oss-security mailing list - 2017/01

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2017/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 12
² 5	³ 3	⁴ 2	⁵ 4	⁶ 6	⁷ 6	⁸ 6
⁹ 1	¹⁰ 9	¹¹ 12	¹² 10	¹³ 14	¹⁴ 6	¹⁵ 4
¹⁶ 6	¹⁷ 19	¹⁸ 11	¹⁹ 6	²⁰ 17	²¹ 7	²² 2
²³ 4	²⁴ 12	²⁵ 18	²⁶ 4	²⁷ 7	²⁸ 9	²⁹ 8
³⁰ 4	³¹ 18

Messages by day:

January 1 (12 messages)

Re: CVE Request: UnRTF: stack-based buffer overflows in cmd_* functions (Salvatore Bonaccorso <carnil@...ian.org>)
libtiff: multilple crashes (Agostino Sarubbo <ago@...too.org>)
libtiff: multiple divide-by-zero (Agostino Sarubbo <ago@...too.org>)
libtiff: multiple heap-based buffer overflow (Agostino Sarubbo <ago@...too.org>)
libtiff: invalid memory READ in t2p_writeproc (tiff2pdf.c) (Agostino Sarubbo <ago@...too.org>)
libtiff: memcpy-param-overlap in t2p_tile_collapse_left (tiff2pdf.c) (Agostino Sarubbo <ago@...too.org>)
libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c) (Agostino Sarubbo <ago@...too.org>)
libtiff: assertion failure in readSeparateTilesIntoBuffer (tiffcp.c) (Agostino Sarubbo <ago@...too.org>)
libtiff: NULL pointer dereference in TIFFReadRawData (tiffinfo.c) (Agostino Sarubbo <ago@...too.org>)
Re: libtiff: multiple heap-based buffer overflow (<cve-assign@...re.org>)
Re: libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c) (<cve-assign@...re.org>)
Re: Re: libtiff: multiple heap-based buffer overflow (Agostino Sarubbo <ago@...too.org>)

January 2 (5 messages)

Multiple issues in OpenH264 1.5.1 (Brandon Perry <bperry.volatile@...il.com>)
Re: Multiple issues in OpenH264 1.5.1 (Brandon Perry <bperry.volatile@...il.com>)
Re: libtiff: multiple divide-by-zero (Leo Famulari <leo@...ulari.name>)
Re: libtiff: multiple divide-by-zero (Henri Salo <henri@...v.fi>)
freeIPA CVEs CVE-2016-9575 (insufficient permission check) & CVE-2016-7030 (DoS) (Cedric Buissart <cbuissar@...hat.com>)

January 3 (3 messages)

Re: Nagios Core < 4.2.4 Root Privilege Escalation [CVE-2016-9566] (Sebastian Krahmer <krahmer@...e.com>)
CVE Request: pcsc-lite use-after-free and double-free (Peter Wu <peter@...ensteyn.nl>)
Re: CVE Request: pcsc-lite use-after-free and double-free (<cve-assign@...re.org>)

January 4 (2 messages)

Firejail local root exploit (Sebastian Krahmer <krahmer@...e.com>)
Re: Firejail local root exploit (<cve-assign@...re.org>)

January 5 (4 messages)

Re: Firejail local root exploit (KellerFuchs <KellerFuchs@...hbang.sh>)
CVE Request: Irssi Multiple Vulnerabilities (2017/01) (Ailin Nemui <ailin.nemui@...il.com>)
[SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure (Mark Thomas <markt@...che.org>)
Re: Re: Firejail local root exploit (Martin Carpenter <mcarpenter@...e.fr>)

January 6 (6 messages)

Re: CVE Request: Irssi Multiple Vulnerabilities (2017/01) (<cve-assign@...re.org>)
Re: Firejail local root exploit (<cve-assign@...re.org>)
Re: Re: Firejail local root exploit (Marcus Meissner <meissner@...e.de>)
Re: Firejail local root exploit (<cve-assign@...re.org>)
Re: Re: Firejail local root exploit (sivmu <sivmu@....de>)
Re: Re: Firejail local root exploit (Lizzie Dixon <_@...zie.io>)

