Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list - 2017/06

Messages by day:

June 1 (14 messages)

• Re: Information on recent sqlite3 issues? (Agostino Sarubbo <ago@...too.org>)
• CVE-2017-9334 CHICKEN Scheme: denial of service due to invalid pointer dereference (Peter Bex <peter@...e-magic.net>)
• CVE-2017-9330 Qemu: usb: ohci: infinite loop due to incorrect return value (P J P <ppandit@...hat.com>)
• Re: Information on recent sqlite3 issues? (Johannes Segitz <jsegitz@...e.de>)
• Re: Information on recent sqlite3 issues? (Kurt Seifried <kseifrie@...hat.com>)
• Re: Information on recent sqlite3 issues? (Moritz Muehlenhoff <jmm@...ian.org>)
• Re: Information on recent sqlite3 issues? (Nicholas Luedtke <nsl@....com>)
• unresponsive distros (Solar Designer <solar@...nwall.com>)
• Re: unresponsive distros ("Liguori, Anthony" <aliguori@...zon.com>)
• Re: unresponsive distros (Solar Designer <solar@...nwall.com>)
• Re: unresponsive distros ("Liguori, Anthony" <aliguori@...zon.com>)
• Re: unresponsive distros ("Liguori, Anthony" <aliguori@...zon.com>)
• Re: unresponsive distros (Solar Designer <solar@...nwall.com>)
• Re: unresponsive distros (Solar Designer <solar@...nwall.com>)

• CVE-2017-7669: Apache Hadoop privilege escalation (Varun Vasudev <vvasudev@...che.org>)
• CVE-2017-7505: User scoped in organization with permissions for user management can manage administrators that are not assigned… (Marek Hulán <mhulan@...hat.com>)
• What happens in order to get CVE numbers (Qhdwns123 <qhdwns123@...tonmail.com>)
• Re: What happens in order to get CVE numbers (Qhdwns123 <qhdwns123@...tonmail.com>)
• Re: What happens in order to get CVE numbers ("kseifried@...hat.com" <kseifried@...hat.com>)
• Unauthenticated Stored XSS Vulnerability in Wordpress plugin gift-certificate-creator v1.0 ("Larry W. Cashdollar" <larry0@...com>)
• Arbitrary terminal access via sudo on Linux ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
• Re: Arbitrary terminal access via sudo on Linux (Kurt Seifried <kseifried@...hat.com>)
• Re: Arbitrary terminal access via sudo on Linux ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
• Re: What happens in order to get CVE numbers (Leo Famulari <leo@...ulari.name>)

• Re: What happens in order to get CVE numbers (Kurt Seifried <kseifried@...hat.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Florian Weimer <fweimer@...hat.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Daniel Micay <danielmicay@...il.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Daniel Micay <danielmicay@...il.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Daniel Micay <danielmicay@...il.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Solar Designer <solar@...nwall.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Daniel Micay <danielmicay@...il.com>)
• Re: Linux kernel: stack buffer overflow with controlled payload in get_options() function (Solar Designer <solar@...nwall.com>)
• TIOCSTI not going away (Solar Designer <solar@...nwall.com>)

• Re: TIOCSTI not going away (Karel Zak <kzak@...hat.com>)
• Re: TIOCSTI not going away (Lizzie Dixon <_@...zie.io>)
• Re: Information on recent sqlite3 issues? (Moritz Muehlenhoff <jmm@...ian.org>)

• CVE-2017-9373 Qemu: ide: ahci host memory leakage during hotunplug (P J P <ppandit@...hat.com>)
• CVE-2017-9375 Qemu: usb: xhci infinite recursive call via xhci_kick_ep (P J P <ppandit@...hat.com>)

• Re: Information on recent sqlite3 issues? (Salvatore Bonaccorso <carnil@...ian.org>)
• Crypto++ and invalid read in decompressor class (Jeffrey Walton <noloader@...il.com>)
• CVE-2017-9374 Qemu: usb: ehci host memory leakage during hotunplug (P J P <ppandit@...hat.com>)
• FYI: Irssi Security Advisory 2017/06 (Ailin Nemui <ailin.nemui@...il.com>)
• CVE-2017-9148 FreeRADIUS TLS resumption authentication bypass (erratum) (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
• Re: Arbitrary terminal access via sudo on Linux (Qualys Security Advisory <qsa@...lys.com>)

