oss-security mailing list - 2016/12

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2016/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 14	² 13	³ 5	⁴ 3
⁵ 25	⁶ 12	⁷ 7	⁸ 20	⁹ 5	¹⁰ 1	¹¹ 2
¹² 7	¹³ 3	¹⁴ 18	¹⁵ 11	¹⁶ 6	¹⁷ 2	¹⁸ 3
¹⁹ 7	²⁰ 7	²¹ 10	²² 15	²³ 2	²⁴ 2	²⁵ 3
²⁶ 9	²⁷ 9	²⁸ 8	²⁹ 3	³⁰ 6	³¹ 3

Messages by day:

December 1 (14 messages)

CVE request: Kernel: kvm: stack memory information leakage (P J P <ppandit@...hat.com>)
gstreamer multiple issues (Hanno Böck <hanno@...eck.de>)
libav: multiple crashes from the Undefined Behavior Sanitizer (Agostino Sarubbo <ago@...too.org>)
imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) (Agostino Sarubbo <ago@...too.org>)
libming: listswf: heap-based buffer overflow in parseSWF_DEFINEFONT (parser.c) (Agostino Sarubbo <ago@...too.org>)
libming: listswf: heap-based buffer overflow in parseSWF_RGBA (parser.c) (Agostino Sarubbo <ago@...too.org>)
libming: listswf: heap-based buffer overflow in _iprintf (outputtxt.c) (Agostino Sarubbo <ago@...too.org>)
libming: listswf: NULL pointer dereference in dumpBuffer (read.c) (Agostino Sarubbo <ago@...too.org>)
graphicsmagick: memory allocation failure in MagickRealloc (memory.c) (Agostino Sarubbo <ago@...too.org>)
CVE Request: Linux: net: out-of-bounds due do a signedness issue when defragging ipv6 (Andrey Konovalov <andreyknvl@...gle.com>)
Re: dcraw and CVE-2015-8366 + CVE-2015-8367 (Ian Zimmerman <itz@...mate.net>)
CVE Request: OpenAFS: directory information leaks (OPENAFS-SA-2016-003) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE request: Kernel: kvm: stack memory information leakage (<cve-assign@...re.org>)
Re: CVE Request: Linux: net: out-of-bounds due do a signedness issue when defragging ipv6 (<cve-assign@...re.org>)

December 2 (13 messages)

Re: graphicsmagick: memory allocation failure in MagickRealloc (memory.c) (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
CVE request: Kernel: kvm: out of bounds memory access via vcpu_id (P J P <ppandit@...hat.com>)
CVE request Qemu: net: mcf_fec: infinite loop while receiving data in mcf_fec_receive (P J P <ppandit@...hat.com>)
Important vulnerability in Dovecot (CVE-2016-8652) (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE request: tomcat privilege escalations in Debian packaging (Sébastien Delafond <seb@...ian.org>)
CVE request: 2 issues in tomcat8 Debian packaging (Sébastien Delafond <seb@...ian.org>)
Re: CVE request: Kernel: kvm: out of bounds memory access via vcpu_id (<cve-assign@...re.org>)
Re: CVE request Qemu: net: mcf_fec: infinite loop while receiving data in mcf_fec_receive (<cve-assign@...re.org>)
Re: CVE Request: OpenAFS: directory information leaks (OPENAFS-SA-2016-003) (<cve-assign@...re.org>)
Re: CVE request: tomcat privilege escalations in Debian packaging (<cve-assign@...re.org>)
Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) (<cve-assign@...re.org>)
Re: Re: imagemagick: heap-based buffer overflow in IsPixelGray (pixel-accessor.h) (Incomplete fix for CVE-2016-9556) (Agostino Sarubbo <ago@...too.org>)
CVE Request: Linux: signed overflows for SO_{SND|RCV}BUFFORCE (Andrey Konovalov <andreyknvl@...gle.com>)

December 3 (5 messages)

