bugtraq mailing list - 2005/01

Messages by day:

January 1 (8 messages)

• ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks ("Steven" <steven@...ebug.org>)
• Jacks FormMail.php remote file access vulnerability (Hack Hawk <hh@...khawk.net>)
• Windows Media files allow opening any url in Internet Explorer ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
• Windows LoadImage API Heapoverflow exploit ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
• 7a69Adv#17 - Internet Explorer FTP download path disclosure (Albert Puigsech Galicia <ripe@...9ezine.org>)
• Various Vulnerabilities in OWL Intranet Engine (Joxean Koret <joxeankoret@...oo.es>)
• Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM (Joxean Koret <joxeankoret@...oo.es>)
• Two Vulnerabilities in ViewCVS (Joxean Koret <joxeankoret@...oo.es>)

• Re: Re: New Santy-Worm attacks *all* PHP-skripts (Paul Laudanski <zx@...tlecops.com>)
• Re: Fwd: Re: [USN-52-1] vim vulnerability (Ciaran McCreesh <ciaranm@...too.org>)
• Re: new phpBB worm affects 2.0.11 (Andrew Farmer <andfarm@...novis.com>)
• [HAT-SQUAD] NetCat Remote Critical Vulnerability, Poc inside. ("class 101" <class101@...-squad.com>)
• Re: New Santy-Worm attacks *all* PHP-skripts (Raistlin <raistlin@...co.net>)
• [SECURITY] [DSA 622-1] New htmlheadline package fixes insecure temporary files (joey@...odrom.org (Martin Schulze))
• Remote DoS in GFI MailEssentials due to a bug in Microsoft HTML parser ("Peter Kruse" <kruse@...sesecurity.dk>)
• STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard (<advisory@...security.com>)
• Multiple Vulnerabilities in FlatNuke (Pierquinto Manco <pierquinto@...il.com>)
• Multiple Firewall Products Bypass Vulnerability ("Ferruh Mavituna" <ferruh@...ituna.com>)
• Multiple Firewall Products Bypass Vulnerability ("Ferruh Mavituna" <ferruh@...ituna.com>)

• 3Com 3CDaemon Multiple Vulnerabilities ("Sowhat ." <smaillist@...il.com>)
• Serious Vulnerabilities In PhotoPost ReviewPost ("GulfTech Security" <security@...ftech.org>)
• [SECURITY] [DSA 623-1] New nasm packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [KDE Security Advisory] ftp kioslave command injection (Dirk Mueller <mueller@....org>)
• Multiple PhotoPost Pro Vulnerabilities ("GulfTech Security" <security@...ftech.org>)
• MyBB SQL Injection (<scottm@...mcop.net>)
• Socket termination, format string and XSS in Soldner Secret Wars 30830 (Luigi Auriemma <aluigi@...istici.org>)
• QWikiwiki directory traversal vulnerability (Madelman <madelman@...me.com>)
• Re: Bluetooth: BlueSnarf and BlueBug Full Disclusore (Przemyslaw Frasunek <venglin@...ebsd.lublin.pl>)

• Re: Shoe 1.0 - Remote Lace Overflow (Nancy Kramer <nekramer@...dtheater.net>)
• Re: AOL website redirection scripts allow for abuse ("morning_wood" <se_cur_ity@...mail.com>)
• [SECURITY] [DSA 624-1] New zip packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [CLA-2005:910] Conectiva Security Announcement - mplayer (Conectiva Updates <secure@...ectiva.com.br>)
• [SECURITY] [DSA 625-1] New pcal packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• IBM DB2 db2fmp buffer overflow (#NISR05012005A) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• firewall 1.4 (TJ Easter <tjeaster@...il.com>)
• IBM DB2 db2fmp buffer overflow (#NISR05012005A) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Paper: SQL Injection Attacks by Example (Steve Friedl <steve@...xwiz.net>)
• DMA[2005-0103a] - 'William LeFebvre "top" format string vulnerability' ("KF (Lists)" <kf_lists@...italmunition.com>)
• IBM DB2 libdb2.so buffer overflow (#NISR05012005B) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 call buffer overflow (#NISR05012005C) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 JDBC Applet Server buffer overflow (#NISR05012005D) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 libdb2.so buffer overflow (#NISR05012005B) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 SATADMIN.SATENCRYPT buffer overflow (#NISR05012005E) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 Windows Permission Problems (#NISR05012005F) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 to_char and to_date Denial Of Service (#NISR05012005G) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• RE: Paper: SQL Injection Attacks by Example ("David Litchfield" <davidl@...software.com>)
• IBM DB2 XML functions overflows (#NISR05012005H) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 XML functions file creation vulnerabilities (#NISR05012005I) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 call buffer overflow (#NISR05012005C) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• RE: Paper: SQL Injection Attacks by Example ("Scovetta, Michael V" <Michael.Scovetta@...com>)
• IBM DB2 JDBC Applet Server buffer overflow (#NISR05012005D) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Re: Paper: SQL Injection Attacks by Example (Chip Andrews <chip@...security.com>)
• Re: Paper: SQL Injection Attacks by Example (Cory Foy <Cory.Foy@...ilehwy.com>)
• IBM DB2 SATADMIN.SATENCRYPT buffer overflow (#NISR05012005E) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• RE: Paper: SQL Injection Attacks by Example ("David Litchfield" <davidl@...software.com>)
• RE: Paper: SQL Injection Attacks by Example (Michael Silk <michaelsilk@...il.com>)
• RE: Paper: SQL Injection Attacks by Example ("Scovetta, Michael V" <Michael.Scovetta@...com>)

