oss-security mailing list - 2017/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2017/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 3	² 12
³ 9	⁴ 7	⁵ 29	⁶ 18	⁷ 17	⁸ 3	⁹
¹⁰ 11	¹¹ 12	¹² 3	¹³ 19	¹⁴ 26	¹⁵ 2	¹⁶ 1
¹⁷ 6	¹⁸ 6	¹⁹ 8	²⁰ 6	²¹ 6	²² 2	²³ 1
²⁴ 3	²⁵ 6	²⁶ 1	²⁷ 2	²⁸	²⁹	³⁰ 2
³¹ 4

Messages by day:

July 1 (3 messages)

Re: accepting new members to (linux-)distros lists (Mark Hatle <mark.hatle@...driver.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Stiepan <stie@....swiss>)

July 2 (12 messages)

systemd fails to parse user that should run service (Daniel Skowroński <daniel@...nf.net>)
linux-distros list membership application - CloudLinux (Igor Seletskiy <i@...udlinux.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: linux-distros list membership application - CloudLinux (Solar Designer <solar@...nwall.com>)
RE: linux-distros list membership application - CloudLinux (Bobby Broughton <bobby@...ciselymanaged.com>)
Re: linux-distros list membership application - CloudLinux (Igor Seletskiy <i@...udlinux.com>)
Re: accepting new members to (linux-)distros lists (Kristian Fiskerstrand <k_f@...too.org>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Anthony Liguori <anthony@...emonkey.ws>)
Re: accepting new members to (linux-)distros lists (Kristian Fiskerstrand <k_f@...too.org>)
Re: accepting new members to (linux-)distros lists (Anthony Liguori <anthony@...emonkey.ws>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)

July 3 (9 messages)

Re: accepting new members to (linux-)distros lists (Mark Hatle <mark.hatle@...driver.com>)
Re: accepting new members to (linux-)distros lists (gremlin@...mlin.ru)
CVE-2017-10788 for DBD::mysql (Re: Re: MySQL - use-after-free after mysql_stmt_close()) (Pali Rohár <pali.rohar@...il.com>)
Re: accepting new members to (linux-)distros lists (Kristian Fiskerstrand <k_f@...too.org>)
Bugzilla implementation of OpenPGP and Memory Hole (Was: Re: accepting new members to (linux-)distros lists) (Kristian Fiskerstrand <k_f@...too.org>)
Re: accepting new members to (linux-)distros lists (John Haxby <john.haxby@...cle.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (John Haxby <john.haxby@...cle.com>)

July 4 (7 messages)

Re: linux-distros list membership application - CloudLinux ("Dmitry V. Levin" <ldv@...linux.org>)
Re: linux-distros list membership application - CloudLinux (Solar Designer <solar@...nwall.com>)
Re: linux-distros list membership application - CloudLinux (Solar Designer <solar@...nwall.com>)
Re: linux-distros list membership application - CloudLinux (Leonid Kanter <lkanter@...udlinux.com>)
Re: linux-distros list membership application - CloudLinux (Solar Designer <solar@...nwall.com>)
jabberd2: CVE-2017-10807: Allows to authenticate using SASL ANONYMOUS even if disabled (Salvatore Bonaccorso <carnil@...ian.org>)
Re: linux-distros list membership application - CloudLinux (Igor Seletskiy <i@...udlinux.com>)

July 5 (29 messages)

