bugtraq mailing list - 2009/06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 21	² 19	³ 9	⁴ 11	⁵ 15	⁶	⁷
⁸ 8	⁹ 20	¹⁰ 23	¹¹ 12	¹² 5	¹³	¹⁴
¹⁵ 22	¹⁶ 17	¹⁷ 3	¹⁸ 15	¹⁹ 4	²⁰	²¹
²² 8	²³ 8	²⁴ 7	²⁵ 11	²⁶ 12	²⁷	²⁸
²⁹ 11	³⁰ 11

Messages by day:

June 1 (21 messages)

Linksys WAG54G2 Web Management Console Local Arbitrary Shell Command Injection Vulnerability (michal.sajdak@...uritum.pl)
OCS Inventory NG 1.02 - Multiple SQL Injections (Nico Leidecker <nico@...decker.info>)
FIREFOX URL space character SPOOF (xushaopei <xisigr@...il.com>)
CFP 26C3 / 26th Chaos Communication Congress (lists@....io)
[ MDVSA-2009:125 ] wireshark (security@...driva.com)
ICQ 6.5 URL Search Hook/ICQToolBar.dll .URL file processing Windows Explorer remote buffer overflow poc (nospam@...il.com)
[SECURITY] [DSA 1807-1] New cyrus-sasl2/cyrus-sasl2-heimdal packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[ MDVSA-2009:124 ] apache (security@...driva.com)
ASMAX AR 804 gu Web Management Console Arbitrary Shell Command Injection Vulnerability (michal.sajdak@...uritum.pl)
MULTIPLE SQL INJECTION VULNERABILITIES -- Online Grades & Attendance v-3.2.6 --> (y3nh4ck3r@...il.com)
FRHACK 2009 Final Call For Papers extended (Jerome Athias <jerome.athias@...e.fr>)
[SECURITY] [DSA 1808-1] New drupal6 packages fix insufficient input sanitising (white@...ian.org (Steffen Joeris))
Re: MULTIPLE REMOTE VULNERABILITIES --Small Pirates v-2.1--> (y3nh4ck3r@...il.com)
(Post Form --> Parent Register (name)) Credentials Changer (SQLi) EXPLOIT -- Online Grades & Attendance v-3.2.6--> (y3nh4ck3r@...il.com)
ACSAC 2009 submissions due June 8 and June 10 (extended) (acsac.publicity@...il.com)
ZDI-09-024: Safenet SoftRemote IKE Service Remote Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Zemana Antilogger 1.9.2 DoS attack (loginit@...il.com)
[USN-778-1] cron vulnerability (Jamie Strandboge <jamie@...onical.com>)
Re: (Post Form --> Parent Register (name)) Credentials Changer (SQLi) EXPLOIT -- Online Grades & Attendance v-3.2.6--> (Jeremy Brown <0xjbrown41@...il.com>)
Re: Re: (Post Form --> Parent Register (name)) Credentials Changer (SQLi) EXPLOIT -- Online Grades & Attendance v-3.2.6--> (y3nh4ck3r@...il.com)
The father of all bombs - another webdav fiasco (Kingcope <kcope2@...glemail.com>)

June 2 (19 messages)

