bugtraq mailing list - 2004/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2004/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 14	² 16	³ 11	⁴ 2	⁵
⁶ 5	⁷ 24	⁸ 30	⁹ 18	¹⁰ 5	¹¹ 2	¹²
¹³ 14	¹⁴ 26	¹⁵ 32	¹⁶ 30	¹⁷ 18	¹⁸ 7	¹⁹
²⁰ 29	²¹ 16	²² 58	²³ 56	²⁴ 35	²⁵ 15	²⁶ 7
²⁷ 10	²⁸ 13	²⁹ 13	³⁰ 13	³¹ 12

Messages by day:

December 1 (14 messages)

RE: Remote Mercury32 Imap exploit (John <JohnH@...netops.com>)
RE: Web Application DoS ("David Taylor" <David.Taylor@...trac.gov.au>)
[Fwd: RE: Remote Mercury32 Imap exploit] (John <JohnH@...netops.com>)
[USN-36-1] NFS statd vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Disclosure of file system information in Mozilla Firefox and Opera Browser: ("Giovanni Delvecchio" <badpenguin79@...mail.com>)
Re: Winamp - Buffer Overflow In IN_CDDA.dll (Black Dot <blackd0t@...l.ru>)
Invision Power Board 'Allow auto login' setting override (Hillel Himovich <hll@...vision.net.il>)
SUSE Security Announcement: various kernel problems (SUSE-SA:2004:042) (Marcus Meissner <meissner@...e.de>)
Re: Web Application DoS (Goetz Von Berlichingen <goetzvonberlichingen@...cast.net>)
Re: Pi3Web/2.0.0 File-Disclosure/Path Disclosure vuln (Holger Zimmermann <zimpel@...rs.sourceforge.net>)
[CLA-2004:904] Conectiva Security Announcement - cyrus-imapd (Conectiva Updates <secure@...ectiva.com.br>)
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003. (Reed Arvin <reedarvin@...il.com>)
RE: Web Application DoS ("Lachniet, Mark" <mlachniet@...uoianet.com>)
[SECURITY] [DSA 603-1] New openssl packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))

December 2 (16 messages)

Remote Mercury32 Imap exploit ("JohnH" <johnh@...netops.com>)
Official IFRAME patch - make sure it installs correctly ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
[CLA-2004:902] Conectiva Security Announcement - abiword (Conectiva Updates <secure@...ectiva.com.br>)
Re: Official IFRAME patch - make sure it installs correctly (Kevin <kkadow@...il.com>)
[KA Advisory 0411291] IPCop Cross Site Scripting Vulnerability in "proxylog.dat" (Kurczaba Associates advisories <advisories@...czaba.com>)
Re: Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003. ("Laurent Saplairoles" <lsaplai-list@...us.net>)
[USN-37-1] cyrus21-imapd vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Official IFRAME patch - make sure it installs correctly ("BillyBob" <billybobknob@...mail.com>)
RE: Official IFRAME patch - make sure it installs correctly ("Todd Towles" <toddtowles@...okshires.com>)
Re: Official IFRAME patch - make sure it installs correctly (daniel uriah clemens <daniel_clemens@...ism.birmingham-infragard.org>)
Re: Official IFRAME patch - make sure it installs correctly ("Des Ward" <des_ward@...co.uk>)
RE: Official IFRAME patch - make sure it instal ls correctly ("Randal, Phil" <prandal@...efordshire.gov.uk>)
Cisco Security Advisory: Cisco CNS Network Registrar Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Blog Torrent preview 0.8 - arbitary file download (Steve Kemp <steve@...ve.org.uk>)
rssh and scponly arbitrary command execution (Jason Wies <jason@...net>)
Multiple vulnerabilities in Kreed 1.05 (Luigi Auriemma <aluigi@...istici.org>)

December 3 (11 messages)

RE: Official IFRAME patch - make sure it installs correctly (Nick FitzGerald <nick@...us-l.demon.co.uk>)
RE: Official IFRAME patch - make sure it installs correctly ("Todd Towles" <toddtowles@...okshires.com>)
[CLA-2004:905] Conectiva Security Announcement - squirrelmail (Conectiva Updates <secure@...ectiva.com.br>)
Re: Disclosure of file system information in Mozilla Firefox and Opera Browser: (Liu Die Yu <liudieyu@...rella.name>)
FreeBSD Security Advisory FreeBSD-SA-04:17.procfs (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Advanced Guestbook (Emile van Elen <emile.van.elen@...il.com>)
RE: Remote Mercury32 Imap exploit ("Randal, Phil" <prandal@...efordshire.gov.uk>)
Re: Remote Mercury32 Imap exploit ("class 101" <class101@...-squad.com>)
RE: Official IFRAME patch - make sure it installs correctly ("Rivera Alonso, David" <drivera@...rdrola.es>)
Tool Announcement: AIRT -- the Advanced Incident Response Tool (linux) ("madsys" <madsys@...ist.iscas.ac.cn>)
[SECURITY] [DSA 604-1] New hpsockd packages fix denial of service (joey@...odrom.org (Martin Schulze))

December 4 (2 messages)

[FLSA-2004:2148] Updated httpd, apache and mod_ssl packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Opera 7.54 vulnerabilities again (still unfixed) (Marc Schoenefeld <schonef@...-muenster.de>)

December 6 (5 messages)

Multiple vulnerabilities in w3who ISAPI DLL (Nicolas Gregoire <ngregoire@...probe.com>)
Re: [Advisory] Mozilla Products Remote Crash Vulnerability ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
[Advisory] Mozilla Products Remote Crash Vulnerability (Niek van der Maas <niekvdmaas@...il.com>)
DoS protection in N-Tiered Web Apps? ("Lachniet, Mark" <mlachniet@...uoianet.com>)
Re: [Advisory] Mozilla Products Remote Crash Vulnerability (Kevin Finisterre <kf_lists@...netops.com>)

December 7 (24 messages)