CVE-2017-10789: DBD::mysql - mysql_ssl=1 does not enforce encryption (Pali Rohár <pali.rohar@...il.com>)
Re: systemd fails to parse user that should run service (Pali Rohár <pali.rohar@...il.com>)
Re: systemd fails to parse user that should run service (Marcus Meissner <meissner@...e.de>)
CVE IDs needed for PHP vulnerabilites (affects 5.6.30 and 7.0.20) (Lior Kaplan <kaplanlior@...il.com>)
Re: CVE IDs needed for PHP vulnerabilites (affects 5.6.30 and 7.0.20) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: systemd fails to parse user that should run service (Casper.Dik@...cle.com)
Re: systemd fails to parse user that should run service (Ben Tasker <ben@...tasker.co.uk>)
Re: CVE IDs needed for PHP vulnerabilites (affects 5.6.30 and 7.0.20) (Lior Kaplan <kaplanlior@...il.com>)
Re: CVE IDs needed for PHP vulnerabilites (affects 5.6.30 and 7.0.20) (Solar Designer <solar@...nwall.com>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)
LKML thread "mm: larger stack guard gap, between vmas" partially CC'ed to linux-distros (Solar Designer <solar@...nwall.com>)
Re: systemd fails to parse user that should run service (Eric Blake <eblake@...hat.com>)
Re: systemd fails to parse user that should run service (John Haxby <john.haxby@...cle.com>)
Re: systemd fails to parse user that should run service (Daniel Micay <danielmicay@...il.com>)
File upload vulnerability in Kindeditor <= 4.1.12 ("Larry W. Cashdollar" <larry0@...com>)
Re: systemd fails to parse user that should run service (John Haxby <john.haxby@...cle.com>)
Re: systemd fails to parse user that should run service (Daniel Micay <danielmicay@...il.com>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)
Re: systemd fails to parse user that should run service (Pali Rohár <pali.rohar@...il.com>)
Re: systemd fails to parse user that should run service (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: systemd fails to parse user that should run service ("Perry E. Metzger" <perry@...rmont.com>)
Re: systemd fails to parse user that should run service ("Perry E. Metzger" <perry@...rmont.com>)
Re: systemd fails to parse user that should run service (Robert Scheck <robert@...oraproject.org>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)
Re: systemd fails to parse user that should run service (Kristian Fiskerstrand <k_f@...too.org>)
Re: systemd fails to parse user that should run service (Jeremy Stanley <fungi@...goth.org>)
Re: systemd fails to parse user that should run service (Kristian Fiskerstrand <k_f@...too.org>)
Re: systemd fails to parse user that should run service (Kristian Fiskerstrand <k_f@...too.org>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)

July 6 (18 messages)

Re: systemd fails to parse user that should run service (Jeffrey Walton <noloader@...il.com>)
Re: CVE IDs needed for PHP vulnerabilites (affects 5.6.30 and 7.0.20) (Marcus Meissner <meissner@...e.de>)
Re: systemd fails to parse user that should run service ("Patrick J. Volkerding" <security@...ckware.com>)
Re: systemd fails to parse user that should run service (Martin Steigerwald <martin@...htvoll.de>)
Re: systemd fails to parse user that should run service (Ben Tasker <ben@...tasker.co.uk>)
X.Org X Server stack overflow and information leak (Marcus Meissner <meissner@...e.de>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)
Libgcrypt 1.7.8 fixes "Sliding right into disaster" RSA side-channel attack (CVE-2017-7526) (Solar Designer <solar@...nwall.com>)
Re: systemd fails to parse user that should run service (Leonid Isaev <leonid.isaev@...a.colorado.edu>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)
Re: systemd fails to parse user that should run service (Leonid Isaev <leonid.isaev@...a.colorado.edu>)
Re: accepting new members to (linux-)distros lists (Kristian Fiskerstrand <k_f@...too.org>)
Re: accepting new members to (linux-)distros lists ("kseifried@...hat.com" <kseifried@...hat.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: systemd fails to parse user that should run service (Simon McVittie <smcv@...ian.org>)
Re: systemd fails to parse user that should run service (Kurt Seifried <kseifried@...hat.com>)
Re: systemd fails to parse user that should run service (Martin Steigerwald <martin@...htvoll.de>)

July 7 (17 messages)