• two heap overflows in raptor (Hanno Böck <hanno@...eck.de>)
• Re: CVE-2017-9468, CVE-2017-9469: Irssi Security Advisory 2017/06 (Ailin Nemui <ailin.nemui@...il.com>)
• ytnef: heap-based buffer overflow in PrintTNEF (ytnefprint/main.c) ("Agostino Sarubbo" <ago@...too.org>)
• ytnef: NULL pointer dereference in MAPIPrint (ytnef.c) ("Agostino Sarubbo" <ago@...too.org>)
• ytnef: heap-based-buffer overflow in SwapWord (ytnef.c) ("Agostino Sarubbo" <ago@...too.org>)
• ytnef: heap-based buffer overflow in SwapDWord (ytnef.c) ("Agostino Sarubbo" <ago@...too.org>)
• ytnef: memory allocation failure in TNEFFillMapi (ytnef.c) ("Agostino Sarubbo" <ago@...too.org>)
• ytnef: heap-based buffer overflow in DecompressRTF (ytnef.c) ("Agostino Sarubbo" <ago@...too.org>)
• CVE update - fixed in Apache Ranger 0.7.1 (Velmurugan Periasamy <vel@...che.org>)

• CVE-2017-9503 Qemu: scsi: null pointer dereference while processing megasas command (P J P <ppandit@...hat.com>)
• Re: [FD] libcroco multiple vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
• Vixie/ISC Cron group crontab to root escalation (Solar Designer <solar@...nwall.com>)
• How long does DWF usually take to issue cve? (Qhdwns123 <qhdwns123@...tonmail.com>)
• Is not memory allocation failure a bug? (Qhdwns123 <qhdwns123@...tonmail.com>)
• Re: Is not memory allocation failure a bug? (Marcus Meissner <meissner@...e.de>)
• Re: How long does DWF usually take to issue cve? (Kurt Seifried <kseifrie@...hat.com>)
• Re: Is not memory allocation failure a bug? (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
• Re: Is not memory allocation failure a bug? (Glenn Randers-Pehrson <glennrp@...il.com>)
• Re: Is not memory allocation failure a bug? (Kurt Seifried <kseifried@...hat.com>)
• MySQL - use-after-free after mysql_stmt_close() (Pali Rohár <pali.rohar@...il.com>)
• Re: Vixie/ISC Cron group crontab to root escalation (Ian Zimmerman <itz@...mate.net>)

• Security bug report read-protected (Qhdwns123 <qhdwns123@...tonmail.com>)
• Re: Security bug report read-protected (Johannes Bauer <zugtprgfwprz@...rnkuller.de>)
• Re: Security bug report read-protected (Andreas Stieger <astieger@...e.com>)
• Re: Vixie/ISC Cron group crontab to root escalation (christos@...las.com (Christos Zoulas))
• Re: Vixie/ISC Cron group crontab to root escalation (Solar Designer <solar@...nwall.com>)
• Re: Vixie/ISC Cron group crontab to root escalation (christos@...las.com (Christos Zoulas))
• Re: Vixie/ISC Cron group crontab to root escalation (Salvatore Bonaccorso <carnil@...ian.org>)

• Berkeley DB reads DB_CONFIG from cwd (Jakub Wilk <jwilk@...lk.net>)

• [ANNOUNCE] Apache NiFi CVE-2017-7667 and CVE-2017-7665 (Matt Gilman <mcgilman@...che.org>)

• CVE-2017-9524 Qemu: nbd: segmentation fault due to client non-negotiation (P J P <ppandit@...hat.com>)
• Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer (Alexander Potapenko <glider@...gle.com>)
• Re: Vixie/ISC Cron group crontab to root escalation (Casper.Dik@...cle.com)
• Re: Vixie/ISC Cron group crontab to root escalation (Alan Coopersmith <alan.coopersmith@...cle.com>)