Winamp - Buffer Overflow In IN_CDDA.dll [ Patch Released ] ("Brett Moore" <brett.moore@...urity-assessment.com>)
Re: [Advisory] Mozilla Products Remote Crash Vulnerability (Heikki Toivonen <heikki@...foundation.org>)
Hosting Controller (mouse small <e_b_i@...oo.com>)
[SECURITY] [DSA 605-1] New viewcvs packages fix information leak (joey@...odrom.org (Martin Schulze))
Re: Advanced Guestbook (Spy Hat <spyhat@...hat.com>)
DoS leading to crash of client in Remote Execute 2.30 (headpimp@...p-industries.com)
Web Application Security Consortium 'Guest Articles' Call for Papers (robert@...appsec.org)
Re: [Advisory] Mozilla Products Remote Crash Vulnerability (Juergen Schmidt <ju@...sec.de>)
Bypass personal firewall application protection . Again. (offtopic <offtopic@...l.ru>)
RE: Disclosure of file system information in Mozilla Firefox and Opera Browser: ("Thor Larholm" <thor@...x.com>)
Tool Announcement: AIRT -- the Advanced Incident Response Tool (linux) ("madsys" <madsys@...ist.iscas.ac.cn>)
Local root exploit on Mac OS X with Adobe Version Cue (fintler <fintler@...il.com>)
MaxDB WebTools <= 7.5.00.18 buffer overflow and Denial of Service (Evgeny Demidov <demidov@...g.net>)
Broadcast client crash in Battlefield 1942 1.6.19 and Vietnam 1.2 (Luigi Auriemma <aluigi@...istici.org>)
Re: [Advisory] Mozilla Products Remote Crash Vulnerability (Heikki Toivonen <heikki@...foundation.org>)
MDKSA-2004:142 - Updated gzip packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Multiple Vulnerabilities in paFileDB 3.1 (Ahmad Muammar <y3dips@...o.or.id>)
Remote Web Server Text File Viewing Vulnerability in WebLibs 1.0 (John Bissell <monkey321_1@...mail.com>)
MD5 To Be Considered Harmful Someday (Dan Kaminsky <dan@...para.com>)
VA Appliance Deployment White Paper (Martin Mkrtchian <dotsecure@...il.com>)
Re: Local root exploit on Mac OS X with Adobe Version Cue (Chet Ramey <chet@...eb.ins.cwru.edu>)
Online Script Decoder (GreyMagic Security <security@...ymagic.com>)
Cleartext SMB passwords in Novell Desktop Linux using KDE (Mike DeMaria <mdemaria@....com>)
7a69Adv#16 - Konqueror FTP command injection (Albert Puigsech Galicia <ripe@...9ezine.org>)

December 8 (30 messages)

zone transfers, a spammer's dream? (Lode Vermeiren <lode@...u.cx>)
MDKSA-2004:143 - Updated ImageMagick packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Online Script Decoder (Stefan Paletta <stefanp@...al1.com>)
Re: MD5 To Be Considered Harmful Someday (Gandalf The White <gandalf@...ital.net>)
IE6 Vulnerability - Local File Detection (ViPeR <viper31337@...oo.co.in>)
MDKSA-2004:147 - Updated openssl packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:146 - Updated nfs-utils packages fix remote DoS vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:145 - Updated rp-pppoe packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:144 - Updated lvm1 packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: [Full-Disclosure] Multiple vulnerabilities in w3who ISAPI DLL (Nicolas Gregoire <ngregoire@...probe.com>)
MD5 To Be Considered Harmful Today (Pavel Machek <pavel@....cz>)
[SECURITY] [DSA 606-1] New nfs-utils packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: MDKSA-2004:145 - Updated rp-pppoe packages fix vulnerability ("David F. Skoll" <dfs@...ringpenguin.com>)
Re: MD5 To Be Considered Harmful Someday (Tim <tim-security@...tinelchicken.org>)
Re: 7a69Adv#16 - Konqueror FTP command injection (Albert Puigsech Galicia <ripe@...9ezine.org>)
Address Bar Spoophing for the Pheeshies: IntotheNet Explorer 6 ("http-equiv@...ite.com " <1@...ware.com>)
Re: MD5 To Be Considered Harmful Someday (Joel Maslak <jmaslak@...elope.net>)
Re: MD5 To Be Considered Harmful Someday (Joel Maslak <jmaslak@...elope.net>)
7a69Adv#15 - Internet Explorer FTP command injection (Albert Puigsech Galicia <ripe@...9ezine.org>)
RE: MD5 To Be Considered Harmful Someday ("Rager, Anton (Anton)" <arager@...ya.com>)
Re: MD5 To Be Considered Harmful Someday (Gandalf The White <gandalf@...ital.net>)
Re: Bypass personal firewall application protection . Again. (Chris Paget <ivegotta@...bom.co.uk>)
RE: MD5 To Be Considered Harmful Someday ("David Schwartz" <davids@...master.com>)
Re: MD5 To Be Considered Harmful Someday (Keith Oxenrider <koxenrider@...-biotech.com>)
Re: MD5 To Be Considered Harmful Someday (Jack Lloyd <lloyd@...dombit.net>)
Re: MD5 To Be Considered Harmful Someday (Dragos Ruiu <dr@....net>)
Re: MD5 To Be Considered Harmful Someday (Jack Lloyd <lloyd@...dombit.net>)
Re: MD5 To Be Considered Harmful Someday ("Ruth A. Kramer" <rhkramer@...t.net>)
Re: MD5 To Be Considered Harmful Someday (Dan Kaminsky <dan@...para.com>)
Re: MD5 To Be Considered Harmful Someday (Dan Kaminsky <dan@...para.com>)

December 9 (18 messages)

Re: MD5 To Be Considered Harmful Someday ("George Georgalis" <george@...is.org>)
Re: MD5 To Be Considered Harmful Someday (Paul Wouters <paul@...net.nl>)
Re: MD5 To Be Considered Harmful Someday (Solar Designer <solar@...nwall.com>)
Re: MD5 To Be Considered Harmful Someday (Paul Wouters <paul@...net.nl>)
Re: MD5 To Be Considered Harmful Someday (Dan Kaminsky <dan@...para.com>)
Re: MD5 To Be Considered Harmful Someday (Steve Friedl <steve@...xwiz.net>)
Re: IE6 Vulnerability - Local File Detection (RSnake <rsnake@...cking.com>)
Re: MD5 To Be Considered Harmful Someday ("David F. Skoll" <dfs@...ringpenguin.com>)
Re: MD5 To Be Considered Harmful Today (Dan Kaminsky <dan@...para.com>)
Re: MD5 To Be Considered Harmful Today (Pavel Machek <pavel@....cz>)
Re: MD5 To Be Considered Harmful Today (Dan Kaminsky <dan@...para.com>)
TSLSA-2004-0064 - nfs-utils (Trustix Security Advisor <tsl@...stix.org>)
KDE Security Advisory: kfax libtiff vulnerabilities (Dirk Mueller <mueller@....org>)
KDE Security Advisory: plain text password exposure (Dirk Mueller <mueller@....org>)
Re: MD5 To Be Considered Harmful Someday (Adam Shostack <adam@...eport.org>)
Re: MD5 To Be Considered Harmful Someday (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
F-Secure Policy Manager - physical path disclosure (<oliver@...yhat.de>)
Re: Multiple Vulnerabilities in paFileDB 3.1 (Rafael San Miguel Carrasco <smcsoc@...oo.es>)

December 10 (5 messages)

CodeCon CFP deadline nearing (Len Sassaman <rabbi@...itum.com>)
wget: Arbitrary file overwriting/appending/creating and other vulnerabilities (Jan Minar <jjminar@...tMail.FM>)
[SECURITY] [DSA 607-1] New libxpm packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
In-game buffer-overflow in the Gamespy cd-key validation SDK (Luigi Auriemma <aluigi@...istici.org>)
HOW TO BREAK XP SP2 POPUP BLOCKER: kick it in the nut ! ("http-equiv@...ite.com " <1@...ware.com>)

December 11 (2 messages)

[ GLSA 200412-06 ] PHProjekt: setup.php vulnerability (Thierry Carrez <koon@...too.org>)
Local off-by-one in mtr versions 0.55 to 0.65 (venglin@...ebsd.lublin.pl)