CVE-2017-10806 Qemu: usb-redirect: stack buffer overflow in debug logging (P J P <ppandit@...hat.com>)
CVE-2017-10810 Kernel: virtio-gpu: memory leakage while creating gpu object (P J P <ppandit@...hat.com>)
Irssi 1.0.4: CVE-2017-10965, CVE-2017-10966. (Ailin Nemui <ailin.nemui@...il.com>)
[ANNOUNCE] [SECURITY] CVE-2017-7660: Security Vulnerability in secure inter-node communication in Apache Solr (Shalin Shekhar Mangar <shalin@...che.org>)
Xen Security Advisory 217 (CVE-2017-10912) - page transfer may allow PV guest to elevate privilege (Xen.org security team <security@....org>)
Xen Security Advisory 219 (CVE-2017-10915) - x86: insufficient reference counts during shadow emulation (Xen.org security team <security@....org>)
Xen Security Advisory 216 (CVE-2017-10911) - blkif responses leak backend stack data (Xen.org security team <security@....org>)
Xen Security Advisory 221 (CVE-2017-10917) - NULL pointer deref in event channel poll (Xen.org security team <security@....org>)
Xen Security Advisory 220 (CVE-2017-10916) - x86: PKRU and BND* leakage between vCPU-s (Xen.org security team <security@....org>)
Xen Security Advisory 223 (CVE-2017-10919) - ARM guest disabling interrupt may crash Xen (Xen.org security team <security@....org>)
Xen Security Advisory 225 (CVE-2017-10923) - arm: vgic: Out-of-bound access when sending SGIs (Xen.org security team <security@....org>)
Xen Security Advisory 222 (CVE-2017-10918) - stale P2M mappings due to insufficient error checking (Xen.org security team <security@....org>)
Xen Security Advisory 224 (CVE-2017-10920,CVE-2017-10921,CVE-2017-10922) - grant table operations mishandle reference c… (Xen.org security team <security@....org…)
Xen Security Advisory 218 (CVE-2017-10913,CVE-2017-10914) - Races in the grant table unmap code (Xen.org security team <security@....org>)
[ANN] Apache Struts 2: possible RCE in the Struts Showcase app in the Struts 1 plugin example in the Struts 2.3.x serie… (Lukasz Lenart <lukaszlenart@...che.org>)
[cve-request@...re.org: Re: [scr357564] sqlite3 - fix in progress] (Seth Arnold <seth.arnold@...onical.com>)
[ANNOUNCE] Apache Traffic Control Traffic Router Slowloris Denial of Service Vulnerability - CVE-2017-7670 (Jeff Elsloo <elsloo@...che.org>)

July 8 (3 messages)

Re: CVE for the TSIG issue in knot? (Salvatore Bonaccorso <carnil@...ian.org>)
Re: accepting new members to (linux-)distros lists (Salvatore Bonaccorso <carnil@...ian.org>)
CVE ID for JasPer 2.0.12 NULL Pointer Dereference jp2_encode (jp2_enc.c) (Anthony Sasadeusz <sasadeu1@...c.edu>)

July 10 (11 messages)

xar: NULL pointer dereference in xar_unserialize (archive.c) ("Agostino Sarubbo" <ago@...too.org>)
xar: NULL pointer dereference in xar_get_path (util.c) ("Agostino Sarubbo" <ago@...too.org>)
mpg123: global buffer overflow in III_i_stereo (layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) (Agostino Sarubbo <ago@...too.org>)
Re: CVE IDs needed for PHP vulnerabilites (affects 5.6.30 and 7.0.20) (Marcus Meissner <meissner@...e.de>)
PHP CVE assignments: [cve-request@...re.org: Re: [scr358150] 7 PHP CVEs] (Marcus Meissner <meissner@...e.de>)
Fwd: [SECURITY] CVE-2017-5652 Apache Impala (incubating) Information Disclosure (Sailesh Mukil <sailesh@...che.org>)
CVE-2017-5640 Apache Impala (incubating) Information Disclosure (Sailesh Mukil <sailesh@...che.org>)
Re: PHP CVE assignments: [cve-request@...re.org: Re: [scr358150] 7 PHP CVEs] (Stanislav Malyshev <smalyshev@...il.com>)
Re: Re: PHP CVE assignments: [cve-request@...re.org: Re: [scr358150] 7 PHP CVEs] (Kurt Seifried <kseifried@...hat.com>)