January 7 (6 messages)

Re: CVE Request: Plone Multiple Vulnerabilities (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
CVE Request: Plone Multiple Vulnerabilities (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
Re: Re: Firejail local root exploit (Martin Carpenter <mcarpenter@...e.fr>)
Re: Re: Firejail local root exploit (Martin Carpenter <mcarpenter@...e.fr>)
Re: Firejail local root exploit (<cve-assign@...re.org>)
Re: Firejail local root exploit (<cve-assign@...re.org>)

January 8 (6 messages)

CVE Request: icoutils: exploitable crash in wrestool programm (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: Firejail local root exploit (Martin Carpenter <mcarpenter@...e.fr>)
Re: Re: Firejail local root exploit (Simon McVittie <smcv@...ian.org>)
Re: Re: Firejail local root exploit (Brad Spengler <spender@...ecurity.net>)
Re: CVE Request: icoutils: exploitable crash in wrestool programm (<cve-assign@...re.org>)
Re: Re: Firejail local root exploit (Martin Carpenter <martin.carpenter@...il.com>)

January 9 (1 message)

Re: [Security] Qt QXmlSimpleReader (Thiago Macieira <thiago@...ieira.org>)

January 10 (9 messages)

ark vulnerability: need CVE (Albert Astals Cid <aacid@....org>)
Re: ark vulnerability: need CVE (<cve-assign@...re.org>)
[SECURITY] CVE-2016-3086: Apache Hadoop YARN NodeManager vulnerability (Akira Ajisaka <aajisaka@...che.org>)
Re: Re: CVE Request: icoutils: exploitable crash in wrestool programm (Salvatore Bonaccorso <carnil@...ian.org>)
CVE Request: two security fixes in libgit2 0.25.1, 0.24.6 (Andreas Stieger <astieger@...e.com>)
CVE request: python-pysaml2 XML external entity attack (Sébastien Delafond <seb@...ian.org>)
CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8 (Andreas Stieger <astieger@...e.com>)
CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL) (Cesar Pereida Garcia <cesar.pereidagarcia@....fi>)
Re: CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL) (Dan McDonald <danmcd@...iti.com>)

January 11 (12 messages)

Docker 1.12.6 - Security Advisory (Nathan McCauley <nathan.mccauley@...ker.com>)
Re: Docker 1.12.6 - Security Advisory (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: icoutils: exploitable crash in wrestool programm (<cve-assign@...re.org>)
Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8 (<cve-assign@...re.org>)
Re: CVE request: python-pysaml2 XML external entity attack (<cve-assign@...re.org>)
Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6 (<cve-assign@...re.org>)
Re: Re: CVE request: python-pysaml2 XML external entity attack (Doran Moppert <dmoppert@...hat.com>)
Re: Docker 1.12.6 - Security Advisory (Andreas Stieger <astieger@...e.com>)
Re: Docker 1.12.6 - Security Advisory (Trevor Jay <tjay@...hat.com>)
Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6 (Carlos Martín Nieto <cmn@...m.me>)
[CVE-2016-3403] [Zimbra] Multiple CSRF in Administration interface - all versions (Sysdream Labs <labs@...dream.com>)
Introducing sodium_compat, a PHP polyfill for libsodium (Scott Arciszewski <scott@...agonie.com>)

January 12 (10 messages)

