oss-security mailing list - 2011/06

Follow us on Twitter or via RSS feeds with tweets or complete announcement texts or excerpts

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2011/06

Messages by day:

June 1 (11 messages)

Re: CVE request for Wireshark 1.4.6/1.2.16 Multiple DoS issues (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request for fetchmail STARTTLS hang (Denial of Service) (Matthias Andree <matthias.andree@....de>)
CVE Request -- OpenOffice.org -- InteVyDis Demo of OpenOffice 0day. Released with VulnDisco 8.8 pack (release date May,200… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: openssl timing attack (Solar Designer <solar@...nwall.com>)
CVE request -- libvirt: regression introduced in disk probe logic (Petr Matousek <pmatouse@...hat.com>)
Re: Closed list (Solar Designer <solar@...nwall.com>)
Re: Closed list (Solar Designer <solar@...nwall.com>)
Re: Closed list (akuster <akuster@...sta.com>)
Re: CVE request for Wireshark 1.4.5 TCP DoS issue (Josh Bressers <bressers@...hat.com>)
2 more messages

June 2 (7 messages)

CVE request: Multiple security vulnerabilities in ARSC Really Simple Chat (Henri Salo <henri@...v.fi>)
CVE Request -- Cherokee -- server admin vulnerable to csrf (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- OpenOffice.org -- InteVyDis Demo of OpenOffice 0day. Released with VulnDisco 8.8 pack (release date May… (Josh Bressers <bressers@...hat.com>)
Re: CVE request -- libvirt: regression introduced in disk probe logic (Josh Bressers <bressers@...hat.com>)
Re: CVE request: XSS in nagios (Josh Bressers <bressers@...hat.com>)
Re: CVE request: Multiple security vulnerabilities in ARSC Really Simple Chat (Josh Bressers <bressers@...hat.com>)

June 3 (12 messages)

CVE request: kernel: ksm: race between ksmd and exiting task (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: set cred->user_ns in key_replace_session_keyring (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Eugene Teo <eugene@...hat.com>)
Re: CVE Request -- Cherokee -- server admin vulnerable to csrf (dave b <db.pub.mail@...il.com>)
CVE Request -- fabric -- Use of insecure temporary file by uploading templates and projects to remote hosts (Jan Lieskovsky <jlieskov@...hat.com>)
Security issue in cherokee (Jamie Strandboge <jamie@...onical.com>)
Security issue in gitweb (Jamie Strandboge <jamie@...onical.com>)
CVE Request / Discussion -- dirmngr -- Improper dealing with blocking system calls, when verifying a certificate (Jan Lieskovsky <jlieskov@...hat.com>)
Re: XSS security issue in gitweb for 'blob_plain' view with HTML files (Jakub Narebski <jnareb@...il.com>)
3 more messages

June 4 (3 messages)

Re: XSS security issue in gitweb for 'blob_plain' view with HTML files (Jakub Narebski <jnareb@...il.com>)
Re: CVE request: openssl timing attack (Michael Gilbert <michael.s.gilbert@...il.com>)
Re: CVE request: openssl timing attack (Solar Designer <solar@...nwall.com>)

June 5 (1 message)

Re: CVE request: kernel: fs/partitions: Kernel heap overflow via corrupted LDM partition tables (Timo Warns <warns@...-sense.de>)

June 6 (26 messages)

Re: CVE request: kernel: ksm: race between ksmd and exiting task (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE request: kernel: set cred->user_ns in key_replace_session_keyring (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request: pam_ssh not dropping root gid(s) (Sebastian Krahmer <krahmer@...e.de>)
CVE Request -- LuaExpat -- Prone to XML "billion laughs attack" (Jan Lieskovsky <jlieskov@...hat.com>)
fetchmail 6.3.20 release to fix CVE-2011-1947 (was: CVE request for fetchmail STARTTLS hang (Denial of Service)) (Matthias Andree <matthias.andree@....de>)
Re: CVE request: pam_ssh not dropping root gid(s) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request: pam_ssh not dropping root gid(s) (Thomas Biege <thomas@...e.de>)
CVE Request -- vsftpd -- Do not create network namespace per connection (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request -- vsftpd -- Do not create network namespace per connection (Greg KH <greg@...ah.com>)
17 more messages

June 7 (3 messages)

Re: CVE request: pam_ssh not dropping root gid(s) (Sebastian Krahmer <krahmer@...e.de>)
CVE request: vlc (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE Request -- WebSVN -- execCommand() remote commands injection vulnerability (Jan Lieskovsky <jlieskov@...hat.com>)

June 8 (6 messages)

Re: CVE request: Multiple security vulnerabilities in ARSC Really Simple Chat ("Steven M. Christey" <coley@...-smtp.mitre.org>)
CVE Request -- Coppermine Photo Gallery -- cpg1.4.27 / cpg1.5.12 -- XSS flaw (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Josh Bressers <bressers@...hat.com>)
Re: CVE request: vlc (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- WebSVN -- execCommand() remote commands injection vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE Request -- Coppermine Photo Gallery -- cpg1.4.27 / cpg1.5.12 -- XSS flaw (Josh Bressers <bressers@...hat.com>)

