bugtraq mailing list - 2005/02

Messages by day:

February 1 (9 messages)

• Windows Security Checklists - 10 Parts (Paul Laudanski <zx@...tlecops.com>)
• University of Phoenix - Outlook Express Unauthorized Configuration Manipulation (Adam Baldwin <evilpacket@...il.com>)
• Re: [ GLSA 200501-46 ] ClamAV: Multiple issues (Trog <trog@...on.org>)
• [ Security Bulletin] SSRT5900 rev.0 HP-UX TGA daemon remote Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
• [USN-71-1] PostgreSQL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [SECURITY] [DSA 663-1] New prozilla packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [ GLSA 200502-01 ] FireHOL: Insecure temporary file creation (Matthias Geerdsen <vorlon@...too.org>)
• [SECURITY] [DSA 662-1] New squirrelmail package fixes several vulnerabilities (joey@...odrom.org (Martin Schulze))
• Re: [Full-Disclosure] [ GLSA 200501-46 ] ClamAV: Multiple issues (Dack <dackbug@...omega.net>)

• [FLSA-2005:2272] Updated unarj package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2255] Updated zip package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2187] Updated freeradius packages fix security flaws (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• SQL injection in EveryDNS.net Service ("Calum Power" <enune@...bble.net>)
• Re: [ GLSA 200501-46 ] ClamAV: Multiple issues (Darren Bounds <lists@...rusense.com>)
• [USN-72-1] Perl vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• Limited buffer-overflow in Painkiller 1.35 (Luigi Auriemma <aluigi@...istici.org>)
• Re:WinAmp POC: How to get 900+ shellcodespace!? (lists@...email.ch)
• [SECURITY] [DSA 664-1] New cpio packages fix insecure file permissions (joey@...odrom.org (Martin Schulze))
• MDKSA-2005:028 - Updated ncpfs packages fix vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:027 - Updated chbg packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:026 - Updated imap packages fix authentication vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• 7a69Adv#19 - ZipGenius unpack path disclosure (Albert Puigsech Galicia <ripe@...9ezine.org>)
• Re: [Full-Disclosure] [ GLSA 200501-46 ] ClamAV: Multiple issues (Trog <trog@...on.org>)
• High Risk Vulnerabilities in Eudora Mail Client ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• 7a69Adv#20 - ZipGenius unpack one-folder path disclosure (Albert Puigsech Galicia <ripe@...9ezine.org>)
• [SIG^2 G-TEC] DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities (<chewkeong@...urity.org.sg>)
• 7a69Adv#21 - WinRAR unpack one-folder path disclosure (Albert Puigsech Galicia <ripe@...9ezine.org>)
• Portcullis Advisory 05-005 Update, Webseries Payment Application ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Portcullis Advisory 05-001 Update, Webseries Payment Application ("Paul J Docherty" <PJD@...tcullis-security.com>)
• UNIX Tar Security Advisory from TEAM PWN4GE ("Team Pwnge" <team_pwn4ge@...gun.com>)
• Portcullis Advisory 05-006 Update, Webseries Payment Application ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Portcullis Advisory 05-007 Update, Webseries Payment Application ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Portcullis Advisory 05-008 Update, Webseries Payment Application ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Gallery is still vulnerable to Cross-site Scripting attacks (Jon Keating <jon@...q.org>)
• Re: [Full-Disclosure] [ GLSA 200501-40 ] ngIRCd: Buffer overflow (qobaiashi <qobaiashi@....net>)
• Re: [Full-Disclosure] [ GLSA 200501-46 ] ClamAV: Multiple issues (exon <exon@...e.se>)

• Portcullis Advisory 05-009 Update, Webseries Payment Application ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Re[2]: WinAmp POC: How to get 900+ shellcodespace!? (Viktor E Larionov <viktor@...net.ee>)
• Google getting smarter ?!?! (John Madden <chiwawa999@...oo.com>)
• PayPal /webscr currency substitution exploit? ("2600hz" <2600hz@...hmail.com>)
• SV: Zyxel / Netgear and probably other routers leaking information. ("Jens Kalvik" <Jens.Kalvik@...ect.se>)
• Python Security Advisory PSF-2005-001 - SimpleXMLRPCServer.py (Guido van Rossum <gvanrossum@...il.com>)
• [USN-73-1] Python vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [Linux kernel ipv6_setsockopt integer overflow] (qobaiashi <qobaiashi@....net>)
• DoS in LANChat Pro Revival 1.666c ("Donato Ferrante" <fdonato@...istici.org>)
• MDKSA-2005:029 - Updated vim packages fix vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• New presentation: Advanced SQL Injection in Oracle databases (Esteban Martínez Fayó <secemf@...oo.com.ar>)
• RE: Google getting smarter ?!?! ("Scott Jacobson" <sjacobson@...linc.com>)
• RE: SECURITEY.NNOV.RU NewsPost buffer overflow [EXPLOIT] (<cybertronic@....net>)
• ngIRCd <= v0.8.2 Format String Vulnerability (CoKi <coki@...ystem.com.ar>)

• [ RSTACK Public Security Advisory ] Remote DOS against Linksys PSUS4 (laurent oudot <oudot@...ack.org>)
• Re: [Linux kernel ipv6_setsockopt integer overflow] (Dan Yefimov <dan@...htwave.net.ru>)
• [USN-74-1] Postfix vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [USN-75-1] cpio vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Re: [Linux kernel ipv6_setsockopt integer overflow] (qobaiashi <qobaiashi@....net>)
• [USN-74-2] Fixed Postfix packages for USN-74-1 (Martin Pitt <martin.pitt@...onical.com>)
• Exploit For Savant Web Server 3.1 (tested on win2003) ("CorryL" <corryl@...overde.com>)

• [SECURITY] [DSA 666-1] New Python2.2 packages fix unauthorised XML-RPC internals access (joey@...odrom.org (Martin Schulze))
• Wireless networks/Default Admin username security problem in Croatia (Radoslav Dejanović <radoslav.dejanovic@...us.hr>)
• [SECURITY] [DSA 667-1] New PostgreSQL packages fix arbitrary library loading (joey@...odrom.org (Martin Schulze))
• Re: [ RSTACK Public Security Advisory ] Remote DOS against Linksys PSUS4 (Denis Jedig <seclists@...eticon.de>)
• Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12 (Jonathan Rockway <jrockw2@....edu>)
• Re: Squirrelmail vacation v0.15 local root exploit (p dont think <pdontthink@...rynerds.com>)
• [SECURITY] [DSA 667-1] New squid packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• Webroot Software Resigns from COAST (Paul Laudanski <zx@...tlecops.com>)
• directory traversal in RaidenHTTPD 1.1.27 ("Donato Ferrante" <fdonato@...istici.org>)
• NGircd <= 0.8.1 Remote DoS (exploit) ("CorryL" <corryl@...overde.com>)
• Re: Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12 (Nicolas Gregoire <ngregoire@...probe.com>)
• Re: Wireless networks/Default Admin username security problem in Croatia (Denis Jedig <seclists@...eticon.de>)
• Foxmail Server Remote Buffer Overflow Vulnerability (Xin Ouyang <xouyang@...tinet.com>)
• [PersianHacker.NET 200502-05] WWWoard passwd (Pedram Hayati <pi3ch@...oo.com>)
• Multiple SQL injection in Chipmunk forum ("GHC vision" <foster@....ru>)