Four BIND vulnerabilities have been disclosed today (11 January) that are fixed in new security releases (ISC Security Officer <security-officer@....org>)
ikiwiki: CVE-2017-0356: Authentication bypass via repeated parameters (Simon McVittie <smcv@...ian.org>)
Re: CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL) (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data" (Salvatore Bonaccorso <carnil@...ian.org>)
invalid free in GNU ed before 1.14.1 (Hanno Böck <hanno@...eck.de>)
Re: invalid free in GNU ed before 1.14.1 (Florian Weimer <fweimer@...hat.com>)
Re: invalid free in GNU ed before 1.14.1 (Hanno Böck <hanno@...eck.de>)
CVE Request: Irssi out of bounds read in format string (Ailin Nemui <ailin.nemui@...il.com>)
CVE Request: MUJS null pointer dereference and Heap buffer overflow write (Dileep Kumar <dileep.chinu@...il.com>)
Re: CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL) (Casper Thomsen <ct@...arhaus.com>)

January 13 (14 messages)

Re: CVE Request: MUJS null pointer dereference and Heap buffer overflow write (<cve-assign@...re.org>)
Re: CVE Request: Irssi out of bounds read in format string (<cve-assign@...re.org>)
Re: invalid free in GNU ed before 1.14.1 (<cve-assign@...re.org>)
Re: CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data" (<cve-assign@...re.org>)
Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Dawid Golunski <dawid@...alhackers.com>)
linux-distros subscription (Michal Hrusecky <Michal.Hrusecky@....cz>)
CVE-2017-2584 Kernel: kvm: use after free in complete_emulated_mmio (P J P <ppandit@...hat.com>)
Re: Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: Re: Fuzzing jasper (Tomas Hoger <thoger@...hat.com>)
Re: Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Thomas Deutschmann <whissi@...too.org>)
CVE-2017-0357: iucode-tool (v1.4 to v2.1): heap buffer overflow on -tr loader (Henrique de Moraes Holschuh <hmh@....eng.br>)
Re: Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE] (Thomas Deutschmann <whissi@...too.org>)

January 14 (6 messages)

CVE Request: Wordpress: 8 security issues in 4.7 (Craig Small <csmall@...ian.org>)
Duplicates of CVE-2015-8789 CVE-2015-8790 for libebml from TALOS reports? (Salvatore Bonaccorso <carnil@...ian.org>)
[CVE-2016-6814] Apache Groovy Information Disclosure (Paul King <paulk@...che.org>)
Re: [Security] Qt QXmlSimpleReader (Solar Designer <solar@...nwall.com>)
Re: [Security] Qt QXmlSimpleReader (Thiago Macieira <thiago@...ieira.org>)
Re: CVE Request: Wordpress: 8 security issues in 4.7 (<cve-assign@...re.org>)

January 15 (4 messages)

Re: linux-distros subscription (Solar Designer <solar@...nwall.com>)
PowerDNS Security Advisories 2016-02, 2016-03, 2016-04 and 2016-05 (Remi Gacogne <remi.gacogne@...erdns.com>)
Re: linux-distros subscription (Kurt Seifried <kseifried@...hat.com>)
Re: linux-distros subscription (Solar Designer <solar@...nwall.com>)

January 16 (6 messages)

CVE-2016-7904: CMS Made Simple <= 2.1.5 CSRF ("Hongkun Zeng" <hongkun.zeng@...ppsecurity.com.cn>)
jasper: multiple crashes with UBSAN (Agostino Sarubbo <ago@...too.org>)
jasper: invalid memory write in dec_clnpass (jpc_t1dec.c) (Agostino Sarubbo <ago@...too.org>)
jasper: invalid memory read in jpc_undo_roi (jpc_dec.c) (Agostino Sarubbo <ago@...too.org>)
jasper: invalid memory read in jas_matrix_asl (jas_seq.c) (Agostino Sarubbo <ago@...too.org>)
CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-on… (Salvatore Bonaccorso <carnil@...ian.org…)

January 17 (19 messages)