June 9 (3 messages)

Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE Request: Ruby on Rails 3/rails_xss XSS (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE Request -- vte -- Excessive memory and CPU use by processing certain character sequences (Jan Lieskovsky <jlieskov@...hat.com>)

June 10 (2 messages)

Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl ("Bernhard Rosenkraenzer" <bero@...linux.ch>)

June 11 (1 message)

CVE request: buffer overflow in tftp-hpa (Timo Warns <warns@...-sense.de>)

June 12 (5 messages)

CVE Request -- dbus -- Local DoS via messages with non-native byte order (Jan Lieskovsky <jlieskov@...hat.com>)
Bug#629938: Info received (CVE Request -- dbus -- Local DoS via messages with non-native byte order) (owner@...s.debian.org (Debian Bug Tracking System))
CVE Request -- Data-FormValidator -- Reports invalid field as valid when untaint_all_constraints used (Jan Lieskovsky <jlieskov@...hat.com>)
Bug#629511: Info received (CVE Request -- Data-FormValidator -- Reports invalid field as valid when untaint_all_constra… (owner@...s.debian.org (Debian Bug Track…)
CVE Request: PHP File upload filename (Felipe Pena <felipensp@...il.com>)

June 13 (17 messages)

CVE request: kernel: hfs_find_init() sb->ext_tree NULL pointer dereference (Eugene Teo <eugene@...hat.com>)
CVE request: kernel: alpha: fix several security issues (Eugene Teo <eugene@...hat.com>)
CVE Request -- libvoikko -- DoS of application linked against libvoikko due improper handling of embedded null characters … (Jan Lieskovsky <jlieskov@...hat.com>)
CVE-request: XSS in Webmin 1.540 (Henri Salo <henri@...v.fi>)
Re: CVE Request -- Data-FormValidator -- Reports invalid field as valid when untaint_all_constraints used (Mark Stosberg <mark@...mersault.com>)
Re: CVE-request: XSS in Webmin 1.540 (Javier Bassi <javierbassi@...il.com>)
Re: CVE-request: XSS in Webmin 1.540 ("Jamie Cameron" <jcameron@...min.com>)
Re: Re: CVE-request: XSS in Webmin 1.540 (Josh Bressers <bressers@...hat.com>)
Re: CVE Request: Ruby on Rails 3/rails_xss XSS (Josh Bressers <bressers@...hat.com>)
8 more messages

June 14 (6 messages)

Re: CVE request: Alpha kernel issues (Eugene Teo <eugene@...hat.com>)
Re: Re: XSS security issue in gitweb for 'blob_plain' view with HTML files (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: [CVE-2011-2186] XSS security issue in gitweb for 'blob_plain' view with HTML files (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: [CVE-2011-2186] XSS security issue in gitweb for 'blob_plain' view with HTML files (Jakub Narebski <jnareb@...il.com>)
[CVE-2011-2186] [PATCH] gitweb: Enable $prevent_xss by default (Jakub Narebski <jnareb@...il.com>)
CVE Request: prosody DoS, djabberd external entity injection (Wouter Coekaerts <wouter@...kaerts.be>)

June 15 (7 messages)

Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) (Luka Marinko <luka.marinko@...il.com>)
Re: CVE Request / Discussion -- dirmngr -- Improper dealing with blocking system calls, when verifying a certificate (Bernhard Reiter <bernhard@...evation.de>)
Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) (Ondrej Vasik <ovasik@...hat.com>)
Re: CVE Request: prosody DoS, djabberd external entity injection (Josh Bressers <bressers@...hat.com>)
Re: CVE Request / Discussion -- dirmngr -- Improper dealing with blocking system calls, when verifying a certificate (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: alpha: fix several security issues (Josh Bressers <bressers@...hat.com>)

June 16 (7 messages)

CVE request: FreeBSD/NetBSD 802.11 kernel memory disclosure (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) (Nicolas François <nicolas.francois@...traliens.net>)
Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) (Nicolas François <nicolas.francois@...traliens.net>)
Re: CVE request: Several Moodle issues (Moritz Mühlenhoff <jmm@...til.org>)
Re: list archive (Tomas Hoger <thoger@...hat.com>)
Re: Closed list (Tomas Hoger <thoger@...hat.com>)
Re: Closed list (Tomas Hoger <thoger@...hat.com>)

June 19 (1 message)

Re: Multiple libraries privilege checking (Florian Weimer <fw@...eb.enyo.de>)

June 20 (17 messages)

CVE request: kernel: inet_diag: fix inet_diag_bc_audit() (Eugene Teo <eugene@...hat.com>)
CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Daniel Godás <dgodas@...il.com>)
Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) (Karel Zak <kzak@...hat.com>)
Re: CVE request: FreeBSD/NetBSD 802.11 kernel memory disclosure (Dan Rosenberg <dan.j.rosenberg@...il.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (The Fungi <fungi@...goth.org>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (The Fungi <fungi@...goth.org>)
8 more messages