December 13 (14 messages)

NetWare Screensaver Authentication Bypass From The Local Console (Adam Gray <agray@...acoast.com>)
Re: MD5 To Be Considered Harmful Someday (Solar Designer <solar@...nwall.com>)
Multiple vulnerabilities in phpMyAdmin (Nicolas Gregoire <ngregoire@...probe.com>)
Citadel/UX <= v6.27 Remote Format String Vulnerability (CoKi <coki@...ystem.com.ar>)
SugarSales Multiple Vulnerabilities ("Daniel Fabian" <research@...-consult.com>)
Gadu-Gadu several vulnerabilities (Jaroslaw Sajko <sloik@....poznan.pl>)
MS IE User's Authentication Details (userid/password) Sharing Issue ("Debasis Mohanty" <mail@...kingspirits.com>)
KDE Security Advisory: Konqueror Window Injection Vulnerability (Waldo Bastian <bastian@....org>)
iDEFENSE Security Advisory 12.13.04 - Multiple Vendor xzgv PRF Parsing Integer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
[ZH2004-19SA] Possible execution of remote shell commands in Opera with kfmclien ("Giovanni Delvecchio" <badpenguin79@...mail.com>)
Winamp 5.07 (latest version) Remote Crash + other stupid shizle (b0f www.b0f.net <b0fnet@...oo.com>)
Socket unreacheable in the Lithtech engine (new protocol) (Luigi Auriemma <aluigi@...istici.org>)
RE: zone transfers, a spammer's dream? ("Marcin Pacyna" <mpacyna@...vision.com>)
What's "may have exploitable buffer overflows" mean in tcpdump? (Dragos Ruiu <dr@....net>)

December 14 (26 messages)

Secure Network Operations SNOsoft Research Team [SRT2004-12-14-0322] Symantec LiveUpdate Advisory ("Secure Network Operations, Inc." <advisory@...netops.com>)
phpBB Attachment Mod Directory Traversal HTTP POST Injection (Paul Laudanski <zx@...tlecops.com>)
Linux kernel IGMP vulnerabilities (Paul Starzetz <ihaquer@...c.pl>)
Re: Secure Network Operations SNOsoft Research Team [SRT2004-12-14-0322] Symantec LiveUpdate Advisory (<secure@...antec.com>)
Linux kernel scm_send local DoS (Paul Starzetz <ihaquer@...c.pl>)
Re: [Full-Disclosure] [HV-LOW] Symantec LiveUpdate issues may cause DoS (Dan Margolis <krispykringle@...too.org>)
[ZH2004-18SA] Content-Type spoofing in Mozilla Firefox and Opera could allow users to bypass security restrictions (Giovanni Delvecchio <badpenguin79@...mai…)
iDEFENSE Security Advisory 12.14.04 - Adobe Acrobat Reader 5.0.9 mailListIsPdf() Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...f…)
MDKSA-2004:148 - Updated iproute2 packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[SECURITY] [DSA 609-1] New atari800 packages fix local root exploit (joey@...odrom.org (Martin Schulze))
ASP Calendar Vulnerability <www.ashiyane.com> (ali reza AcTiOnSpIdEr <actionspider@...il.com>)
[CAN-2004-1022] Insecure Credential Storage on Kerio Software (Secure Computer Group <scg@....es>)
Re: Citadel/UX <= v6.27 Remote Format String Vulnerability (Michael Hampton <error10@...il.com>)
RICOH Aficio 450/455 PCL 5e Printer ICMP DOS vulnerability (Hongzhen Zhou <felix__zhou@...mail.com>)
Possible local root vulnerability in Roxio Toast on Mac OS X (fintler <fintler@...il.com>)
[USN-38-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
STG Security Advisory: [SSA-20041209-13] UseModWiki XSS vulnerability (<advisory@...security.com>)
[SECURITY] [DSA 608-1] New zgv packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
MDKSA-2004:149 - Updated postgresql packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[CAN-2004-1023] Insecure default file system permissions on Microsoft versions of Kerio Software (Secure Computer Group <scg@....es>)
ASP-rider is vulnerable to sql injection attack (shervin khaleghjou <oil_karchack@...oo.com>)
iDEFENSE Security Advisory 12.13.04: Adobe Reader 6.0 .ETD File Format String Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
Re: NetWare Screensaver Authentication Bypass From The Local Console (Brad Bendily <brad@...u.edu>)
Re: Linux kernel IGMP vulnerabilities (Pekka Savola <pekkas@...core.fi>)
[Correction For]: Secure Network Operations SNOsoft Research Team [SRT2004-12-14-0322] Symantec LiveUpdate Advisory ("Secure Network Operations, Inc." <advisor…)
iDEFENSE Security Advisory 12.14.04 - Microsoft Word 6.0/95 Document Converter Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fen…)

December 15 (32 messages)

Yahoo! Mail Cross-Site Scripting Vulnerability ("Rafel Ivgi, The-Insider" <rivgi@...jan.com>)
Hotmail Cross-Site Scripting Vulnerability #1 ("Rafel Ivgi, The-Insider" <rivgi@...jan.com>)
RE: Linux kernel scm_send local DoS (Paul Starzetz <ihaquer@...c.pl>)
Re: Linux kernel scm_send local DoS (even multiplexed <Shadow333@....at>)
Re: Linux kernel scm_send local DoS (Paul Starzetz <ihaquer@...c.pl>)
Re: Linux kernel IGMP vulnerabilities (Paul Starzetz <ihaquer@...c.pl>)
Hotmail Cross Site Scripting Vulnerability #2 ("Rafel Ivgi" <rivgi@...jan.com>)
Re: Linux kernel scm_send local DoS (even multiplexed <Shadow333@....at>)
HyperTerminal - Buffer Overflow In .ht File ("Brett Moore" <brett.moore@...urity-assessment.com>)
Multiple phpGroupWare Vulnerabilities [ phpGroupWare 0.9.16.003 && Earlier ] ("GulfTech Security" <security@...ftech.org>)
Asante FM2008 10/100 Ethernet switch backdoor login (Joe Philipps <secfocus@....philipps.us>)
Hotmail Cross-Site Scripting Vulnerability #1 ("Rafel Ivgi" <rivgi@...jan.com>)
Yahoo! Mail Cross-Site Scripting Vulnerability ("Rafel Ivgi" <rivgi@...jan.com>)
*nix data wipe tools ("Thomas C. Greene" <thomas.greene@...register.co.uk>)
Re: rpcl_icmpdos.c (x90c <jyj9782@...net.net>)
3cdaemon tftp server DOS vulnerability (Wang Ning <nwang@....com.cn>)
MSIE DHTML Edit Control Cross Site Scripting Vulnerability (Paul <paul@...yhats.cjb.net>)
[OpenPKG-SA-2004.052] OpenPKG Security Advisory (vim) (OpenPKG <openpkg@...npkg.org>)
STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability (<advisory@...security.com>)
Security Advisory for CVS Slash (Jamie McCarthy <jamie@...shdot.org>)
Re: RICOH Aficio 450/455 PCL 5e Printer ICMP DOS vulnerability (Hongzhen Zhou <felix__zhou@...mail.com>)
Advisory 01/2004: Multiple vulnerabilities in PHP 4/5 (Stefan Esser <sesser@....net>)
iwebnegar is vulnerable to all kind of sql injections (shervin khaleghjou <oil_karchack@...oo.com>)
Cisco Security Advisory: Cisco Unity Integrated with Exchange Has Default Passwords (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files with multiple extensions in MoniWiki (<advisory@...security.com>)
CSS in phpBB 1.4.4 ("SandI]" <agent050@...a.ru>)
Cisco Security Advisory: Default Administrative Password in Cisco Guard and Traffic Anomaly Detector (Cisco Systems Product Security Incident Response Team <psi…)
Re: Linux kernel IGMP vulnerabilities (stephen joseph butler <stephen.butler@...il.com>)
php unserialize (Martin Eiszner <martin@...sec.org>)
Re: Linux kernel scm_send local DoS (gadgeteer@...gantinnovations.org)
MDKSA-2004:150 - Updated kdelibs and kdebase packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
RE: CSS in phpBB 1.4.4 ("Paul Owen" <paul@...anet.com>)