• Re: [USN-74-1] Postfix vulnerability (wietse@...cupine.org (Wietse Venema))
• Re: Re: [USN-74-1] Postfix vulnerability (FRLinux <frlinux@...il.com>)

• [USN-76-1] Emacs vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [USN-77-1] Squid vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [SECURITY] [DSA 669-1] New php3 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• XSS Vulnerability at thefacebook.com (Jonathan Rockway <jrockw2@....edu>)
• VOIPSEC ("VoIP Security Aliance" <voipsa@...psa.org>)
• Fireflashing [Firefox 1.0] ("mikx" <mikx@...x.de>)
• Firedragging [Firefox 1.0] ("mikx" <mikx@...x.de>)
• Firetabbing [Firefox 1.0] ("mikx" <mikx@...x.de>)
• New version of ike-scan (IPsec IKE scanner) available - v1.7 (Roy Hills <Roy.Hills@...-monitor.com>)
• [OSX Finder] DS_Store arbitrary file overwrite vulnerability. (Vade 79 <v9@...ehalo.deadpig.org>)
• DMA[2005-0131a] - 'Setuid Perl PERLIO_DEBUG root owned file creation' ("KF (lists)" <kf_lists@...italmunition.com>)
• Vulnerability in 3Com 3CServer v1.1 (mandragore <mandragore@...il.com>)
• DMA[2005-0131b] - 'Setuid Perl PERLIO_DEBUG buffer overflow' ("KF (lists)" <kf_lists@...italmunition.com>)
• OpenServer 5.0.6 OpenServer 5.0.7 : Vulnerabilities in long-lived TCP connections / Rose attack (please_reply_to_security@....com)
• UnixWare 7.1.3 UnixWare 7.1.1 : Vulnerabilities in long-lived TCP connections / Rose attack (please_reply_to_security@....com)
• Re: [Contact] Motorola broadband appliance team? (Grzegorz Cegielski <Grzegorz.Cegielski@...nex.com.pl>)
• [Security Bulletin] HP Tru64 Unix Mozilla Application Suite 1.7.3 Remote Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
• iDEFENSE Security Advisory 02.07.05: SquirrelMail S/MIME Plugin Command Injection Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• UnixWare 7.1.4 : racoon multilple security issues (please_reply_to_security@....com)

• [SePro Bugtraq] SQL-Injection in PerlDesk 1.x (<deluxe@...urity-project.org>)
• GMail / Google Groups ESMTP software b0f (Michal Zalewski <lcamtuf@...ttot.org>)
• mailman email harvester (Bernhard Kuemel <bernhard@...ys.at>)
• International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Brandon Kovacs <liljoker771@...il.com>)
• CodeCon Reminder (Len Sassaman <rabbi@...itum.com>)
• OpenServer 5.0.6 OpenServer 5.0.7 : enable command line buffer overflows (please_reply_to_security@....com)
• UnixWare 7.1.4 : vulnerability in foomatic-rip in Foomatic before 3.0.2 allows local users or remote attackers with access to… (please_reply_to_security@....com)
• iDEFENSE Security Advisory 02.07.05: IBM AIX chdev Local Format String Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• Re: mailman email harvester ("Dave Korn" <davek_throwaway@...mail.com>)
• Re: Re: mailman email harvester (James Longstreet <jlongs2@....edu>)
• php-fusion 4.x vuln (<thegreatone2176@...oo.com>)
• Integer overflow and arbitrary files deletion in RealArcade 1.2.0.994 (Luigi Auriemma <aluigi@...istici.org>)
• CORE-2004-0819: MSN Messenger PNG Image Parsing Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)

• iDEFENSE Security Advisory 02.08.05: IBM AIX auditselect Local Format String Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• RE: International Domain Name [IDN] - browser-level fix (not network.enableIDN) ("Scovetta, Michael V" <Michael.Scovetta@...com>)
• Finjan Security Advisory: Microsoft Office XP Remote Buffer Overflow Vulnerability ("Rafel Ivgi" <rivgi@...jan.com>)
• AppleFileServer Denial of Service. (nemo@...inemenace.org)
• [SECURITY] [DSA 671-1] New xemacs21 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Re: iDEFENSE Security Advisory 02.08.05: IBM AIX auditselect Local Format String Vulnerability (Shiva Persaud <shivapd@...ibm.com>)
• [PersianHacker.NET 200502-05] WWWoard passwd (Andrew guess <cybercop38@...oo.com.au>)
• [SECURITY] [DSA 670-1] New emacs20 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• SafeNet SoftRemote VPN Client Issue: Clear-text password stored in memory (Roy Hills <Roy.Hills@...-monitor.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL cer… (Jerome ATHIAS <jerome.athias@...e.fr>)
• EEYE: Windows SMB Client Transaction Response Handling Vulnerability ("Marc Maiffret" <mmaiffret@...e.com>)
• [SIG^2 G-TEC] 602LAN SUITE Web Mail Vulnerability Allows File Upload to Arbitrary Directories (<chewkeong@...urity.org.sg>)
• [SCL-2005.002] - IDN Feature Workaround via proxy.pac ("Scovetta, Michael V" <Michael.Scovetta@...com>)
• GREENAPPLE Release (Dave Aitel <dave@...unitysec.com>)
• MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit (ATmaCA ATmaCA <atmaca@...acasoft.com>)
• Internet Explorer zone spoofing with encoded URLs (Jouko Pynnonen <jouko@....fi>)
• [SIG^2 G-TEC] ArGoSoft Mail Server Webmail Multiple Directory Traversal Vulnerabilities (<chewkeong@...urity.org.sg>)
• MDKSA-2005:031 - Updated perl packages fix multiple vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• [Security Bulletin] - SSRT4883 HP-UX ftpd remote privileged access ("Boren, Rich (SSRT)" <rich.boren@...com>)
• Re: Re: mailman email harvester ("Dave Korn" <davek_throwaway@...mail.com>)
• Mercuryboard <= 1.1.1 Working Sql Injection ("Zeelock" <zee@...bnc.it>)
• [USN-78-1] Mailman vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Several SQL injection bugs in myPHP Forum v.1.0 (foster GHC <foster@....ru>)