Re: CVE Request: Linux: signed overflows for SO_{SND|RCV}BUFFORCE (<cve-assign@...re.org>)
CVE request: -- Linux kernel: ALSA: use-after-free in,kill_fasync (Baozeng Ding <sploving1@...il.com>)
Re: CVE request: -- Linux kernel: ALSA: use-after-free in,kill_fasync (<cve-assign@...re.org>)
CVE Request: -- Linux kernel: double free in netlink_dump (Baozeng Ding <sploving1@...il.com>)
CVE Request: SimpleSAMLphp: SSPSA 201612-01: Incorrect signature verification (Salvatore Bonaccorso <carnil@...ian.org>)

December 4 (3 messages)

Re: Re: RCE in Zabbix 2.2 to 3.0.3 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: -- Linux kernel: double free in netlink_dump (<cve-assign@...re.org>)
Re: libav: multiple crashes from the Undefined Behavior Sanitizer (Agostino Sarubbo <ago@...too.org>)

December 5 (25 messages)

Re: libav: multiple crashes from the Undefined Behavior Sanitizer (<cve-assign@...re.org>)
Re: libming: listswf: heap-based buffer overflow in _iprintf (outputtxt.c) (<cve-assign@...re.org>)
Re: libming: listswf: NULL pointer dereference in dumpBuffer (read.c) (<cve-assign@...re.org>)
Re: libming: listswf: heap-based buffer overflow in parseSWF_DEFINEFONT (parser.c) (<cve-assign@...re.org>)
Re: graphicsmagick: memory allocation failure in MagickRealloc (memory.c) (<cve-assign@...re.org>)
Re: libming: listswf: heap-based buffer overflow in parseSWF_RGBA (parser.c) (<cve-assign@...re.org>)
Re: Xen Security Advisory 201 - ARM guests may induce host asynchronous abort (<cve-assign@...re.org>)
Re: gstreamer multiple issues (<cve-assign@...re.org>)
Re: CVE Request: SimpleSAMLphp: SSPSA 201612-01: Incorrect signature verification (<cve-assign@...re.org>)
CVE Request: zlib security issues found during audit (Marcus Meissner <meissner@...e.de>)
Re: Re: Remote crash in MaraDNS 2.0.13 and git master (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Important vulnerability in Dovecot (CVE-2016-8652) (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE Request: Info-Zip zipinfo buffer overflow (Tyler Hicks <tyhicks@...onical.com>)
CVE-2016-8740: Apache HTTPD 2.4.17-2.4.23: Server memory can be exhausted and service denied when HTTP/2 is used (Solar Designer <solar@...nwall.com>)
CVE request: Qemu: display: virtio-gpu-3d: information leakage in virgl_cmd_get_capset_info (P J P <ppandit@...hat.com>)
Re: CVE-2016-8740: Apache HTTPD 2.4.17-2.4.23: Server memory can be exhausted and service denied when HTTP/2 is used (Leo Famulari <leo@...ulari.name>)
Re: CVE-2016-8740: Apache HTTPD 2.4.17-2.4.23: Server memory can be exhausted and service denied when HTTP/2 is used (Solar Designer <solar@...nwall.com>)
CVE request Qemu: display: virtio-gpu: memory leakage while updating cursor (P J P <ppandit@...hat.com>)
CVE Request: Info-Zip zipinfo buffer overflow ("Steven M. Schweda" <sms@...inode.info>)
Re: CVE Request: Info-Zip zipinfo buffer overflow (<cve-assign@...re.org>)
Re: CVE Request: zlib security issues found during audit (<cve-assign@...re.org>)
Re: CVE request: Qemu: display: virtio-gpu-3d: information leakage in virgl_cmd_get_capset_info (<cve-assign@...re.org>)
Re: CVE request Qemu: display: virtio-gpu: memory leakage while updating cursor (<cve-assign@...re.org>)
Re: CVE Request: Info-Zip zipinfo buffer overflow (Tyler Hicks <tyhicks@...onical.com>)
Re: CVE Request: Info-Zip zipinfo buffer overflow ("Steven M. Schweda" <sms@...inode.info>)

December 6 (12 messages)