• Re: MySQL - use-after-free after mysql_stmt_close() (Pali Rohár <pali.rohar@...il.com>)
• Linux kernel: drm/vmwgfx: 4 byte read of uninitialised kernel memory in vmw_gb_surface_define_ioctl() (Murray McAllister <murray.mcallister@...omniasec.com>)
• Re: Vixie/ISC Cron group crontab to root escalation (Fiedler Roman <Roman.Fiedler@....ac.at>)
• Re: Vixie/ISC Cron group crontab to root escalation (Jakub Wilk <jwilk@...lk.net>)
• Re: Vixie/ISC Cron group crontab to root escalation (Fiedler Roman <Roman.Fiedler@....ac.at>)
• Re: Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer (Adam Maris <amaris@...hat.com>)
• OpenJDK: java(1): untrusted search path (Jakub Wilk <jwilk@...lk.net>)
• Re: Vixie/ISC Cron group crontab to root escalation (Florian Weimer <fweimer@...hat.com>)
• Re: Vixie/ISC Cron group crontab to root escalation (Fiedler Roman <Roman.Fiedler@....ac.at>)
• Re: OpenJDK: java(1): untrusted search path (Stiepan <stie@....swiss>)
• Re: Linux kernel: drm/vmwgfx: 4 byte read of uninitialised kernel memory in vmw_gb_surface_define_ioctl() (Murray McAllister <murray.mcallister@...omniasec.com…)

• [SECURITY ADVISORY] curl: URL file scheme drive letter buffer overflow (Daniel Stenberg <daniel@...x.se>)
• Re: Qualys Security Advisory - CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux (Qualys Security Advisory <qsa@...lys.com>)
• Re: Berkeley DB reads DB_CONFIG from cwd (Solar Designer <solar@...nwall.com>)
• BIND9 CVE-2017-3140 & CVE-2017-3141 (ISC Security Officer <security-officer@....org>)

• Re: Re: MySQL - use-after-free after mysql_stmt_close() (Adam Maris <amaris@...hat.com>)
• Re: Re: MySQL - use-after-free after mysql_stmt_close() (Kurt Seifried <kseifried@...hat.com>)
• Re: Berkeley DB reads DB_CONFIG from cwd (Solar Designer <solar@...nwall.com>)
• Re: Re: MySQL - use-after-free after mysql_stmt_close() (Kurt H Maier <khm@...ops.net>)
• Re: Re: MySQL - use-after-free after mysql_stmt_close() (Feng Cao <feng.cao@...cle.com>)
• Re: Re: MySQL - use-after-free after mysql_stmt_close() ("kseifried@...hat.com" <kseifried@...hat.com>)
• Re: Berkeley DB reads DB_CONFIG from cwd (Ritwik Ghoshal <ritwik.ghoshal@...cle.com>)
• Re: Re: MySQL - use-after-free after mysql_stmt_close() (Seth Arnold <seth.arnold@...onical.com>)
• CVE request: sthttpd remote heap buffer overflow (Alexandre Rebert <alex@...allsecure.com>)
• Re: Re: MySQL - use-after-free after mysql_stmt_close() (Brian May <brian@...uxpenguins.xyz>)

• Do I have to inform someone about CVE? (Qhdwns123 <qhdwns123@...tonmail.com>)
• Re: Do I have to inform someone about CVE? (Solar Designer <solar@...nwall.com>)
• Re: Do I have to inform someone about CVE? (Kurt Seifried <kseifried@...hat.com>)
• two vulns in uClibc-0.9.33.2 ("fefe" <qbenjin@...com>)
• Re: two vulns in uClibc-0.9.33.2 (Andrej Nemec <anemec@...hat.com>)
• Re: CVE request: sthttpd remote heap buffer overflow (Andrej Nemec <anemec@...hat.com>)
• Re: two vulns in uClibc-0.9.33.2 (Zach W <kestrel@...linux.us>)
• Re: two vulns in uClibc-0.9.33.2 (Peter Korsgaard <peter@...sgaard.com>)
• Re: two vulns in uClibc-0.9.33.2 (Seth Arnold <seth.arnold@...onical.com>)
• Re: two vulns in uClibc-0.9.33.2 (Kurt Seifried <kseifried@...hat.com>)