• IBM DB2 Windows Permission Problems (#NISR05012005F) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 to_char and to_date Denial Of Service (#NISR05012005G) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 XML functions overflows (#NISR05012005H) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• IBM DB2 XML functions file creation vulnerabilities (#NISR05012005I) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• All Symantec Products All Versions Until 2005 - Remote Stack Buffer Overflow ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• WinHKI BH File Incorrect Filename Handeling Leads to 100 CPU% ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• WinAce - GZIP File Directory Transversal ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• WinHKI - LHA File Incorrect Filename Handeling Leads to Crash/Underflow ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• WinHKI - BH File Directory Transversal ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• WinHKI - CAB File Directory Transversal ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• RE: Paper: SQL Injection Attacks by Example (Sergey Chernyshev <Sergey@...rttv.com>)
• [SECURITY] [DSA 627-1] New namazu2 packages fix cross-site scripting vulnerability (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 626-1] New tiff packages fix denial of service (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 628-1] New imlib2 packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [USN-55-1] imlib2 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [USN-54-1] TIFF library tool vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• RE: All Symantec Products All Versions Until 2005 - Remote Stack Buffer Overflow ("Polazzo Justin" <Justin.Polazzo@...ilities.gatech.edu>)
• Socket unreacheable in Amp II engine (Luigi Auriemma <aluigi@...istici.org>)
• WinAce & WinHKI - ZIP File Directory Transversal ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• [CLA-2005:913] Conectiva Security Announcement - samba (Conectiva Updates <secure@...ectiva.com.br>)
• Re: Again: zone transfers, a spammer's dream? (Bruno Wolff III <bruno@...ff.to>)
• MDKSA-2005:001 - Updated libtiff packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• re: All Symantec Products All Versions Until 2005 - Remote Stack Buffer Overflow (Sym Security <secure@...antec.com>)
• Re: New Santy-Worm attacks *all* PHP-skripts (Pekka Savola <pekkas@...core.fi>)
• MDKSA-2005:002 - Updated wxGTK2 packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:003 - Updated vim packages fix modeline vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:004 - Updated nasm packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)

• WinAc AND WinHKI ZIP File Directory Transversal ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• Re: Re: new phpBB worm affects 2.0.11 (Paul Laudanski <zx@...tlecops.com>)
• RE: YEY AGAIN Automatic remote compromise ofInternetExplorer Service Pack 2 XP SP2 ("Michael Evanchik" <mevanchik@...ationship1.com>)
• Santy and SSL ("Ofer Shezaf" <Ofer.Shezaf@...ach.com>)
• Re: New Santy-Worm attacks *all* PHP-skripts (Juergen Schmidt <ju@...sec.de>)
• Re: Again: zone transfers, a spammer's dream? (xyberpix <xyberpix@...erpix.com>)
• Re: Heap overflow in Mozilla Browser <= 1.7.3 NNTP code. (Michal Zalewski <lcamtuf@...ttot.org>)
• Multiple vulnerabilities in AOL and AOL affiliate web sites (Michel Blomgren <michel.blomgren@...erteam.se>)
• Microsoft Windows BMP file buffer overflow (Chenghuai Lu <luchenghuai@...oo.com>)
• WinHKI - ARC File Extraction of 1KB to 1.56GB ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• AOL's Online Password Reset feature does not fully validate user information ("Steven" <steven@...ebug.org>)
• Re: Microsoft Windows BMP file buffer overflow (SysAdminKC <sysadminkc@...il.com>)
• Re: New Santy-Worm attacks *all* PHP-skripts ("morning_wood" <se_cur_ity@...mail.com>)
• [USN-56-1] exim4 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• RE: WinHKI - ARC File Extraction of 1KB to 1.56GB ("ALD, Aditya, Aditya Lalit Deshmukh" <aditya.deshmukh@...ine.gateway.expertworks.net>)
• Linux kernel sys_uselib local root vulnerability (Paul Starzetz <ihaquer@...c.pl>)
• [iSEC] [Dailydave] Advisory 1/2005 - Linux Kernel arbitrary code execution (fwd) (Paul Starzetz <ihaquer@...c.pl>)
• Simple PHP Blog directory traversal vulnerability (Madelman <madelman@...me.com>)
• grsecurity 2.1.0 release / 5 Linux kernel advisories (spender-JNS0hek0TMl4qEwOxq4T+Q@...lic.gmane.org (Brad Spengler))
• Linux kernel uselib() privilege elevation, corrected (Paul Starzetz <ihaquer@...c.pl>)
• grsecurity 2.1.0 release / 5 Linux kernel advisories (spender@...ecurity.net (Brad Spengler))
• Mozilla XBM Image Vulnerability (Luca Ercoli <luca.ercoli@...ind.it>)
• [SECURITY] [DSA 629-1] New kerberos packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Re: grsecurity 2.1.0 release / 5 Linux kernel advisories (Greg Ahmad <gahmad@...urityfocus.com>)
• Linux kernel uselib() privilege elevation, corrected (Paul Starzetz <ihaquer@...c.pl>)
• iDEFENSE Security Advisory [IDEF0725] Exim host_aton() Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)

• Troj/Winser-A malware analysis (Steve Friedl <steve@...xwiz.net>)
• iDEFENSE Security Advisory [IDEF0731] Exim auth_spa_server() Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
• Kindergarten on vacation (was: Obvious fake mail...) (Stefan Esser <s.esser@...atters.de>)
• Outsch... Sorry... (Stefan Esser <s.esser@...atters.de>)