CVE-2016-8655 Linux af_packet.c race condition (local root) (Philip Pettersson <philip.pettersson@...il.com>)
CVE request Qemu: display: virtio-gpu-3d: information leakage in virgl_cmd_get_capset (P J P <ppandit@...hat.com>)
CVE request Qemu: usb: redirector: memory leakage when destroying redirector (P J P <ppandit@...hat.com>)
Xen Security Advisory 199 (CVE-2016-9637) - qemu ioport array overflow (Xen.org security team <security@....org>)
CVE Request: html5lib: potential cross-site scripting vulnerablity: quote attributes that need escaping in legacy brows… (Salvatore Bonaccorso <carnil@...ian.org…)
Tcsh: Out-of-bounds read in c_substitute() (Andrej Nemec <anemec@...hat.com>)
Re: CVE Request - Webproxy Portlet - cross-user cache over-hits (Andrew W Petro <andrew.petro@...c.edu>)
Opensource Python whitebox code analysis tool recommendations (Fiedler Roman <Roman.Fiedler@....ac.at>)
Re: Opensource Python whitebox code analysis tool recommendations (Grant Murphy <grantcmurphy@...il.com>)
CVE request: Qemu: usb: ehci: memory leakage in ehci_init_transfer (P J P <ppandit@...hat.com>)
CVE request Qemu: 9pfs: memory leakage via proxy/handle callbacks (P J P <ppandit@...hat.com>)
CVE request Qemu: display: virtio-gpu: memory leakage when destroying gpu resource (P J P <ppandit@...hat.com>)

December 7 (7 messages)

CVE request - BigTree CMS 4.2.13 - Cross-Site Scripting (XSS) (haojun hou <haojunhou@...il.com>)
CVE request -BigTree CMS 4.2.13 Extension Form Builder Multiple Cross-Site Scripting (XSS) (haojun hou <haojunhou@...il.com>)
Re: CVE-2016-8655 Linux af_packet.c race condition (local root) (Philip Pettersson <philip.pettersson@...il.com>)
Xen Security Advisory 201 (CVE-2016-9815,CVE-2016-9816,CVE-2016-9817,CVE-2016-9818) - ARM guests may induce host asynch… (Xen.org security team <security@....org…)
Re: Re: CVE-2016-8655 Linux af_packet.c race condition (local root) (Hanno Böck <hanno@...eck.de>)
Re: Re: CVE-2016-8655 Linux af_packet.c race condition (local root) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: CVE-2016-8655 Linux af_packet.c race condition (local root) (Brad Spengler <spender@...ecurity.net>)

December 8 (20 messages)

[CVE-2016-9561] ffmpeg crashes on decoding MOV file (连一汉 <lianyihan@....cn>)
[CVE-2016-8595] ffmpeg crashes with an assert (连一汉 <lianyihan@....cn>)
Re: CVE request Qemu: usb: redirector: memory leakage when destroying (<cve-assign@...re.org>)
Re: CVE request Qemu: display: virtio-gpu-3d: information leakage in virgl_cmd_get_capset (<cve-assign@...re.org>)
Re: CVE request: Qemu: usb: ehci: memory leakage in ehci_init_transfer (<cve-assign@...re.org>)
Re: CVE request Qemu: display: virtio-gpu: memory leakage when destroying gpu resource (<cve-assign@...re.org>)
Re: CVE request Qemu: 9pfs: memory leakage via proxy/handle callbacks (<cve-assign@...re.org>)
Re: CVE Request: html5lib: potential cross-site scripting vulnerablity: quote attributes that need escaping in legacy browsers (<cve-assign@...re.org>)
CVE request Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy (P J P <ppandit@...hat.com>)
roundcube code execution via mail() (Hanno Böck <hanno@...eck.de>)
CVE request Qemu: char: use after free issue in char backend (P J P <ppandit@...hat.com>)
CVE Request: file inclusion(traversal/manipulation) in modx revolution 2.5.1 (陈瑞琦 <chenruiqi@...60.cn>)
Re: CVE request Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy (Huawei PSIRT <psirt@...wei.com>)
Re: Ruby:HTTP Header injection in 'net/http' (Casper Thomsen <ct@...arhaus.com>)
CVE request: Linux panic on fragemented IPv6 traffic (icmp6_send) (Florian Pritz <bluewind@...u.at>)
Re: CVE request: Linux panic on fragemented IPv6 traffic (icmp6_send) (<cve-assign@...re.org>)
Re: roundcube code execution via mail() (<cve-assign@...re.org>)
Re: imagemagick: heap-based buffer overflow in IsPixelMonochrome (pixel-accessor.h) (Ian Zimmerman <itz@...mate.net>)
Linux Kernel use-after-free in SCSI generic device interface (Marcus Meissner <meissner@...e.de>)
Re: Opensource Python whitebox code analysis tool recommendations (Sarah Newman <srn@...mr.com>)