• Re: two vulns in uClibc-0.9.33.2 (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: two vulns in uClibc-0.9.33.2 (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
• Re: two vulns in uClibc-0.9.33.2 (Florian Weimer <fweimer@...hat.com>)
• Re: two vulns in uClibc-0.9.33.2 (Michal Zalewski <lcamtuf@...edump.cx>)
• Re: two vulns in uClibc-0.9.33.2 (Simon McVittie <smcv@...ian.org>)
• Re: two vulns in uClibc-0.9.33.2 (Jakub Wilk <jwilk@...lk.net>)
• Expat 2.2.1 security fixes (Sebastian Pipping <sebastian@...ping.org>)

• Qualys Security Advisory - The Stack Clash (Qualys Security Advisory <qsa@...lys.com>)
• Re: Qualys Security Advisory - The Stack Clash ("kseifried@...hat.com" <kseifried@...hat.com>)
• Re: Qualys Security Advisory - The Stack Clash (Daniel Micay <danielmicay@...il.com>)
• Re: Qualys Security Advisory - The Stack Clash (Marcus Meissner <meissner@...e.de>)
• CVE-2017-7659: mod_http2 null pointer dereference (Jim Jagielski <jim@...che.org>)
• Re: Qualys Security Advisor -- The Stack Clash (Jeff Law <law@...hat.com>)
• Re: Re: Qualys Security Advisor -- The Stack Clash (Daniel Micay <danielmicay@...il.com>)
• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Re: Re: Qualys Security Advisor -- The Stack Clash (Jeff Law <law@...hat.com>)
• CVE-2017-7679: Apache httpd 2.x mod_mime buffer overread (Jacob Champion <jchampion@...che.org>)
• CVE-2017-7668: Apache httpd 2.x ap_find_token buffer overread (Jacob Champion <jchampion@...che.org>)
• CVE-2017-3169: Apache httpd 2.x mod_ssl null pointer dereference (Jacob Champion <jchampion@...che.org>)
• CVE-2017-3167: Apache httpd 2.x ap_get_basic_auth_pw authentication bypass (Jacob Champion <jchampion@...che.org>)

• [SECURITY ADVISORY] c-ares NAPTR parser out of bounds access (Daniel Stenberg <daniel@...x.se>)
• Re: Re: Qualys Security Advisor -- The Stack Clash (Daniel Micay <danielmicay@...il.com>)
• CVE-request: heap-buffer-overflow in jasper (xiaoqixue_1 <xiaoqixue_1@....com>)
• CVE-request: heap-buffer-overflow in jasper (xiaoqixue_1 <xiaoqixue_1@....com>)
• Xen Security Advisory 217 - page transfer may allow PV guest to elevate privilege (Xen.org security team <security@....org>)
• Xen Security Advisory 221 - NULL pointer deref in event channel poll (Xen.org security team <security@....org>)
• Xen Security Advisory 225 - arm: vgic: Out-of-bound access when sending SGIs (Xen.org security team <security@....org>)
• Xen Security Advisory 222 - stale P2M mappings due to insufficient error checking (Xen.org security team <security@....org>)
• Xen Security Advisory 219 - x86: insufficient reference counts during shadow emulation (Xen.org security team <security@....org>)
• Xen Security Advisory 220 - x86: PKRU and BND* leakage between vCPU-s (Xen.org security team <security@....org>)
• Xen Security Advisory 224 - grant table operations mishandle reference counts (Xen.org security team <security@....org>)
• Xen Security Advisory 223 - ARM guest disabling interrupt may crash Xen (Xen.org security team <security@....org>)
• Xen Security Advisory 216 - blkif responses leak backend stack data (Xen.org security team <security@....org>)
• Xen Security Advisory 218 - Races in the grant table unmap code (Xen.org security team <security@....org>)
• Xen Security Advisory 216 - blkif responses leak backend stack data (Xen.org security team <security@....org>)
• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Re: Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer (Alexander Potapenko <glider@...gle.com>)