December 16 (30 messages)

Re: Linux kernel IGMP vulnerabilities (matthew-bugtraq@...toncomputing.co.uk)
RE: Linux kernel scm_send local DoS (Leif Sawyer <lsawyer@....com>)
Hotmail Cross-Site Scripting Vulnerability #2 ("Rafel Ivgi, The-Insider" <rivgi@...jan.com>)
Re: php unserialize (Stefan Esser <sesser@....net>)
[SAMBA] CAN-2004-1154 : Integer overflow could lead to remote code execution in Samba 2.x, 3.0.x <= 3.0.9 (Gerald Carter <jerry@...ba.org>)
STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard (<advisory@...security.com>)
iDEFENSE Security Advisory 12.15.04: Computer Associates eTrust EZ Antivirus Insecure File Permission Vulnerability ("customer service mailbox" <customerservice…)
[MaxPatrol] SQL-injection in Ikonboard 3.1.x (Alexander Anisimov <anisimov@...ecurity.com>)
STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files with multiple extensions in phpBB Attachment Mod (<advisory@...security.com>)
STG Security Advisory: [SSA-20041215-19] Vulnerability of uploading files with multiple extensions in MediaWiki (<advisory@...security.com>)
Multiple XSS Vulnerabilities in Wordpress 1.2.1 (Thomas Waldegger <bugtraq@...ph3us.org>)
[USN-40-1] PHP vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-39-1] Linux amd64 kernel vulnerability (Martin Pitt <martin.pitt@...onical.com>)
DJB's students release 44 *nix software vulnerability advisories ("Thor Larholm" <thor@...x.com>)
PHP Input Validation Vulnerabilities ("Daniel Fabian" <research@...-consult.com>)
Re: [ GLSA 200412-10 ] Vim, gVim: Vulnerable options in modelines ("Alexey I. Froloff" <raorn@...o.ru>)
iDEFENSE Security Advisory 12.16.04: Samba smbd Security Descriptor Integer Overflow Vulnerability (iDEFENSE Security Advisory <customerservice@...fense.com>)
iDEFENSE Security Advisory 12.16.04: Veritas Backup Exec Agent Browser Registration Request Buffer Overflow Vulnerabilit… (iDEFENSE Security Advisory <customerser…)
iDEFENSE Security Advisory 12.16.04: MPlayer Remote RTSP HeapOverflow Vulnerability (iDEFENSE Security Advisory <customerservice@...fense.com>)
Re: NetWare Screensaver Authentication Bypass From The Local Console ("Roger McLaren" <RMcLaren@...s.k12.ca.us>)
iDEFENSE Security Advisory 12.16.04: MPlayer MMST Streaming Stack Overflow Vulnerability (iDEFENSE Security Advisory <customerservice@...fense.com>)
Yahoo! Mail Cross-Site Scripting Vulnerability ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
iDEFENSE Security Advisory 12.16.04: MPlayer Bitmap Parsing Remote Heap Overflow Vulnerability (iDEFENSE Security Advisory <customerservice@...fense.com>)
Hotmail Cross-Site Scripting Vulnerability #2 ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
Hotmail Cross-Site Scripting Vulnerability #1 ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
Discussion: Microsoft(R) PowerPoint �Action Settings� feature allows invocation of default browser pointed at arbitr… (Monte Ratzlaff <advisories@...fosystems…)
[OpenPKG-SA-2004.053] OpenPKG Security Advisory (php) (OpenPKG <openpkg@...npkg.org>)
[SIG^2 G-TEC] singapore Image Gallery Web Application v0.9.10 Multiple Vulnerabilities (<chewkeong@...urity.org.sg>)
Re: *nix data wipe tools (David Cannings <lists@...ca.net>)
RE: STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard ("Richard Stanway" <bugtraq@...ur1ty.net>)

December 17 (18 messages)

OpenText FirstClass 8.0 HTTP Daemon /Search Remote DoS Vulnerability (dila <dilabox@...il.com>)
[USN-41-1] Samba vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Unchecked returns from kernel_read() in linux-2.6.10-rc2 kernel (Katrina Tsipenyuk <ytsipenyuk@...tifysoftware.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Crispin Cowan <crispin@...unix.com>)
RE: Linux kernel IGMP vulnerabilities (Jirka Kosina <jikos@...os.cz>)
[OpenPKG-SA-2004.054] OpenPKG Security Advisory (samba) (OpenPKG <openpkg@...npkg.org>)
Gadu-Gadu, another two bugs (Jaroslaw Sajko <sloik@....poznan.pl>)
NetBSD Security Advisory 2004-010: Insufficient argument validation in compat code (NetBSD Security-Officer <security-officer@...bsd.org>)
phphpbb2 + php version < 4.3.10 unserialize() memory dump sql password from config.php exploit (bad boy <slythers@...il.com>)
Re: *nix data wipe tools (wietse@...cupine.org (Wietse Venema))
4 Vulnerabilities in GamePort (amoXi Devilkin <am0xi@...oo.com>)
Re: Linux kernel IGMP vulnerabilities ("Timothy Hall" <admin@...E2WIN.NET>)
Re: *nix data wipe tools ("Thomas C. Greene" <thomas.greene@...register.co.uk>)
Re: DJB's students release 44 *nix software vulnerability advisories (cees-bart <ceesb@...ru.nl>)
Re: iDEFENSE Security Advisory 12.16.04: MPlayer MMST Streaming Stack Overflow Vulnerability (Hideki Yamane <henrich@...mio-mail.jp>)
Re: DJB's students release 44 *nix software vulnerability advisories (security curmudgeon <jericho@...rition.org>)
NetBSD kernel local vulnerabilities (Evgeny Demidov <demidov@...g.net>)
4 Vulnerabilities in GamePort (amoXi Devilkin <am0xi@...oo.com>)

December 18 (7 messages)