• Patch available for high risk IBM DB2 Universal Database flaw ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• yet another DSL modem backdoor - Mentor (Conexant) (Adam Laurie <adam.laurie@...bunker.net>)
• Some details about MS05-007 security bulletin (Jean-Baptiste Marchand <Jean-Baptiste.Marchand@....fr>)
• RE: MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit ("Andrew Hunter" <andiroohunter@....com>)
• RE: International Domain Name [IDN] - browser-level fix (not network.enableIDN) (R Dicaire <secure@...tek.net>)
• [FLSA-2005:1943] Updated libpng resolves security vulnerabilities (Dominic Hargreaves <dom@...th.li>)
• Data Mining for PIX Firewall Logs (Carey Heck <carey.heck@...il.com>)
• [FLSA-2005:1906] Updated abiword packages fix security issue (Dominic Hargreaves <dom@...th.li>)
• RE: International Domain Name [IDN] support in modern browsers al lows attackers to spoof domain name URLs + SSL cer… ("Randal, Phil" <prandal@...efordshire.g…)
• CFP for SyScAN'05 ("organiser@...can.org" <organiser@...can.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL cert… (Simon Østengaard <simon@...engaard.dk>)
• Re: GMail / Google Groups ESMTP software b0f (Heather Adkins <hadkins@...gle.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Will Kamishlian <will@...l-k.com>)
• [SECURITY] [DSA 672-1] New xview packages fix potential arbitrary code execution (joey@...odrom.org (Martin Schulze))
• SQL injection in Chipmunk forums (foster GHC <foster@....ru>)
• Paper: Solution to Red Hat PIE Protection (Zarul Shahrin <zarul_shahrin@...oo.com>)
• CMS Core SQL injection (foster GHC <foster@....ru>)
• Re: yet another DSL modem backdoor - Mentor (Conexant) ("Philip Barnham" <admin@...ktech.org.uk>)
• iDEFENSE Security Advisory 02.09.05: CA BrightStor ARCserve Backup v11 Discovery Service Remote Buffer Overflow ("iDefense Customer Service" <customerservice@id…)
• [USN-79-1] PostgreSQL vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [Security Bulletin] SSRT4861 rev.0 - HP-UX BIND9.2.0 remote Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
• SUSE Security Announcement: squid (SUSE-SA:2005:006) (Thomas Biege <thomas@...e.de>)
• [SECURITY] [DSA 674-1] New mailman packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• Re: International Domain Name [IDN] support in modern browsers al lows attackers to spoof domain name URLs + SSL cert… (Marcin Sochacki <wanted@....univ.gda.pl…)
• iDEFENSE Security Advisory 02.10.05: IBM AIX lspath Local File Access Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• [SECURITY] [DSA 673-1] New evolution packages fix arbitrary code execution as root (joey@...odrom.org (Martin Schulze))
• iDEFENSE Security Advisory 02.10.05: IBM AIX netpmon Local Buffer Overflow Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• Barracuda Spam Firewall <= 3.1.10 acts as open relay for whitelisted senders. (Sean Sosik-Hamor <ssh@....com>)
• Re: iDEFENSE Security Advisory 02.07.05: IBM AIX chdev Local Format String Vulnerability (Shiva Persaud <shivapd@...ibm.com>)
• iDEFENSE Security Advisory 02.10.05: IBM AIX ipl_varyon Local Buffer Overflow Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• [SECURITY] [DSA 675-1] New hztty packages fix local utmp exploit (joey@...odrom.org (Martin Schulze))
• Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0 (Luigi Auriemma <aluigi@...istici.org>)
• secure-roster script to address mailman email harvester (Neal McBurnett <neal@....boulder.co.us>)
• Re:iDEFENSE Security Advisory 02.10.05: IBM AIX ipl_varyon Local Buffer Overflow Vulnerability (Shiva Persaud <shivapd@...ibm.com>)
• RE: MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit ("Thor Larholm" <thor@...x.com>)
• RE: MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit ("Color Inc." <neoexitus@...mail.com>)
• Re: iDEFENSE Security Advisory 02.10.05: IBM AIX netpmon Local Buffer Overflow Vulnerability (Shiva Persaud <shivapd@...ibm.com>)
• Re: Finjan Security Advisory: Microsoft Office XP Remote Buffer Overflow Vulnerability (Derek Martin <code@...zashack.org>)
• Re: iDEFENSE Security Advisory 02.10.05: IBM AIX lspath Local File Access Vulnerability (Shiva Persaud <shivapd@...ibm.com>)

• [FLSA-2005:2252] Updated iptables packages resolve security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2353] Updated gpdf package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2352] Updated Xpdf package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• iDEFENSE Security Advisory 02.10.05: Computer Associates BrightStor ARCserve Backup UniversalAgent Backdoor Vulnerabilit… ("iDefense Customer Service" <customerse…)
• [FLSA-2005:2188] Updated gaim package resolves security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• HACKING WITH JAVASCRIPT ("hictor ertd" <hict0r@...mail.com>)
• Symantec UPX Parsing Engine Heap Overflow (Neil Watson <bugtraq@...son-wilson.ca>)
• ASPjar guestbook (Injection in login page) (farhad koosha <farhadkey@...oo.com>)
• RE: MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit ("Andrew Hunter" <andiroohunter@....com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("Peter J. Holzer" <hjp@....ac.at>)
• [USN-80-1] mod_python vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [USN-81-1] iptables vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Re: Data Mining for PIX Firewall Logs (jkowall <jkowall@...cking.net>)
• RE: Data Mining for PIX Firewall Logs (mhuston@...gitekltd.com)
• TSLSA-2005-0003 - multi (Trustix Security Advisor <tsl@...stix.org>)
• [SECURITY] [DSA 678-1] New netkit-rwho packages fix denial of service (joey@...odrom.org (Martin Schulze))
• MDKSA-2005:032 - Updated cpio packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:033 - Updated enscript packages fix multiple vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:034 - Updated squid packages fix multiple vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:035 - Updated python packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:036 - Updated MySQL packages fix temporary file vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Remotely Controlling XSS Attacks - Announcing XSS-Proxy ("Rager, Anton (Anton)" <arager@...ya.com>)
• [SECURITY] [DSA 674-2] New mailman packages really fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• insecure temporary file creation in kdelibs 3.3.2 (Davide Madrisan <davide.madrisan@...inux.it>)
• Re: Symantec UPX Parsing Engine Heap Overflow (James Riden <j.riden@...sey.ac.nz>)
• [SECURITY] [DSA 676-1] New xpcd packages fix arbitrary code execution as root (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 677-1] New sympa packages fix potential arbitrary code execution (joey@...odrom.org (Martin Schulze))
• BrightStor ARCserve Backup buffer overflow PoC (<cybertronic@....net>)
• Re: HACKING WITH JAVASCRIPT (Cleiton Martins <cleiton@...il.com>)
• Re: HACKING WITH JAVASCRIPT (Jim Halfpenny <jim@...nanswers.co.uk>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL cert… (Scott Gifford <sgifford@...pectclass.co…)
• iDEFENSE Security Advisory 02.11.05: ZoneAlarm 5.1 Invalid Pointer Dereference Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• SYM05-003 Symantec UPX Parsing Engine Heap Overflow (<secure@...antec.com>)
• Zone Labs Security Alert ZL05-01: Zone Labs IPC Instability ("Zone Labs Product Security" <Product-Security@...elabs.com>)

