bugtraq mailing list - 2005/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2005/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 20	² 14	³ 2
⁴ 17	⁵ 17	⁶ 39	⁷ 26	⁸ 26	⁹ 16	¹⁰ 7
¹¹ 15	¹² 19	¹³ 29	¹⁴ 16	¹⁵ 26	¹⁶ 20	¹⁷ 13
¹⁸ 17	¹⁹ 36	²⁰ 19	²¹ 35	²² 23	²³ 15	²⁴ 6
²⁵ 16	²⁶ 20	²⁷ 21	²⁸ 33	²⁹ 17	³⁰ 12	³¹ 6

Messages by day:

July 1 (20 messages)

Re: [VulnWatch] Microsoft Windows NTFS Information Disclosure (Matthew Murphy <mattmurphy@...rr.com>)
NetBSD Security Advisory 2005-001: Crypto leaks across HyperThreaded CPUs (i386, P4, HTT+SMP only) (NetBSD Security-Officer <security-officer@...bsd.org>)
Re: Publishing exploit code - what is it good for ("Raghu Chinthoju" <raghu.chinthoju@...iffmail.com>)
RE: Publishing exploit code - what is it good for ("Michael Evanchik" <mike@...npickel.com>)
Re: [VulnWatch] Microsoft Windows NTFS Information Disclosure (Melvin Klassen <klassen@...c.ca>)
Re: Publishing exploit code - what is it good for (Curt Sampson <cjs@...ic.net>)
RE: Publishing exploit code - what is it good for (Socrates <socrates@...sguy.com>)
RE: Publishing exploit code - what is it good for ("Morales, David (Seta)" <David_Morales@....navy.mil>)
Re: Published exploit codes foo foo foo ("Dave Korn" <davek_throwaway@...mail.com>)
MDKSA-2005:108 - Updated squirrelmail packages fix XSS vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:109 - Updated php-pear packages fix remotely exploitable vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:110 - Updated 2.6 kernel packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:111 - Updated 2.4 kernel packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
[SECURITY] [DSA 735-1] New sudo packages fix pathname validation race (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 736-1] New spamassassin packages fix potential DOS (Michael Stone <mstone@...cker.debian.org>)
/dev/random is probably not ("Charles M. Hannum" <mycroft@...bsd.org>)
PEAR XML_RPC Remote Code Execution Vulnerability (GulfTech Security Research <security@...ftech.org>)
TSLSA-2005-0031 - multi (Trustix Security Advisor <tsl@...stix.org>)
[SECURITY ALERT] osTicket bugs (ghc@....ru)
PHPXMLRPC Remote Code Execution (GulfTech Security Research <security@...ftech.org>)

July 2 (14 messages)

UnixWare 7.1.4 : Mozilla updated to 1.7.8 fixes security issues (please_reply_to_security@....com)
Re: Publishing exploit code - what is it good for (Joachim Schipper <j.schipper@...h.uu.nl>)
Re: Re: [VulnWatch] Microsoft Windows NTFS Information Disclosure (James Tucker <jftucker@...il.com>)
Re: Re: [VulnWatch] Microsoft Windows NTFS Information Disclosure (Matthew Murphy <mattmurphy@...rr.com>)
Advisory 03/2005: Cacti Multiple SQL Injection Vulnerabilities (Stefan Esser <sesser@...dened-php.net>)
Advisory 03/2005: Cacti Multiple SQL Injection Vulnerabilities [FIXED] (Stefan Esser <sesser@...dened-php.net>)
Advisory 04/2005: Cacti Remote Command Execution Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Advisory 05/2005: Cacti Authentification/Addslashes Bypass Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Re: Publishing exploit code - what is it good for (ChayoteMu <chayotemu@...il.com>)
Re: In-game /ignore crash in Soldier of Fortune II 1.03 ("Slawek" <sgp@...satgp.com.pl>)
RE: Publishing exploit code - what is it good for ("Harry Metcalfe" <harry@...ptop.com>)
Re: /dev/random is probably not (Thomas Wana <thomas@...a.at>)
Re: Solaris 9/10 ld.so fun ("KF (lists)" <kf_lists@...italmunition.com>)
Re: /dev/random is probably not (Chiaki <ishikawa@...rim.or.jp>)

July 3 (2 messages)