[OpenPKG-SA-2004.056] OpenPKG Security Advisory (cvstrac) (OpenPKG <openpkg@...npkg.org>)
Re: *nix data wipe tools (Casper.Dik@....COM)
Internet Explorer Code Execution Bypass Vulnerability (aikon none <aikon.bcn@...il.com>)
[SECURITY] [DSA 610-1] New cscope packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))
Bug in Crypt::ECB perl module ("Bennett R. Samowich" <brs@...roduce.com>)
Re: *nix data wipe tools ("George Georgalis" <george@...is.org>)
[ GLSA 200412-13 ] Samba: Integer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

December 20 (29 messages)

Multiple Vulnerabilities In Kayako eSupport v2.x ("GulfTech Security" <security@...ftech.org>)
Re: DJB's students release 44 *nix software vulnerability advisories ("D. J. Bernstein" <djb@...yp.to>)
MS Windows Media Player 9 Vulns (2) (Arman Nayyeri <arman-n@...eaker.net>)
MDKSA-2004:151 - Updated php packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Patch available for multiple critical flaws in Oracle (Marc Bejarano <bugtraq@...j.org>)
Re: DJB's students release 44 *nix software vulnerability advisories (Julian T J Midgley <jtjm@...oclast.org>)
Tlen.pl, remote script execution (Jaroslaw Sajko <sloik@....poznan.pl>)
[USN-42-1] Xine library vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 611-1] New htget packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Security Bulletin SSRT4687 rev.0 HP-UX newgrp(1) local privilege elevation ("Boren, Rich (SSRT)" <rich.boren@...com>)
AIX 5.1/5.2/5.3 local root exploits (cees-bart <ceesb@...ru.nl>)
PHP shmop.c module permits write of arbitrary memory. (Stefano Di Paola <stefano.dipaola@...ec.it>)
TSLSA-2004-0068 - kernel (Trustix Security Advisor <tsl@...stix.org>)
KDE Security Advisory: Konqueror Java Vulnerability (Waldo Bastian <bastian@....org>)
Windows Explorer TGA Crash (Bill <Bill@...tracon.com>)
Re: Internet Explorer Code Execution Bypass Vulnerability (<cmthemc@...oo.com>)
Crystal FTP Pro Client Buffer Overflow (Luca Ercoli <luca.ercoli@...ind.it>)
Exploit for Ultrix 4.5 dxterm (Kristoffer Brånemyr <ztion@...pnet.se>)
TSLSA-2004-0066 - multi (Trustix Security Advisor <tsl@...stix.org>)
Internet Explorer Help ActiveX Control Local Zone Security Restriction Bypass Vulnerability (updated) (Paul <paul@...yhats.cjb.net>)
[USN-43-1] groff utility vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: Gadu-Gadu, another two bugs (Przemyslaw Frasunek <venglin@...ebsd.lublin.pl>)
Gadu-Gadu Remote DoS (all versions) (Maciej Soltysiak <maciej@...tysiak.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Marcin Owsiany <marcin@...iany.pl>)
MDKSA-2004:153 - Updated aspell packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:152 - Updated ethereal packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[SECURITY] [DSA 612-1] New a2ps packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
Updated: TSLSA-2004-0068 - kernel (Trustix Security Advisor <tsl@...stix.org>)
Re: [Full-Disclosure] Re: Gadu-Gadu, another two bugs ("Maciej Soltysiak" <maciej@...tysiak.com>)

December 21 (16 messages)

MITKRB5-SA-2004-004: heap overflow in libkadm5srv (Tom Yu <tlyu@....edu>)
Re: Windows Explorer TGA Crash is a DoS bug in Internet Explorer. ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
Re: Windows Explorer TGA Crash is a DoS bug in Internet Explorer. ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
[USN-44-1] perl information leak (Martin Pitt <martin.pitt@...onical.com>)
TSLSA-2004-0069 - kerberos5 (Trustix Security Advisor <tsl@...stix.org>)
[SECURITY] [DSA 614-1] New xzgv packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: AIX 5.1/5.2/5.3 local root exploits (diag issue) (Shiva Persaud <shivapd@...ibm.com>)
Xprobe 0.2.1 Released (bugtraq@...-security.com)
phpBB Worm (Shannon Lee <shannon@...hostworks.net>)
Re: DJB's students release 44 *nix software vulnerability advisories (Jonathan T Rockway <jrockw2@....edu>)
SUSE Security Announcement: various kernel problems (SUSE-SA:2004:044) (Marcus Meissner <meissner@...e.de>)
Re: DJB's students release 44 *nix software vulnerability advisories (Artem Chuprina <ran@....pp.ru>)
Re: DJB's students release 44 *nix software vulnerability advisories (Dave Holland <dh3@...ger.ac.uk>)
Re: DJB's students release 44 *nix software vulnerability advisories ("milw0rm Inc." <milw0rm@...il.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Antoine Martin <antoine@...afix.co.uk>)
Re: DJB's students release 44 *nix software vulnerability advisories ("Thor" <thor@...merofgod.com>)

December 22 (58 messages)