• RE: Data Mining for PIX Firewall Logs ("Todd Towles" <toddtowles@...okshires.com>)
• RE: Data Mining for PIX Firewall Logs ("Hill, Keith (Contractor)" <Keith.Hill@....treas.gov>)
• Re: Fireflashing [Firefox 1.0] (Jelmer Kuperus <jkuperus@...net.nl>)
• exim auth_spa_server() PoC exploit (Yuri Gushin <yuri@...ipse.org.il>)
• Infostring crash and shutdown in the Quake 3 engine (Luigi Auriemma <aluigi@...istici.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Neil W Rickert <rickert+bt@...niu.edu>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Scott Gifford <sgifford@...pectclass.co…)
• MDKSA-2005:032-1 - Updated cpio packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Symantec UPX issue solution ("Roger A. Grimes" <roger@...neretcs.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs… ("Janusz A. Urbanowicz" <alex@...h.net.p…)
• Re: Advanced Guestbook 2.2 -- SQL Injection Exploit (<mary@...webworks.com>)

• Re: BrightStor ARCserve Backup buffer overflow PoC (H D Moore <sflist@...italoffense.net>)

• The ultimate solution to phising (Stian Øvrevåge <sovrevage@...il.com>)
• [CLA-2005:924] Conectiva Security Announcement - XFree86 (Conectiva Updates <secure@...ectiva.com.br>)
• [SECURITY] [DSA 679-1] New toolchain-source package fixes insecure temporary files (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 680-1] New htdig packages fix cross-site scripting vulnerability (joey@...odrom.org (Martin Schulze))
• ASPjar Guestbook login.asp not official patch ("CorryL" <corryl@...overde.com>)
• RE: International Domain Name [IDN] support in modern browsers al lows attackers to spoof domain name URLs + SSL cer… (Michael Wojcik <Michael.Wojcik@...rofoc…)
• [SECURITY] [DSA 681-1] New synaesthesia packages fix unauthorised file access (joey@...odrom.org (Martin Schulze))
• AWStats <= 6.4 Multiple vulnerabilities (GHC@....securityfocus.com, [ru]@securityfocus.com@....securityfocus.com <foster@....ru>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("David Schwartz" <davids@...master.com>)
• Credit Card Phishing with executable download (Gandalf The White <gandalf@...ital.net>)
• Microsoft Baseline Security Analyzer not seeing KB887742 and KB88 6185 (James Lay <jlay@...riben.com>)
• eBay Account Phishing with eBay Redirect ("Steven" <steven@...ebug.org>)
• vbulletin 3.0.x PHP code execution (AL3NDALEEB <al3ndaleeb@....net>)
• Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management Software (Maximillian Dornseif <dornseif@...ormatik.rwth-aachen.de>)
• Re: BrightStor ARCserve Backup buffer overflow PoC (H D Moore <sflist@...italoffense.net>)
• Exploit on tcp/4128? ("Lawrence Baldwin" <baldwinL@...etwatchman.com>)
• RE: Exploit on tcp/4128? ("David Gillett" <gillettdavid@...a.edu>)
• [NOBYTES.COM: #2] CubeCart 2.0.4 - Multiple Vulnerabilities ("John Cobb" <johnc@...ytes.com>)
• Re: eBay Account Phishing with eBay Redirect (Josh Tolley <josh@...ntreeinc.com>)

• RE: Exploit on tcp/4128? (Jeff Mickey <jmic@...rknob.id.iit.edu>)
• Re: Exploit on tcp/4128? (James Eaton-Lee <james.mailing@...il.com>)
• RE: Exploit on tcp/4128? ("Butterworth, Jim" <jim.butterworth@...dancesoftware.com>)
• RE: Exploit on tcp/4128? ("Lawrence Baldwin" <baldwinL@...etwatchman.com>)
• SecurityForest - Public Release no.2 ("loni@...urityforest.com" <loni@...urityforest.com>)
• RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185 ("Threlkeld, Richard" <richardt@...lcomm.com>)
• Kayako eSupport v2.3.1 Support Tracker XSS Vulnerability (Seth Alan Woolley <seth@...tology.org>)
• Re: Microsoft Baseline Security Analyzer not seeing KB887742 and KB88 6185 (Vincent Archer <var@...y-all.com>)
• [USN-82-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185 ("STANESCU Ionut" <ionut.stanescu@....ro>)
• RE: RE: Microsoft Baseline Security Analyzer no t seeing KB887742 and KB886185 ("Randal, Phil" <prandal@...efordshire.gov.uk>)
• ASPjar Guestbook login.asp not official patch ("CorryL" <corryl@...overde.com>)
• [SECURITY] [DSA 683-1] New postgresql packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Re: AWStats <= 6.4 Multiple vulnerabilities (Ondra Holecek <bln@...rese.net>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Vincent Archer <var@...y-all.com>)
• [SECURITY] [DSA 682-1] New awstats packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
• Re: eBay Account Phishing with eBay Redirect (Nick FitzGerald <nick@...us-l.demon.co.uk>)
• Re: vbulletin 3.0.x PHP code execution (pokley <pokleyzz@...n-associates.net>)
• MDKSA-2005:037 - Updated mailman packages fix directory traversal vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Re: eBay Account Phishing with eBay Redirect (Jonathan Rockway <jrockw2@....edu>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• RE: Exploit on tcp/4128? ("Mueller, Lance" <lance.mueller@...dancesoftware.com>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Jamie Pratt <jpratt@...wich.edu>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Ondra Holecek <bln@...rese.net>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Gwendolynn ferch Elydyr <gwen@...tiles.…)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("Thor (Hammer of God)" <thor@...merofgod…)
• IE6 SP1 - Click N Crash (ViPeR <viper31337@...oo.co.in>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Sebastian <security-basics@...sinki.fi.…)
• RE: eBay Account Phishing with eBay Redirect ("Thomas T. Evans, III" <ttevans@...kcorp.net>)