JBoss jBPM 2.0: Remote code execution and classloader covert channel (Marc Schoenefeld <marc.schoenefeld@....org>)
[ GLSA 200507-01 ] PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability (Thierry Carrez <koon@...too.org>)

July 4 (17 messages)

Directory traversal vulnerability in "Quick & Dirty PHPSource Printer" 1.0 (Seth Alan Woolley <seth@...tology.org>)
log4sh insecure temporary file creation (ZATAZ Audits <exploits@...az.net>)
[ GLSA 200507-02 ] WordPress: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
[ GLSA 200507-03 ] phpBB: Arbitrary command execution (Matthias Geerdsen <vorlon@...too.org>)
Re: /dev/random is probably not (exon <exon@...e.se>)
Three More Vulnerable to PHPXMLRPC code injection (GulfTech Security Research <security@...ftech.org>)
Re: Directory traversal in source.php not fixed. (Seth Alan Woolley <seth@...tology.org>)
Re: /dev/random is probably not (McLain Causey <mclaincausey@...oo.com>)
XMLRPC remote commands execute exploit (duk3nn@...ru)
pam_ldap/nss_ldap password leak in a master+slave+start_tls LDAP setup (Rob Holland <tigger@...too.org>)
UPDATE: [ GLSA 200506-17 ] SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[SECURITY] [DSA 725-2] New ppxp packages fix local root exploit (joey@...odrom.org (Martin Schulze))
Re: Directory traversal in source.php not fixed. (Kaf Oseo <kaf@...b.net>)
Re: /dev/random is probably not ("Zow" Terry Brugger <zow@...l.gov>)
Re: Access right escalation / severe permission problems on Raritan Console Servers (spam@...etter.org)
Re: Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit (stupidfrenchdudes@...off.fr)
PlanetFileServer v2.0.1.3 - Denial Of Service (unsecure@...teme.com)

July 5 (17 messages)

a new sql injection for aspjar guestbook (arash_pc0@...oo.com)
Advisory 06/2005: Geeklog SQL Injection Vulnerability (Stefan Esser <sesser@...dened-php.net>)
[Fwd: Returned post for forensics@...urityfocus.com] (Jason Coombs <jasonc@...ence.org>)
!!! pre-authenticated remote code inclusion vulnerability inside phppgadmin !!! (<rznvynqqe@...hmail.com>)
[USN-147-1] PHP XMLRPC vulnerability (Martin Pitt <martin.pitt@...onical.com>)
ekg insecure temporary file creation and arbitrary code execution (ZATAZ Audits <exploits@...az.net>)
kpopper insecure temporary file creation (ZATAZ Audits <exploits@...az.net>)
[SECURITY] [DSA 734-1] New gaim packages fix denial of service (joey@...odrom.org (Martin Schulze))
XSS in nested tag in phpbb 2.0.16 ("alex" <pigrelax@...dex.ru>)
RE: Publishing exploit code - what is it good for ("wnorth" <wnorth@...izon.net>)
MyGuestbook Remote File Inclusion. ("group@...lblack.com.ar" <group@...lblack.com.ar>)
iDEFENSE Security Advisory 07.05.05: Adobe Acrobat Reader UnixAppOpenFilePerform() Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Re: [badroot security] AutoIndex PHP Script: XSS vulnerability (mozako <mozako@...ox.it>)
[badroot security] probe.cgi: Remote Command Execution (mozako <mozako@...ox.it>)
RE: Solaris 9/10 ld.so fun ("Glenn Pitcher" <Glenn.Pitcher@...Impact.com>)
[covide] possible sql injection (Hans Wolters <hans.wolters@...all.nl>)
Re: /dev/random is probably not (Darren Reed <avalon@...igula.anu.edu.au>)

July 6 (39 messages)