July 11 (12 messages)

Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) (Seth Arnold <seth.arnold@...onical.com>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) (Michal Zalewski <lcamtuf@...edump.cx>)
Re: [scr358145] pcre-8.41 - 8.41 ("ben" <qbenjin@...com>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) (Kurt Seifried <kseifried@...hat.com>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) (Kurt Seifried <kseifried@...hat.com>)
Re: Re: [scr358145] pcre-8.41 - 8.41 (Agostino Sarubbo <ago@...too.org>)
Re: Re: PHP CVE assignments: [cve-request@...re.org: Re: [scr358150] 7 PHP CVEs] (Marcus Meissner <meissner@...e.de>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Jenkins plugins -- multiple vulnerabilities (Daniel Beck <ml@...kweb.net>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mpg123: global buffer overflow in III_i_stereo (layer3.c) (Jonas Thiem <jonas@...em.email>)
Blind SQL injection in wordpress plugin event-espresso-free v3.1.37.11.L, fixed in v3.1.37.12.L ("Larry W. Cashdollar" <larry0@...com>)

July 12 (3 messages)

CVE-2017-11171: gnome-session: Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c (Matthias Gerstner <mgerstner@...e.de>)
CVE-2017-7678 Apache Spark XSS web UI MHTML vulnerability (Sean Owen <srowen@...che.org>)
Asus wireless routers Global buffer overflow and Stack buffer overflow in networkmap ("逢坂河河、、" <598930392@...com>)

July 13 (19 messages)

CVE-IDs request for ASUS wiress router Remote Command/Code Execution Vulnerability (varsleak <varsleak@...il.com>)
[ANN] Apache Struts 2.5.12 GA with Security Fixes Release (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2017-9789: Apache httpd 2.4 Read after free in mod_http2 (William A Rowe Jr <wrowe@...che.org>)
CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest (William A Rowe Jr <wrowe@...che.org>)
CVE-2017-1000083: evince: Command injection vulnerability in CBT handler (Johannes Segitz <jsegitz@...e.de>)
CVE-2017-7663 - Apache OpenMeetings - XSS in chat (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7666 - Apache OpenMeetings Missing Secure Headers (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7673 - Apache OpenMeetings Insufficient check in dialogs with passwords (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7680 - Apache OpenMeetings - Insecure crossdomain.xml policy (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7682 - Apache OpenMeetings - Business Logic Bypass (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7683 - Apache OpenMeetings - Information Disclosure (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7684 - Apache OpenMeetings - Insecure File Upload (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7685 - Apache OpenMeetings - Insecure HTTP Methods (Maxim Solodovnik <solomax@...che.org>)
CVE-2017-7688 - Apache OpenMeetings - Insecure Password Update (Maxim Solodovnik <solomax@...che.org>)
firewalld: lockdown whitelist cmdline access check is not secure (Matthias Gerstner <mgerstner@...e.de>)
CVE-2017-7664 - Apache OpenMeetings - Missing XML Validation (Maxim Solodovnik <solomax666@...il.com>)
Re: CVE-IDs request for ASUS wiress router Remote Command/Code Execution Vulnerability (Zach W <kestrel@...linux.us>)
Re: Asus wireless routers Global buffer overflow and Stack buffer overflow in networkmap (Zach W <kestrel@...linux.us>)

July 14 (26 messages)