December 9 (5 messages)

Re: CVE request Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy (<cve-assign@...re.org>)
Re: CVE request Qemu: char: use after free issue in char backend (<cve-assign@...re.org>)
[ANNOUNCE] CVE-2016-6810: ActiveMQ Web Console - Cross-Site Scripting (Christopher Shannon <christopher.l.shannon@...il.com>)
CVE-2016-9580 CVE-2016-9581 openjpeg2: heap buffer oevrflows (Adam Maris <amaris@...hat.com>)
CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push IQ stanza (Salvatore Bonaccorso <carnil@...ian.org…)

December 10 (1 message)

Re: CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push IQ st… (Mathieu Pasquet <mathieui@...hieui.net>)

December 11 (2 messages)

Multiple vulnerabilities affecting three WordPress Plugins (XSS, & PHP object injection) (Summer of Pwnage <lists@...urify.nl>)
Re: CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push IQ stanza (<cve-assign@...re.org>)

December 12 (7 messages)

[SECURITY] CVE-2016-8745 Apache Tomcat Information Disclosure (Mark Thomas <markt@...che.org>)
CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0 (Lior Kaplan <kaplanlior@...il.com>)
Re: Re: CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push IQ stanza (Sam Whited <sam@...whited.com>)
Re: Re: CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push IQ stanza (Sam Whited <sam@...whited.com>)
Re: CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0 (<cve-assign@...re.org>)
CVE Request: Potential DoS in Crypto++ ASN.1 parser (Jeffrey Walton <noloader@...il.com>)
Re: CVE Request: Potential DoS in Crypto++ ASN.1 parser (<cve-assign@...re.org>)

December 13 (3 messages)

Re: CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push IQ st… (Salvatore Bonaccorso <carnil@...ian.org…)
Xen Security Advisory 200 (CVE-2016-9932) - x86 CMPXCHG8B emulation fails to ignore operand size override (Xen.org security team <security@....org>)
CVE-2016-9583 jasper: Out of bounds heap read in jpc_pi_nextpcrl() (Adam Maris <amaris@...hat.com>)

December 14 (18 messages)

vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> (Sona Sarmadi <sona.sarmadi@...a.com>)
why many CVEs are ** RESERVED ** on Mitre (Sona Sarmadi <sona.sarmadi@...a.com>)
CVE-2016-1253 most: shell command injection through filenames (Sébastien Delafond <seb@...ian.org>)
Re: why many CVEs are ** RESERVED ** on Mitre (Kurt Seifried <kseifried@...hat.com>)
Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> (Kurt Seifried <kseifried@...hat.com>)
Re: why many CVEs are ** RESERVED ** on Mitre (Sevan Janiyan <venture37@...klan.co.uk>)
CVE Request: SimpleSAMLphp: SSPSA 201612-02: Incorrect signature verification (Salvatore Bonaccorso <carnil@...ian.org>)
Re: why many CVEs are ** RESERVED ** on Mitre (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE Request: MCabber: remote attackers can modify the roster and intercept messages via a crafted roster-push I… (Salvatore Bonaccorso <carnil@...ian.org…)
Re: why many CVEs are ** RESERVED ** on Mitre (Sevan Janiyan <venture37@...klan.co.uk>)
CVE Request: FlightGear: Allows the route manager to overwrite arbitrary files (Salvatore Bonaccorso <carnil@...ian.org>)
Re: why many CVEs are ** RESERVED ** on Mitre (Marcus Meissner <meissner@...e.de>)
Re: why many CVEs are ** RESERVED ** on Mitre (Kurt Seifried <kseifried@...hat.com>)
Re: Re: CVE request: w3m - multiple vulnerabilities (Kuang-che Wu <kcwu@...e.org>)
Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: why many CVEs are ** RESERVED ** on Mitre (Sona Sarmadi <sona.sarmadi@...a.com>)
Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> (Kurt Seifried <kseifried@...hat.com>)
CVE Request: IrRegular Expressions resource exhaustion in regex compilation [was: Re: CVE Request: resource exhaustion in reg… (Peter Bex <peter@...e-magic.net>)