Re: /dev/random is probably not (Anton Ivanov <arivanov@...segv.cx>)
Imail Cookie Vulnerability (unhashed) (Sintigan@...ecure.net)
Re: /dev/random is probably not ("Robert Foxworth" <rfoxwor1@...pabay.rr.com>)
RE: /dev/random is probably not ("David Schwartz" <davids@...master.com>)
Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.] ("Anything But Microsoft" <abm@...thingbutmicrosoft.org>)
Re: /dev/random is probably not (Glynn Clements <glynn@...ements.plus.com>)
Re: /dev/random is probably not (Jack Lloyd <lloyd@...dombit.net>)
Advisory 07/2005: Jaws Multiple Remote Code Execution Vulnerabilities (Stefan Esser <sesser@...dened-php.net>)
[ GLSA 200507-04 ] RealPlayer: Heap overflow vulnerability (Thierry Carrez <koon@...too.org>)
[USN-148-1] zlib vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[ GLSA 200507-05 ] zlib: Buffer overflow (Thierry Carrez <koon@...too.org>)
[USN-147-2] Fixed php4-pear packages for USN-147-1 (Martin Pitt <martin.pitt@...onical.com>)
McAfee Intrushield IPS Abuse (c0ntexb@...il.com)
SUSE Security Announcement: zlib denial of service attack (SUSE-SA:2005:039) (Marcus Meissner <meissner@...e.de>)
FreeBSD Security Advisory FreeBSD-SA-05:16.zlib (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
SUSE Security Announcement: heimdal telnetd remote buffer overflow (SUSE-SA:2005:040) (Marcus Meissner <meissner@...e.de>)
[SECURITY] [DSA 740-1] New zlib packages fix denial of service (Michael Stone <mstone@...cker.debian.org>)
GNATS - gen-index (pi3ki31ny@...pl)
[SECURITY] [DSA 738-1] New razor packages fix potential DOS (Michael Stone <mstone@...cker.debian.org>)
Re: Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.] (Jason Coombs <jasonc@...ence.org>)
Re: /dev/random is probably not (devnull@...ents.Montreal.QC.CA)
Re: Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit (berendjanwever@...il.com)
Re: /dev/random is probably not (devnull@...ents.Montreal.QC.CA)
Re: Publishing exploit code - what is it good for (Lionel <nop@....net>)
Re: /dev/random is probably not (Chris Kuethe <chris.kuethe@...il.com>)
Re: /dev/random is probably not (Thomas <tom@...ctric-sheep.org>)
Re: /dev/random is probably not (ChayoteMu <chayotemu@...il.com>)
Re: /dev/random is probably not (Thomas <tom@...ctric-sheep.org>)
Re: /dev/random is probably not (Darren Reed <avalon@...igula.anu.edu.au>)
Re: /dev/random is probably not (Thomas <tom@...ctric-sheep.org>)
Re: Imail Cookie Vulnerability (unhashed) (Christophe Vandeplas <christophe@...deplas.com>)
Re: /dev/random is probably not (Alexey Toptygin <alexeyt@...eshell.org>)
VoIP-Phones: Weakness in proccessing SIP-Notify-Messages (Tobias Glemser <tglemser@...e-consulting.com>)
Solaris Socket Hijack (c0ntexb@...il.com)
PHPXMAIL - Authentication Bypass (Steve <steve01@...llo.at>)
Cross site scripting in Lotus Notes web mail (shalom@...era.com)
[SECURITY] [DSA 737-1] New clamav packages fix potential DOS (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 739-1] New trac package fixes upload/download vulnerability (joey@...odrom.org (Martin Schulze))
[ GLSA 200507-06 ] TikiWiki: Arbitrary command execution through XML-RPC (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)

July 7 (26 messages)

eRoom Multiple Security Issues (c0ntexb@...il.com)
Re: ekg insecure temporary file creation and arbitrary code execution (Adam Wysocki <gophi@...oh.org>)
eRoom Multiple Security Issues (c0ntexb@...il.com)
Re: McAfee Intrushield IPS Abuse (shs_bulldog@...mail.com)
Re: PHPXMAIL - Authentication Bypass (security@...efoot.com)
Re: /dev/random is probably not ("Michael Gnau" <MGnau@....pcusa.org>)
Re: Microsoft Word Protection Bypass (Dave.Collins@...ratech.com)
MDKSA-2005:112 - Updated zlib packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Re: Re: Microsoft Word Protection Bypass (dan@...icalhosting.co.uk)
phpSlash account hijacking vulnerability ("tobozo" <tobozo@...chat.org>)
Problems with the Oracle Critical Patch Update for April 2005 ("David Litchfield" <davidl@...software.com>)
ICMP vulnerabilities (Theo de Raadt <deraadt@....openbsd.org>)
RE: Microsoft Word Protection Bypass ("Christian King" <cking@...curi.com>)
Vulnerability in Whatpulse.Org profiles allows XSS and session hijacking (rift13@...rter.net)
RE: Microsoft Word Protection Bypass ("Walter Wickersham" <wwickersham@...ntinc.com>)
PNGƒJƒEƒ“ƒ^+—pƒƒO‰ƒXƒNƒŠƒvƒg remote commands execution vulnera… (blahplok@...oo.com)
SimplePHPBlog 0.4.0 <= Remote Password Disclosure (pjphem@...ox.it)
Multiple vulnerabilities in Lantronix SLC console server (spam@...etter.org)
Re: ICMP vulnerabilities ("J. Oquendo" <root@...iltrated.net>)
Re: phpSlash account hijacking vulnerability (tobozo@...chat.org)
[OpenPKG-SA-2005.013] OpenPKG Security Advisory (zlib) (OpenPKG <openpkg@...npkg.org>)
NULL sessions vulnerabilities using alternate named pipes (Jean-Baptiste Marchand <Jean-Baptiste.Marchand@....fr>)
Re: Re: McAfee Intrushield IPS Abuse (c0ntexb@...il.com)
[SECURITY] [DSA 741-1] New bzip2 packages prevent decompression bomb (joey@...odrom.org (Martin Schulze))
UPDATE: [ GLSA 200506-20 ] Cacti: Several vulnerabilities (Thierry Carrez <koon@...too.org>)
[Bday release] Comersus shopping cart has multiple Sql injection and Cross Site Scripting vulnerabilities (dcrab@...kerscenter.com)

