oss-security mailing list - 2012/06

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2012/06

Messages by day:

June 1 (4 messages)

Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Kurt Seifried <kseifried@...hat.com>)

June 2 (1 message)

Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (Stefan Behte <craig@...too.org>)

June 4 (6 messages)

CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version (Jan Lieskovsky <jlieskov@...hat.com>)
Re: fix to CVE-2009-4307 (Xi Wang <xi.wang@...il.com>)
Re: CVE Request for Drupal contributed modules (Greg Knaddison <greg.knaddison@...uia.com>)
Re: CVE Request for Drupal contributed modules (Solar Designer <solar@...nwall.com>)
Re: CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal contributed modules (Greg Knaddison <greg.knaddison@...uia.com>)

June 5 (4 messages)

memory allocator upstream patches (Xi Wang <xi.wang@...il.com>)
Re: CVE Request -- Symfony / php-symfony-symfony: Session fixation flaw corrected in upstream 1.4.18 version (Kurt Seifried <kseifried@...hat.com>)
BIND: Handling of zero length rdata can cause named to terminate unexpectedly (Solar Designer <solar@...nwall.com>)
CVE request: openldap does not honor TLSCipherSuite configuration option (Vincent Danen <vdanen@...hat.com>)

June 6 (12 messages)

Re: CVE request: openldap does not honor TLSCipherSuite configuration option (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: openldap does not honor TLSCipherSuite configuration option (Henri Salo <henri@...v.fi>)
Re: CVE id request: Multiple buffer overflow in unixODBC (Kurt Seifried <kseifried@...hat.com>)
CVE request: rack-cache caches sensitive headers (Set-Cookie) (Matthias Weckbecker <mweckbecker@...e.de>)
Re: CVE request: rack-cache caches sensitive headers (Set-Cookie) (Jan Lieskovsky <jlieskov@...hat.com>)
Arbitrary File Upload/Execution in Collabtive (Mark Hoopes <xync@...c.org>)
CVE-Request: hyper-v daemon (Sebastian Krahmer <krahmer@...e.de>)
Re: CVE request: rack-cache caches sensitive headers (Set-Cookie) (Kurt Seifried <kseifried@...hat.com>)
Re: Arbitrary File Upload/Execution in Collabtive (Kurt Seifried <kseifried@...hat.com>)
3 more messages

June 7 (13 messages)

Re: CVE-Request: hyper-v daemon (Greg KH <greg@...ah.com>)
CVE request: Mojarra allows deployed web applications to read FacesContext from other applications (David Jorm <djorm@...hat.com>)
Re: CVE request: Mojarra allows deployed web applications to read FacesContext from other applications (Kurt Seifried <kseifried@...hat.com>)
Some notes on CVE's and group privilege dropping (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)
Re: CVE-Request: hyper-v daemon (Marcus Meissner <meissner@...e.de>)
Re: CVE-Request: hyper-v daemon (Greg KH <greg@...ah.com>)
Re: CVE-Request: hyper-v daemon (Marcus Meissner <meissner@...e.de>)
Re: memory allocator upstream patches (Jan Lieskovsky <jlieskov@...hat.com>)
4 more messages

June 8 (2 messages)

Re: CVE request: Piwik before 1.7 (Henri Salo <henri@...v.fi>)
Re: CVE Request -- kernel: tcp: drop SYN+FIN messages (John Haxby <john.haxby@...cle.com>)

June 9 (2 messages)

CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11 (David Hicks <d@...id.au>)
Security vulnerability in MySQL/MariaDB sql/password.c (Sergei Golubchik <serg@...typrogram.com>)

June 11 (6 messages)

CVE request -- libguestfs: virt-edit doesn't preserve file permissions (Petr Matousek <pmatouse@...hat.com>)
CVE request -- libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored (Petr Matousek <pmatouse@...hat.com>)
Re: CVE request -- libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored (Kurt Seifried <kseifried@...hat.com>)
Re: Re: WHMCS 5.0.2> SQLi CVE Request (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request -- libguestfs: virt-edit doesn't preserve file permissions (Kurt Seifried <kseifried@...hat.com>)
Re: CVE requests (x2) for Mantis Bug Tracker (MantisBT) before 1.2.11 (Kurt Seifried <kseifried@...hat.com>)

June 12 (5 messages)

Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation (Xen.org security team <security@....org>)
Xen Security Advisory 8 (CVE-2012-0218) - syscall/enter guest DoS (Xen.org security team <security@....org>)
Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Xen.org security team <security@....org>)
Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694) (Aaron Patterson <tenderlove@...y-lang.org>)
Ruby on Rails SQL Injection (CVE-2012-2695) (Aaron Patterson <tenderlove@...y-lang.org>)

June 14 (4 messages)

CVE request: XSS in uselang http parameter (mediawiki) (Vincent Danen <vdanen@...hat.com>)
Re: CVE request: XSS in uselang http parameter (mediawiki) (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Florian Weimer <fw@...eb.enyo.de>)

June 15 (12 messages)

CVE Request: NetworkManager creates an open network when asked to create an adhoc-WPA network (Huzaifa Sidhpurwala <huzaifas@...hat.com>)
Re: CVE Request: NetworkManager creates an open network when asked to create an adhoc-WPA network (Kurt Seifried <kseifried@...hat.com>)
CVE-2012-3345: symlink attack in ioquake3 >= r1773, < r2253 (Simon McVittie <smcv@...ian.org>)
Re: CVE Request: NetworkManager creates an open network when asked to create an adhoc-WPA network (Yves-Alexis Perez <corsac@...ian.org>)
Re: CVE Request for Drupal contributed modules (Henri Salo <henri@...v.fi>)
Re: CVE Request for Drupal contributed modules (Kurt Seifried <kseifried@...hat.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Giles Coochey <giles@...chey.net>)
Re: CVE Request -- mosh (and probably vte too): mosh server DoS (long loop) due improper parsing of terminal parameters … (Stefan Cornelius <scorneli@...hat.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Florian Weimer <fw@...eb.enyo.de>)
3 more messages