[ MDVSA-2009:126 ] eggdrop (security@...driva.com)
[SECURITY] [DSA 1809-1] New Linux 2.6.26 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Secunia Research: Apple QuickTime MS ADPCM Encoding Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
(Post Form --> 'cc') Blind (SQLi) EXPLOIT --Online Grades & Attendance <= v-3.2.6--> (y3nh4ck3r@...il.com)
Secunia Research: QuickTime Sorenson Video 3 Content Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
ACDSee Products TIFF and Font Parsing Buffer Overflow Vulnerabilities ("VUPEN Security Research" <advisories@...en.com>)
MULTIPLE LOCAL FILE INCLUSION VULNERABILITIES -- Online Grades & Attendance <= v-3.2.6 --> (y3nh4ck3r@...il.com)
[security bulletin] HPSBUX02429 SSRT090058 rev.2 - HP-UX Running Java, Remote Execution of Arbitrary Code and Other Vulnerabilities (security-alert@...com)
ZDI-09-025: Apple Quicktime Picture Viewer FLC Delta-Encoded Frame Decompression Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-026: Apple QuickTime Packed-bit Decoding Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-027: Apple Quicktime PICT Opcode 0x8201 Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-028: Apple QuickTime CRGN Atom Parsing Heap Buffer Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-029: Apple QuickTime Jpeg2000 Marker Size Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-030: Apple Quicktime PICT Opcode 0x71 Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[SECURITY] [DSA 1810-1] New libapache-mod-jk packages fix information disclosure (Stefan Fritsch <sf@...ian.org>)
TPTI-09-03: Apple iTunes Multiple Protocol Handler Buffer Overflow Vulnerabilities (dvlabs <dvlabs@...pingpoint.com>)
TPTI-09-04: Apple Terminal xterm Resize Escape Sequence Memory Corruption Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
[SECURITY] [DSA 1810-1] New cups/cupsys packages fix denial of service (Nico Golde <nion@...ian.org>)
CORE-2009-0420 - Apple CUPS IPP_TAG_UNSUPPORTED Handling null pointer Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)

June 3 (9 messages)

Advisory: Apple QuickTime Image Description Atom Sign Extension Memory Corruption (Roee Hay <roeehay@...il.com>)
[USN-780-1] CUPS vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-781-1] Pidgin vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-781-2] Gaim vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: TPTI-09-03: Apple iTunes Multiple Protocol Handler Buffer Overflow Vulnerabilities (Will Drewry <redpig@...aspill.org>)
[SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication (Mark Thomas <markt@...che.org>)
[ MDVSA-2009:127 ] gaim (security@...driva.com)
OCS Inventory NG 1.02 - Directory Traversal (Nico Leidecker <nico@...decker.info>)

June 4 (11 messages)

[SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure (Mark Thomas <markt@...che.org>)
[InterN0T] moziloCMS 1.11.1 - XSS Vulnerability (security@...ern0t.net)
[InterN0T] LightNEasy 2.2.2 - HTML Injection Vulnerability (security@...ern0t.net)
[InterN0T] SiteCore.NET 6.0.0 - XSS Vulnerability (security@...ern0t.net)
[InterN0T] Geeklog 1.5 - Pre-Installation Vulnerabilities (security@...ern0t.net)
[InterN0T] Flatnux 2009-03-27 - XSS Vulnerabilities + More (security@...ern0t.net)
[ MDVSA-2009:128 ] libmodplug (security@...driva.com)
SQL INJECTION VULNERABILITY--LightOpen CMS Devel 0.1--> (y3nh4ck3r@...il.com)
[SECURITY] [DSA 1812-1] New apr-util packages fix several vulnerabilities (Stefan Fritsch <sf@...ian.org>)
Re: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication (Christopher Schultz <chris@...istopherschultz.net>)
Re: [InterN0T] Geeklog 1.5 - Pre-Installation Vulnerabilities ("Dirk Haun" <dirk@...n-online.de>)

June 5 (15 messages)

Re: Re: [InterN0T] Geeklog 1.5 - Pre-Installation Vulnerabilities (peter@...er.com)
[Security] XM Easy Personal FTP Server Multiple DoS vulnerabilities (neeraj.thakar@...isnetworks.com)
[ MDVSA-2009:129 ] file (security@...driva.com)
[SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability with FORM authentication (Mark Thomas <markt@...che.org>)
[ISecAuditors Security Advisories] Joomla! 1.5.10 JA_Purity Multiple Persistent XSS (ISecAuditors Security Advisories <advisories@...cauditors.com>)
LightOpenCMS 0.1 pre-alpha Remote SQL Injection ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Reminder: DeepSec 2009 Call for Papers is open (DeepSec Conference <deepsec@...psec.net>)
EC2ND 2009 CFP - 5th European Conference on Computer Network Defence (Maggi Federico <federico.maggi@...il.com>)
Re: Exploiting IE8 UTF-7 XSS Vulnerability using Local Redirection (lord.ittk@...il.com)
Re: [Full-disclosure] Cross Site Scripting in PHP Nuke 8.0 Version (Christian Kujau <lists@...dbynature.de>)
Re: [InterN0T] SiteCore.NET 6.0.0 - XSS Vulnerability-fixed (pm@...ecore.net)
SQL INJECTION VULNERABILITY--Kjtechforce mailman Beta-1--> (y3nh4ck3r@...il.com)
[security bulletin] HPSBMA02433 SSRT090084 rev.1 - HP Discovery & Dependency Mapping Inventory (DDMI) Running on Windows, Remote Unauthori… (security-alert@...com)
[ MDVSA-2009:130 ] gstreamer0.10-plugins-good (security@...driva.com)
('dest') Blind (SQLi) EXPLOIT --Kjtechforce mailman Beta-1 --> (y3nh4ck3r@...il.com)