July 8 (26 messages)

Advisory 08/2005: PunBB SQL Injection Vulnerability (Stefan Esser <sesser@...dened-php.net>)
Advisory 09/2005: PunBB arbitrary PHP code inclusion vulnerability (Stefan Esser <sesser@...dened-php.net>)
Re: [USN-147-1] PHP XMLRPC vulnerability (Jan Schneider <jan@...de.org>)
Re: Re: [USN-147-1] PHP XMLRPC vulnerability (Jan Schneider <jan@...de.org>)
Re: Re: [USN-147-1] PHP XMLRPC vulnerability (Matt Zimmerman <mdz@...onical.com>)
Re: Re: [USN-147-1] PHP XMLRPC vulnerability (Matt Zimmerman <mdz@...onical.com>)
SUSE Security Announcement: php/pear XML RPC remote code execution (SUSE-SA:2005:041) (Marcus Meissner <meissner@...e.de>)
[SECURITY] [DSA 744-1] New fuse packages fix information disclosure (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 743-1] New ht packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
TSLSA-2005-0034 - multi (Trustix Security Advisor <tsl@...stix.org>)
SiteMinder Multiple Vulnerabilities (c0ntexb@...il.com)
Fwd: [VOIPSEC] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages (gary madsen <gmads.seclists@...il.com>)
Security Advisory for Bugzilla 2.18.1 and 2.19.3 (mkanat@...zilla.org)
[SECURITY] [DSA 735-2] New sudo packages fix pathname validation race (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 736-2] New spamassassin packages fix potential DOS (Michael Stone <mstone@...cker.debian.org>)
Re: ICMP Vulnerabilities (Dragos Ruiu <dr@....net>)
ToorCon 2005 Call for Papers ("h1kari@...rcon.org" <h1kari@...rcon.org>)
[SECURITY] [DSA 742-1] New cvs packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
RE: /dev/random is probably not ("David Schwartz" <davids@...master.com>)
USENIX Security Symposium, July 31, Baltimore, Maryland, USA (Peter Mui <pmui@...nix.org>)
Re: ICMP vulnerabilities (Bob Beck <beck@...h.cns.ualberta.ca>)
Re: /dev/random is probably not (Kai Howells <kai.howells@...rp.com.au>)
Vocera IP Phones (Holden Caulfield <skypotato@...il.com>)
WindowsUpdate sending unsigned ActiveX ? (Nestor Burma <goudron_et_plumes@...oo.fr>)
Re: /dev/random is probably not (fwd) (Bencsath Boldizsar <boldi@...l2005.etl.hu>)
Re: /dev/random is probably not (Stefan Bethke <s.bethke@...lence.com>)

July 9 (16 messages)

