oss-security mailing list - 2017/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2017/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 8	² 2	³ 1
⁴ 2	⁵ 4	⁶ 7	⁷ 10	⁸ 5	⁹	¹⁰ 1
¹¹ 6	¹² 8	¹³ 5	¹⁴ 21	¹⁵ 4	¹⁶ 2	¹⁷ 8
¹⁸ 8	¹⁹ 2	²⁰ 1	²¹ 7	²² 13	²³ 9	²⁴ 2
²⁵ 8	²⁶ 23	²⁷ 13	²⁸ 16	²⁹ 14	³⁰ 4

Messages by day:

September 1 (8 messages)

Re: Reporting and disclosing Linux kernel vulnerabilities (Andrey Konovalov <andreyknvl@...il.com>)
Re: openjpeg: heap-based buffer overflow in opj_t2_encode_packet (t2.c) (Agostino Sarubbo <ago@...too.org>)
Re: openjpeg: invalid memory write in tgatoimage (convert.c) (Agostino Sarubbo <ago@...too.org>)
Re: openjpeg: stack-based buffer overflow write in pgxtoimage (convert.c) (Agostino Sarubbo <ago@...too.org>)
Re: graphicsmagick: memory allocation failure in MagickRealloc (memory.c) (Agostino Sarubbo <ago@...too.org>)
graphicsmagick: use-after-free in CloseBlob (blob.c) (INCOMPLETE FIX FOR CVE-2017-11403) ("Agostino Sarubbo" <ago@...too.org>)
Re: graphicsmagick: use-after-free in CloseBlob (blob.c) (INCOMPLETE FIX FOR CVE-2017-11403) (Agostino Sarubbo <ago@...too.org>)
CVE-2017-14106 kernel: net/ipv4: divide by 0 in __tcp_select_window() (Vasily Averin <vvs@...tuozzo.com>)

September 2 (2 messages)

libzip: memory allocation failure in _zip_cdir_grow (zip_dirent.c) ("Agostino Sarubbo" <ago@...too.org>)
libzip: use-after-free in _zip_buffer_free (zip_buffer.c) ("Agostino Sarubbo" <ago@...too.org>)

September 3 (1 message)

CVE-2017-14102: MIMEDefang privilege escalation via PID file manipulation (Michael Orlitzky <michael@...itzky.com>)

September 4 (2 messages)

Re: unrar-free/unrar-gpl: directory traversal and other issues (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2017-1000083: evince: Command injection vulnerability in CBT handler (Marcus Meissner <meissner@...e.de>)

September 5 (4 messages)

[ANN] Apache Struts 2.5.13 GA with Security Fixes Release (Lukasz Lenart <lukaszlenart@...che.org>)
Re: [ANN] Apache Struts 2.5.13 GA with Security Fixes Release (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2017-1000249: file: stack based buffer overflow (Thomas Jarosch <thomas.jarosch@...ra2net.com>)
Django security releases issued: 1.11.5 and 1.10.8 (Tim Graham <timograham@...il.com>)

September 6 (7 messages)

openjpeg: heap-based buffer overflow in opj_mqc_flush (mqc.c) ("Agostino Sarubbo" <ago@...too.org>)
openjpeg: heap-based buffer overflow in opj_write_bytes_LE (cio.c) ("Agostino Sarubbo" <ago@...too.org>)
openjpeg: heap-based buffer overflow in opj_write_bytes_LE (cio.c) (INCOMPLETE FIX FOR CVE-2017-14152) ("Agostino Sarubbo" <ago@...too.org>)
graphicsmagick: memory allocation failure in MagickMalloc (memory.c) ("Agostino Sarubbo" <ago@...too.org>)
libarchive: heap-based buffer overflow in xml_data (archive_read_support_format_xar.c) ("Agostino Sarubbo" <ago@...too.org>)
Re: openjpeg: heap-based buffer overflow in opj_write_bytes_LE (cio.c) (INCOMPLETE FIX FOR CVE-2017-14152) (Agostino Sarubbo <ago@...too.org>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

September 7 (10 messages)

[ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2017-14167 Qemu: i386: multiboot OOB access while loading guest kernel image (P J P <ppandit@...hat.com>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Michael Orlitzky <michael@...itzky.com>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Simon McVittie <smcv@...ian.org>)
aacplusenc: NULL pointer dereference in DeleteBitBuffer (bitbuffer.c) ("Agostino Sarubbo" <ago@...too.org>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Daniel Kahn Gillmor <dkg@...thhorseman.net>)
Tcpdump 4.9.2 (Leo Famulari <leo@...ulari.name>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Simon McVittie <smcv@...ian.org>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Daniel Kahn Gillmor <dkg@...thhorseman.net>)

September 8 (5 messages)

Re: Tcpdump 4.9.2 (Raphael Geissert <geissert@...ian.org>)
Re: Tcpdump 4.9.2 (Peter Korsgaard <peter@...sgaard.com>)
Re: Tcpdump 4.9.2 (Jerry Lundström <jerry@...-oarc.net>)
CVE-2017-12612 Unsafe deserialization in Apache Spark launcher API (Sean Owen <srowen@...che.org>)
Arch Linux and tcpdump 4.9.2 (Denis Ovsienko <denis@...ienko.info>)

September 10 (1 message)

Re: CVE-2017-13673 Qemu: vga: reachable assert failure during during display update (Salvatore Bonaccorso <carnil@...ian.org>)

September 11 (6 messages)

GNU Emacs 25.2 enriched text remote code execution (Paul Eggert <eggert@...ucla.edu>)
Re: GNU Emacs 25.2 enriched text remote code execution (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Michael Orlitzky <michael@...itzky.com>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation (Simon McVittie <smcv@...ian.org>)
Re: CVE-2017-12847: nagios-core privilege escalation via PID file manipulation ("kseifried@...hat.com" <kseifried@...hat.com>)
CVE-2017-14159: OpenLDAP privilege escalation via PID file manipulation (Michael Orlitzky <michael@...itzky.com>)

September 12 (8 messages)

Re: GNU Emacs 25.2 enriched text remote code execution (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2017-13673 Qemu: vga: reachable assert failure during during display update (P J P <ppandit@...hat.com>)
Xen Security Advisory 231 (CVE-2017-14316) - Missing NUMA node parameter verification (Xen.org security team <security@....org>)
Xen Security Advisory 232 (CVE-2017-14318) - Missing check for grant table (Xen.org security team <security@....org>)
Xen Security Advisory 233 (CVE-2017-14317) - cxenstored: Race in domain cleanup (Xen.org security team <security@....org>)
Xen Security Advisory 234 (CVE-2017-14319) - insufficient grant unmapping checks for x86 PV guests (Xen.org security team <security@....org>)
Re: GNU Emacs 25.2 enriched text remote code execution (Florian Weimer <fw@...eb.enyo.de>)
Shibboleth plugin for WordPress: CVE-2017-14313: XSS vulnerability due to improper use of add_query_arg() (Salvatore Bonaccorso <carnil@...ian.org>)

September 13 (5 messages)

CVE-2017-14340: Linux kernel: xfs: unprivileged user kernel oops (Dave Chinner <david@...morbit.com>)
CVE-2017-12153 Linux kernel: nl80211: null pointer dereference in nl80211_set_rekey_data() (Vladis Dronov <vdronov@...hat.com>)
Re: Tcpdump 4.9.2 (akuster <akuster@...sta.com>)
Linux BlueBorne vulnerabilities (Armis Security <security@...is.com>)
tcpdump 4.9.2 is fully available (Denis Ovsienko <denis@...ienko.info>)

September 14 (21 messages)