• [USN-57-1] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)

• Re: Bluetooth: BlueSnarf and BlueBug Full Disclusore ("Eric Detoisien" <eric-mailing@...b-internet.fr>)
• Re: Re: Bluetooth: BlueSnarf and BlueBug Full Disclusore (Scott Renna <srenna@...music.com>)
• [USN-58-1] MIT Kerberos server vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Security Advisory: Woltlab Burning Board Lite formmail.php XSS (Martin Heistermann <martin.heistermann@....de>)
• [SECURITY] [DSA 630-1] New lintian packages fix insecure temporary directory (joey@...odrom.org (Martin Schulze))
• Encrypted Messenger DoS Vulnerability (Adam Baldwin <evilpacket@...il.com>)
• SUSE Security Announcement: libtiff/tiff (SUSE-SA:2005:001) (Thomas Biege <thomas@...e.de>)
• [SECURITY] [DSA 632-1] New linpopup packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• applicable exploit for winxp-sp2-uptodate Internet Explorer (Liu Die Yu <liudieyu@...rella.name>)
• [SECURITY] [DSA 631-1] New kdlibs packages fix arbitrary FTP command execution (joey@...odrom.org (Martin Schulze))
• UPDATED: the insider exploit( = the latest ie 0day which involves SHOWMODALDIALOG) (Liu Die Yu <liudieyu@...rella.name>)
• SQL Injection Vulnerability in Invision Community Blog (darkhawk matrix <darkhawk.matrix@...il.com>)
• [USN-59-1] mailman vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• Multi-vendor AV gateway image inspection bypass vulnerability (Darren Bounds <dbounds@...rusense.com>)
• [AppSecInc Team SHATTER Security Advisory] Microsoft Windows Improper Token Validation ("Team SHATTER (Application Security, Inc.)" <vrathod@...secinc.com>)
• [KDE Security Advisory] ftp kioslave command injection (Dirk Mueller <mueller@....org>)
• [AppSecInc Team SHATTER Security Advisory] Microsoft Windows LPC heap overflow ("Team SHATTER (Application Security, Inc.)" <vrathod@...secinc.com>)

• Firespoofing [Firefox 1.0] ("mikx" <mikx@...x.de>)
• [ GLSA 200501-15 ] UnRTF: Buffer overflow (Dan Margolis <krispykringle@...too.org>)
• [ GLSA 200501-14 ] mpg123: Buffer overflow (Dan Margolis <krispykringle@...too.org>)
• RE: UPDATED: the insider exploit( = the latest ie 0day which involves SHOWMODALDIALOG) ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• RE: UPDATED: the insider exploit( = the latest ie0day which involves SHOWMODALDIALOG) ("Ferruh Mavituna" <ferruh@...ituna.com>)
• VERITAS Backup Exec 8.x/9.x Remote Universal Exploit ("class 101" <class101@...-squad.com>)
• RE: Firespoofing [Firefox 1.0] ("Soderland, Craig" <craig.soderland@....com>)
• Re: Shoe 1.0 - Remote Lace Overflow (stonersavant <dank.krew@...il.com>)
• [ GLSA 200501-19 ] imlib2: Buffer overflows in image decoding (Dan Margolis <krispykringle@...too.org>)
• [SECURITY] [DSA 634-1] New hylafax packages fix unauthorised access (joey@...odrom.org (Martin Schulze))
• UPDATED: the insider exploit( = the latest ie 0day which involves SHOWMODALDIALOG) (Liu Die Yu <liudieyu@...rella.name>)
• The Misuse of RC4 in Microsoft Word and Excel (Hongjun Wu <hongjun@....a-star.edu.sg>)
• HylaFAX hfaxd unauthorized login vulnerability (Lee Howard <faxguy@...ardsilvan.com>)
• Multi-vendor AV gateway image inspection bypass vulnerability (Darren Bounds <lists@...rusense.com>)
• applicable exploit for winxp-sp2-uptodate Internet Explorer (Liu Die Yu <liudieyu@...rella.name>)
• VERITAS Backup Exec 8.x/9.x Remote Universal Exploit ("class 101" <class101@...-squad.com>)
• EEYE: Windows ANI File Parsing Buffer Overflow ("Derek Soeder" <dsoeder@...e.com>)
• Portcullis Security Advisory 05-010 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Re: Multi-vendor AV gateway image inspection bypass vulnerability (Danny <nocmonkey@...il.com>)
• Portcullis Security Advisory 05-005 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Portcullis Security Advisory 05-001 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Portcullis Security Advisory 05-007 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Mod_dosevasive symlink and race vulnerability (LSS Security <exposed@....hr>)
• Portcullis Security Advisory 05-006 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• [SECURITY] [DSA 633-1] New bmv package fixes insecure temporary file creation (joey@...odrom.org (Martin Schulze))
• Portcullis Security Advisory 05-003 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Re: Firespoofing [Firefox 1.0] (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
• [OpenPKG-SA-2005.001] OpenPKG Security Advisory (perl) (OpenPKG <openpkg@...npkg.org>)
• Portcullis Security Advisory 05-004 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Woltlab Burning Book addentry.php SQL Injection (Martin Heistermann <martin.heistermann@....de>)
• Metasploit Framework v2.3 (H D Moore <sflist@...italoffense.net>)
• Apache mod_auth_radius remote integer overflow (LSS Security <exposed@....hr>)
• Portcullis Security Advisory 05-009 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Security Contact for Nokia Mobile phone softwares (rohit@...tikalsolutions.com)

