full-disclosure mailing list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

full-disclosure mailing list - 2016/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 10	²	³ 1	⁴
⁵ 7	⁶ 6	⁷	⁸ 2	⁹ 10	¹⁰	¹¹ 3
¹² 5	¹³ 1	¹⁴ 11	¹⁵ 4	¹⁶ 4	¹⁷	¹⁸ 1
¹⁹ 1	²⁰ 5	²¹	²² 3	²³ 1	²⁴	²⁵
²⁶	²⁷ 5	²⁸ 4	²⁹	³⁰ 4	³¹

Messages by day:

December 1 (10 messages)

[FD] Apple iOS v10.1 & 10.1.1 - iCloud & Device Lock Bypass on Activate via local Buffer Overflow Vulnerability (Wifi N… (Vulnerability Lab <research@...nerabili…)
[FD] Google Chrome Accessibility blink::Node corruption details (Berend-Jan Wever <berendj@...ver.nl>)
[FD] Opera foreignObject textNode::removeChild use-after-free details (Berend-Jan Wever <berendj@...ver.nl>)
[FD] [FOXMOLE SA 2016-05-02] e107 Content Management System (CMS) - Multiple Issues (FOXMOLE Advisories <advisories@...mole.com>)
[FD] CVE-2015-6168: MS Edge CMarkup::EnsureDeleteCFState use-after-free details (Berend-Jan Wever <berendj@...ver.nl>)
[FD] Announcing NorthSec 2017 CFP + Reg - Montreal, May 16-21 (Pierre-David Oriol - Northsec Conference <conference@...c.io>)
[FD] Eagle Speed USB MODEM SOFTWARE Privilege Escalation (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] XSS in tooltip plugin of Zurb Foundation 5 (Winni Neessen <winni@...ecure.so>)
[FD] WinPower V4.9.0.4 Privilege Escalation (Kacper Szurek <kacperszurek@...il.com>)
[FD] New CSRF vulnerabilities in D-Link DAP-1360 ("MustLive" <mustlive@...security.com.ua>)

December 3 (1 message)

[FD] CVE-2013-0019: MSIE 9 CDoc::ExecuteScriptUri use-after-free (Berend-Jan Wever <berendj@...ver.nl>)

December 5 (7 messages)

[FD] Microsoft Windows Media Center "ehshell.exe" XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] Microsoft Excel Starter 2010 XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] Microsoft Authorization Manager "azman" XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] Microsoft MSINFO32.EXE ".NFO" Files XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] Microsoft Event Viewer v1.0 XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] CVE-2016-3222: MS Edge CBaseScriptable::PrivateQueryInterface memory corruption (Berend-Jan Wever <berendj@...ver.nl>)
[FD] CVE-2016-8740, Server memory can be exhausted and service denied when HTTP/2 is used (Eissing Stefan <stefan.eissing@...il.com>)

December 6 (6 messages)

[FD] CFP - 31c0n - Feb 2017, New Zealand (31c0n <callforpaper@...0n.co.nz>)
[FD] Insecure Transmission of Qualcomm Assisted-GPS Data [CVE-2016-5341] (Nightwatch Cybersecurity Research <research@...htwatchcybersecurity.com>)
[FD] Microsoft PowerShell XML External Entity (hyp3rlinx <apparitionsec@...il.com>)
[FD] DAVOSET v.1.2.9 ("MustLive" <mustlive@...security.com.ua>)
Re: [FD] CVE-2016-3222: MS Edge CBaseScriptable::PrivateQueryInterface memory corruption (Berend-Jan Wever <berendj@...ver.nl>)
[FD] SEC Consult SA-20161206-0 :: Backdoor vulnerability in Sony IPELA ENGINE IP Cameras (SEC Consult Vulnerability Lab <research@...-consult.com>)

December 8 (2 messages)

[FD] AST-2016-008: Crash on SDP offer or answer from endpoint using Opus ("Asterisk Security Team" <security@...erisk.org>)
[FD] AST-2016-009: <br> ("Asterisk Security Team" <security@...erisk.org>)