December 15 (11 messages)

CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code executi… (Salvatore Bonaccorso <carnil@...ian.org…)
Re: CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code exe… (Salvatore Bonaccorso <carnil@...ian.org…)
CVE-2016-9588 Kernel: kvm: nVMX: uncaught software exceptions in L1 guest lead to DoS (P J P <ppandit@...hat.com>)
CVE request: PT-2013-46 Local File Include in Nagios Looking Glass (Henri Salo <henri@...v.fi>)
CVE-2016-9584: heap use-after-free on libical (Agustin Mista <mista.agustin@...il.com>)
Re: CVE-2016-9584: heap use-after-free on libical (Brandon Perry <bperry.volatile@...il.com>)
Re: CVE-2016-9584: heap use-after-free on libical (Brandon Perry <bperry.volatile@...il.com>)
Re: CVE Request: IrRegular Expressions resource exhaustion in regex compilation [was: Re: CVE Request: resource exhaustion in regex expre… (<cve-assign@...re.org>)
Re: CVE Request: SimpleSAMLphp: SSPSA 201612-02: Incorrect signature verification (<cve-assign@...re.org>)
Re: CVE Request: FlightGear: Allows the route manager to overwrite arbitrary files (<cve-assign@...re.org>)
Re: CVE Request: Game Music Emulators: incorrect emulation of the SPC700 audio co-processor of SNES: arbitrary code execution via malform… (<cve-assign@...re.org>)

December 16 (6 messages)

CVE Request - Exim 4.69-4.87 - disclosure of private information (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE Request - Exim 4.69-4.87 - disclosure of private information (<cve-assign@...re.org>)
CVE-2016-9591 jasper: Use-after-free on heap in jas_matrix_destroy (Adam Maris <amaris@...hat.com>)
Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> (Kurt Seifried <kseifried@...hat.com>)
Re: CVE Request: FlightGear: Allows the route manager to overwrite arbitrary files (Florent Rougon <f.rougon@...e.fr>)
[SECURITY] CVE-2016-5001: Apache Hadoop Information Disclosure (Arpit Agarwal <aagarwal@...tonworks.com>)

December 17 (2 messages)

CVE Request - squid HTTP proxy multiple Information Disclosure issues (Amos Jeffries <squid3@...enet.co.nz>)
CVE request - DCMTK remote stack buffer overflow (Gjoko Krstic <gjoko@...oscience.mk>)

December 18 (3 messages)

Re: CVE Request - squid HTTP proxy multiple Information Disclosure issues (<cve-assign@...re.org>)
Re: CVE request - DCMTK remote stack buffer overflow (<cve-assign@...re.org>)
CVE-2016-9963 Exim private information leak (Heiko Schlittermann <hs@...littermann.de>)

December 19 (7 messages)