• IlohaMail Insecure Configuration Files (<wang@...dyresponse.org>)
• Fwd: APPLE-SA-2005-01-11 iTunes 4.7.1 (David Ahmad <da@...urityfocus.com>)
• Re: [Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulnerability (Darren Bounds <lists@...rusense.com>)
• Re: DSL- Router Teledat 530 DoS (Stefan S. <webmaster@...ix.de>)
• [NILESA-20050101]: Denial of Service vulnerability due to the mountd bug (Jonglim Yun <abc@...esoft.co.kr>)
• Re: The Misuse of RC4 in Microsoft Word and Excel (Brendan Dolan-Gavitt <bdolangavitt@...leyan.edu>)
• UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : mountd remote denial of service (please_reply_to_security@....com)
• Squirrelmail vacation v0.15 local root exploit (LSS Security <exposed@....hr>)
• WMV (Windows Media Player) trojan in wild (Marc Bejarano <bugtraq@...j.org>)
• Portcullis Security Advisory 05-008 ("Paul J Docherty" <PJD@...tcullis-security.com>)
• Re: MORE CRITICAL FLAWS IN MS WINDOWS EXPLORER (Andrew Farmer <andfarm@...novis.com>)
• RE: MORE CRITICAL FLAWS IN MS WINDOWS EXPLORER ("Paul Kurczaba" <seclists@...urinews.com>)
• TFTPD32 Long FileName Remote Denial of Service ("Sowhat ." <smaillist@...il.com>)
• RE: MORE CRITICAL FLAWS IN MS WINDOWS EXPLORER ("ALD, Aditya, Aditya Lalit Deshmukh" <aditya.deshmukh@...ine.gateway.expertworks.net>)
• (no subject) ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
• MailMonitor for Exchange has processed a suspicious mail (<MailMonitor@...gs.edu>)
• Linux kernel i386 SMP page fault handler privilege escalation (Paul Starzetz <ihaquer@...c.pl>)
• Arkeia Possible remote root & information leakage (Maciej Bogucki <maciej.bogucki@...egence.com>)
• [SECURITY] [DSA 635-1] New exim packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Security Advisory: BiTBOARD xss (Martin Heistermann <martin.heistermann@....de>)
• [SECURITY] [DSA 636-1] New libc6 packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
• Is DEP easily evadable? (John Richard Moser <nigelenki@...cast.net>)
• Windows ANI File Parsing Proof Of Concept (MS05-002) (<assaf404@...oo.com>)

• [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke (Janek Vind <come2waraxe@...oo.com>)
• RE: MORE CRITICAL FLAWS IN MS WINDOWS EXPLORER ("Paul Kurczaba" <seclists@...urinews.com>)
• InternetExploiter 3.2 ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
• RE: MORE CRITICAL FLAWS IN MS WINDOWS EXPLORER ("ALD, Aditya, Aditya Lalit Deshmukh" <aditya.deshmukh@...ine.gateway.expertworks.net>)
• [SECURITY] [DSA 638-1] New gopher packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• [CLA-2005:915] Conectiva Security Announcement - php4 (Conectiva Updates <secure@...ectiva.com.br>)
• [SECURITY] [DSA 637-1] New exim-tls packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [CLA-2005:916] Conectiva Security Announcement - ethereal (Conectiva Updates <secure@...ectiva.com.br>)
• XSS Vulnerability in ForumKIT (tom cruise <the.n3t@...il.com>)
• IE issue with percent 20 (RSnake <rsnake@...cking.com>)
• [CLA-2005:917] Conectiva Security Announcement - krb5 (Conectiva Updates <secure@...ectiva.com.br>)
• (no subject) ("The Insider" <the_insider@...l.com>)
• Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attack ("CIRT Advisory" <advisory@...t.dk>)
• Re: Is DEP easily evadable? (John Richard Moser <nigelenki@...cast.net>)
• Cross Site Scripting holes found in Horde 3.0 ("Hyperdose Security" <robfly@...erdose.com>)
• TSLSA-2005-0001 - multi (Trustix Security Advisor <tsl@...stix.org>)
• SB2005002: pron to bypass APF checking uid(0) routine (x90c <jyj9782@...net.net>)
• Server crash in Breed patch #1 (Luigi Auriemma <aluigi@...istici.org>)
• Re: Is DEP easily evadable? (Ben Pfaff <blp@...stanford.edu>)
• MDKSA-2005:006 - Updated hylafax packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:007 - Updated imlib packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities (<advisory@...security.com>)
• Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attack (<Hammud_Saway@...mium.trendmicro.com>)
• Re: Is DEP easily evadable? (Florian Weimer <fw@...eb.enyo.de>)
• iDEFENSE Security Advisory 01.13.05 - Apple iTunes Playlist Parsing Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)

• Internet Explorer (SP2) - Remote File Download Information Bar Bypass ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• Internet Explorer valid JavaScript-file successfull load detection local file enumeration ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
• iDEFENSE Security Advisory 01.13.05: MySQL MaxDB WebAgent websql logon Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
• [USN-60-0] Linux kernel vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• iDEFENSE Security Advisory 01.13.05: SGI IRIX inpview Design Error Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
• XSS Vulnerability in Siteman v1.1.9 (Pedram hayati <pi3ch@...oo.com>)
• Re: Is DEP easily evadable? (John Richard Moser <nigelenki@...cast.net>)
• iDEFENSE Security Advisory 01.14.05: Exim dns_buld_reverse() Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
• [CLA-2005:918] Conectiva Security Announcement - twiki (Conectiva Updates <secure@...ectiva.com.br>)
• Paper: How to exploit overflow vulnerability under Fedora Core 2 ("vangelis vangelis" <progressfree@...mail.com>)
• Re: Is DEP easily evadable? (Ben Pfaff <blp@...stanford.edu>)
• MDKSA-2005:005 - Updated nfs-utils packages fix 64bit vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: Multi-vendor AV gateway image inspection bypass vulnerability (Trog <trog@...on.org>)
• new tool : the first remote PHP vulnerability scanner (bad boy <slythers@...il.com>)
• Re: Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attack (shadown <shadown@...il.com>)
• Re: Multiple Firewall Products Bypass Vulnerability (Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>)
• [SECURITY] [DSA 639-1] New mc packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))