• Re: two vulns in uClibc-0.9.33.2 ("fefe" <qbenjin@...com>)
• Re: Qualys Security Advisory - The Stack Clash (Agostino Sarubbo <ago@...too.org>)
• Re: CVE-request: heap-buffer-overflow in jasper (Emilio Pozuelo Monfort <pochu@...ian.org>)
• Re:Re: CVE-request: heap-buffer-overflow in jasper (xiaoqixue_1 <xiaoqixue_1@....com>)
• 4 remote vulnerabilities in OpenVPN (Guido Vranken <guidovranken@...il.com>)
• Re: 4 remote vulnerabilities in OpenVPN (Solar Designer <solar@...nwall.com>)
• Re: 4 remote vulnerabilities in OpenVPN (Guido Vranken <guidovranken@...il.com>)
• Re: Qualys Security Advisory - The Stack Clash (Josh Bressers <josh@...ss.net>)
• CVE Request: unrar: VMSF_DELTA filter allows arbitrary memory write (Alexander Bergmann <abergmann@...e.com>)
• Re: Qualys Security Advisory - The Stack Clash (Brad Spengler <spender@...ecurity.net>)
• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Re: Qualys Security Advisory - The Stack Clash (Stuart Henderson <stu@...cehopper.org>)
• Re: Qualys Security Advisory - The Stack Clash ("kseifried@...hat.com" <kseifried@...hat.com>)
• Re: Qualys Security Advisory - The Stack Clash (Jeff Law <law@...hat.com>)
• Re: Qualys Security Advisory - The Stack Clash (Daniel Micay <danielmicay@...il.com>)
• Re: Re: Qualys Security Advisor -- The Stack Clash (Jeff Law <law@...hat.com>)
• WebKitGTK+ Security Advisory WSA-2017-0005 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
• Re: Qualys Security Advisory - The Stack Clash (Qualys Security Advisory <qsa@...lys.com>)
• Re: Qualys Security Advisory - The Stack Clash (Qualys Security Advisory <qsa@...lys.com>)
• Re: Qualys Security Advisory - The Stack Clash (Brad Spengler <spender@...ecurity.net>)
• Re: Qualys Security Advisory - The Stack Clash ("PaX Team" <pageexec@...email.hu>)
• Re: Qualys Security Advisory - The Stack Clash (nospam@...so.re)
• Re: Qualys Security Advisory - The Stack Clash (Qualys Security Advisory <qsa@...lys.com>)
• Re: Qualys Security Advisory - The Stack Clash (Jeff Law <law@...hat.com>)
• Re: Re: Qualys Security Advisory - The Stack Clash (Franz Pletz <fpletz@...rdicwalking.de>)
• Re: Qualys Security Advisory - The Stack Clash (Jeff Law <law@...hat.com>)

• Re: Re: Qualys Security Advisor -- The Stack Clash (Daniel Micay <danielmicay@...il.com>)
• Re: Qualys Security Advisory - The Stack Clash (Daniel Micay <danielmicay@...il.com>)
• Re: Qualys Security Advisory - The Stack Clash (Florian Weimer <fweimer@...hat.com>)
• Re: Qualys Security Advisory - The Stack Clash ("Mike O'Connor" <mjo@...o.mi.org>)
• Re: Information on recent sqlite3 issues? (Johannes Segitz <jsegitz@...e.de>)
• stackguard fix in Red Hat and Ubuntu kernels (Solar Designer <solar@...nwall.com>)
• Re: stackguard fix in Red Hat and Ubuntu kernels (Marcus Meissner <meissner@...e.de>)
• Re: CVE Request: unrar: VMSF_DELTA filter allows arbitrary memory write (Alexander Bergmann <abergmann@...e.com>)
• Re: stackguard fix in Red Hat and Ubuntu kernels (Greg KH <greg@...ah.com>)
• Re: stackguard fix in Red Hat and Ubuntu kernels (Vasily Averin <vvs@...tuozzo.com>)
• Re: stackguard fix in Red Hat and Ubuntu kernels (Marcus Meissner <meissner@...e.de>)
• Re: stackguard fix in Red Hat and Ubuntu kernels (Eduardo Valentin <eduval@...zon.com>)
• CVE-2017-9780: Flatpak: privilege escalation via setuid/world-writable file permissions (Simon McVittie <smcv@...ian.org>)