A comment on using CPU resources (Gandalf The White <gandalf@...ital.net>)
RE: [VOIPSEC] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages ("Walton, John Michael (John)" <jmwalton@...ya.com>)
Re: ICMP Vulnerabilities (Joachim Schipper <j.schipper@...h.uu.nl>)
Re: A comment on using CPU resources (Jeroen van Rijn <xananda@...il.com>)
Re: A comment on using CPU resources ("Security" <security@...tainedhits.com>)
A comment on using CPU resources, addendum. (Jeroen van Rijn <xananda@...il.com>)
Re: A comment on using CPU resources (Andreas Bartelt <bugtraq@...tula.de>)
RE: A comment on using CPU resources ("Joseph Finley" <jfinley@...urium.net>)
Re: A comment on using CPU resources (Raghu Chinthoju <raghu.chinthoju@...il.com>)
RE: A comment on using CPU resources (Martin Konold <konold@...rakon.de>)
RE: A comment on using CPU resources ("Scott Marburger" <s_marburger@....org>)
Re: Re: A comment on using CPU resources (securityfocus@...icwebdesign.co.uk)
Re: A comment on using CPU resources ("Joachim Schipper" <j.schipper@...h.uu.nl>)
Re: A comment on using CPU resources (Christian <evil@...ouse.de>)
Re: A comment on using CPU resources (Steven Champeon <schampeo@...keth.com>)
Re: A comment on using CPU resources (Steven Champeon <schampeo@...keth.com>)

July 10 (7 messages)

[ GLSA 200507-07 ] phpWebSite: Multiple vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
[ GLSA 200507-08 ] phpGroupWare, eGroupWare: PHP script injection vulnerability (Matthias Geerdsen <vorlon@...too.org>)
[FLSA-2005:155505] Updated php packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:154991] Updated sharutils package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152908] Updated gftp package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152895] Updated mailman package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152835] Updated dhcp package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)

July 11 (15 messages)

[ Suresec Advisories ] - Linux kernel ia32 compatibility (ia64/x86-64) race condition (Suresec Advisories <advisories@...esec.org>)
Re: [ Suresec Advisories ] - Linux kernel ia32 compatibility (ia64/x86-64) race condition (Juergen Schmidt <ju@...sec.de>)
[ GLSA 200507-09 ] Adobe Acrobat Reader: Buffer overflow vulnerability (Matthias Geerdsen <vorlon@...too.org>)
[ GLSA 200507-10 ] Ruby: Arbitrary command execution through XML-RPC (Thierry Carrez <koon@...too.org>)
[SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 748-1] New ruby1.8 packages fix arbitrary command execution (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 750-1] New dhcpcd packages fix denial of service (joey@...odrom.org (Martin Schulze))
McAfee Intrushield IPS Abuse Update is available (AsTriXs <astrixs@...il.com>)
Bug Hosting Controller New (v6.1 - Hotfix 2.1) (kehieuhoc@...oo.com)
[SECURITY] [DSA 749-1] New ettercap packages fix arbitrary code execution (Michael Stone <mstone@...cker.debian.org>)
[SECURITY] [DSA 745-1] New drupal package fixes multiple vulnerabilities (Michael Stone <mstone@...cker.debian.org>)
WASC-Articles: 'DOM Based Cross Site Scripting or XSS of the Third Kind: A look at an overlooked flavor of XSS' (contact@...appsec.org)
blogtorrent remote/local user password disclosure (Emanuele Gentili <emanuele@...ietolug.org>)
Re: SiteMinder Multiple Vulnerabilities (Tero Hänninen <tero@...abyte.net>)
[SECURITY] [DSA 752-1] New gzip packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))

July 12 (19 messages)

[FLSA-2005:152583] Updated telnet packages fix security issues (fedora-legacy-announce@...hat.com)
[FLSA-2005:123014] Updated openssh packages fix a security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Re: Problems with the Oracle Critical Patch Update for April 2005 (Cesar <cesarc56@...oo.com>)
ASP.NET RCP/Encoded Web service DOS ("SPI Labs" <spilabs@...dynamics.com>)
Re: XSS in nested tag in phpbb 2.0.16 (Paul Laudanski <zx@...tlecops.com>)
iDEFENSE Security Advisory 07.12.05: Microsoft Word 2000 and Word 2002 Font Parsing Buffer Overflow Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)
Detecting vulnerable zlib versions (CAN-2005-2096) (Florian Weimer <fw@...eb.enyo.de>)
Advisory 10/2005: Yawp/YaWiki Remote URL Include Vulnerability (Stefan Esser <sesser@...dened-php.net>)
[ GLSA 200507-11 ] MIT Kerberos 5: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
MA[2005-0712b] - 'Nokia Affix Bluetooth btsrv/btobex poor use of system()' ("KF (lists)" <kf_lists@...italmunition.com>)
MITKRB5-SA-2005-003: double-free in krb5_recvauth (Tom Yu <tlyu@....EDU>)
SoftiaCom MailServer - Local Password Disclosure Vulnerability (unsecure@...teme.com)
[SECURITY] [DSA 753-1] New gedit packages fix denial of service (joey@...odrom.org (Martin Schulze))
Cisco Security Advisory: Cisco CallManager Memory Handling Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: a new sql injection for aspjar guestbook (security curmudgeon <jericho@...rition.org>)
Re: Problems with the Oracle Critical Patch Update for April 2005 ("David Litchfield" <davidl@...software.com>)
MDKSA-2005:116 - Updated cpio packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:115 - Updated mplayer packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:114 - Updated leafnode packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)