[OSSN-0074] Nova metadata service should not be used for sensitive information (Luke Hinds <lhinds@...hat.com>)
Announce: OpenSSH 7.4 released (Damien Miller <djm@...nbsd.org>)
Re: CVE-2016-9584: heap use-after-free on libical (Agustin Mista <mista.agustin@...il.com>)
Xen Security Advisory 204 - x86: Mishandling of SYSCALL singlestep during emulation (Xen.org security team <security@....org>)
Re: Announce: OpenSSH 7.4 released (<cve-assign@...re.org>)
Re: Xen Security Advisory 204 - x86: Mishandling of SYSCALL singlestep during emulation (<cve-assign@...re.org>)
Xen Security Advisory 204 (CVE-2016-10013) - x86: Mishandling of SYSCALL singlestep during emulation (Xen.org security team <security@....org>)

December 20 (7 messages)

CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities (P J P <ppandit@...hat.com>)
CVE request Qemu: display: virtio-gpu: out of bounds read in virtio_gpu_set_scanout (P J P <ppandit@...hat.com>)
CVE requests for various ImageMagick issues (anarcat@...ian.org (Antoine Beaupré))
Nagios Core < 4.2.2 Curl Command Injection leading to Remote Code Execution [CVE-2016-9565] (Dawid Golunski <dawid@...alhackers.com>)
Nagios Core < 4.2.4 Root Privilege Escalation [CVE-2016-9566] (Dawid Golunski <dawid@...alhackers.com>)
CVE Request: Smack: TLS SecurityMode.required not always enforced, leading to striptls attack (Sylvain SARMEJEANNE <sylvain.sarmejeanne.ml@...il.com>)
CVE request: ikiwiki: authorization bypass when reverting changes (Simon McVittie <smcv@...ian.org>)

December 21 (10 messages)

Re: CVE-2016-9963 Exim private information leak (Heiko Schlittermann <hs@...littermann.de>)
[SECURITY ADVISORY] curl: printf floating point buffer overflow (Daniel Stenberg <daniel@...x.se>)
Re: CVE request: ikiwiki: authorization bypass when reverting changes (<cve-assign@...re.org>)
Curious about the security of my router fermwair. (tapper <lancett01@...glemail.com>)
Xen Security Advisory 203 (CVE-2016-10025) - x86: missing NULL pointer check in VMFUNC emulation (Xen.org security team <security@....org>)
Xen Security Advisory 202 (CVE-2016-10024) - x86 PV guests may be able to mask interrupts (Xen.org security team <security@....org>)
Re: Curious about the security of my router fermwair. (Seth Arnold <seth.arnold@...onical.com>)
Re: Nagios Core < 4.2.2 Curl Command Injection leading to Remote Code Execution [CVE-2016-9565] (Tomas Hoger <thoger@...hat.com>)
CVE request - Vesta Control Panel 0.9.7 <= 0.9.8-16 Local Privilege Escalation (Luka Pusic <luka@...ic.com>)
Re: CVE-2016-9963 Exim private information leak (Kurt H Maier <khm@...ops.net>)

December 22 (15 messages)

Re: CVE-2016-9963 Exim private information leak (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE-2016-9963 Exim private information leak (Kurt H Maier <khm@...ops.net>)
Re: Curious about the security of my router fermwair. (tapper <lancett01@...glemail.com>)
Re: CVE-2016-9963 Exim private information leak (Johannes Segitz <jsegitz@...e.com>)
Re: Curious about the security of my router fermwair. (Agostino Sarubbo <ago@...too.org>)
Re: CVE-2016-9963 Exim private information leak (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE-2016-9963 Exim private information leak (Jeffrey Walton <noloader@...il.com>)
Re: Curious about the security of my router fermwair. (Nicholas Prowse <nick5990@...oo.co.uk>)
Re: CVE-2016-9963 Exim private information leak (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE-2016-9963 Exim private information leak (Jeffrey Walton <noloader@...il.com>)
Re: CVE-2016-9963 Exim private information leak (Heiko Schlittermann <hs@...littermann.de>)
Re: CVE Request: Smack: TLS SecurityMode.required not always enforced, leading to striptls attack (<cve-assign@...re.org>)
Re: CVE-2016-9963 Exim private information leak (Kurt Seifried <kseifried@...hat.com>)
Re: CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities (<cve-assign@...re.org>)
Re: CVE request Qemu: display: virtio-gpu: out of bounds read in virtio_gpu_set_scanout (<cve-assign@...re.org>)