Re: phpBB Worm (Raymond Dijkxhoorn <raymond@...location.net>)
iDEFENSE Security Advisory 12.21.04: Multiple Vendor xpdf PDF Viewer Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
iDEFENSE Security Advisory 12.21.04: Multiple Vendor Xine version 0.99.2 PNM Handler Negative Read Length Heap Overflow … ("customer service mailbox" <customerser…)
iDEFENSE Security Advisory 12.21.04: Multiple Vendor Xine version 0.99.2 PNM Handler PNA_TAG Heap Overflow Vulnerability ("customer service mailbox" <customerser…)
iDEFENSE Security Advisory 12.21.04: libtiff Directory Entry Count Integer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
iDEFENSE Security Advisory 12.21.04: libtiff STRIPOFFSETS Integer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
iDEFENSE Security Advisory 12.21.04: Hewlett Packard HP-UX ftpd Remote Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Stephen Samuel <samuel@...reen.com>)
Script Injection in Google Groups Beta (n3td3v <xploitable@...il.com>)
Re: Wordpress 1.2.2 is still vulnerable (Thomas Waldegger <bugtraq@...ph3us.org>)
RE: DJB's students release 44 *nix software vulnerability advisories ("Devin Ganger" <DevinG@...arp.com>)
Script Injection in Google Groups Beta (n3td3v <xploitable@...il.com>)
Re: Script Injection in Google Groups Beta (n3td3v <xploitable@...il.com>)
Re: Script Injection in Google Groups Beta (n3td3v <xploitable@...il.com>)
Re: DJB's students release 44 *nix software vulnerability advisories ("David F. Skoll" <dfs@...ringpenguin.com>)
WebWorm using PHPBB vulnerability in the wild! (Niki Denev <nike_d@...exbg.com>)
Re: AIX 5.1/5.2/5.3 local root exploits (paginit issue) (Shiva Persaud <shivapd@...ibm.com>)
RE: phpBB Worm ("Paul Kurczaba" <paul@...pis.com>)
[SECURITY] [DSA 613-1] New ethereal packages fix denial of service (joey@...odrom.org (Martin Schulze))
Re: DJB's students release 44 *nix software vulnerability advisories (Stephen Harris <bugtraq@...ddy.org>)
Re: DJB's students release 44 *nix software vulnerability advisories (laffer1 <laffer1@...l.foolishgames.com>)
Re: DJB's students release 44 *nix software vulnerability advisories ("Raymond M. Reskusich" <reskusic@...c.edu>)
[USN-45-1] nasm vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Gadu-Gadu, another two bugs (lazy@...ver.gwsh.gda.pl)
[USN-46-1] TIFF library vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Java Runtime Environment Remote Denial-of-Service (DoS) Vulnerability (Marc Schoenefeld <schonef@...-muenster.de>)
SUSE Security Announcement: samba (SUSE-SA:2004:045) (krahmer@...e.de (Sebastian Krahmer))
Local versus remote security holes ("D. J. Bernstein" <djb@...yp.to>)
[SECURITY] [DSA 615-1] New debmake package fixes insecure temporary directories (joey@...odrom.org (Martin Schulze))
MDKSA-2004:154 - Updated kdelibs packages fix multiple vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: iDEFENSE Security Advisory 12.21.04: libtiff STRIPOFFSETS Integer Overflow Vulnerability ("Dmitry V. Levin" <ldv@...linux.org>)
Sybase ASE 12.5.2 vulnerabilities (NGSSoftware Insight Security Research <nisr@...software.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Jonathan Rockway <jrockw2@....edu>)
Shoe 1.0 - Remote Lace Overflow (announce@...0.org)
Re: DJB's students release 44 *nix software vulnerability advisories (Chris Paget <ivegotta@...bom.co.uk>)
Re: DJB's students release 44 *nix software vulnerability advisories (Jonathan Rockway <jrockw2@....edu>)
Re: DJB's students release 44 *nix software vulnerability advisories ("D. J. Bernstein" <djb@...yp.to>)
Re: phpBB Worm (Sebastian Wiesinger <bofh@...e-world.de>)
Re: phpBB Worm (Alexander Klimov <alserkli@...ox.ru>)
MDKSA-2004:156 - Updated krb5 packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
malware effecting broadband users in Israel (Gadi Evron <gadi@...ila.gov.il>)
Re: DJB's students release 44 *nix software vulnerability advisories (Valdis.Kletnieks@...edu)
Re: phpBB Worm (<ycw1bh302@...akemail.com>)
Re: Local versus remote security holes (Adam Shostack <adam@...eport.org>)
Re: DJB's students release 44 *nix software vulnerability advisories ("Steven M. Christey" <coley@...re.org>)
Permission problem in Skype BETA for linux (Peter Conrad <conrad@...ano.de>)
PHP v4.3.x exploit for Windows. ("The Warlock" <thewarlock@....org>)
Re: DJB's students release 44 *nix software vulnerability advisories (David Eisner <cradle@....edu>)
Re: DJB's students release 44 *nix software vulnerability advisories ("Steven M. Christey" <coley@...re.org>)
Realone2.0 "pnxr3260.dll" Lets Remote Users IE Browser Crash (Wei Li <pcocop@...mail.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Casper.Dik@....COM)
RE: DJB's students release 44 *nix software vulnerability advisories ("Manning, Robert (Mission Systems)" <Bob.Manning@....com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Crispin Cowan <crispin@...unix.com>)
stick with "anonymous" or "authenticated" when describing attacks ("Jonathan G. Lampe" <jonathan.lampe@...ndardnetworks.com>)
possible local exploit via sendmail with procmail on solaris (Michael Barnes <mbarnes@...psci.wm.edu>)
Webmin BruteForce + Command execution - By Di42lo <DiAblo_2@....net.il> (amit sides <DiAblo_2@....net.il>)
MDKSA-2004:155 - Updated logcheck packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Jack Lloyd <lloyd@...dombit.net>)

December 23 (56 messages)

MDKSA-2004:157 - Updated mplayer packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
2Bgal : 2.4 & 2.5.1 SQL injection Vulnerability (zib zib <zibelette@....com>)
Security Advisory for ALL forum services with client-set images (James Bandara <jamez1@...il.com>)
Re: WebWorm using PHPBB vulnerability in the wild! (Nick Johnson <arachnid@...dot.net>)
SUSE Security Announcement: kernel local privilege escalation (SUSE-SA:2004:046) (Marcus Meissner <meissner@...e.de>)
Re: DJB's students release 44 *nix software vulnerability advisories (sean <infamous41md@...pop.com>)
[USN-47-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-48-1] xpdf, tetex-bin vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[webmin-l] Re: Webmin BruteForce + Command execution - By Di42lo <DiAblo_2@....net.il> (Martin Mewes <mm@...es.tv>)
Re: [webmin-l] Re: Webmin BruteForce + Command execution - By Di42lo <DiAblo_2@....net.il> (Jamie Cameron <jcameron@...min.com>)
[USN-49-1] debmake vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-50-1] CUPS vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-51-1] teTeX auxiliary script vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-52-1] vim vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: Java Runtime Environment Remote Denial-of-Service (DoS) Vulnerability (James Tucker <jftucker@...il.com>)
Oracle Trigger Abuse (#NISR2122004I) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle clear text passwords (#NISR2122004D) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle ISQLPlus file access vulnerability (#NISR2122004E) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle Character Conversion Bugs (#NISR2122004G) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle extproc buffer overflow (#NISR23122004A) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle extproc directory traversal (#NISR23122004B) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
IBM DB2 generate_distfile buffer overflow vulnerability (#NISR2122004L) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle extproc local command execution (#NISR23122004C) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle TNS Listener DoS (#NISR2122004F) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle wrapped procedure overflow (#NISR2122004J) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Oracle multiple PL/SQL injection vulnerabilities (#NISR2122004H) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[OpenPKG-SA-2004.055] OpenPKG Security Advisory (gettext) (OpenPKG <openpkg@...npkg.org>)
Oracle Trigger Abuse (#NISR2122004I) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
IBM DB2 rec2xml buffer overflow vulnerability (#NISR2122004J) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[SECURITY] [DSA 616-1] New telnetd-ssl packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Microsoft Windows Kernel ANI File Parsing Crash and DOS Vulnerability (flashsky fangxing <flashsky@...cus.org>)
Microsoft Windows LoadImage API Integer Buffer overflow (flashsky fangxing <flashsky@...cus.org>)
Re: iDEFENSE Security Advisory 12.21.04: libtiff STRIPOFFSETS Integer Overflow Vulnerability (Moritz Muehlenhoff <muehlenhoff@...vention.de>)
SHOUTcast remote format string vulnerability (Damian Put <pucik@...team.org>)
Re: phpBB Worm (Alvin Packard <appredator@...il.com>)
Crystal FTP Pro 2.8 PoC (<cybertronic@....net>)
Oracle Character Conversion Bugs (#NISR2122004G) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Cross Site Scripting In PsychoStats 2.2.4 Beta && Earlier ("GulfTech Security" <security@...ftech.org>)
Re: stick with "anonymous" or "authenticated" when describing ("Steven M. Christey" <coley@...re.org>)
Re: phpBB Worm (Anders Henke <anders@...lund.de>)
Re: Linux kernel scm_send local DoS ("Pavel Kankovsky" <peak@...o.troja.mff.cuni.cz>)
RE: DJB's students release 44 *nix software vulnerability advisories ("Palmer, Paul (ISSAtlanta)" <PPalmer@....net>)
Re: DJB's students release 44 *nix software vulnerability advisories (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: DJB's students release 44 *nix software vulnerability advisories ("D. J. Bernstein" <djb@...yp.to>)
Re: Security Advisory for ALL forum services with client-set images (Stefan Paletta <stefanp@...al1.com>)
Oracle extproc buffer overflow (#NISR23122004A) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (Crispin Cowan <crispin@...unix.com>)
Inexcusable weakness in Kmail / GnuPG ("Thomas C. Greene" <thomas.greene@...register.co.uk>)
Re: phpBB Worm ("William Geoghegan" <w.geoghegan@...tekcs.co.uk>)
Re: DJB's students release 44 *nix software vulnerability advisories (Crispin Cowan <crispin@...unix.com>)
Oracle extproc directory traversal (#NISR23122004B) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
RE: Local versus remote security holes (David Brodbeck <DavidB@...l.interclean.com>)
RE: Crystal FTP Pro 2.8 PoC (<cybertronic@....net>)
Oracle extproc local command execution (#NISR23122004C) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
RE: phpBB Worm ("Ofer Shezaf" <Ofer.Shezaf@...ach.com>)
[ Security Bulletin ] SSRT4699 rev.0 HP-UX SAM local privilege increase ("Boren, Rich (SSRT)" <rich.boren@...com>)