Re: jasper: multiple crashes with UBSAN (<cve-assign@...re.org>)
Re: jasper: invalid memory write in dec_clnpass (jpc_t1dec.c) (<cve-assign@...re.org>)
Re: jasper: invalid memory read in jpc_undo_roi (jpc_dec.c) (<cve-assign@...re.org>)
Re: jasper: invalid memory read in jas_matrix_asl (jas_seq.c) (<cve-assign@...re.org>)
Re: CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors (<cve-assign@...re.org>)
Re: Re: jasper: multiple crashes with UBSAN (Agostino Sarubbo <ago@...too.org>)
Re: Re: jasper: invalid memory read in jas_matrix_asl (jas_seq.c) (Agostino Sarubbo <ago@...too.org>)
Re: Re: jasper: invalid memory read in jpc_undo_roi (jpc_dec.c) (Agostino Sarubbo <ago@...too.org>)
Re: Re: jasper: invalid memory write in dec_clnpass (jpc_t1dec.c) (Agostino Sarubbo <ago@...too.org>)
Re: Re: jasper: invalid memory write in dec_clnpass (jpc_t1dec.c) (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Re: jasper: invalid memory write in dec_clnpass (jpc_t1dec.c) (Agostino Sarubbo <ago@...too.org>)
CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem (P J P <ppandit@...hat.com>)
CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm (Vladis Dronov <vdronov@...hat.com>)
Re: CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem (Greg Kurz <groug@...d.org>)
Re: CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm (Lokesh Ubuntu <lokesh.ubuntu@...il.com>)
CVE Request: Plone Sandbox escape vulnerability (Nathan Van Gheem <nathan.van.gheem@...ne.org>)
CVE Request: php-gettext: Arbitrary code execution in select_string, ngettext and npgettext count parameter (Salvatore Bonaccorso <carnil@...ian.org>)
WebKitGTK+ Security Advisory WSA-2017-0001 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE request Qemu: audio: memory leakage in ac97 device (P J P <ppandit@...hat.com>)

January 18 (11 messages)

CVE request Qemu: audio: memory leakage in es1370 device (P J P <ppandit@...hat.com>)
Re: jasper: multiple crashes with UBSAN (<cve-assign@...re.org>)
Re: CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm (<cve-assign@...re.org>)
Re: CVE Request: php-gettext: Arbitrary code execution in select_string, ngettext and npgettext count parameter (<cve-assign@...re.org>)
CVE-2017-2591 389 Directory Server: DoS via OOB heap read in "attribute uniqueness" plugin (Cedric Buissart <cbuissar@...hat.com>)
Re: CVE Request: Plone Sandbox escape vulnerability (<cve-assign@...re.org>)
Re: CVE request Qemu: audio: memory leakage in ac97 device (<cve-assign@...re.org>)
Re: CVE request Qemu: audio: memory leakage in es1370 device (<cve-assign@...re.org>)
Re: linux-distros subscription (Michal Hrusecky <Michal.Hrusecky@....cz>)
CVE request Kernel: kvm: use-after-free issue while creating devices (P J P <ppandit@...hat.com>)
CVE request Weblate: information disclosure in password reset form (Jelle van der Waa <jelle@...aa.nl>)

January 19 (6 messages)

Re: Re: CVE request: python-pysaml2 XML external entity attack (Doran Moppert <dmoppert@...hat.com>)
CVE-2017-2583 Kernel: Kvm: vmx/svm potential privilege escalation inside guest (P J P <ppandit@...hat.com>)
CVE Request - Samsung Exynos GPU driver OOB read (Idler <idler1984@...il.com>)
Re: CVE Request - Samsung Exynos GPU driver OOB read (Greg KH <greg@...ah.com>)
Re: CVE request: python-pysaml2 XML external entity attack (<cve-assign@...re.org>)
Re: CVE request Kernel: kvm: use-after-free issue while creating devices (<cve-assign@...re.org>)

January 20 (17 messages)