June 8 (8 messages)

[ MDVSA-2009:131 ] apr-util (security@...driva.com)
[ MDVSA-2009:132 ] libsndfile (security@...driva.com)
[SECURITY] [DSA 1813-1] New evolution-data-server packages fix several vulnerabilities (white@...ian.org (Steffen Joeris))
[DSECRG-09-015] SAP GUI 6.4 Buffer Overflow vulnerability (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[ MDVSA-2009:131-1 ] apr-util (security@...driva.com)
Rasterbar libtorrent arbitrary file overwrite vulnerability (Dimitris Glynos <dimitris@...sus-labs.com>)
New paper by Amit Klein (Trusteer) - Temporary user tracking in major browsers and Cross-domain information leakage and at… (Amit Klein <amit.klein@...steer.com>)
[USN-783-1] eCryptfs vulnerability (Kees Cook <kees@...ntu.com>)

June 9 (20 messages)

[SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability (Mark Thomas <markt@...che.org>)
ZDI-09-031: libpurple MSN Protocol SLP Message Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-784-1] ImageMagick vulnerability (Jamie Strandboge <jamie@...onical.com>)
ZDI-09-034: Apple Safari SVG Set.targetElement() Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-033: Apple WebKit dir Attribute Freeing Dangling Object Pointer Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-032: Apple WebKit attr() Invalid Attribute Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Apple Safari local file theft vulnerability (Chris Evans <scarybeasts@...il.com>)
XMLHttpRequest file upload vulnerability Chrome 2 & Safari 3 (pantera_bleed@...mail.com)
[USN-785-1] ipsec-tools vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
TELUS Security Labs VR - Microsoft Office Excel Malformed Records Stack Buffer Overflow (noreply@...us.com)
[security bulletin] HPSBMA02430 SSRT080094 rev.1 - HP OpenView Network Node Manager (OV NNM) Running SNMP and MIB, Remote Execution of Arb… (security-alert@...com)
MULTIPLE LOCAL FILE INCLUSION VULNERABILITIES --S-CMS <= v-2.0 Beta3--> (y3nh4ck3r@...il.com)
New paper - Testing the Enterprise Security: Anti-Spam and Anti-Virus Solutions (marian.ventuneac@...ie)
MULTIPLE SQL INJECTION VULNERABILITIES --S-CMS <= v-2.0 Beta3--> (y3nh4ck3r@...il.com)
(Post Form var 'username') BLIND SQLi exploit --S-CMS <= v-2.0 Beta3--> (y3nh4ck3r@...il.com)
Secunia Research: Microsoft Excel Record Parsing Array Indexing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Microsoft Excel String Parsing Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept ("Adrian P." <ap@...citizen.org>)
Re: XMLHttpRequest file upload vulnerability Chrome 2 & Safari 3 (Michal Zalewski <lcamtuf@...edump.cx>)
Re: XMLHttpRequest file upload vulnerability Chrome 2 & Safari 3 ("Adrian P." <ap@...citizen.org>)

June 10 (23 messages)