December 24 (35 messages)

Oracle clear text passwords (#NISR2122004D) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[Security Bulletin] SSRT4867 rev.0 Netscape Directory Server on HP-UX LDAP remote buffer overflow ("Boren, Rich (SSRT)" <rich.boren@...com>)
Microsoft Windows winhlp32.exe Heap Overflow Vulnerability (flashsky fangxing <flashsky@...cus.org>)
WPkontakt message parsing error (Jaroslaw Sajko <sloik@....poznan.pl>)
[Security Bulletin] SSRT4876 rev.0 HP Tru64 UNIX SWS (Apache) Secure Web Server Remote ("Boren, Rich (SSRT)" <rich.boren@...com>)
Oracle ISQLPlus file access vulnerability (#NISR2122004E) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Linux 2.6 Kernel Capability LSM Module Local Privilege Elevation (flashsky fangxing <flashsky@...cus.org>)
Re: Security Advisory for ALL forum services with client-set images (Tim Jackson <lists@...j.co.uk>)
[Security Bulletin] SSRT4883 rev.3 HP-UX ftp and ftpd remote unauthorized access ("Boren, Rich (SSRT)" <rich.boren@...com>)
Re: phpBB Worm (Anders Henke <anders@...lund.de>)
Oracle TNS Listener DoS (#NISR2122004F) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[Security Bulletin] SSRT4696 rev.0 - HP Tru64 UNIX TCP Stack Remote Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
Oracle multiple PL/SQL injection vulnerabilities (#NISR2122004H) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Re: [Full-Disclosure] Re: Linux kernel scm_send local DoS (Valdis.Kletnieks@...edu)
Re: possible local exploit via sendmail with procmail on solaris (Jeff Damens <jdamens@...ets.poly.edu>)
Oracle wrapped procedure overflow (#NISR2122004J) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
IBM DB2 rec2xml buffer overflow vulnerability (#NISR2122004J) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
raptor's xmas pack 2004 (Marco Ivaldi <raptor@...eadbeef.info>)
IBM DB2 generate_distfile buffer overflow vulnerability (#NISR2122004L) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Re: [USN-52-1] vim vulnerability (Liu Die Yu <liudieyu@...rella.name>)
[ADVISORY] Scripting Vulnerabilities in Indian Email Providers Put Millions At Risk (S G Masood <sgmasood@...oo.com>)
Cross-Site Scripting - an industry-wide problem ("mikx" <mikx@...x.de>)
Plesk 7 Cross-Site Scripting (Andrew Smith <stfunub@...il.com>)
Re: Shoe 1.0 - Remote Lace Overflow ("Alex V. Lukyanenko" <y_avenger_y@...fm>)
[SECURITY] [DSA 618-1] New imlib packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 617-1] New libtiff packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: DJB's students release 44 *nix software vulnerability advisories (Crispin Cowan <crispin@...unix.com>)
Re: DJB's students release 44 *nix software vulnerability advisories (daw@...erner.cs.berkeley.edu (David Wagner))
Re: phpBB Worm (<steve@...ime.org.uk>)
STG Security Advisory: [SSA-20041220-16] PHP source injection and cross-site scripting vulnerabilities in ZeroBoard (<advisory@...security.com>)
Re: Inexcusable weakness in Kmail / GnuPG (Simple Nomad <thegnome@...c.org>)
XSS in yacy 0.31 ("Donato Ferrante" <fdonato@...istici.org>)
Final Call for Papers & Workshops - BCS Asia 2005 ("Anthony.zboralski" <bcs2005@...lua.com>)
Re: phpBB Worm (Raymond Dijkxhoorn <raymond@...location.net>)
YEY AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 ("Michael Evanchik" <mevanchik@...ationship1.com>)

December 25 (15 messages)

Re: Cross-Site Scripting - an industry-wide problem ("morning_wood" <se_cur_ity@...mail.com>)
Re: Re: Microsoft Windows LoadImage API Integer Buffer overflow ("flashsky" <flashsky@...cus.org>)
new phpBB worm affects 2.0.11 (Herman Sheremetyev <herman@...bpage.com>)
YET AGAIN Automatic remote compromise of Internet Explorer Service Pack 2 XP SP2 ("Michael Evanchik" <Mike@...haelEvanchik.com>)
Re: phpBB Worm (Zeljko Brajdic <zebrajdi@...t.hr>)
CleanCache v2.19: False Sense of Security (WBG Links <wbglinks@...il.com>)
New Santy-Worm attacks *all* PHP-skripts (Juergen Schmidt <ju@...sec.de>)
PHPBB worm in action (Colin Keith <bugtraq@...ith.clara.net>)
RE: phpBB Worm (Chris Ess <securityfocus@....tokimi.net>)
Re: New Santy-Worm attacks *all* PHP-skripts ( Santy.c ? ) (K-OTiK Security <Special-Alerts@...tik.com>)
New Winhlp32.exe vuln (<bad_son@...p.it>)
Re: new phpBB worm affects 2.0.11 (Adam <adam@...ed.org>)
Re: Microsoft Windows LoadImage API Integer Buffer overflow (Brett Glass <brett@...iat.org>)
DJB's contest (repost after being moderated on BGTQ) (<support@...re-security.com>)
Microsoft Internet Explorer SP2 Fully Automated Remote Compromise (Paul <paul@...yhats.cjb.net>)

December 26 (7 messages)