CVE-2017-7506 spice: Possible buffer overflow via invalid monitor configurations (Kristian Fiskerstrand <k_f@...too.org>)
Re: CVE-IDs request for ASUS wiress router Remote Command/Code Execution Vulnerability (varsleak <varsleak@...il.com>)
Re: Re: Asus wireless routers Global buffer overflow and Stack buffer overflow in networkmap ("598930392@...com" <598930392@...com>)
Estimate for the total number of exploitable bugs in large linux distro? (Georgi Guninski <guninski@...inski.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Greg KH <greg@...ah.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Steven Miano <mianosm@...il.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Hanno Böck <hanno@...eck.de>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Steve Grubb <sgrubb@...hat.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Santiago Torres <torresariass@...il.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Javantea <jvoss@...sci.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Kurt Seifried <kseifried@...hat.com>)
Re: Estimate for the total number of exploitable bugs in large linux distro? (Kristian Fiskerstrand <k_f@...too.org>)
Re: accepting new members to (linux-)distros lists (Anthony Liguori <anthony@...emonkey.ws>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists ("kseifried@...hat.com" <kseifried@...hat.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Anthony Liguori <anthony@...emonkey.ws>)
Re: accepting new members to (linux-)distros lists (Kristian Fiskerstrand <k_f@...too.org>)
Re: accepting new members to (linux-)distros lists (Kurt Seifried <kseifrie@...hat.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (Kurt Seifried <kseifried@...hat.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: CVE-2017-1000083: evince: Command injection vulnerability in CBT handler (Hanno Böck <hanno@...eck.de>)

July 15 (2 messages)

Re: CVE-2017-1000083: evince: Command injection vulnerability in CBT handler (Brandon Perry <bperry.volatile@...il.com>)
Re: CVE-2017-1000083: evince: Command injection vulnerability in CBT handler (Seth Arnold <seth.arnold@...onical.com>)

July 16 (1 message)

ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004 (Henri Salo <henri@...v.fi>)

July 17 (6 messages)

ImageMagick: CVE-2017-11352: Improper EOF handling in coders/rle.c can trigger crash (Incomplete fix for CVE-2017-9144) (Salvatore Bonaccorso <carnil@...ian.org…)
yadm: CVE-2017-11353: race condition allows access to SSH and PGP keys (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2017-11343 CHICKEN Scheme: algorithmic complexity attack in hash tables (Peter Bex <peter@...e-magic.net>)
CVE-2017-11334 Qemu: exec: oob access during dma operation (P J P <ppandit@...hat.com>)
Re: Re: Asus wireless routers Global buffer overflow and Stack buffer overflow in networkmap (GbigMao <gbigmao@...com>)
11 remote vulnerabilities (inc. 2x RCE) in FreeRADIUS packet parsers (Guido Vranken <guidovranken@...il.com>)

July 18 (6 messages)

graphicsmagick: use-after-free in CloseBlob (blob.c) ("Agostino Sarubbo" <ago@...too.org>)
CVE-2016-6798 : Apache Sling XXE vulnerability (Bertrand Delacretaz <bdelacretaz@...che.org>)
CVE-2016-5394 : Apache Sling XSS vulnerability (Bertrand Delacretaz <bdelacretaz@...che.org>)
Re: CVE-IDs request for ASUS wiress router Remote Command/Code Execution Vulnerability (varsleak <varsleak@...il.com>)
CoreOS membership to linux-distros (updated) (Euan Kemp <euan.kemp@...eos.com>)
Re: CoreOS membership to linux-distros (updated) (Kees Cook <keescook@...gle.com>)

July 19 (8 messages)

CVE-IDs request for Apache Kafka desrialization vulnerability via runtime (Hooman Ghasem Broujerdi <hghasemb@...hat.com>)
CVE-2017-11434 Qemu: slirp: out-of-bounds read while parsing dhcp options (P J P <ppandit@...hat.com>)
gnome-exe-thumbnailer: CVE-2017-11421: VBScript script injection when generating thumbnails for MSI files (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-IDs request for Apache Kafka desrialization vulnerability via runtime (Salvatore Bonaccorso <carnil@...ian.org>)
Re: ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004 (Matthew Daley <mattd@...fuzz.com>)
Re: ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004 (Henri Salo <henri@...v.fi>)
Devil's Ivy (CVE-2017-9765) in gSOAP 2.7 up to 2.8.47 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Devil's Ivy (CVE-2017-9765) in gSOAP 2.7 up to 2.8.47 (Andreas Stieger <astieger@...e.com>)