• Re: rssh and scponly arbitrary command execution (Derek Martin <code@...zashack.org>)
• XSS in the nested BB tag in many forum ("pigrelax" <pigrelax@...dex.ru>)
• Various Vulnerabilities in SparkleBlog (Kovács László <bugtracklist@...email.hu>)
• iDefense iTunes advisory. (nemo@...inemenace.org)
• Various Vulnerabilities in SparkleBlog (Kovács László <bugtracklist@...email.hu>)
• Apple Airport WDS DoS (Dylan Griffiths <dylang@...ck.com>)
• RE: Various Vulnerabilities in SparkleBlog ("Alan W. Rateliff, II" <lists@...eliff.net>)
• exim dns_buld_reverse() proof-of-concept (Rafael San Miguel Carrasco <smcsoc@...oo.es>)

• phpGiftReq SQL Injection (Madelman <madelman@...me.com>)
• Minis directory traversal vulnerability (Madelman <madelman@...me.com>)

• Netegrity SiteMinder smpwservicescgi.exe target specification ("Marc Ruef" <maru@...p.ch>)
• Novell GroupWise WebAccess error modules loading ("Marc Ruef" <maru@...p.ch>)
• [SECURITY] [DSA 640-1] New gatos packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [OpenPKG-SA-2005.002] OpenPKG Security Advisory (sudo) (OpenPKG <openpkg@...npkg.org>)
• [SECURITY] [DSA 641-1] New playmidi packages fix local root exploit (joey@...odrom.org (Martin Schulze))
• [OpenPKG-SA-2005.003] OpenPKG Security Advisory (a2ps) (OpenPKG <openpkg@...npkg.org>)
• [SECURITY] [DSA 642-1] New gallery packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• SUSE Security Announcement: php4/mod_php4 (SUSE-SA:2005:002) (Ludwig Nussel <ludwig.nussel@...e.de>)
• iDEFENSE Security Advisory 01.17.05: Multiple Vendor ImageMagick .psd Image File Decode Heap Overflow Vulnerability ("customer service mailbox" <customerservice…)
• Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
• Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations ("Rafel Ivgi, The-Insider" <theinsider@....net.il…)
• MDKSA-2005:008 - Updated cups packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Multiple Vulnerabilities in Netgear FVS318 Router (Paul Kurczaba <advisories@...urinews.com>)
• [SIG^2 G-TEC] NodeManager Professional V2.00 Buffer Overflow Vulnerability (<chewkeong@...urity.org.sg>)

• Multiple high risk vulnerabilities in Oracle RDBMS 10g/9i ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Multiple high risk vulnerabilities in Oracle RDBMS 10g/9i ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 643-1] New queue packages fix buffer overflows (joey@...odrom.org (Martin Schulze))
• Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations (Thierry Zoller <Thierry@...ff-em.com>)
• [USN-61-1] vim vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [USN-62-1] imagemagick vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• [USN-63-1] MySQL client vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• IE HHCTRL exploit still usable even after patch (Valentin Avram <vavram@...adnet.ro>)
• Re: Shoe 1.0 - Remote Lace Overflow (Thomas Sutpen <sutpen@...il.com>)
• UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : chroot A known exploit can break a chroot prison. (please_reply_to_security@....com)
• Unrestricted I/O access vulnerability in INCA Gameguard ("Ryu Connor" <Hellfire@...pacy.com>)
• iDEFENSE Security Advisory 01.18.05 - Multiple Unix/Linux Vendor Xpdf makeFileKey2 Stack Overflow ("customer service mailbox" <customerservice@...fense.com>)
• Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations ("Berend-Jan Wever" <skylined@...p.tudelft.n…)
• PeteFinnigan.com - Oracle security advisory (Pete Finnigan <plsql@...efinnigan.com>)

• Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations (Markus Kern <markus-kern@....net>)
• Re: Novell GroupWise WebAccess error modules loading (Pete Connolly <pete.connolly@...nternet.com>)
• SyScAN'05 CFP ("organiser@...can.org" <organiser@...can.org>)
• Re: grsecurity 2.1.0 release / 5 Linux kernel advisories (Marcus Meissner <meissner@...e.de>)
• [USN-64-1] xpdf, CUPS vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• Re: [security] Novell GroupWise WebAccess error modules loading ("tyron miller" <tyron.miller@....mq.edu.au>)
• Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations (Markus Kern <markus-kern@....net>)
• [USN-65-1] Apache utility script vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Multiple vulnerabilities in the AtHoc Toolbar (#NISR19012005c) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• MSN Heartbeat Control Buffer Overflow ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Multiple vulnerabilities in Konversation (Wouter Coekaerts <wouter@...kaerts.be>)
• Cisco Security Advisory: Vulnerability in Cisco IOS Embedded Call Processing Solutions (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• RealPlayer Arbitrary File Deletion Vulnerability (#NISR19012005f) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Microsoft Internet Explorer Install Engine Control Buffer Overflow (#NISR19012005a) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• RealPlayer Miscellaneous Vulnerabilities (#NISR19012005g) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Darwin Kernel Vulnerability (nemo@...inemenace.org)
• RealPlayer 'ShowPreferences' Buffer Overflow Vulnerability (#NISR19012005e) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• iDEFENSE Security Advisory 01.19.05: MySQL MaxDB Web Agent Multiple Denial of Service Vulnerabilities ("Michael Sutton" <msutton@...fense.com>)
• [SECURITY] [DSA 645-1] New CUPS packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))