Re: YET AGAIN Automatic remote compromise of InternetExplorer Service Pack 2 XP SP2 (Andrew Smith <stfunub@...il.com>)
Re: Re: New Santy-Worm attacks *all* PHP-skripts (Raistlin <raistlin@...co.net>)
Re: [Full-Disclosure] YET AGAIN Automatic remote compromise of InternetExplorer Service Pack 2 XP SP2 ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
Re: New Santy-Worm attacks *all* PHP-skripts (Paul Laudanski <zx@...tlecops.com>)
Re: Re: New Santy-Worm attacks *all* PHP-skripts (Paul Laudanski <zx@...tlecops.com>)
Re: New Santy-Worm attacks *all* PHP-skripts (Paul Laudanski <zx@...tlecops.com>)
[HAT-SQUAD] NetCat Remote Critical Vulnerability, Poc inside. ("class 101" <class101@...-squad.com>)

December 27 (10 messages)

Re: new phpBB worm affects 2.0.11 (Andrew Farmer <andfarm@...novis.com>)
New Santy-Worm attacks *all* PHP-skripts ("Gary E. Miller" <gem@...lim.com>)
Re: Re: New Santy-Worm attacks *all* PHP-skripts (Steve Wray <steve@...elf.gen.nz>)
AOL website redirection scripts allow for abuse (Michel Blomgren <michel.blomgren@...erteam.se>)
Re: YEY AGAIN Automatic remote compromise of InternetExplorer Service Pack 2 XP SP2 ("morning_wood" <se_cur_ity@...mail.com>)
Re: Re: Re: Microsoft Windows LoadImage API Integer Buffer overflow (Brett Glass <brett@...iat.org>)
Re: *nix data wipe tools (Pavel Machek <pavel@....cz>)
Re: Re: Microsoft Windows LoadImage API Integer Buffer overflow (Brett Glass <brett@...iat.org>)
Re: Shoe 1.0 - Remote Lace Overflow (Thomas Sutpen <sutpen@...il.com>)
(no subject) ("class 101" <class101@...eaker.net>)

December 28 (13 messages)

BUG FIX Remote compromise of Internet Explorer Service Pack 2 XP SP2 ("Michael Evanchik" <Mike@...haelEvanchik.com>)
Suggested filters against PHP Attacking Worms (Paul Laudanski <zx@...tlecops.com>)
Multiple Vulnerabilities in Moodle (Bartek Nowotarski <silence10@...pl>)
MDKSA-2004:158 - Updated samba packages fix integer overflow vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
possible error in latest NGS realplayer advisory (Marc Bejarano <bugtraq@...j.org>)
Did a 16-bit counter overflow shut down Comair? ("Richard M. Smith" <rms@...puterbytesman.com>)
Multiple WHM Autopilot Vulnerabilities ("GulfTech Security" <security@...ftech.org>)
Re: iDEFENSE Security Advisory 12.21.04: libtiff STRIPOFFSETS Integer Overflow Vulnerability (Marcus Meissner <meissner@...e.de>)
Remote code execution with parameters withoutu ser interaction, even with XP SP2 ("ShredderSub7 SecExpert" <shreddersub7@...mail.com>)
[HAT-SQUAD] NetCat Remote Critical Vulnerability, Poc included (Hat-Squad Security Team <bugtraq@...-squad.com>)
Netcat v1.11 For Windows , New fixed version (Hat-Squad Security Team <bugtraq@...-squad.com>)
XSA-2004-7: stack overflow in AIFF demultiplexer (Michael Roitzsch <mroi@...rs.sourceforge.net>)
Re: [HAT-SQUAD] NetCat Remote Critical Vulnerability, Poc included (Chris Wysopal <weld@...nwatch.org>)

December 29 (13 messages)

KDE Security Advisory: kpdf Buffer Overflow Vulnerability (Dirk Mueller <mueller@....org>)
Re: Microsoft Windows LoadImage API IntegerBuffer overflow ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
Re: Windows (XP SP2) Remote code execution with parameters (ShredderSub7 <shreddersub7@...oo.com>)
[USN-53-1] imlib vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Again: zone transfers, a spammer's dream? (Ralf Glauberman <ralfglauberman@...il.com>)
php-Calendar File Include Vulnerability [ Command Exec ] ("GulfTech Security" <security@...ftech.org>)
QNX crrtrap arbitrary file read/write vulnerability [RLSA_06-2004] (Julio Cesar Fort <julio@...slabs.com.br>)
Sanity Worm Concepts (Andy Fewtrell <afsec@...owaway.coldfyre.net>)
Re: Did a 16-bit counter overflow shut down Comair? ("Mike Nice" <niceman@....net>)
Re: Did a 16-bit counter overflow shut down Comair? (Avleen Vig <lists-bugtraq@...verwraith.com>)
[CLA-2004:909] Conectiva Security Announcement - netpbm (Conectiva Updates <secure@...ectiva.com.br>)
Re: Again: zone transfers, a spammer's dream? (Jorrit Kronjee <full-disclosure@...pam.wafel.org>)
Heap overflow in Mozilla Browser <= 1.7.3 NNTP code. (Maurycy Prodeus <z33d@...c.pl>)

December 30 (13 messages)

Heap overflow in Mozilla Browser <= 1.7.3 NNTP code. (Maurycy Prodeus <z33d@...c.pl>)
[SECURITY] [DSA 620-1] New perl packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
MDKSA-2004:160 - Updated kdelibs packages fix konqueror email vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:161 - Updated xpdf packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
KorWeblog php injection Vulnerability (Min-sung Choi <mins@....or.kr>)
NetCat V 1.11 Multiple Bugs (CorryL <corryl80@...il.com>)
MDKSA-2004:164 - Updated cups packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:159 - Updated glibc packages fix temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[SECURITY] [DSA 619-1] New xpdf packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
MDKSA-2004:163 - Updated kdegraphics packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:165 - Updated koffice packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:162 - Updated gpdf packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Multiple Vulnerabilities in Moodle (Martin Dougiamas <martin@...dle.com>)

December 31 (12 messages)

Re: Sanity Worm Concepts (Paul Laudanski <zx@...tlecops.com>)
Re: Re: Re: Microsoft Windows LoadImage API Integer Buffer overflow (Valdis.Kletnieks@...edu)
MDKSA-2004:166 - Updated tetex packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
SQL Injection Vulnerability In IBProArcade (mike bailey <mike@...r.net>)
[EXPL] (MS04-031) NetDDE buffer overflow vulnerability PoC (houseofdabus HOD <houseofdabus@...ox.ru>)
ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks (steven@...ebug.org)
Bluetooth: BlueSnarf and BlueBug Full Disclusore (Adam Laurie <adam.laurie@...bunker.net>)
Re: [EXPL] (MS04-031) NetDDE buffer overflow vulnerability PoC (Alberto Garcia Hierro <tcpdevil@...uxlover.org>)
[SECURITY] [DSA 621-1] New CUPS packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Cross Site Scripting DOS (Zyxel B-420 Ethernet Bridge) (beniwiedmer@...cali.ch)
WHM AutoPilot Security Release [ Plus Upgrade Instructions ] ("GulfTech Security" <security@...ftech.org>)
Re: [EXPL] (MS04-031) NetDDE buffer overflow vulnerability PoC (Steve Friedl <steve@...xwiz.net>)

531 messages

Powered by blists - more mailing lists