CORE-2009-0521 - DX Studio Player Firefox plug-in command injection (CORE Security Technologies Advisories <advisories@...esecurity.com>)
CORE-2008-0826 - Internet Explorer Security Zone restrictions bypass (CORE Security Technologies Advisories <advisories@...esecurity.com>)
catching up on several recently fixed bugs of note (Michal Zalewski <lcamtuf@...edump.cx>)
[USN-775-2] Quagga regression (Kees Cook <kees@...ntu.com>)
FreeBSD Security Advisory FreeBSD-SA-09:11.ntpd (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-09:10.ipv6 (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-09:09.pipe (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability (Mark Thomas <markt@...che.org>)
[security bulletin] HPSBUX02435 SSRT090059 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Bypass Security Restrictions (security-alert@...com)
ZDI-09-035: Microsoft Word Document Stack Based Buffer Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-037: Microsoft Internet Explorer Concurrent Ajax Request Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-038: Microsoft Internet Explorer Event Handler Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
FortiGuard Advisory: Microsoft Internet Explorer DHTML Handling Remote Memory Corruption Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@…)
ZDI-09-041: Microsoft Internet Explorer 8 Rows Property Dangling Pointer Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
FortiGuard Advisory: Apple Safari Remote Memory Corruption Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
XM Easy Personal FTP Server HELP and TYPE command Remote Denial of Service exploit (vinodsharma.mimit@...il.com)
ZDI-09-040: Microsoft Office Excel QSIR Record Pointer Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ECHO_ADV_110$2009] Firefox (GNU/Linux version) <= 3.0.10 Denial Of Services (y3dips@...o.or.id)
ZDI-09-039: Microsoft Internet Explorer onreadystatechange Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Secunia Research: Microsoft PowerPoint Freelance Layout Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Apple Safari cross-domain XML theft vulnerability (Chris Evans <scarybeasts@...il.com>)
ZDI-09-036: Microsoft Internet Explorer setCapture Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Secunia Research: Adobe Reader JBIG2 Text Region Segment Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)

June 11 (12 messages)

ZDI-09-042: Adobe Reader U3D RHAdobeMeta Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-786-1] apr-util vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
(Post Form login var 'username') BLIND SQLi exploit--Open Biller 0.1--> (y3nh4ck3r@...il.com)
F5 FirePass Cross-Site Scripting vulnerability ("Sjoerd Resink" <resink@...-it.com>)
MULTIPLE SQL INJECTION VULNERABILITIES --Splog <= v-1.2 Beta--> (y3nh4ck3r@...il.com)
iDefense Security Advisory 06.11.09: Multiple Vendor WebKit Error Handling Use After Free Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 06.11.09: Microsoft Active Directory Hexdecimal DN AttributeValue Invalid Free Vulnerability (iDefense Labs <labs-no-reply@...fense.c…)
FortiGuard Advisory: Adobe Reader/Acrobat TrueType Font Processing Memory Corruption Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...t…)
ModSecurity (Core Rules) HTTP Parameter Pollution Filter Bypass Vulnerability (lavakumar kuppan <lavakumar.in@...il.com>)
iDefense Security Advisory 06.11.09: Microsoft Excel SST Record Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 06.11.09: Adobe Reader and Acrobat FlateDecode Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 06.11.09: Microsoft Windows 2000 Print Spooler Remote Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)

June 12 (5 messages)

VUPEN Security - Microsoft Office Word Document Parsing Buffer Overflow Vulnerability ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security - Adobe Acrobat and Reader JBIG2 Filter Heap Overflow Vulnerability ("VUPEN Security Research" <advisories@...en.com>)
[USN-787-1] Apache vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Secunia Research: Mozilla Firefox Java Applet Loading Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Serena Dimensions CM has insufficient default privileges (roland.gruber.extern@...creditgroup.eu)

June 15 (22 messages)