• [SECURITY] [DSA 646-1] New ImageMagick packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 647-1] New mysql packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
• RE: [VulnWatch] RealPlayer Arbitrary File Deletion Vulnerability (#NISR19012005f) ("Efrain Soto" <esoto@...tarricense.cr>)
• ASH Hashing Algorithm (seasonedpaper@....people.inodetech.com)
• Re: [ISN] Book Review: Forensic Discovery (Anthony Zboralski <bcs2005@...lua.com>)
• Microsoft Internet Explorer HTML Help Control Vulnerability Still Exploitable After Patch (Valentin Avram <vavram@...adnet.ro>)
• [USN-66-1] PHP vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• fkey[v0.0.2]: local/remote file accessibility exploit. (Vade 79 <v9@...ehalo.deadpig.org>)
• [SECURITY] [DSA 651-1] New squid packages fix denial of service (joey@...odrom.org (Martin Schulze))
• [USN-67-1] Squid vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• OpenServer 5.0.6 OpenServer 5.0.7 : bind remote attacker can poison the nameserver cache (please_reply_to_security@....com)
• Re: Re: [ISN] Book Review: Forensic Discovery (j mark <jmark2099@...oo.com>)
• [CLA-2005:920] Conectiva Security Announcement - libtiff3 (Conectiva Updates <secure@...ectiva.com.br>)
• iDEFENSE Security Advisory 01.20.05: 3Com OfficeConnect Wireless 11g AP Information Disclosure Vulnerability ("iDefense Customer Service" <customerservice@...fe…)

• [ GLSA 200501-27 ] Ethereal: Multiple vulnerabilities (Luke Macken <lewk@...too.org>)
• Security Contact within RIM / Blackberry ("Mark Litchfield" <mark@...software.com>)
• MDKSA-2005:011 - Updated xine packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Integrigy Security Advisory - High Risk Security Issues in the Oracle Database and Oracle Applications ("Integrigy Security" <alerts@...egrigy.com>)
• Re: Darwin Kernel Vulnerability (neil@...kridge.org)
• UnixWare 7.1.3 UnixWare 7.1.1 : OpenSSL Multiple Vulnerabilities (please_reply_to_security@....com)
• MDKSA-2005:009 - Updated mpg123 packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:010 - Updated playmidi packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• STG Security Advisory: [SSA-20050120-24] GForge 3.x directory traversal vulnerability (<advisory@...security.com>)
• STG Security Advisory: [SSA-20050120-22] JSBoard file disclosure vulnerability (<advisory@...security.com>)
• [SECURITY] [DSA 649-1] New xtrlock packages fix authentication bypass (joey@...odrom.org (Martin Schulze))
• God Admin Injection Vulnerability in Siteman 1.0.x (Pedram hayati <pi3ch@...oo.com>)
• [SECURITY] [DSA 650-1] New sword packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
• [sb] [USN-65-1] Apache utility script vulnerability ("Martin Pitt" <martin.pitt@...onical.com>)
• Microsoft NetDDE Service Unauthenticated Remote Buffer Overflow ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Arbitrary files overwriting through skins in DivX Player 2.6 (Luigi Auriemma <aluigi@...istici.org>)
• [SECURITY] [DSA 652-1] New unarj packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))

• SUSE Security Announcement: kernel local privilege escalation (SUSE-SA:2005:003) (Marcus Meissner <meissner@...e.de>)
• Various Buffer Overflows in Oracle 10g Tools (Joxean Koret <joxeankoret@...oo.es>)
• bug report comersus Back Office Lite 6.0 and 6.0.1 ("raf somers" <beltech2bugtraq@...mail.com>)
• Mac OS X 10.3 iSync Privilege Escalation (Braden Thomas <bjthomas@....edu>)
• (MS05-002) Cursor and Icon Format Handling Vulnerability (PoC for all affected systems) (houseofdabus HOD <houseofdabus@...ox.ru>)
• Re: Advanced Guestbook (Stewart Souter <webmaster@...bonize.co.uk>)
• PHRACK #63 CALL FOR PAPERS (rm@...ack.org)
• Call for DEFCON Capture the Flag Organizers. (The Dark Tangent <dtangent@...con.org>)
• Re: Various Buffer Overflows in Oracle 10g Tools ("David Litchfield" <davidl@...software.com>)
• [SECURITY] [DSA 653-1] New ethereal packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
• KDE Security Advisory: KOffice PDF Import Filter Vulnerability (Waldo Bastian <bastian@....org>)
• [SECURITY] [DSA 654-1] New enscript packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• KDE Security Advisory: Multiple vulnerabilities in Konversation (Waldo Bastian <bastian@....org>)
• Siteman User Database Line Insertion Vulnerability (shoalie sefid <shoaliesefid7@...oo.com>)
• [sb] [USN-65-1] Apache utility script vulnerability ("Martin Pitt" <martin.pitt@...onical.com>)