mp3gain: stack-based buffer overflow in filterYule (gain_analysis.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL/interface.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: stack-based buffer overflow in copy_mp (mpglibDBL/interface.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: global buffer overflow in III_dequantize_sample (mpglibDBL/layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: stack-based buffer overflow in dct36 (mpglibDBL/layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: invalid memory write in copy_mp (mpglibDBL/interface.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: global buffer overflow in III_i_stereo (mpglibDBL/layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
mp3gain: memcpy-param-overlap in set_pointer (mpglibDBL/common.c) ("Agostino Sarubbo" <ago@...too.org>)
Re: mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL/interface.c) (Simon McVittie <smcv@...ian.org>)
Re: mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL/interface.c) (Agostino Sarubbo <ago@...too.org>)
Re: mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL/interface.c) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL/interface.c) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL/interface.c) (Agostino Sarubbo <ago@...too.org>)
Re: Linux BlueBorne vulnerabilities (Petr Matousek <pmatouse@...hat.com>)
Re: Linux BlueBorne vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: Re: Linux kernel: CVE-2017-1000112: Exploitable memory corruption due to UFO to non-UFO path switch (Thomas Jarosch <thomas.jarosch@...ra2net.com>)
Re: tcpdump 4.9.2 is fully available (Solar Designer <solar@...nwall.com>)
Re: tcpdump 4.9.2 is fully available (Levente Polyak <levente@...entepolyak.net>)
Re: GNU Emacs 25.2 enriched text remote code execution (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux BlueBorne vulnerabilities (Armis Security <security@...is.com>)
Re: Linux BlueBorne vulnerabilities (Solar Designer <solar@...nwall.com>)

September 15 (4 messages)

Re: Linux BlueBorne vulnerabilities (Ben Seri <ben@...is.com>)
Re: Linux BlueBorne vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: Linux BlueBorne vulnerabilities (Ben Seri <ben@...is.com>)
CVE-2017-1000252: KVM denial of service with posted interrupts on Intel systems (since Linux 4.4) ("Jan H. Schönherr" <jschoenh@...zon.de>)

September 16 (2 messages)

Podbeuter podcast fetcher: remote code execution (Alexander Batischev <eual.jp@...il.com>)
Re: Podbeuter podcast fetcher: remote code execution (Solar Designer <solar@...nwall.com>)

September 17 (8 messages)

[OSSN-0081] sha512_crypt is insufficient for password hashing (Luke Hinds <lhinds@...hat.com>)
Re: [OSSN-0081] sha512_crypt is insufficient for password hashing (Solar Designer <solar@...nwall.com>)
Re: Podbeuter podcast fetcher: remote code execution (Alexander Batischev <eual.jp@...il.com>)
Re: Podbeuter podcast fetcher: remote code execution (Solar Designer <solar@...nwall.com>)
Re: Podbeuter podcast fetcher: remote code execution (Kurt Seifried <kseifried@...hat.com>)
Re: Podbeuter podcast fetcher: remote code execution (Solar Designer <solar@...nwall.com>)
CVE-2017-14312: Nagios core root privilege escalation via insecure permissions (Michael Orlitzky <michael@...itzky.com>)
Re: Podbeuter podcast fetcher: remote code execution (Kurt Seifried <kseifrie@...hat.com>)

September 18 (8 messages)

CVE-2017-14497: Linux kernel: packet: buffer overflow in tpacket_rcv() (Vladis Dronov <vdronov@...hat.com>)
Optionsbleed bug in Apache HTTPD (Hanno Böck <hanno@...eck.de>)
Re: CVE-2017-14497: Linux kernel: packet: buffer overflow in tpacket_rcv() (Vladis Dronov <vdronov@...hat.com>)
[CVE-2017-14266] tcprewrite Heap-Based Buffer Overflow (Luciano Bello <luciano@...ian.org>)
CVE-2017-9803: Security vulnerability in kerberos delegation token functionality (Shalin Shekhar Mangar <shalin@...che.org>)
Re: [OSSN-0081] sha512_crypt is insufficient for password hashing (Jordan Glover <Golden_Miller83@...tonmail.ch>)
Re: [OSSN-0081] sha512_crypt is insufficient for password hashing (Jeremy Stanley <fungi@...goth.org>)
Re: [OSSN-0081] sha512_crypt is insufficient for password hashing (Nicholas Prowse <nick5990@...oo.co.uk>)

September 19 (2 messages)

[SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP upload (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosure (Mark Thomas <markt@...che.org>)

September 20 (1 message)

Re: [CVE-2017-14266] tcprewrite Heap-Based Buffer Overflow (Luciano Bello <luciano@...ian.org>)

September 21 (7 messages)