• Re: CVE-2017-9780: Flatpak: privilege escalation via setuid/world-writable file permissions (Florian Weimer <fweimer@...hat.com>)
• Re: CVE-2017-9780: Flatpak: privilege escalation via setuid/world-writable file permissions (Simon McVittie <smcv@...ian.org>)
• Re: Qualys Security Advisory - The Stack Clash (Jeff Law <law@...hat.com>)
• Re: Qualys Security Advisory - The Stack Clash (Kurt Seifried <kseifried@...hat.com>)
• CVE-2017-7518 Kernel: KVM: debug exception via syscall emulation (P J P <ppandit@...hat.com>)
• CVE-2017-9772: OCaml release 4.04.2 (Anil Madhavapeddy <anil@...oil.org>)
• Re: CVE-2017-9772: OCaml release 4.04.2 (Anil Madhavapeddy <anil@...oil.org>)
• charset.alias in pkexec/glib/gnulib (was: glibc locale issues) (Jakub Wilk <jwilk@...lk.net>)
• Re: Re: Qualys Security Advisor -- The Stack Clash (Szabolcs Nagy <nsz@...t70.net>)
• Remotely exploitable crash in dhcpcd ("Jason A. Donenfeld" <Jason@...c4.com>)
• Re: CVE-2017-9772: OCaml release 4.04.2 (Leo Famulari <leo@...ulari.name>)
• Re: CVE-2017-9772: OCaml release 4.04.2 (Leo Famulari <leo@...ulari.name>)
• Re: two vulns in uClibc-0.9.33.2 (Waldemar Brodkorb <wbx@...ibc-ng.org>)

• More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Brad Spengler <spender@...ecurity.net>)
• Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Linus Torvalds <torvalds@...ux-foundation.org>)
• CVE for the TSIG issue in knot? (Yves-Alexis Perez <corsac@...ian.org>)
• Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Brad Spengler <spender@...ecurity.net>)
• Re: CVE for the TSIG issue in knot? (Ondřej Surý <ondrej@...y.org>)
• Re: CVE for the TSIG issue in knot? (Solar Designer <solar@...nwall.com>)
• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Brad Spengler <spender@...ecurity.net>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Shawn <citypw@...il.com>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Solar Designer <solar@...nwall.com>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Shawn <citypw@...il.com>)
• distros list archive (Solar Designer <solar@...nwall.com>)
• Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Linus Torvalds <torvalds@...ux-foundation.org>)

• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Brad Spengler <spender@...ecurity.net>)
• CVE-2017-9669 and CVE-2017-9671: Exploitable buffer overflows in apk (Alpine's package manager) (Ariel Zelivansky <ariel@...stlock.com>)

• Re: Qualys Security Advisory - The Stack Clash (Solar Designer <solar@...nwall.com>)
• Can someone explain all the CONFIG_VMAP_STACK CVEs lately? (Andy Lutomirski <luto@...nel.org>)
• Re: Can someone explain all the CONFIG_VMAP_STACK CVEs lately? (Greg KH <greg@...ah.com>)
• CVE-2017-7482 Linux kernel: krb5 ticket decode len check. (Wade Mealing <wmealing@...hat.com>)
• Re: Can someone explain all the CONFIG_VMAP_STACK CVEs lately? (Brad Spengler <spender@...ecurity.net>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Mansour Moufid <mansourmoufid@...il.com>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method (Kurt Seifried <kseifried@...hat.com>)
• RE: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method ("Christey, Steven M." <coley@...re.org>)
• civilized discussion (Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootki… (Solar Designer <solar@...nwall.com>)
• Re: civilized discussion (Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / ro… (Kurt Seifried <kseifrie@...hat.com>)
• OpenVPN fuzzers released (Guido Vranken <guidovranken@...il.com>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit meth (Kurt Seifried <kseifried@...hat.com>)