• RealVNC Contact (DSGM <dsgm1972@...foot.com>)
• Internet Explorer URL obfuscation. ("Stewart, Graeme" <gstewart@...strepublic.com>)
• Netscape Overflow. (Carlos Ulver <carlos.ulver@...il.com>)
• Re: Novell GroupWise WebAccess error modules loading (Jonathan Rockway <jrockw2@....edu>)
• Re: Internet Explorer URL obfuscation. ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)

• 2 vulnerabilities combine to auto execute received files in Nokia series 60 OS (rohit@...tikalsolutions.com)
• [USN-68-1] enscript vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
• [KDE Security Advisory] kpdf Buffer Overflow Vulnerability (Dirk Mueller <mueller@....org>)
• New PGP key (Carlos Ulver <carlos.ulver@...il.com>)
• [USN-69-1] Evolution vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Re: 2 vulnerabilities combine to auto execute received files in Nokia series 60 OS ("KF (lists)" <kf_lists@...italmunition.com>)
• SUSE Security Announcement: Realplayer 8 (SUSE-SA:2005:004) (Marcus Meissner <meissner@...e.de>)
• Re: 2 vulnerabilities combine to auto execute received files in Nokia series 60 OS (Valdis.Kletnieks@...edu)
• RealPlayer 10.5 Denial of Service and possible Overflow (Carlos Ulver <carlos.ulver@...il.com>)
• RE: 2 vulnerabilities combine to auto execute received files in Nokia series 60 OS ("Paul Kurczaba" <seclists@...urinews.com>)
• Re: 2 vulnerabilities combine to auto execute received files in Nokia series 60 OS (Anders Langworthy <hades@...lanthropy.org>)
• SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow (3APA3A <3APA3A@...urity.nnov.ru>)
• iDEFENSE Security Advisory 01.24.05: DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability ("iDefense Customer Service" <customerservice@...fens…)
• Local buffer-overflow in W32Dasm 8.93 (Luigi Auriemma <aluigi@...istici.org>)

• Portcullis Security Advisory 05-002 Spectrum Cash Receipting System Weak Password Encryption ("Paul J Docherty" <PJD@...tcullis-security.com>)
• MDKSA-2005:012 - Updated zhcon packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Multiple vulnerabilities in MercuryBoard 1.1.1 ("Alberto Trivero" <trivero@...py.it>)
• English-language version of K-OTik.COM launched today ! (K-OTiK Security <Special-Alerts@...tik.com>)
• MDKSA-2005:013 - Updated ethereal packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• [SECURITY] [DSA 657-1] New xine-lib packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
• logwatch and logrotate might create a blind spot in reporting (Sami Pitko <sami.pitko@...sala.com>)
• [SECURITY] [DSA 656-1] New vdr packages fix insecure file access (joey@...odrom.org (Martin Schulze))
• [SECURITY] [DSA 655-1] New zhcon packages fix unauthorised file access (joey@...odrom.org (Martin Schulze))
• Vulnerabilities in eXponent 0.95 (Ahmad Muammar <y3dips@...o.or.id>)
• MDKSA-2005:015 - Updated mailman packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:014 - Updated squid packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: ADVISORY: security hole (http response splitting) in snitz forums 2000 (Harold Lines <hlines@...c.com>)
• [USN-70-1] Perl DBI module vulnerability (Martin Pitt <martin.pitt@...onical.com>)
• Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow (Michael Hampton <error10@...il.com>)
• [CLA-2005:921] Conectiva Security Announcement - xpdf (Conectiva Updates <secure@...ectiva.com.br>)
• Re: "Local" and "Remote" considered insufficient (Frank Knobbe <frank@...bbe.us>)
• phpEventCalendar HTML injection (Madelman <madelman@...me.com>)
• [SECURITY] [DSA 658-1] New libdbi-perl packages fix insecure temporary file (joey@...odrom.org (Martin Schulze))

• OpenServer 5.0.6 OpenServer 5.0.7 : wu-ftp local users can bypass access restrictions (please_reply_to_security@....com)
• OpenServer 5.0.6 OpenServer 5.0.7 : scosessoin local privilege elevation (please_reply_to_security@....com)
• wifi AP + broadcoast ping ("Miroslav Kubik" <kubik_miroslav@...nam.cz>)
• UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : x.org possible local socket hijacking (please_reply_to_security@....com)
• iDEFENSE Security Advisory 01.26.05: Openswan XAUTH/PAM Buffer Overflow Vulnerability ("iDefense Customer Service" <customerservice@...fense.com>)
• MDKSA-2005:022 - Updated cups packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• List of all admin accounts in phpBB ("Predrag Damnjanovic" <bugtraq@...ity.co.yu>)
• MDKSA-2005:020 - Updated kdegraphics packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• DMA[2005-0125a] - 'berlios gpsd format string vulnerability' ("KF (Lists)" <kf_lists@...italmunition.com>)
• MDKSA-2005:017 - Updated xpdf packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: [ GLSA 200501-36 ] AWStats: Remote code execution (Delian Krustev <krustev@...stev.net>)