CVE-2017-14609 Kannel privilege escalation via PID file manipulation (Michael Orlitzky <michael@...itzky.com>)
CVE-2017-14160: libvorbis-1.3.5 bark_noise_hybridmp() integer signedness bug (连一汉 <lianyihan@....cn>)
Re: CVE-2017-14160: libvorbis-1.3.5 bark_noise_hybridmp() integer signedness bug (Solar Designer <solar@...nwall.com>)
CVE request: code execution in Horde_Image 2.0.0 to 2.5.1 (Thomas Jarosch <thomas.jarosch@...ra2net.com>)
Re: CVE request: code execution in Horde_Image 2.0.0 to 2.5.1 (Thomas Jarosch <thomas.jarosch@...ra2net.com>)
Re: CVE request: code execution in Horde_Image 2.0.0 to 2.5.1 (Thomas Jarosch <thomas.jarosch@...ra2net.com>)
CVE-2017-14681: P3Scan privilege escalation via PID file manipulation (Michael Orlitzky <michael@...itzky.com>)

September 22 (13 messages)

bladeenc: global buffer overflow in iteration_loop (loop.c) ("Agostino Sarubbo" <ago@...too.org>)
graphicsmagick: assertion failure in pixel_cache.c ("Agostino Sarubbo" <ago@...too.org>)
bento4: heap-based buffer overflow in AP4_BitStream::ReadBytes (Ap4BitStream.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: NULL pointer dereference in AP4_Atom::SetType (Ap4Atom.h) ("Agostino Sarubbo" <ago@...too.org>)
bento4: NULL pointer dereference in AP4_AtomSampleTable::GetSample (Ap4AtomSampleTable.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: NULL pointer dereference in AP4_DataAtom::~AP4_DataAtom (Ap4MetaData.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: NULL pointer dereference in AP4_StdcFileByteStream::ReadPartial (Ap4StdCFileByteStream.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: heap-based buffer overflow in AP4_HdlrAtom::AP4_HdlrAtom (Ap4HdlrAtom.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: heap-based buffer overflow in AP4_BytesToUInt32BE (Ap4Utils.h) ("Agostino Sarubbo" <ago@...too.org>)
bento4: heap-based buffer overflow in AP4_DataBuffer::SetData (Ap4DataBuffer.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: stack-based buffer overflow in AP4_VisualSampleEntry::ReadFields (Ap4SampleEntry.cpp) ("Agostino Sarubbo" <ago@...too.org>)
bento4: stack-based buffer underflow in AP4_VisualSampleEntry::ReadFields (Ap4SampleEntry.cpp) ("Agostino Sarubbo" <ago@...too.org>)
CVE-2017-14489: Linux kernel: scsi: nlmsg is not properly parsed in iscsi_if_rx() (Vladis Dronov <vdronov@...hat.com>)

September 23 (9 messages)

Re: [CVE-2017-14266] tcprewrite Heap-Based Buffer Overflow (Salvatore Bonaccorso <carnil@...ian.org>)
Why send bugs embargoed to distros? (Hanno Böck <hanno@...eck.de>)
Re: Why send bugs embargoed to distros? (Levente Polyak <levente@...entepolyak.net>)
Re: Why send bugs embargoed to distros? (Simon McVittie <smcv@...ian.org>)
Re: Why send bugs embargoed to distros? (Anthony Liguori <anthony@...emonkey.ws>)
Re: Why send bugs embargoed to distros? (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: Why send bugs embargoed to distros? (Kurt H Maier <khm@...ops.net>)
Re: Why send bugs embargoed to distros? (Till Dörges <doerges@...-sense.de>)
Re: Why send bugs embargoed to distros? (Marcus Meissner <meissner@...e.de>)

September 24 (2 messages)

Re: Why send bugs embargoed to distros? (ludo@....org (Ludovic Courtès))
Re: tcpdump 4.9.2 is fully available (Leo Famulari <leo@...ulari.name>)

September 25 (8 messages)

Re: Why send bugs embargoed to distros? (Igor Seletskiy <i@...udlinux.com>)
Re: Why send bugs embargoed to distros? (John Haxby <john.haxby@...cle.com>)
Re: CVE-2017-14489: Linux kernel: scsi: nlmsg is not properly parsed in iscsi_if_rx() (Vladis Dronov <vdronov@...hat.com>)
Foreman 1.1+ stored XSS in organizations/locations assignment to hosts (Marek Hulán <mhulan@...hat.com>)
wordpress <= 4.8.1 SQLi (Slavco Mihajloski <slavco.mihajloski@...il.com>)
Re: Why send bugs embargoed to distros? (Cliff Perry <cperry@...hat.com>)
Re: Why send bugs embargoed to distros? (Leo Famulari <leo@...ulari.name>)
Re: CVE-2017-14160: libvorbis-1.3.5 bark_noise_hybridmp() integer signedness bug (Salvatore Bonaccorso <carnil@...ian.org>)