July 20 (6 messages)

NIX-2017-0003: LDAP with useTLS option disabled TLS peer verification (Graham Christensen <graham@...hamc.com>)
Re: Re: ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004 (Kurt Seifried <kseifried@...hat.com>)
phamm: CVE-2017-0378: reflected XSS in login page (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CoreOS membership to linux-distros (updated) (gremlin@...mlin.ru)
Re: CoreOS membership to linux-distros (updated) (Greg KH <greg@...ah.com>)
Re: CoreOS membership to linux-distros (updated) (Jesse Hertz <jesse_hertz@...le.com>)

July 21 (6 messages)

Re: NIX-2017-0003: LDAP with useTLS option disabled TLS peer verification (Franz Pletz <fpletz@...rdicwalking.de>)
Re: CoreOS membership to linux-distros (updated) (Stiepan <stie@....swiss>)
[OSSN-0078] Ceph credentials included in logs using older versions of libvirt/qemu (Luke Hinds <lhinds@...hat.com>)
CVE-2017-7539 Qemu: qemu-nbd crashes due to undefined I/O coroutine (P J P <ppandit@...hat.com>)
Re: CoreOS membership to linux-distros (updated) (Nicolas RUFF <nicolas.ruff@...il.com>)
Re: CoreOS membership to linux-distros (updated) (Solar Designer <solar@...nwall.com>)

July 22 (2 messages)

pagure: private repositories accessible through ssh (Stefan Bühler <stbuehler@...httpd.net>)
Re: pagure: private repositories accessible through ssh (Patrick Uiterwijk <puiterwijk@...hat.com>)

July 23 (1 message)

Re: ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004 (Henri Salo <henri@...v.fi>)

July 24 (3 messages)

tcmu-runner: multiple vulnerabilities in tcmu-runner daemon allowing local DoS, information leak and a memory leak (Matthias Gerstner <mgerstner@...e.de>)
CVE-2017-7541: Linux kernel: Memory corruption due to a buffer overflow in brcmf_cfg80211_mgmt_tx() (Vladis Dronov <vdronov@...hat.com>)
[CVE-2015-5191] local privilege escalation in Open VMware Tools (VMware Security Response Center <security@...are.com>)

July 25 (6 messages)

WebKitGTK+ Security Advisory WSA-2017-0006 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: accepting new members to (linux-)distros lists (John Haxby <john.haxby@...cle.com>)
Re: accepting new members to (linux-)distros lists (Henri Salo <henri@...v.fi>)
Re: accepting new members to (linux-)distros lists (John Haxby <john.haxby@...cle.com>)
Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
Re: accepting new members to (linux-)distros lists (John Haxby <john.haxby@...cle.com>)

July 26 (1 message)

Four memory safety bugs in "sipcrack" package (2 CVE IDs) (Dhiru Kholia <dhiru.kholia@...il.com>)

July 27 (2 messages)

Cacti: CVE-2017-11691: Cross-site scripting vulnerability in user profile management page (auth_profile.php) (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2017-11671: GCC generates incorrect code for RDRAND/RDSEED intrinsics (Florian Weimer <fw@...eb.enyo.de>)

July 30 (2 messages)

Linux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak (sohu0106 <sohu0106@....com>)
Linux kernel: driver/video/fbdev/aty/atyfb_base.c: atyfb_ioctl() stack infoleak (sohu0106 <sohu0106@....com>)

July 31 (4 messages)

Re: Linux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak (John Haxby <john.haxby@...cle.com>)
Re: Linux kernel: net/irda/af_irda.c: irda_getsockopt() stack infoleak (Solar Designer <solar@...nwall.com>)
Potential security bugs in "eapmd5pass" software (3 CVE IDs) (Dhiru Kholia <dhiru.kholia@...il.com>)
Re: CoreOS membership to linux-distros (updated) (Solar Designer <solar@...nwall.com>)

225 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.