[USN-779-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[TZO-31-2009] Ikarus multiple generic evasions (CAB,ZIP,RAR) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-32-2009] Norman generic bypass (RAR) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-33-2009] Frisk F-prot evasion (TAR) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-36-2009] Apple Safari & Quicktime Denial of Service (Thierry Zoller <Thierry@...ler.lu>)
[TZO-37-2009] Apple Safari <v4 Remote code execution (Thierry Zoller <Thierry@...ler.lu>)
[waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09 (come2waraxe@...oo.com)
[TZO-30-2009] Kaspersky and the silent patch that wasn't (PDF evasion, forced full disclosure) (Thierry Zoller <Thierry@...ler.lu>)
SugarCRM 5.2.0e Remote Code Execution (ascii <ascii@...amail.com>)
Link Logger syslogd resource overwhelm DoS (mcyr2@....com)
CakeCMS XSRF Vulnerability (onur.turkeshan@...mail.com)
[InterN0T] Pivot 1.40.4-7 - Multiple Vulnerabilities (security@...ern0t.net)
[InterN0T] SkyBlueCanvas 1.1 r237 - Multiple Vulnerabilities (security@...ern0t.net)
[InterN0T] TBDev 01-01-2008 - Multiple Vulnerabilities (security@...ern0t.net)
[InterN0T] transLucid 1.75 - Multiple Vulnerabilities (security@...ern0t.net)
[SECURITY] [DSA 1814-1] New libsndfile packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[InterN0T] Webmedia Explorer - XSS Vulnerability (security@...ern0t.net)
[USN-788-1] Tomcat vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1815-1] New libtorrent-rasterbar packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[DSF-02-2009] - Zoki Catalog SQL Injection (SmOk3 <smok3f00@...il.com>)
Netgear DG632 Router Authentication Bypass Vulnerability ("Tom Neaves" <tom@...neaves.co.uk>)
Netgear DG632 Router Remote DoS Vulnerability ("Tom Neaves" <tom@...neaves.co.uk>)

June 16 (17 messages)

Re: Netgear DG632 Router Remote DoS Vulnerability ("Tom Neaves" <tom@...neaves.co.uk>)
Re: VUPEN Security - Microsoft Office Word Document Parsing Buffer Overflow Vulnerability (Nick Boyce <nick.boyce@...il.com>)
Re: [Full-disclosure] Netgear DG632 Router Remote DoS Vulnerability (Hanno Böck <hanno@...eck.de>)
[TZO-33-2009] Fprot generic bypass (TAR) (Thierry Zoller <Thierry@...ler.lu>)
Re[2]: [Full-disclosure] Netgear DG632 Router Remote DoS Vulnerability ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
[TZO-40-2009] Clamav generic bypass (RAR,CAB,ZIP) (Thierry Zoller <Thierry@...ler.lu>)
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities ("Williams, James K" <James.Williams@...com>)
CA20090615-01: CA ARCserve Backup Message Engine Denial of Service Vulnerabilities (Updated) ("Williams, James K" <James.Williams@...com>)
CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability ("Williams, James K" <James.Williams@...com>)
Official release of "Keykeriki" open source wireless keyboard sniffer (Max Moser <max.moser@...il.com>)
[ MDVSA-2009:133 ] irssi (security@...driva.com)
phpMyTourney adminfunctions.php Remote File Include Vulnerabilities (IrIsT.Ir@...il.Com)
ZDI-09-043: Apple Java CColorUIResource Pointer Derference Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
WinAppDbg version 1.2 is out! (Mario Alejandro Vilas Jerez <mvilas@...il.com>)
Re: [Full-disclosure] WinAppDbg version 1.2 is out! (Mario Alejandro Vilas Jerez <mvilas@...il.com>)
[SECURITY] [DSA 1816-1] New apache2 packages fix privilege escalation (Stefan Fritsch <sf@...ian.org>)
Re: [Full-disclosure] WinAppDbg version 1.2 is out! (Jared DeMott <jdemott@...cialsecurity.com>)

June 17 (3 messages)

CERT-FI statement on the Outpost24 TCP issues updated (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ MDVSA-2009:134 ] firefox (security@...driva.com)
[ MDVSA-2009:135 ] kernel (security@...driva.com)

June 18 (15 messages)