September 26 (23 messages)

Linux kernel CVEs not mentioned on oss-security ("Priedhorsky, Reid" <reidpr@...l.gov>)
Re: Linux kernel CVEs not mentioned on oss-security (Kurt Seifried <kseifried@...hat.com>)
CVE-2017-12154 Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (P J P <ppandit@...hat.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Simon McVittie <smcv@...ian.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Moritz Muehlenhoff <jmm@...ian.org>)
binutils: heap-based buffer overflow in _bfd_x86_elf_get_synthetic_symtab (elfxx-x86.c) ("Agostino Sarubbo" <ago@...too.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Agostino Sarubbo <ago@...too.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Greg KH <greg@...ah.com>)
Advisory: Git cvsserver OS Command Injection (joernchen <joernchen@...noelit.de>)
ImageMagick : CVE-2017-14741 : Infinite loop in ReadCAPTIONImage ("NOIRFATE" <noirfate@....qq.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Nicholas Luedtke <nicholas.luedtke@....com>)
Re: Linux kernel CVEs not mentioned on oss-security (Agostino Sarubbo <ago@...too.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Greg KH <greg@...ah.com>)
CVE-2017-7687: Libprocess might crash when decoding a malformed request. (Alex R <alexr@...che.org>)
CVE-2017-9790: Libprocess might crash when decoding an HTTP request with absent path. (Alex R <alexr@...che.org>)
Qualys Security Advisory - Linux PIE/stack corruption (CVE-2017-1000253) (Qualys Security Advisory <qsa@...lys.com>)
Re: Linux kernel CVEs not mentioned on oss-security ("Priedhorsky, Reid" <reidpr@...l.gov>)
Re: Linux kernel CVEs not mentioned on oss-security (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Linux kernel CVEs not mentioned on oss-security (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Agostino Sarubbo <ago@...too.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: Linux kernel CVEs not mentioned on oss-security (Kurt Seifried <kseifried@...hat.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Kurt Seifried <kseifried@...hat.com>)

September 27 (13 messages)

Re: Linux kernel CVEs not mentioned on oss-security (Marcus Meissner <meissner@...e.de>)
Re: Linux kernel CVEs not mentioned on oss-security (Muhammed Mustapha Abiola <1@...tapha.org>)
Re: binutils: heap-based buffer overflow in _bfd_x86_elf_get_synthetic_symtab (elfxx-x86.c) (Efraim Flashner <efraim@...shner.co.il>)
Re: Linux kernel CVEs not mentioned on oss-security (Solar Designer <solar@...nwall.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Greg KH <greg@...ah.com>)
[SECURITY] CVE-2017-12621 Apache Commons Jelly connects to URL with custom doctype definitions. (Rob Tompkins <chtompki@...che.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Solar Designer <solar@...nwall.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Solar Designer <solar@...nwall.com>)
Vulnerability in Wordpress Plugin backwpup v3.4.1 possible brute forcing of backup file download ("Larry W. Cashdollar" <larry0@...com>)
Re: Linux BlueBorne vulnerabilities (Solar Designer <solar@...nwall.com>)
Re: Qualys Security Advisory - Linux PIE/stack corruption (CVE-2017-1000253) (Solar Designer <solar@...nwall.com>)
Re: [OSSN-0081] sha512_crypt is insufficient for password hashing (Solar Designer <solar@...nwall.com>)
Re: CVE-2017-9772: OCaml release 4.04.2 (Emilio Pozuelo Monfort <pochu27@...il.com>)

September 28 (16 messages)