Re: CVE request Weblate: information disclosure in password reset form (<cve-assign@...re.org>)
Re: CVE Request - Samsung Exynos GPU driver OOB read (<cve-assign@...re.org>)
CVE Request: two flaws in hesiod permitting privilege elevation (Doran Moppert <dmoppert@...hat.com>)
CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (Harshula <harshula@...hat.com>)
RE: CVE Request - Samsung Exynos GPU driver OOB read ("idl3r" <idler1984@...il.com>)
CVE request: cgiemail multiple vulnerabilities (Sébastien Delafond <seb@...ian.org>)
Re: CVE Request - Samsung Exynos GPU driver OOB read (Greg KH <greg@...ah.com>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (Greg KH <greg@...ah.com>)
RE: CVE Request - Samsung Exynos GPU driver OOB read ("idl3r" <idler1984@...il.com>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (Harshula <harshula@...hat.com>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (Greg KH <greg@...ah.com>)
Re: CVE-2016-9584: heap use-after-free on libical (Raphael Hertzog <hertzog@...ian.org>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (Brad Spengler <spender@...ecurity.net>)
CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb (P J P <ppandit@...hat.com>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (Greg KH <greg@...ah.com>)
Re: CVE-2016-9584: heap use-after-free on libical (Gustavo Grieco <gustavo.grieco@...il.com>)
CVE request Qemu: display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing (P J P <ppandit@...hat.com>)

January 21 (7 messages)

Re: CVE Request: two flaws in hesiod permitting privilege elevation (<cve-assign@...re.org>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash (<cve-assign@...re.org>)
Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel (<cve-assign@...re.org>)
Re: CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb (<cve-assign@...re.org>)
Re: CVE request Qemu: display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing (<cve-assign@...re.org>)
Please assign CVE to PageKit Remote Password Reset Vulnerability (Sandeep Kamble <sandeepk.l337@...il.com>)
CVE request: Linux kernel: vc4: int overflow leading to heap-based buffer overflow (Murray McAllister <murray.mcallister@...omniasec.com>)

January 22 (2 messages)

Re: [tigervnc-announce] TigerVNC 1.7.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE Request: libXpm < 3.5.12 heap overflow (Tobias Stoeckmann <tobias@...eckmann.org>)

January 23 (4 messages)

CVE request: lcms2 heap OOB read parsing crafted ICC profile (Doran Moppert <dmoppert@...hat.com>)
Re: [tigervnc-devel] Re: [tigervnc-announce] TigerVNC 1.7.1 (Pierre Ossman <ossman@...dio.se>)
CVE request Qemu: display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing (P J P <ppandit@...hat.com>)
wavpack: multiple out of bounds memory reads (Hanno Böck <hanno@...eck.de>)

January 24 (12 messages)

Re: [tigervnc-devel] Re: [tigervnc-announce] TigerVNC 1.7.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE request Virglrenderer: host memory leakage when creating decode context (P J P <ppandit@...hat.com>)
Re: CVE request: Linux kernel: vc4: int overflow leading to heap-based buffer overflow (<cve-assign@...re.org>)
Headsup: systemd v228 local root exploit (CVE-2016-10156) (Sebastian Krahmer <krahmer@...e.com>)
CVE request Virglrenderer: OOB access while parsing texture instruction (P J P <ppandit@...hat.com>)
Windows ports of Linux software bundling outdated libraries (Gajim / PyCurl) (Hanno Böck <hanno@...eck.de>)
CVE request: rubygem minitar: directory traversal vulnerability (Max Veytsman <max@...canary.com>)
CVE request Qemu: serial: host memory leakage in 16550A UART emulation (P J P <ppandit@...hat.com>)
Re: Headsup: systemd v228 local root exploit (CVE-2016-10156) ("Alexander E. Patrakov" <patrakov@...il.com>)
CVE request: GNU screen escalation (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Headsup: systemd v228 local root exploit (CVE-2016-10156) (Daniel Micay <danielmicay@...il.com>)
Re: Headsup: systemd v228 local root exploit (CVE-2016-10156) (Daniel Micay <danielmicay@...il.com>)

January 25 (18 messages)