[SECURITY] [DSA 1817-1] New ctorrent packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 1818-1] New gforge packages fix insufficient input sanitising (white@...ian.org (Steffen Joeris))
ERRATA: [TZO-32-2009] Norman generic bypass (RAR) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-34-2009] Frisk FPROT generic evasion (RAR,ARJ,LHA) (Thierry Zoller <Thierry@...ler.lu>)
[TZO-43-2009] - Clamav generic evasion (CAB) (Thierry Zoller <Thierry@...ler.lu>)
iPhone Safari phone-auto-dial vulnerability (original date: Nov. 2008) (Collin Mulliner <collin@...aversion.net>)
[SECURITY] [DSA 1820-1] New xulrunner packages fix several vulnerabilities (white@...ian.org (Steffen Joeris))
Nokia 6212 classic URI spoofing and DoS advisory (original date: Dec. 2008) (Collin Mulliner <collin@...aversion.net>)
The Möbius Defense, the end of Defense in Depth (Pete Herzog <lists@...com.org>)
[SECURITY] [DSA 1819-1] New vlc packages fix several vulnerabilities (white@...ian.org (Steffen Joeris))
Re: iPhone Safari phone-auto-dial vulnerability (original date: Nov. 2008) (Mike Ely <me@...pehat.com>)
Re: Advisory: Apple QuickTime Image Description Atom Sign Extension Memory Corruption (rajendra.palnaty@...escale.com)
Re: CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept (lord.iitk@...il.com)
Re: iPhone Safari phone-auto-dial vulnerability (original date: Nov. 2008) (Collin Mulliner <collin@...aversion.net>)
Re: iPhone Safari phone-auto-dial vulnerability (original date: Nov. 2008) (Mike Ely <me@...pehat.com>)

June 19 (4 messages)

PhpPortal v1 Insecure Cookie Handling Vulnerability (ceza_fuat_kolik@...mail.com)
[ MDVSA-2009:137 ] java-1.6.0-openjdk (security@...driva.com)
MULTIPLE LOCAL FILE INCLUSION VULNERABILITIES --FretsWeb 1.2--> (y3nh4ck3r@...il.com)
(GET var 'name') BLIND SQL INJECTION EXPLOIT --FretsWeb 1.2--> (y3nh4ck3r@...il.com)

June 22 (8 messages)

[USN-789-1] GStreamer Good Plugins vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[RISE-2009001] ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow Vulnerability (RISE Security <advisories@...esecurity.org>)
CMS Buzz (XSS/PC/HI) Multiple Remote Vulnerabilities (ceza_fuat_kolik@...mail.com)
FretsWeb 1.2 (name) Remote Blind SQL Injection Exploit (ceza_fuat_kolik@...mail.com)
phportal 1.0 Insecure Cookie Handling Vulnerability (ceza_fuat_kolik@...mail.com)
fuzzylime cms <= 3.03a Local Inclusion / Arbitrary File Corruption PoC (ceza_fuat_kolik@...mail.com)
FretsWeb 1.2 Multiple Local File Inclusion Vulnerabilities (ceza_fuat_kolik@...mail.com)
Back door trojan in acajoom-3.2.6 for joomla (Jan van Niekerk <jvnkrk@...il.com>)

June 23 (8 messages)

[ MDVSA-2009:136 ] tomcat5 (security@...driva.com)
[SECURITY] [DSA 1821-1] New amule packages fix insufficient input sanitising (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:138 ] tomcat5 (security@...driva.com)
CFP: ISOI 7 - Sept 17, 18 - San Diego (Gadi Evron <ge@...uxbox.org>)
[SECURITY] [DSA 1822-1] New mahara packages fix cross-site scripting (Nico Golde <nion@...ian.org>)
n.runs-SA-2009.006 - Apple Safari - Null pointer dereference (<security@...ns.com>)
n.runs-SA-2009.005 - Apple Safari - Information disclosure (<security@...ns.com>)
Authentication Bypas in BASE version 1.2.4 and prior (timmedin@...il.com)

June 24 (7 messages)

Re: Authentication Bypas in BASE version 1.2.4 and prior (timmedin@...il.com)
Re: Authentication Bypass in BASE version 1.2.4 and prior (timmedin@...il.com)
Cisco Security Advisory: Cisco Physical Access Gateway Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ MDVSA-2009:139 ] libtorrent-rasterbar (security@...driva.com)
Trustwave's SpiderLabs Security Advisory TWSL2009-002 (Trustwave Advisories <TrustwaveAdvisories@...stwave.com>)
CHASE - 2009 Lahoe Pakistan | Call for Papers (Muhammad Farooq-i-Azam <lists@...se.org.pk>)
Cisco Security Advisory: Vulnerabilities in Cisco Video Surveillance Products (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)