June 21 (16 messages)

Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Josh Bressers <bressers@...hat.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Josh Bressers <bressers@...hat.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
7 more messages

June 22 (7 messages)

CVE request: kernel: taskstats local DoS (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE request: kernel: taskstats local DoS (Eugene Teo <eugene@...hat.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
CVE requests: opie off by one and setuid() failure (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE requests: opie off by one and setuid() failure (Vasiliy Kulikov <segoon@...nwall.com>)

June 23 (7 messages)

NetworkManager: did not honour PolicyKit auth_admin action element by creation of Ad-Hoc wireless networks (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE request: kernel: NLM: Don't hang forever on NLM unlock requests (Eugene Teo <eugene@...hat.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
Re: CVE request: Joomla unspecified information disclosure vulnerability (Josh Bressers <bressers@...hat.com>)
Re: CVE requests: opie off by one and setuid() failure (Josh Bressers <bressers@...hat.com>)
Re: CVE request: kernel: NLM: Don't hang forever on NLM unlock requests (Josh Bressers <bressers@...hat.com>)
CVE request: kernel: ext4: init timer earlier to avoid a kernel panic in __save_error_info (Kees Cook <kees@...ntu.com>)

June 24 (9 messages)

Re: CVE request: crypt_blowfish 8-bit character mishandling (Solar Designer <solar@...nwall.com>)
CVE request: kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace (Eugene Teo <eugene@...hat.com>)
Re: CVE request: kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace (Murray McAllister <mmcallis@...hat.com>)
Re: CVE request: kernel: ext4: init timer earlier to avoid a kernel panic in __save_error_info (Eugene Teo <eugene@...hat.com>)
CVE-2011-2485 assignment notification -- gdk-pixbuf (Jan Lieskovsky <jlieskov@...hat.com>)
CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Vasiliy Kulikov <segoon@...nwall.com>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Djalal Harouni <tixxdz@...ndz.org>)
CVE request: kernel: mm: avoid wrapping vm_pgoff in mremap() and stack expansions (Petr Matousek <pmatouse@...hat.com>)
CVE request: kernel: remote buffer overflow in bluetooth (Dan Rosenberg <dan.j.rosenberg@...il.com>)

June 25 (1 message)

Re: CVE request: kernel: taskstats/procfs io infoleak (Vasiliy Kulikov <segoon@...nwall.com>)

June 27 (13 messages)

Re: CVE request: kernel: taskstats/procfs io infoleak (Eugene Teo <eugeneteo@...nel.org>)
Re: CVE request: kernel: mm: avoid wrapping vm_pgoff in mremap() and stack expansions (Eugene Teo <eteo@...hat.com>)
Re: CVE request: kernel: remote buffer overflow in bluetooth (Eugene Teo <eugene@...hat.com>)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Linus Torvalds <torvalds@...ux-foundati…)
CVE Request: Mambo CMS 4.6.x | Multiple Cross Site Scripting Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
Re: CVE request: Joomla unspecified information disclosure vulnerability (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request: nfs-utils (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: CVE request: Joomla unspecified information disclosure vulnerability (Henri Salo <henri@...v.fi>)
Re: CVE request: crypt_blowfish 8-bit character mishandling (Ludwig Nussel <ludwig.nussel@...e.de>)
4 more messages

June 28 (18 messages)

CVE request: kernel: oom: use pte pages in OOM score (Eugene Teo <eugene@...hat.com>)
CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities (Mango <h@...r.se>)
Re: CVE request: kernel: oom: use pte pages in OOM score (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
CVE Request: Joomla! 1.6.3 and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities (YGN Ethical Hacker Group <lists@...g.net>)
CVE Request -- DokuWiki -- XSS in DokuWiki's RSS embedding mechanism (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities (Jan Lieskovsky <jlieskov@...hat.com>)
Bug#631818: Info received (CVE Request -- DokuWiki -- XSS in DokuWiki's RSS embedding mechanism) (owner@...s.debian.org (Debian Bug Tracking System))
Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities (Herman van Rink <rink@...tfour.nl>)
CVE request: libvirt: integer overflow in VirDomainGetVcpus (Petr Matousek <pmatouse@...hat.com>)
9 more messages

June 29 (16 messages)

Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Linus Torvalds <torvalds@...ux-foundati…)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Linus Torvalds <torvalds@...ux-foundati…)
Re: CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Eugene Teo <eugeneteo@...nel.org>)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Vasiliy Kulikov <segoon@...nwall.com>)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Vasiliy Kulikov <segoon@...nwall.com>)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Vasiliy Kulikov <segoon@...nwall.com>)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Vasiliy Kulikov <segoon@...nwall.com>)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Linus Torvalds <torvalds@...ux-foundati…)
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) (Vasiliy Kulikov <segoon@...nwall.com>)
7 more messages

June 30 (2 messages)

CVE request: kernel: tomoyo: oops in tomoyo_mount_acl() (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request: kernel: taskstats local DoS (Vasiliy Kulikov <segoon@...nwall.com>)

224 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