December 23 (2 messages)

[SECURITY ADVISORY] curl: uninitialized random (Daniel Stenberg <daniel@...x.se>)
CVE-2016-9963 (Was: CVE Request - Exim 4.69-4.87 - disclosure of private information) (Heiko Schlittermann <hs@...littermann.de>)

December 24 (2 messages)

Qt QXmlSimpleReader (Solar Designer <solar@...nwall.com>)
Re: Qt QXmlSimpleReader (<cve-assign@...re.org>)

December 25 (3 messages)

CVE-2016-9963 | Exim 4.87.1 released (Was: CVE Request - Exim 4.69-4.87) - disclosure of private information) (Heiko Schlittermann <hs@...littermann.de>)
tqdm: insecure use of git (Jakub Wilk <jwilk@...lk.net>)
Re: tqdm: insecure use of git (<cve-assign@...re.org>)

December 26 (9 messages)

PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
Joomla com_blog_calendar SQL Injection Vulnerability ("Steevee a.k.a Stefanus" <steevee.aka@...il.com>)
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Hanno Böck <hanno@...eck.de>)
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Peter Bex <peter@...e-magic.net>)
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Peter Bex <peter@...e-magic.net>)
Re: [security] PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Michael Hess <mlhess@...ch.edu>)
Re: [security] PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Yannick Warnier <ywarnier@...milo.org>)
Incomplete fix for CVE-2016-8641 (Nagios local root via (sym)links) (Michael Orlitzky <michael@...itzky.com>)
Re: CVE requests for various ImageMagick issues (<cve-assign@...re.org>)

December 27 (9 messages)

Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Tracy Reed <treed@...raviolet.org>)
Buffer overflow in pycrypto (Leo Famulari <leo@...ulari.name>)
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Michael Hess <mlhess@...ch.edu>)
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Florian Pritz <bluewind@...u.at>)
PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Michael Hess <mlhess@...ch.edu>)
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
Re: Buffer overflow in pycrypto (<cve-assign@...re.org>)
Re: tqdm: insecure use of git (Jakub Wilk <jwilk@...lk.net>)

December 28 (8 messages)

Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Solar Designer <solar@...nwall.com>)
Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) (Dawid Golunski <dawid@...alhackers.com>)
[CVE-2016-8741] Apache Qpid Broker for Java - Information Leakage (Oleksandr Rudyy <orudyy@...il.com>)
Re: PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) (Solar Designer <solar@...nwall.com>)
SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) (Dawid Golunski <dawid@...alhackers.com>)
Re: tqdm: insecure use of git (<cve-assign@...re.org>)

December 29 (3 messages)

Re: PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) (Dawid Golunski <dawid@...alhackers.com>)
libpng NULL pointer dereference bugfix (Glenn Randers-Pehrson <glennrp@...il.com>)
ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery) (Simon McVittie <smcv@...ian.org>)

December 30 (6 messages)

Re: Linux Kernel use-after-free in SCSI generic device interface (Salvatore Bonaccorso <carnil@...ian.org>)
Zend Framework (zend-mail) < 2.4.11 Remote Code Execution (CVE-2016-10034) (Dawid Golunski <dawid@...alhackers.com>)
Re: Linux Kernel use-after-free in SCSI generic device interface (<cve-assign@...re.org>)
Re: libpng NULL pointer dereference bugfix (<cve-assign@...re.org>)
CVE request: Nagios: Incomplete fix for CVE-2016-8641 (Michael Orlitzky <michael@...itzky.com>)
Re: CVE request: Nagios: Incomplete fix for CVE-2016-8641 (<cve-assign@...re.org>)

December 31 (3 messages)

Fwd: [ANNOUNCE] CVE-2016-6793 Apache Wicket deserialization vulnerability (Pedro Santos <pedrosans@...il.com>)
CVE Request: UnRTF: stack-based buffer overflows in cmd_* functions (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE Request: UnRTF: stack-based buffer overflows in cmd_* functions (<cve-assign@...re.org>)

241 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.