• re: two vulns in uClibc-0.9.33.2 ("fefe" <qbenjin@...com>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit meth ("PaX Team" <pageexec@...email.hu>)
• Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit meth ("PaX Team" <pageexec@...email.hu>)
• Re: civilized discussion (Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass… (Kyle R <Kyle.R@...ticalInformatics.com>)
• CVE-2017-8797 Linux kernel: nfsd: remote DoS (Ari Kauppi <Ari.Kauppi@...opsys.com>)
• malicious hypervisor threat was ignored but it is real (Mikhail Utin <mikhailutin@...mail.com>)
• Re: malicious hypervisor threat was ignored but it is real (Solar Designer <solar@...nwall.com>)
• CVE-2017-9445: Out-of-bounds write in systemd-resolved with crafted TCP payload (Chris Coulson <chris.coulson@...onical.com>)
• CoreOS membership to linux-distros (Euan Kemp <euan.kemp@...eos.com>)
• Re: CoreOS membership to linux-distros (Kurt Seifried <kseifried@...hat.com>)
• Re: CoreOS membership to linux-distros (Euan Kemp <euan.kemp@...eos.com>)

• [CVE-2017-7686] Apache Ignite Information Disclosure (Denis Magda <dmagda@...che.org>)
• Re: CoreOS membership to linux-distros (Sven Dowideit <sven@...cher.com>)
• Re: CoreOS membership to linux-distros (Dominique Martinet <asmadeus@...ewreck.org>)
• lame: multiple vulnerabilities (Agostino Sarubbo <ago@...too.org>)
• lame: global-buffer-overflow in II_step_one (layer2.c) ("Agostino Sarubbo" <ago@...too.org>)
• lame: global-buffer-overflow in III_i_stereo (layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
• lame: heap-based buffer overflow in fill_buffer_resample (util.c) ("Agostino Sarubbo" <ago@...too.org>)
• lame: stack-based buffer overflow in III_i_stereo (layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
• lame: stack-based buffer overflow in III_dequantize_sample (layer3.c) ("Agostino Sarubbo" <ago@...too.org>)
• lame: multiple left shift ("Agostino Sarubbo" <ago@...too.org>)
• lame: two UBSAN crashes ("Agostino Sarubbo" <ago@...too.org>)
• Re: CoreOS membership to linux-distros (Sven Dowideit <sven@...cher.com>)
• Re: lame: multiple vulnerabilities ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
• Re: Qualys Security Advisory - The Stack Clash (Qualys Security Advisory <qsa@...lys.com>)
• Re: lame: multiple vulnerabilities (Hanno Böck <hanno@...eck.de>)
• Re: lame: multiple vulnerabilities (Agostino Sarubbo <ago@...too.org>)
• accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
• Re: accepting new members to (linux-)distros lists (Simon McVittie <smcv@...ian.org>)
• Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
• Re: accepting new members to (linux-)distros lists (Sven Dowideit <sven@...cher.com>)

• CVE-2017-10664 Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort (P J P <ppandit@...hat.com>)
• rkhunter: [CVE-2017-7480] Potential RCE after MiTM due to clear text download without signature (Michael Scherer <misc@...b.org>)
• Re: CVE request: sthttpd remote heap buffer overflow (Thomas Deutschmann <whissi@...too.org>)
• Re: TIOCSTI not going away (Solar Designer <solar@...nwall.com>)
• Re: TIOCSTI not going away (Nick Kralevich <nnk@...gle.com>)
• Re: TIOCSTI not going away ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
• Re: TIOCSTI not going away (christos@...las.com (Christos Zoulas))
• Re: CVE Request: unrar: VMSF_DELTA filter allows arbitrary memory write (Andreas Stieger <astieger@...e.com>)

• exiv2: multiple memory safety issues (Hanno Böck <hanno@...eck.de>)
• ISC announces two BIND vulnerabilities (ISC Security Officer <security-officer@....org>)
• Re: ISC announces two BIND vulnerabilities (Yves-Alexis Perez <corsac@...ian.org>)
• Re: ISC announces two BIND vulnerabilities (Solar Designer <solar@...nwall.com>)
• Re: ISC announces two BIND vulnerabilities (Yves-Alexis Perez <corsac@...ian.org>)
• Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)
• Re: accepting new members to (linux-)distros lists (Seth Arnold <seth.arnold@...onical.com>)
• Re: accepting new members to (linux-)distros lists (Solar Designer <solar@...nwall.com>)

278 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.