Re: CVE request: GNU screen escalation (Solar Designer <solar@...nwall.com>)
Re: CVE request Qemu: display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing (<cve-assign@...re.org>)
Re: CVE request Qemu: serial: host memory leakage in 16550A UART emulation (<cve-assign@...re.org>)
Re: CVE request Virglrenderer: host memory leakage when creating decode context (<cve-assign@...re.org>)
Re: CVE request Virglrenderer: OOB access while parsing texture instruction (<cve-assign@...re.org>)
Re: [tigervnc-announce] TigerVNC 1.7.1 (<cve-assign@...re.org>)
Re: CVE Request: libXpm < 3.5.12 heap overflow (<cve-assign@...re.org>)
jasper: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c) (Agostino Sarubbo <ago@...too.org>)
jasper: invalid memory read in jas_matrix_bindsub (jas_seq.c) (Agostino Sarubbo <ago@...too.org>)
jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c) (Agostino Sarubbo <ago@...too.org>)
Re: jasper: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: jasper: invalid memory read in jas_matrix_bindsub (jas_seq.c) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: lcms2 heap OOB read parsing crafted ICC profile (<cve-assign@...re.org>)
Re: Please assign CVE to PageKit Remote Password Reset Vulnerability (<cve-assign@...re.org>)
Multiple PHP object injection vulnerabilities affecting three WordPress Plugins (Summer of Pwnage <lists@...urify.nl>)
Re: Windows ports of Linux software bundling outdated libraries (Gajim / PyCurl) (Adrien Nader <adrien@...k.org>)
Re: Windows ports of Linux software bundling outdated libraries (Gajim / PyCurl) (Jeffrey Walton <noloader@...il.com>)

January 26 (4 messages)

CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in … (Salvatore Bonaccorso <carnil@...ian.org…)
Re: OpenSSH: CVE-2015-6565 (pty issue in 6.8-6.9) can lead to local privesc on Linux (up201407890@...nos.dcc.fc.up.pt)
Re: Re: OpenSSH: CVE-2015-6565 (pty issue in 6.8-6.9) can lead to local privesc on Linux (Noryungi <noryungi@...il.com>)
[OSSA-2017-001] CatchErrors leaks sensitive values in oslo.middleware (CVE-2017-2592) (Jeremy Stanley <fungi@...goth.org>)

January 27 (7 messages)

Re: Re: OpenSSH: CVE-2015-6565 (pty issue in 6.8-6.9) can lead to local privesc on Linux (up201407890@...nos.dcc.fc.up.pt)
CVE Request: Wordpress: 4.7.2 security release: unauthorized bypass, SQL injection, cross-site scripting issues (Salvatore Bonaccorso <carnil@...ian.org>)
SSRF issue in the svgsalamander library (Luc Lynx <luc.lynx@...dex.ru>)
Re: CVE-2016-9584: heap use-after-free on libical (Raphael Hertzog <hertzog@...ian.org>)
Re: CVE-2016-9584: heap use-after-free on libical (Gustavo Grieco <gustavo.grieco@...il.com>)
Re: Re: CVE request: linux kernel - local DoS with cgroup offline code (Andreas Stieger <astieger@...e.com>)
CVE Request: s-nail local root (wapiflapi <wapiflapi@...oo.fr>)

January 28 (9 messages)

Use after free in libmysqlclient.so (pali@...n.org)
Gentoo: order of installed packages may result in vary directories permissions, leading to crontab not requiring cron g… (KARBOWSKI Piotr <piotr.karbowski@...il.…)
Re: Gentoo: order of installed packages may result in vary directories permissions, leading to crontab not requiring cro… (Kristian Fiskerstrand <k_f@...too.org>)
Multiple vulnerabilities affecting two WordPress Plugins (XSS, CSRF & SQLi) (Summer of Pwnage <lists@...urify.nl>)
Re: CVE Request: Wordpress: 4.7.2 security release: unauthorized bypass, SQL injection, cross-site scripting issues (<cve-assign@...re.org>)
Re: CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c (<cve-assign@...re.org>)
Re: Gentoo: order of installed packages may result in vary directories permissions, leading to crontab not requiring cron group membershi… (<cve-assign@...re.org>)
Re: CVE request: cgiemail multiple vulnerabilities (<cve-assign@...re.org>)
Re: wavpack: multiple out of bounds memory reads (<cve-assign@...re.org>)