• Re: eBay Account Phishing with eBay Redirect (Jay Calvert <jcalvert@...aneronetworks.com>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Herman Sheremetyev <herman@...bpage.com>)
• Re: IE6 SP1 - Click N Crash is old news ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
• Scottrader Application Exploit (Ben Efros <befros@...il.com>)
• Scottsave.com Trade History Exploit (Ben Efros <befros@...il.com>)
• [NOBYTES.COM: #3] osCommerce 2.2-MS2 - XSS Vulnerability ("John Cobb" <johnc@...ytes.com>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Ondra Holecek <bln@...rese.net>)
• RE: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? ("William Pratt" <wpratt@...apath.net>)
• RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB88 6185 Correction (James Lay <jlay@...riben.com>)
• RE: eBay Account Phishing with eBay Redirect ("Israel Torres" <ITorres@...ronic.com>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Jeffrey Wilkinson <jwilkins@...rox.com>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (twebster@...soft.com)
• XSS in MySpace.com RuWeb.net and Primus.com (Chris <cdp2906@...ma2.uta.edu>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Jamie Pratt <jpratt@...wich.edu>)
• Re: RE: Microsoft Baseline Security Analyzer no t seeing KB887742 and KB886185 ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
• [NORTHSHOREINTERNET.COM.AU: #1] amihotornot.com.au vulnerability ("North Shore Internet" <advisories@...thshoreinternet.com.au>)
• Re: RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185 ("Thor \(Hammer of God\)" <thor@...merofgod.com>)
• RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185 (Harshad <harshad@...oo.com>)
• RE: RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB886185 ("Threlkeld, Richard" <richardt@...lcomm.com>)
• [USN-83-1] LessTif 2 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [Full Disclosure] Using DHTML XSS to launch HHCTRL exploit (Valentin Avram <vavram@...adnet.ro>)
• [CLA-2005:925] Conectiva Security Announcement - evolution (Conectiva Updates <secure@...ectiva.com.br>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Thom Craver <tcraver@...p-com.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("Thor (Hammer of God)" <thor@...merofgod…)
• Re: vbulletin 3.0.x PHP code execution (AL3NDALEEB. <al3ndaleeb@....net>)
• Re: BrightStor ARCserve Backup buffer overflow PoC ("Williams, James K" <James.Williams@...com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (George Capehart <gwc@....org>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (K-OTiK Security <Special-Alerts@...tik.com>)
• MDKSA-2005:038 - Updated emacs/xemacs packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• [KDE Security Advisory] Buffer overflow in fliccd of kdeedu/kstars/indi (Dirk Mueller <mueller@....org>)
• [hackgen-2005-#003] - SQL injection bugs in DCP-Portal (Exoduks <exoduks@...il.com>)
• [KDE Security Advisory] Buffer overflow in fliccd of kdeedu/kstars/indi (Dirk Mueller <dirk@....org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("Janusz A. Urbanowicz" <alex@...h.net.pl…)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Gwendolynn ferch Elydyr <gwen@...tiles.…)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Gwendolynn ferch Elydyr <gwen@...tiles.…)
• xprobe2 v0.2.2 released (Ofir Arkin <ofir@...-security.com>)
• Blind Sql-Injection in MySQL Databases ("Zeelock" <zee@...bnc.it>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("David Schwartz" <davids@...master.com>)
• RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB88 6185 Correction (Joe Granto <Joe.Granto@....Com>)

• Re: vbulletin 3.0.x PHP code execution (pokley <pokleyzz@...n-associates.net>)
• [SECURITY] [DSA 684-1] New typespeed packages fix arbitrary group games code execution (joey@...odrom.org (Martin Schulze))
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("David Schwartz" <davids@...master.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Bill Brown <bbrown@...s.dartmouth.edu>)
• Update Your Bookmarks ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
• SHA-1 broken (Gadi Evron <gadi@...ila.gov.il>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Micah Brandon <brandon@...com>)
• [Security Bulletin] SSRT5893 rev.0 - HP Web-enabled Management Software Remote Buffer Overflow ("Boren, Rich (SSRT)" <rich.boren@...com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("lyal.collins" <lyal.collins@...2it.com.…)
• RE: Microsoft Baseline Security Analyzer not seeing KB887742 and KB88 6185 Correction ("Threlkeld, Richard" <richardt@...lcomm.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Seth Breidbart <sethb@...ix.com>)
• [PersianHacker.NET 200505-06] paNews v2.0b4 XSS Vulnerability (PersianHacker Team <pi3ch@...oo.com>)
• NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+ ("TAC" <tac@...sec.net>)
• [USN-78-2] Fixed mailman packages for USN-78-1 (Martin Pitt <martin.pitt@...onical.com>)
• [USN-66-2] PHP vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Advisory: Multiple Vulnerabilities in BibORB (Patrick Hof <security@...f25.de>)
• iDEFENSE Labs Website Launch ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
• Re: SHA-1 broken (Kent Borg <kentborg@...g.org>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Benjamin Franz <snowhare@...ongo.org>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Stefan Paletta <stefanp@...al1.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Stefan Paletta <stefanp@...al1.com>)
• RE: BrightStor ARCserve Backup buffer overflow PoC (fix available) ("Williams, James K" <James.Williams@...com>)
• Re: SHA-1 broken (Michael Cordover <michael.cordover@...il.com>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Nick FitzGerald <nick@...us-l.demon.co.…)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("David Schwartz" <davids@...master.com>)
• Re: SHA-1 broken (Robert Sussland <robert@...wood.org>)
• Re: SHA-1 broken (Steve Friedl <steve@...xwiz.net>)
• XSS vulnerabilty in ASP.Net [with details] (Andir Andir <spam_andir@...l.ru>)
• RE: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? ("Michael Scheidell" <scheidell@...nap.net>)
• MDKSA-2005:039 - Updated rwho packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Re: xprobe2 v0.2.2 released (Stan Bubrouski <stan@....neu.edu>)
• RECON 2005 CFP [Montreal, Canada] (dataworm <dataworm@...lating.us>)

