>)

September 25 (3 messages)

CVE-2016-7545 -- SELinux sandbox escape (up201407890@...nos.dcc.fc.up.pt)
ffmpeg afl bugs (cookieopfer@....net)
Re: ffmpeg afl bugs (Solar Designer <solar@...nwall.com>)

September 26 (15 messages)

Re: ffmpeg afl bugs (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Re: ffmpeg afl bugs (cookieopfer@....net)
CVE-2016-6823 - ImageMagick BMP Coder Out-Of-Bounds Write Vulnerability (pwchen(陈佩文) <pwchen@...cent.com>)
Re: CVE Request: irssi: information disclosure vulnerabilit in buf.pl (cve-assign@...re.org)
Re: ffmpeg afl bugs (cve-assign@...re.org)
[CVE-2016-6881] ffmpeg endless loop when dealing with craft swf file. (连一汉 <lianyihan@....cn>)
Re: Re: ffmpeg afl bugs (Hanno Böck <hanno@...eck.de>)
CVE-2016-7101 - ImageMagick SGI Coder Out-Of-Bounds Read Vulnerability (pwchen(陈佩文) <pwchen@...cent.com>)
CVE-2016-7543 -- bash SHELLOPTS+PS4 (up201407890@...nos.dcc.fc.up.pt)
Re: CVE-2016-7545 -- SELinux sandbox escape (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2016-7545 -- SELinux sandbox escape (John Haxby <john.haxby@...cle.com>)
Re: Re: ffmpeg afl bugs (cookieopfer@....net)
Re: CVE-2016-7545 -- SELinux sandbox escape (up201407890@...nos.dcc.fc.up.pt)
Re: CVE-2016-7545 -- SELinux sandbox escape (christos@...las.com (Christos Zoulas))
[ANNOUNCE] Django security releases issued: 1.9.10 and 1.8.15 (Tim Graham <timograham@...il.com>)

September 27 (9 messages)

openjpeg CVE-2016-3181, CVE-2016-3182 .. and CVE-2013-6045 (Doran Moppert <dmoppert@...hat.com>)
Re: CVE-2016-7543 -- bash SHELLOPTS+PS4 (Tavis Ormandy <taviso@...xchg8b.com>)
CVE Request: libgd: Integer overflow in function gdImageWebpCtx of gd_webp.c (winsonliu(刘科) <winsonliu@...cent.com>)
CVE Request - OpenSLP 2.0 Memory Corruption (Reno Robert <renorobert@...il.com>)
ImageMagick identify "d:" hangs (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: ImageMagick identify "d:" hangs (Jakub Wilk <jwilk@...lk.net>)
Re: ImageMagick identify "d:" hangs (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
BIND9 CVE-2016-2776: Assertion Failure in buffer.c While Building Responses to a Specifically Constructed Request (ISC Security Officer <security-officer@....o…)
Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Leo Famulari <leo@...ulari.name>)

September 28 (14 messages)

Re: CVE Request - OpenSLP 2.0 Memory Corruption (cve-assign@...re.org)
CVE Request: docker2aci: Path traversals present in image converting (张开翔 <zhangkaixiang@....cn>)
Re: CVE Request - OpenSLP 2.0 Memory Corruption (jericho <jericho@...rition.org>)
Re: CVE Request: docker2aci: Path traversals present in image converting (Alex Crawford <alex.crawford@...eos.com>)
Re: CVE Request - OpenSLP 2.0 Memory Corruption (cve-assign@...re.org)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)
Re: CVE Request: libgd: Integer overflow in function gdImageWebpCtx of gd_webp.c (cve-assign@...re.org)
Re: CVE Request: docker2aci: Path traversals present in image converting (cve-assign@...re.org)
CVE Request: systemd v209+: local denial-of-service attack (Andrew Ayer <agwa@...rewayer.name>)
CVE Requests for Drupal Core - SA-CORE-2016-004 (Pere Orga <pere@...a.cat>)
Re: CVE request - mujs Heap-Buffer-Overflow write and OOB Read (cve-assign@...re.org)
Re: CVE Requests for Drupal Core - SA-CORE-2016-004 (cve-assign@...re.org)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)
Re: ImageMagick identify "d:" hangs (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)