January 29 (8 messages)

Re: CVE request: rubygem minitar: directory traversal vulnerability (<cve-assign@...re.org>)
Re: SSRF issue in the svgsalamander library (<cve-assign@...re.org>)
Re: CVE request: GNU screen escalation (<cve-assign@...re.org>)
Re: Firejail local root exploit (Ion Ionescu <netblue30@...oo.com>)
mp3splt: NULL pointer dereference in splt_cue_export_to_file (cue.c) (Agostino Sarubbo <ago@...too.org>)
mp3splt: invalid free in free_options (options_manager.c) (Agostino Sarubbo <ago@...too.org>)
mp3splt: NULL pointer dereference in main (mp3splt.c) (Agostino Sarubbo <ago@...too.org>)
Requesting CVE for calibre file disclosure (Martin Pitt <mpitt@...ian.org>)

January 30 (4 messages)

FW: [DSA 3775-1] tcpdump security update] (Leo Famulari <leo@...ulari.name>)
CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer (P J P <ppandit@...hat.com>)
Re: FW: [DSA 3775-1] tcpdump security update] (David Manouchehri <david@...idmanouchehri.com>)
CVE Request - Remote DoS vulnerabilities in BitlBee (dequis <dx@...one.com.ar>)

January 31 (18 messages)

CVE request: Out-of-Bound read and write issues in put1bitbwtile()(tiff-4.0.7/libtiff/tif-getimage.c:1352) and putgreytile()(… (chunibalon <chunibalon@...il.com>)
CVE request: Out-of-Bound read and write issues in put1bitbwtile()(tiff-4.0.7/libtiff/tif-getimage.c:1352) and putgreytile()(… (chunibalon <chunibalon@...il.com>)
Re: Re: CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem (P J P <ppandit@...hat.com>)
CVE-2017-2596 Kernel: kvm: page reference leakage in handle_vmon (P J P <ppandit@...hat.com>)
CVE request: multiples vulnerabilities in Revive Adserver (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
CVE request: multiples vulnerabilities in libplist (<nikola.sc@...mail.me>)
Re: mp3splt: NULL pointer dereference in splt_cue_export_to_file (cue.c) (<cve-assign@...re.org>)
Re: mp3splt: invalid free in free_options (options_manager.c) (<cve-assign@...re.org>)
Re: Requesting CVE for calibre file disclosure (<cve-assign@...re.org>)
Re: CVE request Qemu: sd: sdhci OOB access during multi block SDMA transfer (<cve-assign@...re.org>)
Re: CVE Request - Remote DoS vulnerabilities in BitlBee (<cve-assign@...re.org>)
CVE Request: ffmpeg remote exploitaion results code execution (Paul Cher <paulcher@...lab.cs.msu.su>)
Re: Re: OpenSSH: CVE-2015-6565 (pty issue in 6.8-6.9) can lead to local privesc on Linux (Sebastian Krahmer <krahmer@...e.com>)
CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r (Max Veytsman <max@...canary.com>)
CVE requests: OpenBSD httpd - 2 DoS (Pierre Kim <pierre.kim.sec@...il.com>)
Re: Re: Firejail local root exploit (Thomas Deutschmann <whissi@...too.org>)
Bugs fixed in libevent 2.1.6 (Leo Famulari <leo@...ulari.name>)
Re: CVE Request: ffmpeg remote exploitaion results code execution (Leo Famulari <leo@...ulari.name>)

252 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.