• [FLSA-2005:2137] Updated cyrus-sasl resolves security vulnerabilities (Dominic Hargreaves <dom@...th.li>)
• Invision Power Boards 1.3.1 FINAL XSS Exploit (Daniel A. <ldrada@...il.com>)
• Dangers of discarding duplicated messages (Adrian Bunk <bunk@...sta.de>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (Matt Wilder <grewaru@...il.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• RE: BrightStor ARCserve Backup buffer overflow PoC (fixes available) ("Williams, James K" <James.Williams@...com>)
• [ SCL-2005.001 ] - WebCalendar: SQL Injection from encoded cookie (Scovetta Labs <security@...vettalabs.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Ron DuFresne <dufresne@...ternet.com>)
• Re: Permission problem in Skype BETA for linux (Peter Conrad <conrad@...ano.de>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("Thor (Hammer of God)" <thor@...merofgod…)
• Remote Windows Kernel Exploitation - Step Into the Ring 0 ("Marc Maiffret" <mmaiffret@...e.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Vincent Archer <var@...y-all.com>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Tosoni <jean-pierre.tosoni@...ertysurf.f…)
• [PersianHacker.NET 200505-07] paFAQ Beta4 Sql Injection (PersianHacker Team <pi3ch@...oo.com>)
• Possible phpBB <=2.0.11 bug or sql injection? (<jtm297@...online.net>)
• [SECURITY] [DSA 685-1] New emacs21 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Re: SHA-1 broken ("Jonathan G. Lampe" <jonathan.lampe@...ndardnetworks.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• [SECURITY] [DSA 686-1] New gftp packages fix directory traversal vulnerability (joey@...odrom.org (Martin Schulze))
• hpm_guestbook.cgi JavaScript-Injection (Christoph Burchert <chburchert@....de>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("David Schwartz" <davids@...master.com>)
• Re: IE6 SP1 - Click N Crash (Robert ONeal <rob@...elworks.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. ("David Schwartz" <davids@...master.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (bkfsec <bkfsec@....lonestar.org>)
• Phishing hole found in IE and OE (Jay Calvert <jcalvert@...aneronetworks.com>)
• RE: SHA-1 broken ("Scovetta, Michael V" <Michael.Scovetta@...com>)
• Re: NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+ (Vade 79 <v9@...ehalo.deadpig.org>)
• Multiple vulnerabilities in TrackerCam 5.12 (Luigi Auriemma <aluigi@...istici.org>)
• Re: Multiple vulnerabilities in TrackerCam 5.12 ("morning_wood" <se_cur_ity@...mail.com>)
• Re: SHA-1 broken (<dullien@....de>)
• Knox Arkeia remote root/system exploit ("John Doe" <guldens111@...mail.com>)
• Re: SHA-1 broken (<dullien@....de>)
• RE: SHA-1 broken (Michael Silk <michaelsilk@...il.com>)
• MDKSA-2005:043 - Updated xpdf packages fix vulnerabilities on 64 bit platforms (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• BizMail 2.1 Spam Exploit (Jason Frisvold <xenophage0@...il.com>)
• Re: Dangers of discarding duplicated messages (Maciej Soltysiak <maciej@...tysiak.com>)
• Re: Possible phpBB <=2.0.11 bug or sql injection? (Exoduks <exoduks@...il.com>)

• [SECURITY] [DSA 687-1] New bidwatcher packages fix format string vulnerability (joey@...odrom.org (Martin Schulze))
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Rainer Duffner <rainer@...ra-secure.de>)
• 3com 3CDaemon FTP "USER" Remote BOverflow POC (Hat-Squad Security Team <bugtraq@...-squad.com>)
• Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs. (Riccardo Murri <murri@...m.uniroma1.it>)
• Re: Phishing hole found in IE and OE (Greg Merideth <gmerideth@...wardtechnology.net>)
• Re: SHA-1 broken ("D.J. Capelis" <djcapelisp@...oo.com>)
• RE: Possible phpBB <=2.0.11 bug or sql injection? (Miguel Angel Rodríguez Jódar <rodriguj@....us.es>)
• Re: Phishing hole found in IE and OE (David Nichols <dnichols@...i.com>)
• Combining Hashes (Kent Borg <kentborg@...g.org>)
• MDKSA-2005:045 - Updated kdelibs packages fix vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Re: SHA-1 broken (Michael Silk <michaelsilk@...il.com>)
• Adobe Reader invalid root page node Count value DOS (Hongzhen Zhou <felix__zhou@...mail.com>)
• Re: SHA-1 broken (Dan Harkless <bugtraq@...kless.org>)
• MDKSA-2005:044 - Updated tetex packages fix vulnerabilities on 64 bit platforms (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3? (newbug Tseng <newbug@...oot.org>)
• MDKSA-2005:041 - Updated cups packages fix vulnerabilities on 64 bit platforms (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:040 - Updated PostgreSQL packages fix multiple vulnerabilities (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• Multiple vulnerabilities in Glftpd v1.26 - v2.00 default zip based plug-ins (headpimp@...p-industries.com)
• Joint encryption? (John Richard Moser <nigelenki@...cast.net>)
• Thomson TCW690 POST Password Validation Vulnerability (MurDoK <murdok.lnx@...il.com>)
• Thomson TCW690 Denial Of Service Vulnerability (MurDoK <murdok.lnx@...il.com>)
• Re: Thomson TCW690 Denial Of Service Vulnerability (Andres Tarasco <atarasco@...il.com>)
• Re: SHA-1 broken (<dullien@....de>)
• Re: SHA-1 broken (Darren Reed <avalon@...igula.anu.edu.au>)
• Multiples vulnerability in ZeroBoard, ("albanian haxorz" <asc@...anianhaxorz.org>)

• Re: Joint encryption? (John Richard Moser <nigelenki@...cast.net>)
• Re: Joint encryption? (Damian Menscher <menscher@...c.edu>)
• exwormshoucast part of PTjob project: SHOUTcast v1.9.4 remote exploit (yan feng <jsk@...nt0m.net>)
• Re: Phishing hole found in IE and OE (cyberpixl <cyberpixl@...il.com>)
• [Hat-Squad] Findjmp2 Tool (Hat-Squad Security Team <bugtraq@...-squad.com>)
• Re: SHA-1 broken (Tollef Fog Heen <tfheen@....no>)
• webfsd fun. opensource is god .lol windows (yan feng <jsk@...nt0m.net>)
• cfengine rsa heap remote exploit: part of PTjob project (yan feng <jsk@...nt0m.net>)
• 3com 3CDaemon FTP Unauthorized "USER" Remote BOverflow ("class 101" <class101@...-squad.com>)
• Re: Joint encryption? (Casper.Dik@....COM)
• Re: Joint encryption? (devnull@...ents.Montreal.QC.CA)
• Re: Possible phpBB <=2.0.11 bug or sql injection? ("kaosone+[ONE]+" <kaosone@...il.com>)
• Re: Combining Hashes (Aaron Mizrachi (unmanarc) <aaron@...acksecurity.com>)
• Re: [lists] Combining Hashes (Elliott Bäck <ecb29@...nell.edu>)
• Re: Joint encryption? (John Richard Moser <nigelenki@...cast.net>)
• Re: Joint encryption? (John Richard Moser <nigelenki@...cast.net>)
• Re: SHA-1 broken (Michael Silk <michaelsilk@...il.com>)
• Re: SHA-1 broken (Anatole Shaw <shaw_bugtraq20050218@...oloop.com>)
• Re: SHA-1 broken (<securityfocus@...rotechnical.co.uk>)
• Re: Dangers of discarding duplicated messages (Jon Keating <jonkeating@...il.com>)
• Re: Combining Hashes (Felix Cuello <felix@...iga.com>)
• Re: SHA-1 broken (Brian May <brian@...arthed.org>)
• Re: SHA-1 broken (exon <exon@...e.se>)
• Re: Dangers of discarding duplicated messages (Gene Rackow <rackow@....anl.gov>)
• Re: Possible phpBB <=2.0.11 bug or sql injection? (Giacomo Rizzo <a_l_t_o_s@...oo.it>)
• Re: Dangers of discarding duplicated messages ("David F. Skoll" <dfs@...ringpenguin.com>)
• Re: SHA-1 broken (Michael Cordover <michael.cordover@...il.com>)
• Re: Combining Hashes (exon <exon@...e.se>)
• Re: Thomson TCW690 Denial Of Service Vulnerability (MurDoK <murdok.lnx@...il.com>)
• [FLSA-2005:1945] Updated sox packages fix buffer overflows (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2058] Updated cdrtools packages fix a security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:1944] GNOME VFS updates address extfs vulnerability (Marc Deslauriers <marcdeslauriers@...eotron.ca>)