September 29 (28 messages)

Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)
kdesu vulnerability: need CVE (Albert Astals Cid <aacid@....org>)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)
Re: ImageMagick identify "d:" hangs (Florian Weimer <fw@...eb.enyo.de>)
Re: ImageMagick identify "d:" hangs (Florian Weimer <fw@...eb.enyo.de>)
Re: CVE-2016-7545 -- SELinux sandbox escape (Jakub Wilk <jwilk@...lk.net>)
Re: kdesu vulnerability: need CVE (cve-assign@...re.org)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)
Re: CVE-2016-7545 -- SELinux sandbox escape (christos@...las.com (Christos Zoulas))
CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (张谦 <zhangqian-c@....cn>)
Re: CVE Request - Exponent CMS 2.3.9 multi-vulnerabilities in install code (cve-assign@...re.org)
Re: CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (Greg KH <greg@...ah.com>)
[SECURITY ADVISORY] c-ares: single byte out of buffer write (Daniel Stenberg <daniel@...x.se>)
Re: CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (Quentin Casasnovas <quentin.casasnovas@…)
Re: CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (Mario Pirker <mpirker@...ux.com>)
Re: CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (Vitaly Nikolenko <vnik5287@...il.com>)
Re: [SECURITY ADVISORY] c-ares: single byte out of buffer write (Daniel Stenberg <daniel@...x.se>)
Re: CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (Greg KH <greg@...ah.com>)
Re: [SECURITY ADVISORY] c-ares: single byte out of buffer write (Hanno Böck <hanno@...eck.de>)
git-hub: missing sanitization of data received from GitHub (Jakub Wilk <jwilk@...lk.net>)
CVE-2016-5019: MyFaces Trinidad view state deserialization security vulnerability (Mike Kienenberger <mkienenb@...il.com>)
[ANNOUNCE][CVE-2016-5019] Apache MyFaces Trinidad 2.1.2 released (Mike Kienenberger <mkienenb@...il.com>)
[ANNOUNCE][CVE-2016-5019] Apache MyFaces Trinidad 1.2.15 released (Mike Kienenberger <mkienenb@...il.com>)
[ANNOUNCE][CVE-2016-5019] Apache MyFaces Trinidad 2.0.2 released (Mike Kienenberger <mkienenb@...il.com>)
Re: CVE-2016-5019: MyFaces Trinidad view state deserialization security vulnerability (Mike Kienenberger <mkienenb@...il.com>)
Systemd local denial of service (Mark Hatle <mark.hatle@...driver.com>)
Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (Chet Ramey <chet.ramey@...e.edu>)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)

September 30 (10 messages)

Re: CVE Request: systemd v209+: local denial-of-service attack (cve-assign@...re.org)
Re: git-hub: missing sanitization of data received from GitHub (cve-assign@...re.org)
CVE request: b2evolution 6.7.6 Object Injection vulnerability (Carl Peng <felixk3y@...il.com>)
CVE Request: File Upload & File Delete lead to Unauthorized RCE in Exponent CMS 2.3.9 (fyth <fyth.cnss@...il.com>)
CVE request: ExponentCMS 2.x Object Injection and SQLi vulnerabilities (Carl Peng <felixk3y@...il.com>)
Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode (Mike Santillana <michael.santillana@...ork.com>)
CVE request: pacemaker DoS when pacemaker remote is in use (Cedric Buissart <cbuissar@...hat.com>)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)
Re: ImageMagick identify "d:" hangs (Florian Weimer <fw@...eb.enyo.de>)
Re: ImageMagick identify "d:" hangs (Tavis Ormandy <taviso@...gle.com>)

287 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.