• Cisco Security Advisory: Multiple Crafted IPv6 Packets Cause Reload (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Cisco IOS Misformed BGP Packet Causes Reload (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Crafted Packet Causes Reload on Cisco Routers (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• [SECURITY] [DSA 660-1] New kdebase packages fix authentication bypass (joey@...odrom.org (Martin Schulze))
• Black Hat new content on-line & Registration now open for Asia and Europe. (Jeff Moss <jmoss@...ckhat.com>)
• [SECURITY] [DSA 659-1] New libpam-radius-auth packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
• MDKSA-2005:016 - Updated gpdf packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:018 - Updated cups packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:019 - Updated koffice packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2005:021 - Updated tetex packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Multiple Vulnerabilities in Pocket IE (kers0r <root@...lum-nz.com>)
• Re: List of all admin accounts in phpBB (Aaron Klein <klein.aaron@...il.com>)
• [CLA-2005:923] Conectiva Security Announcement - squid (Conectiva Updates <secure@...ectiva.com.br>)
• Re: logwatch and logrotate might create a blind spot in reporting (The Tibetan Traveller <garnet@...ait.net>)
• Ingate Firewall: Removed PPTP tunnels not deactivated (Per Cederqvist <ceder@...ate.com>)
• NSFOCUS SA2005-01 : Buffer Overflow in WinAMP in_cdda.dll CDA Device Name (NSFOCUS Security Team <security@...ocus.com>)
• DMA[2005-0127a] - 'Apple OSX batch family poor use of setuid' ("KF (Lists)" <kf_lists@...italmunition.com>)
• Re: [ GLSA 200501-36 ] AWStats: Remote code execution (Niels Bakker <niels-bugtraq@...ker.net>)
• NOVL-2005-10096251 GroupWise WebAccess Error modules loading (report) ("Ed Reed" <ereed@...ell.com>)
• [Contact] Motorola broadband appliance team? ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
• [SIG^2 G-TEC] Magic Winmail Server v4.0 Multiple Vulnerabilities (<chewkeong@...urity.org.sg>)
• Re: [ GLSA 200501-36 ] AWStats: Remote code execution ("Joao Victor A. Di Stasi" <jvictor_rj@...oo.com.br>)
• UEBIMIAU <= 2.7.2 MULTIPLES VULNERABILITIES (Nash Leon <nashleon@...oo.com.br>)
• HKLM locking (Vladimir Kraljevic <vladimir_kraljevic@...oo.com>)
• [SECURITY] [DSA 661-1] New f2c packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
• MDKSA-2005:024 - Updated evolution packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)

• WarFTPD 1.82 RC9 DoS ("MC.Iglo" <mc.iglo@....de>)
• Re: Re: [ GLSA 200501-36 ] AWStats: Remote codeexecution ("morning_wood" <se_cur_ity@...mail.com>)
• Winamp Exploit (POC) 5.08 Stack Overflow ("Rojodos" <rojo2_bugtraq@...oo.es>)
• Multiple vulnerabilities in Alt-N WebAdmin <= 3.0.2 (David Alonso Pérez <kamborio@...il.com>)
• WebWasher Classic - HTTP CONNECT weakness ("Oliver Karow" <Oliver.Karow@....de>)
• [OpenPKG-SA-2005.004] OpenPKG Security Advisory (sasl) (OpenPKG <openpkg@...npkg.org>)
• Re: UEBIMIAU <= 2.7.2 MULTIPLES VULNERABILITIES (pokley <pokleyzz@...n-associates.net>)
• Multiple vulnerabilities in Icewarp Web Mail 5.3.0: New holes (ShineShadow <ss_contacts@...mail.com>)
• Winamp Exploit (POC) 5.08 Stack Overflow ("Rojodos" <rojo2_bugtraq@...oo.es>)
• RE: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow ("David LeBlanc" <dleblanc@...hange.microsoft.com>)
• Re: Unrestricted I/O access vulnerability in INCA Gameguard (David Roberts <david@...den.demon.co.uk>)

• Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow (Damien Miller <djm@...drot.org>)
• RE: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow ("David LeBlanc" <dleblanc@...hange.microsoft.com>)
• SquirrelMail Security Advisory ("Jonathan Angliss" <jon@...irrelmail.org>)
• Re: List of all admin accounts in phpBB (Paul Laudanski <zx@...tlecops.com>)
• Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow (Lee Dilkie <lee_dilkie@...el.com>)
• XSS in Infinite Mobile Delivery v2.6 Webmail (steven@...ebug.org)

• Broadcast crash in Xpand Rally 1.0.0.0 (Luigi Auriemma <aluigi@...istici.org>)

• Re: [ GLSA 200501-45 ] Gallery: Cross-site scripting vulnerability (Paul Laudanski <zx@...tlecops.com>)
• WASC-Articles: "The 80/20 Rule for Web Application Security" (robert@...appsec.org)
• Security Bulletin - SSRT4875 rev.1 - HP Tru64 UNIX Java (TM) Technology Software Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
• drone armies C&C report - Jan/2005 (Gadi Evron <gadi@...ila.gov.il>)
• Re[2]: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow (3APA3A <3APA3A@...URITY.NNOV.RU>)
• Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow (Casper.Dik@....COM)
• Re: Winamp Exploit (POC) 5.08 Stack Overflow (Black Dot <blackd0t@...l.ru>)
• Re: iDEFENSE Security Advisory 01.24.05: DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability (dila <dilabox@...il.com>)
• [PersianHacker.net] Full Path Disclosure and PHP Injection In Pafiledb 3.1 Final (Pedram hayati <pi3ch@...oo.com>)
• Zyxel / Netgear and probably other routers leaking information. (Jens Kalvik <jens.kalvik@...ect.se>)
• New Whitepaper available on security best practices (Gunter Ollmann <gunter@...software.com>)
• MDKSA-2005:025 - Updated clamav packages fix vulnerability (Mandrakelinux Security Team <security@...ux-mandrake.com>)

440 messages

Powered by blists - more mailing lists