• [USN-84-1] Squid vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [SECURITY] [DSA 674-3] New mailman packages really fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• Arkeia Network Backup Client Remote Access (H D Moore <sflist@...italoffense.net>)
• Re: Knox Arkeia remote root/system exploit (H D Moore <sflist@...italoffense.net>)
• Gigafast/CompUSA router (model EE400-R) vulnerabilities ("Gary H. Jones II" <gary@...ntblanksecurity.com>)
• ADP Elite System Max 9000 Series Login Vulnerability (<rootfiend@...e-mail.net>)
• Re: SHA-1 broken (Michael Silk <michaelsilk@...il.com>)
• Re: Combining Hashes (Ivan Krstic <krstic@....harvard.edu>)
• Windows Firewall Has A Backdoor (Jay Calvert <jcalvert@...aneronetworks.com>)
• Re: SHA-1 broken (exon <exon@...e.se>)
• Re: Joint encryption? ("Robert C. Helling" <R.Helling@...tp.cam.ac.uk>)
• Re: Combining Hashes (Frank Knobbe <frank@...bbe.us>)
• RE: SHA-1 broken (Frank Knobbe <frank@...bbe.us>)
• Re: Joint encryption? (Gandalf The White <gandalf@...ital.net>)
• RE: Joint encryption? ("David Schwartz" <davids@...master.com>)
• SD Server 4.0.70 Directory Traversal Bug ("CorryL" <corryl@...overde.com>)
• Re: Joint encryption? (John Richard Moser <nigelenki@...cast.net>)
• Re: SHA-1 broken (peeon+securityfocus@...on.net)
• Re: Joint encryption? (Valdis.Kletnieks@...edu)
• Re: SHA-1 broken (Denis Jedig <seclists@...eticon.de>)
• Re: Windows Firewall Has A Backdoor (Chris Wysopal <weld@...nwatch.org>)
• Re: Joint encryption? ("Ruud H.G. van Tol" <rvtol@...lution.nl>)
• Re: SHA-1 broken (Damian Menscher <menscher@...c.edu>)
• Re: Joint encryption? (John Richard Moser <nigelenki@...cast.net>)
• Re: SHA-1 broken (Paul Johnston <paul@...tpoint.ltd.uk>)
• Re: Joint encryption? (peter zulu <peterzulu@...il.com>)
• RE: Windows Firewall Has A Backdoor ("Chris Goodwin" <chris.goodwin@...centerprises.com>)
• iDEFENSE Security Advisory 02.21.05: Multiple PuTTY SFTP Client Packet Parsing Integer Overflow Vulnerabilities ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
• iDEFENSE Security Advisory 02.21.05: Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnera… ("iDEFENSE Labs" <labs-no-reply@...fense…)

• iDEFENSE Security Advisory 02.21.05: Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vul… ("iDEFENSE Labs" <labs-no-reply@...fense…)
• Re: SHA-1 broken (Peter Jeremy <peter.jeremy@...atel.com.au>)
• Re: SHA-1 broken ("Peter J. Holzer" <hjp@....ac.at>)
• phpBB 2.0.12 released ("Snapdragon" <lists@...droseweb.net>)
• Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability (<m123303@...hmond.ac.uk>)
• Re: Arkeia Network Backup Client Remote Access (Vincent Archer <var@...y-all.com>)
• iDEFENSE Security Advisory 02.22.05: phpBB Group phpBB Arbitrary File Disclosure Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
• Re: Arkeia Network Backup Client Remote Access (H D Moore <sflist@...italoffense.net>)
• Re: Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability (grutz@...gojango.net)
• SD Server 4.0.70 Directory Traversal Bug ("CorryL" <corryl@...overde.com>)
• [NOBYTES.COM: #5] iGeneric eShop 1.2 - Information Disclosure & Possible SQL Injection ("John Cobb" <johnc@...ytes.com>)
• Re: Windows Firewall Has A Backdoor ("Thor (Hammer of God)" <thor@...merofgod.com>)
• RE: Windows Firewall Has A Backdoor ("Thor Larholm" <thor@...x.com>)
• Re: Combining Hashes (Joel Maslak <jmaslak@...elope.net>)
• The WebConnect 6.4.4 and 6.5 contains several vulnerabilities ("CIRT Advisory" <advisory@...t.dk>)
• [SCAN Associates Security Advisory] vbulletin 3.0.6 and below php code injection (pokley <pokleyzz@...n-associates.net>)
• paNews v2.0b4 - PHP Injection (tjomka <tjomka@...igator.lv>)
• Cross Site Scripting exploitation via malformed files (Jerome ATHIAS <jerome.athias@...e.fr>)
• iDEFENSE Security Advisory 02.22.05: phpBB Group phpBB2 Arbitrary File Unlink Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)

• Incorrect Classification of iDownload's Product as Spyware... (Paul Laudanski <zx@...tlecops.com>)
• Software PBLang 4.65 search.php XSS vulnerability (Raven <raven@...-security.com>)
• Software PBLang 4.65 pm.php XSS vulnerability (Raven <raven@...-security.com>)
• Re: Arkeia Network Backup Client Remote Access (Arnaud Spicht <aspicht@...eia.com>)
• Re: Knox Arkeia remote root/system exploit (Arnaud Spicht <aspicht@...eia.com>)
• Re: Cross Site Scripting exploitation via malformed files ("http-equiv@...ite.com " <1@...ware.com>)
• Re: phpBB 2.0.12 released (bcl@...anlane.com)
• [SECURITY] [DSA 688-1] New squid packages fix denial of service (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 689-1] New mod_python packages fix information leak (joey@...odrom.org (Martin Schulze))
• Robustness patch for TWiki, vulnerability in ImageGalleryPlugin (Florian Weimer <fw@...eb.enyo.de>)
• Release of Arkeia Network Backup 5.3.5 fixes security issue [bugtraq id 12594] (Arnaud Spicht <aspicht@...eia.com>)
• [Fwd: [arkeia-announce] Release of Arkeia Network Backup 5.3.5 fixes security issue] (Maciej Bogucki <maciej.bogucki@...egence.com>)
• RE: Incorrect Classification of iDownload's Product as Spyware... ("Paul Kurczaba" <seclists@...urinews.com>)