Re: Linux kernel CVEs not mentioned on oss-security (Salvatore Bonaccorso <carnil@...ian.org>)
OpenVPN CVE-2017-12166: remote buffer overflow (Guido Vranken <guidovranken@...il.com>)
Joomla extension Easy Joomla Backup v3.2.4 database backup exposure ("Larry W. Cashdollar" <larry0@...com>)
Re: Joomla extension Easy Joomla Backup v3.2.4 database backup exposure (David Jardin <david.jardin@...munity.joomla.org>)
Re: Linux kernel CVEs not mentioned on oss-security (Greg KH <greg@...ah.com>)
Re: Linux kernel CVEs not mentioned on oss-security (Greg KH <greg@...ah.com>)
Re: Advisory: Git cvsserver OS Command Injection (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Joomla extension Easy Joomla Backup v3.2.4 database backup exposure ("Larry W. Cashdollar" <larry0@...com>)
Xen Security Advisory 245 - ARM: Some memory not scrubbed at boot (Xen.org security team <security@....org>)
The Internet Bug Bounty: Data Processing (hackerone.com) (Henri Salo <henri@...v.fi>)
Stored XSS vulnerability in Tine 2.0 Community Edition <= 2017.08.3 (chbi@...i.eu)
Stored XSS vulnerability in eGroupware Community Edition <= 16.1.20170703 (chbi@...i.eu)
CSRF vulnerability in Tiki <= 17.0, 16.2, 15.4 LTS and 12.11 LTS (chbi@...i.eu)
Re: CSRF vulnerability in Tiki <= 17.0, 16.2, 15.4 LTS and 12.11 LTS (chbi@...i.eu)
Re: Linux kernel CVEs not mentioned on oss-security (Brad Spengler <spender@...ecurity.net>)
Re: The Internet Bug Bounty: Data Processing (hackerone.com) (Guido Vranken <guidovranken@...il.com>)

September 29 (14 messages)

Re: The Internet Bug Bounty: Data Processing (hackerone.com) (Reed Loden <reed@...dloden.com>)
[CVE-2017-11321] UCOPIA Wireless Appliance < 5.1.8 Restricted Shell Escape (Sysdream Labs <labs@...dream.com>)
[CVE-2017-11322] UCOPIA Wireless Appliance < 5.1.8 Privileges Escalation (Sysdream Labs <labs@...dream.com>)
clamav: Out of bounds read and segfault in xar parser (Hanno Böck <hanno@...eck.de>)
Re: The Internet Bug Bounty: Data Processing (hackerone.com) (Hanno Böck <hanno@...eck.de>)
[CVE-2017-6089] PhpCollab 2.5.1 Multiple SQL Injections (unauthenticated) (Sysdream Labs <labs@...dream.com>)
[CVE-2017-6090] PhpCollab 2.5.1 Arbitrary File Upload (unauthenticated) (Sysdream Labs <labs@...dream.com>)
Re: The Internet Bug Bounty: Data Processing (hackerone.com) (Kurt Seifried <kseifried@...hat.com>)
Re: binutils: heap-based buffer overflow in _bfd_x86_elf_get_synthetic_symtab (elfxx-x86.c) (Agostino Sarubbo <ago@...too.org>)
[SECURITY] CVE-2017-9797 Apache Geode client/server authentication vulnerability (Anthony Baker <abaker@...che.org>)
[SECURITY] CVE-2017-9794 Apache Geode gfsh query vulnerability (Anthony Baker <abaker@...che.org>)
Re: Stored XSS vulnerability in eGroupware Community Edition <= 16.1.20170703 (chbi@...i.eu)
Re: Stored XSS vulnerability in Tine 2.0 Community Edition <= 2017.08.3 (chbi@...i.eu)
Re: CSRF vulnerability in Tiki <= 17.0, 16.2, 15.4 LTS and 12.11 LTS (chbi@...i.eu)

September 30 (4 messages)

binutils: memory allocation failure in _bfd_elf_slurp_version_tables (elf.c) ("Agostino Sarubbo" <ago@...too.org>)
binutils: heap-based buffer overflow in read_1_byte (dwarf2.c) ("Agostino Sarubbo" <ago@...too.org>)
binutils: NULL pointer dereference in scan_unit_for_symbols (dwarf2.c) ("Agostino Sarubbo" <ago@...too.org>)
Re: CVE-2017-14160: libvorbis-1.3.5 bark_noise_hybridmp() integer signedness bug (Guido Günther <agx@...xcpu.org>)

214 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.