June 16 (1 message)

CVE request: phplist before 2.10.18 XSS and sql injection (Hanno Böck <hanno@...eck.de>)

June 17 (2 messages)

Re: CVE request: java hashdos vulnerability (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: phplist before 2.10.18 XSS and sql injection (Kurt Seifried <kseifried@...hat.com>)

June 18 (3 messages)

CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase through … (Jan Lieskovsky <jlieskov@...hat.com>)
Re: MySQL CVEs (was: Security vulnerability in MySQL/MariaDB sql/password.c) (Tomas Hoger <thoger@...hat.com>)
Re: CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase thro… (Kurt Seifried <kseifried@...hat.com>)

June 19 (4 messages)

Joomla! Security News 2012-06-19 (Henri Salo <henri@...v.fi>)
Re: Joomla! Security News 2012-06-19 (Kurt Seifried <kseifried@...hat.com>)
Re: MySQL CVEs (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request -- Revelation: 1) Limits effective password length to 32 characters 2) Doesn't iterate the passphrase t… ("Steven M. Christey" <coley@...-smtp.mi…)

June 20 (1 message)

Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Marcus Meissner <meissner@...e.de>)

June 22 (2 messages)

mod_security CVE request (Kurt Seifried <kseifried@...hat.com>)
Re: mod_security CVE request (Kurt Seifried <kseifried@...hat.com>)

June 24 (3 messages)

CVE request: CSRF in eXtplorer (Luciano Bello <luciano@...ian.org>)
CVE request: Full path disclosure in DokuWiki (Felipe Pena <felipensp@...il.com>)
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) (Florian Weimer <fw@...eb.enyo.de>)

June 25 (9 messages)

Re: CVE request: CSRF in eXtplorer (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: Full path disclosure in DokuWiki (Kurt Seifried <kseifried@...hat.com>)
Xen vulnerability disclosure process, recent timeline (Solar Designer <solar@...nwall.com>)
CVE Request: viewvc (Ludwig Nussel <ludwig.nussel@...e.de>)
CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Album',… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Alb… (Jan Lieskovsky <jlieskov@...hat.com>)
Re: CVE 2011-* Request -- rhythmbox (context plug-in): Insecure temporary directory use by loading template files for 'Alb… (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: viewvc (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request: CSRF in eXtplorer (Moritz Muehlenhoff <jmm@...ian.org>)

June 26 (4 messages)

Re: CVE request: CSRF in eXtplorer (Luciano Bello <luciano@...ian.org>)
XXE in Zend (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
CVE-2012-2639 reject request (duplicate of CVE-2011-4940) (Jan Lieskovsky <jlieskov@...hat.com>)
Re: XXE in Zend (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)

June 27 (11 messages)

Re: CVE request: CSRF in eXtplorer (Kurt Seifried <kseifried@...hat.com>)
Re: XXE in Zend (Kurt Seifried <kseifried@...hat.com>)
CVE Request -- dtach: Memory portion (random stack data) disclosure to the client by unclean client disconnect (Jan Lieskovsky <jlieskov@...hat.com>)
Re: MySQL CVEs (was: Security vulnerability in MySQL/MariaDB sql/password.c) (Tomas Hoger <thoger@...hat.com>)
please verify unusual x.509 constraints are handled (Tavis Ormandy <taviso@...xchg8b.com>)
Re: please verify unusual x.509 constraints are handled (Ludwig Nussel <ludwig.nussel@...e.de>)
Re: please verify unusual x.509 constraints are handled (Tim <tim-security@...tinelchicken.org>)
CVE Request: Kernel [PATCH] NFC: prevent multiple buffer overflows in NCI (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: Kernel [PATCH] NFC: prevent multiple buffer overflows in NCI (Kurt Seifried <kseifried@...hat.com>)
2 more messages

June 28 (12 messages)

Re: CVE request: arbitrary code exec in bcfg2 (Kurt Seifried <kseifried@...hat.com>)
PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Kurt Seifried <kseifried@...hat.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Pierre Joye <pierre.php@...il.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Matthias Weckbecker <mweckbecker@...e.de>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Kurt Seifried <kseifried@...hat.com>)
Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Johannes Schlüter <johannes@....net>)
Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Stuart Henderson <stu@...cehopper.org>)
RE: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (Zeev Suraski <zeev@...d.com>)
accountsservice local file disclosure flaw (CVE-2012-2737) (Vincent Danen <vdanen@...hat.com>)
3 more messages

June 29 (4 messages)

Re: CVE Request -- dtach: Memory portion (random stack data) disclosure to the client by unclean client disconnect (Kurt Seifried <kseifried@...hat.com>)
Irfanview Plugins JLS Decompression ("Joseph Sheridan" <joe@...ctionis.com>)
GIMP FIT File Format DoS ("Joseph Sheridan" <joe@...ctionis.com>)
RE: GIMP FIT File Format DoS ("Morris, Patrick" <patrick.morris@...com>)

June 30 (1 message)

Re: RE: GIMP FIT File Format DoS (Benji <me@...ji.com>)

128 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