• Office 10 applications & flashdrives can be used to browse restricted drives ("Discini, Sonny" <Sonny.Discini@...tgomerycountymd.gov>)
• Re: Incorrect Classification of iDownload's Product as Spyware... (Paul Laudanski <zx@...tlecops.com>)
• [FLSA-2005:2343] Updated vim packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2005] Updated gdk-pixbuf packages fix security flaws (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• [FLSA-2005:2043] Updated zlib package fixes security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
• Re: Incorrect Classification of iDownload's Product as Spyware... (Dave C <davec@...istruction.com>)
• Google as Application FireWall (Andrey Bayora <andrey@...denbit.org>)
• RE: Incorrect Classification of iDownload's Product as Spyware... ("Roger A. Grimes" <roger@...neretcs.com>)
• Multiple vulnerabilities found in CSGuestbook by CoolSerlets.com (<Josh884@...mail.com>)
• RE: Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability ("Walton, John Michael (John)" <jmwalton@...ya.com>)
• iDEFENSE Security Advisory 02.23.05: Sun Solaris kcms_configure Arbitrary File Corruption Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
• Re: phpBB 2.0.12 released (bcl@...anlane.com)
• Cisco Security Advisory: ACNS Denial of Service and Default Admin Password Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
• In-game cl_guid crash in Soldier of Fortune II 1.03 (Luigi Auriemma <aluigi@...istici.org>)
• [Security Bulletin] SSRT4694 HP-UX ftpd remote unauthorized access ("Boren, Rich (SSRT)" <rich.boren@...com>)
• RE: Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability ("PASTOR ADRIAN" <M123303@...hmond.ac.uk>)
• Multiple vulns in punBB (John Gumbel <johannes.gumbel.2873@...dent.uu.se>)
• MDKSA-2005:046 - Updated uim packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:047 - Updated squid packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)
• phpWebSite-0.10.0_exploit (tjomka <tjomka@...igator.lv>)

• [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4 (Maksymilian Arciemowicz <max@...tsuper.pl>)
• [FLSA-2005:2336] Updated kernel packages fix security issues (fedora-legacy-announce@...hat.com)
• Firescrolling [Firefox 1.0] ("mikx" <mikx@...x.de>)
• Announce: RSBAC v1.2.4 released (Amon Ott <ao@...ac.org>)
• [USN-85-1] Gaim vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• phpWebSite 0.10.0 Full Path disclosure (HaCkZaTaN. <hck_zatan@...mail.com>)
• phpWebSite 0.10.0 Full Path disclosure (HaCkZaTaN <hck_zatan@...mail.com>)
• [SECURITY] [DSA 690-1] New bsmtpd packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
• CFP: WORM 2005 (David Moore <dmoore@...da.org>)
• AW: phpWebSite-0.10.0_exploit (webmaster@...eless-design.de)
• Re: Office 10 applications & flashdrives can be used to browse restricted drives (Denis Jedig <seclists@...eticon.de>)
• RE: Firescrolling [Firefox 1.0] ("Eric McCarty" <eric@...eduncan.com>)
• RE: Firescrolling [Firefox 1.0] ("Beauford, Jason" <jbeauford@...htInOnePet.com>)
• iDEFENSE Security Advisory 02.25.05: WU-FTPD File Globbing Denial of Service Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
• CIS WebServer Directory Traversal Bug ("CorryL" <corryl@...overde.com>)
• Re: iDEFENSE Security Advisory 02.25.05: WU-FTPD File Globbing Denial of Service Vulnerability (Stan Bubrouski <stan@....neu.edu>)

• RE: Firescrolling [Firefox 1.0] ("Andrade, Leonardo F. Buonsanti de \(BR - IT Brazil\)" <leoandrade@...oitte.com>)
• Re: Firescrolling [Firefox 1.0] (Stan Bubrouski <stan@....neu.edu>)
• More T-Mobile fall out... ("pingywon" <pingywon@...mail.com>)
• Re: Firescrolling [Firefox 1.0] (btrq@...-n.com)
• -==phpBB 2.0.12 Full path disclosure==- (HaCkZaTaN <hck_zatan@...mail.com>)
• Re: [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion ("Calum Power" <enune@...bble.net>)
• Knet <= 1.04c Buffer Overflow Bug ("CorryL" <corryl@...overde.com>)
• Re: Office 10 applications & flashdrives can be used to browse restricted drives (Paul <paul@...yhats.cjb.net>)
• Mozilla Firefox 1.0.1 Javascript Images are Draggable (Paul <paul@...yhats.cjb.net>)
• Re: Mozilla Firefox 1.0.1 Javascript Images are Draggable ("Jay D. Dyson" <jdyson@...achery.net>)
• Re: Office 10 applications & flashdrives can be used to browse restricted drives ("Jay D. Dyson" <jdyson@...achery.net>)

• Google Getting (even) smarter (Josh Zlatin-Amishav <josh@...s.co.il>)
• [HAT-SQUAD] BadBlue, Easy P2P File Sharing Remote Exploit ("class 101" <class101@...-squad.com>)

• [USN-86-1] cURL vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [USN-87-1] Cyrus IMAP server vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [USN-88-1] reportbug information disclosure (Martin Pitt <martin.pitt@...onical.com>)
• Re: Google Getting (even) smarter (Jordan Wiens <numatrix@....edu>)
• [USN-89-1] XML library vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• Re: Office 10 applications & flashdrives can be used to browse restricted drives ("Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@...bell.net>)
• Re: Office 10 applications & flashdrives can be used to browse restricted drives ("Jay D. Dyson" <jdyson@...achery.net>)
• 7a69Adv#22 - UNIX unzip keep setuid and setgid files (Albert Puigsech Galicia <ripe@...9ezine.org>)
• Re: iDEFENSE Security Advisory 02.25.05: WU-FTPD File Globbing Denial of Service Vulnerability (Rainer Schöpf <rainer.schoepf@...teosys.com>)
• WASC-Articles: 'The Insecure Indexing Vulnerability - Attacks Against Local Search Engines' By Amit Klein (robert@...appsec.org)
• iDEFENSE Security Advisory 02.28.05: Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design Error ("iDEFENSE Labs" <labs-no-reply@...fense.com…)
• iDEFENSE Security Advisory 02.28.05: KPPP Privileged File Descriptor Leak Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
• Server termination in Scrapland 1.0 (Luigi Auriemma <aluigi@...istici.org>)
• [Hat-Squad] GFI L.N.S.S 5.0 Insecure Credential Storage (Hat-Squad Security Team <bugtraq@...-squad.com>)
• [SECURITYREASON.COM] PostNuke SQL Injection 0.760-RC2=>x cXIb8O3.3 (Maksymilian Arciemowicz <max@...tsuper.pl>)
• [SECURITYREASON.COM] PostNuke Critical XSS 0.760-RC2=>x cXIb8O3.2 (Maksymilian Arciemowicz <max@...tsuper.pl>)
• [SECURITYREASON.COM] PostNuke Critical SQL Injection 0.760-RC2=>x cXIb8O3.1 (Maksymilian Arciemowicz <max@...tsuper.pl>)
• Re: iDEFENSE Security Advisory 02.28.05: Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design Error (Miles Beck <mbeck@...tq.com>)

562 messages

Powered by blists - more mailing lists