June 25 (11 messages)

[USN-790-1] Cyrus SASL vulnerability (Kees Cook <kees@...ntu.com>)
[USN-791-1] Moodle vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-791-2] Moodle vulnerability (Kees Cook <kees@...ntu.com>)
[USN-791-3] Smarty vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2009:140 ] gaim (security@...driva.com)
SQL INJECTION VULNERABILITY --AlumniServer v-1.0.1--> (y3nh4ck3r@...il.com)
(POST var 'resetpwemail') BLIND SQL INJECTION EXPLOIT --AlumniServer v-1.0.1--> (y3nh4ck3r@...il.com)
[USN-792-1] OpenSSL vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
iDefense Security Advisory 06.25.09: Unisys Business Information Server Stack Buffer Overflow (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1823-1] New samba packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
iDefense Security Advisory 06.25.09: Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

June 26 (12 messages)

[SECURITY] [DSA 1824-1] New phpmyadmin packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
[USN-782-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Security Assessment of TCP at the IETF (Fernando Gont <fernando.gont@...il.com>)
aMSN SSL Certificate Vulnerability (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
Gizmo SSL Certificate Vulnerability (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
Trillian SSL Certificate Vulnerability (Gabriel Menezes Nunes <gab.mnunes@...il.com>)
Report vulnerabilities (JP <j07ap3@...il.com>)
Re: Trillian SSL Certificate Vulnerability (krymson@...il.com)
evil little dictionary (Pavel Machek <pavel@....cz>)
MULTIPLE SQL INJECTION VULNERABILITIES --PHP-AddressBook v-4.0.x--> (y3nh4ck3r@...il.com)
[ MDVSA-2009:141 ] mozilla-thunderbird (security@...driva.com)
iDefense Security Advisory 06.26.09: HP Network Node Manager rping Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

June 29 (11 messages)

[ MDVSA-2009:142 ] jasper (security@...driva.com)
[ MDVSA-2009:143 ] netpbm (security@...driva.com)
Mega File Manager Remote File Vuln (ceza_fuat_kolik@...mail.com)
osTicket v1.6 RC4 Admin Login Blind SQLi (Adam Baldwin <adam_baldwin@...l.ngenuity-is.com>)
[ MDVSA-2009:145 ] php (security@...driva.com)
Shakacon III - Presentations Posted to site ("Shakacon" <info@...kacon.org>)
[ GLSA 200906-01 ] libpng: Information disclosure (Tobias Heinlein <keytoaster@...too.org>)
AjaxPortal v3.0 Remote File Inclusion Vulnerability ("Cru3l.b0y" <cru3l.b0y@...il.com>)
[ GLSA 200906-02 ] Ruby: Denial of Service (Alex Legler <a3li@...too.org>)
[ MDVSA-2009:144 ] ghostscript (security@...driva.com)
[ MDVSA-2009:146 ] imap (security@...driva.com)

June 30 (11 messages)

[ GLSA 200906-03 ] phpMyAdmin: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[ GLSA 200906-04 ] Apache Tomcat JK Connector: Information disclosure (Alex Legler <a3li@...too.org>)
Multiple Flaws in Huawei D100 (filip.palian@...stk.edu.pl)
[ GLSA 200906-05 ] Wireshark: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
SIPS v0.2.2 Remote File Inclusion Vulnerability ("Cru3l.b0y" <cru3l.b0y@...il.com>)
XAMPP for Windows (Xss/PHPinfo) Multiple Vulnerability ("Cru3l.b0y" <cru3l.b0y@...il.com>)
Re: SIPS v0.2.2 Remote File Inclusion Vulnerability ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Re: SIPS v0.2.2 Remote File Inclusion Vulnerability (Joe <joe@...anta.com>)
[ MDVSA-2009:147 ] pidgin (security@...driva.com)
Empire Cms 5.1 sql injection (info@...uritylab.ir)
dedecms v5.3 Arbitrary File Upload Vulnerability (info@...uritylab.ir)

272 messages

Powered by blists - more mailing lists