December 9 (10 messages)

[FD] CVE-2015-1730: MSIE jscript9 JavaScriptStackWalker memory corruption details and PoC (Berend-Jan Wever <berendj@...ver.nl>)
[FD] CVE-2013-1309: (Berend-Jan Wever <berendj@...ver.nl>)
[FD] CVE-2013-1306: MSIE 9 MSHTML CDispNode::InsertSiblingNode use-after-free details (Berend-Jan Wever <berendj@...ver.nl>)
[FD] Splunk Enterprise Server-Side Request Forgery (Francesco Oddo <francesco.oddo@...urity-assessment.com>)
[FD] Gstreamer ID3v2 v1.0 - Out of Bounds Read (Joshua <joshua2014@...tonmail.ch>)
[FD] Roundcube 1.2.2: Command Execution via Email (Martin Bednorz <mbednorz@...stech.com>)
[FD] Dual DHCP DNS Server 7.29 Buffer Overflow (Dos) (Rio Sherri <rio.sherri@...nstudent.info>)
[FD] [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security (ESNC Security <secure@...c.de>)
[FD] MSIE 9 MSHTML CElement::HasFlag memory corruption (Berend-Jan Wever <berendj@...ver.nl>)
[FD] Broken access control on bluemix containers (Oscar Martinez <oscarmrdc@...il.com>)

December 11 (3 messages)

[FD] CSRF vulnerability in Multisite Post Duplicator could allow an attacker to do almost anything an admin user can do (WordP… (dxw Security <security@....com>)
[FD] Reflected XSS in Social Pug – Easy Social Share Buttons could allow an attacker to do almost anything an admin user can (… (dxw Security <security@....com>)
[FD] Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability (Summer of Pwnage <lists@...urify.nl>)

December 12 (5 messages)

[FD] Apple iOS/tvOS/watchOS Remote memory corruption through certificate file ("[CXSEC]" <submit@...ec.org>)
[FD] CVE-2013-3111: MSIE 9 IEFRAME CSelectionInteractButtonBehavior::_UpdateButtonLocation use-after-free (Berend-Jan Wever <berendj@...ver.nl>)
[FD] APPLE-SA-2016-12-12-1 iOS 10.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-12-2 watchOS 3.1.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-12-3 tvOS 10.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)

December 13 (1 message)

[FD] SQL injection in Joomla extension DT Register (Elar Lang <elarlang@...il.com>)

December 14 (11 messages)

[FD] Adobe Animate <= v15.2.1.95 Memory Corruption Vulnerability (hyp3rlinx <apparitionsec@...il.com>)
[FD] MSIE 9 MSHTML CMarkup::ReloadInCompatView use-after-free (Berend-Jan Wever <berendj@...ver.nl>)
[FD] APPLE-SA-2016-12-13-1 macOS 10.12.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-2 Safari 10.0.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-3 iTunes 12.5.4 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-4 iCloud for Windows v6.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-5 Additional information for APPLE-SA-2016-12-12-1 iOS 10.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-6 Additional information for APPLE-SA-2016-12-12-3 tvOS 10.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-7 Additional information for APPLE-SA-2016-12-12-2 watchOS 3.1.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] APPLE-SA-2016-12-13-8 Transporter 1.9.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[FD] Reflected XSS in MailChimp for WordPress could allow an attacker to do almost anything an admin user can (WordPress plugin… (dxw Security <security@....com>)

December 15 (4 messages)

[FD] CVE-2013-3143: MSIE 9 IEFRAME CMarkup..RemovePointerPos use-after-free (Berend-Jan Wever <berendj@...ver.nl>)
[FD] Nagios Core < 4.2.2 Curl Command Injection leading to Remote Code Execution [CVE-2016-9565] (Dawid Golunski <dawid@...alhackers.com>)
[FD] Nagios Core < 4.2.4 Root Privilege Escalation [CVE-2016-9566] (Dawid Golunski <dawid@...alhackers.com>)
[FD] XenForo 1.5.x Unauthenticated Remote Code Injection ("Vishal Mishra" <vishalsec@...h.com>)

December 16 (4 messages)

[FD] MSIE 9 IEFRAME CMarkupPointer::MoveToGap use-after-free (Berend-Jan Wever <berendj@...ver.nl>)
[FD] CVE-2013-0090: MSIE 9 IEFRAME CView::EnsureSize use-after-free (Berend-Jan Wever <berendj@...ver.nl>)
Re: [FD] XenForo 1.5.x Unauthenticated Remote Code Injection (Julien Ahrens <info@...security.com>)
[FD] CSRF/stored XSS in Quiz And Survey Master (Formerly Quiz Master Next) allows unauthenticated attackers to do almost anyth… (dxw Security <security@....com>)

December 18 (1 message)

Re: [FD] SQL injection in Joomla extension DT Register (Elar Lang <elarlang@...il.com>)

December 19 (1 message)

[FD] CVE-2013-6627: Chrome Chrome HTTP 1xx base::StringTokenizerT<...>::QuickGetNext OOBR (Berend-Jan Wever <berendj@...ver.nl>)

December 20 (5 messages)

[FD] Hotlinking Vulnerability in Glype (All Versions) (Celso Bento <celsobento2009@...il.com>)
[FD] CVE-2014-1785: MSIE 11 MSHTML CSpliceTreeEngine::RemoveSplice use-after-free (Berend-Jan Wever <berendj@...ver.nl>)
[FD] New BlackArch Linux ISOs (2016.12.20) released! (Black Arch <blackarchlinux@...il.com>)
[FD] [ERPSCAN-16-035] SAP Solman - user accounts disclosure (ERPScan inc <erpscan.online@...il.com>)
[FD] NEW VMSA-2016-0023 VMware ESXi updates address a cross-site scripting issue (VMware Security Response Center <security@...are.com>)

December 22 (3 messages)

[FD] CVE-2014-4138: MSIE 11 MSHTML CPasteCommand::ConvertBitmaptoPng heap-based buffer overflow (Berend-Jan Wever <berendj@...ver.nl>)
[FD] [0-day] RCE and admin credential disclosure in NETGEAR WNR2000 (Pedro Ribeiro <pedrib@...il.com>)
[FD] copy-me vulnerable to CSRF allowing unauthenticated attacker to copy posts (WordPress plugin) (dxw Security <security@....com>)

December 23 (1 message)

[FD] [RT-SA-2016-001] Padding Oracle in Apache mod_session_crypto (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

December 27 (5 messages)

[FD] BlackArch Linux OVA Image released! (Black Arch <blackarchlinux@...il.com>)
[FD] Arbitrary file deletion vulnerability in Image Slider allows authenticated users to delete files (WordPress plugin) (dxw Security <security@....com>)
[FD] kernel vuln status question - how can I be protected (BENCSATH Boldizsar <boldi@...sys.hu>)
[FD] PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
Re: [FD] [RT-SA-2016-001] Padding Oracle in Apache mod_session_crypto (gremlin@...mlin.ru)

December 28 (4 messages)

[FD] PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Dawid Golunski <dawid@...alhackers.com>)
[FD] PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) (Dawid Golunski <dawid@...alhackers.com>)
Re: [FD] [RT-SA-2016-001] Padding Oracle in Apache mod_session_crypto (Tim <tim-security@...tinelchicken.org>)
Re: [FD] PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] (Luigi Rosa <lists@...girosa.com>)

December 30 (4 messages)

[FD] Executable installers are vulnerable^WEVIL (case 42): SoftMaker's FreeOffice installer allows escalation of privil… ("Stefan Kanthak" <stefan.kanthak@...go.…)
Re: [FD] [RT-SA-2016-001] Padding Oracle in Apache mod_session_crypto (Erik Auerswald <auerswal@...x-ag.uni-kl.de>)
[FD] SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) (Dawid Golunski <dawid@...alhackers.com>)
Re: [FD] [RT-SA-2016-001] Padding Oracle in Apache mod_session_crypto (Tim <tim-security@...tinelchicken.org>)

88 messages