July 13 (29 messages)

MDKSA-2005:113 - Updated clamav packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Possible security issue with FreeBSD 5.4 jailing and BPF (ronvdaal <ronvdaal@...athustra.linux666.com>)
[FLSA-2005:152777] Updated ImageMagick packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Metasploit exploit for PHP XMLRPC (comsatcat <comsatcat@...thlink.net>)
Multiple High Risk Vulnerabilities in Oracle E-Business Suite 11i - Critical Patch Update July 2005 ("Integrigy Security" <alerts@...egrigy.com>)
PacSec/core05 Call For Papers (Dragos Ruiu <dr@....net>)
DMA[2005-0712a] - 'Nokia Affix Bluetooth btftp client buffer overflow' ("KF (lists)" <kf_lists@...italmunition.com>)
Re: /dev/random is probably not (Francesco Messineo <frank@...s.ccii.unipi.it>)
Re: MITKRB5-SA-2005-003: double-free in krb5_recvauth (Tom Yu <tlyu@....EDU>)
Dragonfly Shopping Cart Multiple vulnerabilities (dcrab@...kerscenter.com)
Full Disclosure - XMLRPC Exploit Code written in Python jul 2005 (Anonymous@...nymous.com)
MITKRB5-SA-2005-002: buffer overflow, heap corruption in KDC (Tom Yu <tlyu@....EDU>)
SoftiaCom MailServer v2.0 - Denial Of Service (unsecure@...teme.com)
APPLE Darwin Streaming Server Web Admin Remote Denial of Serivce ("Sowhat ." <smaillist@...il.com>)
CORE-2005-0629: MailEnable Buffer Overflow Vulnerability (Core Security Technologies Advisories <advisories@...esecurity.com>)
[SECURITY] [DSA 755-1] New tiff packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 754-1] New centericq packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))
Cisco Security Advisory: Cisco ONS 15216 OADM Telnet Denial-of-Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
MDKSA-2005:118 - Updated ruby packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:117 - Updated dhcpcd packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
Cisco Security Advisory:Cisco Security Agent Vulnerable to Crafted IP attack (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SM-ANNOUNCE] SquirrelMail 1.4.5 Released (Jonathan Angliss <jon@...irrelmail.org>)
Endless loop in NetPanzer 0.8 (Luigi Auriemma <aluigi@...istici.org>)
[ GLSA 200507-12 ] Bugzilla: Unauthorized access and information disclosure (Thierry Carrez <koon@...too.org>)
[SECURITY] [DSA 756-1] New squirrelmail packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
WPS Web-Portal-System v.0.7.0 (wps_shop.cgi) remote commands execution vulnerability (blahplok@...oo.com)
PHPsFTPd - Admin password leak (Steve <steve01@...llo.at>)
Advisory: Oracle JDeveloper passes Plaintext Password (ak@...-database-security.com)
Advisory: Oracle JDeveloper Plaintext Passwords (ak@...-database-security.com)

July 14 (16 messages)

Re: Microsoft Word Protection Bypass (Johan De Meersman <jdm@...ramail.com>)
Advisory: Oracle Forms Insecure Temporary File Handling (ak@...-database-security.com)
Advisory: Oracle Forms Builder Password in Temp Files (ak@...-database-security.com)
Path Disclosure and XSS problem in PHP Counter 7.2 ("priestmaster" <priest@...estmaster.org>)
[ GLSA 200507-13 ] pam_ldap and nss_ldap: Plain text authentication leak (Thierry Carrez <koon@...too.org>)
Re: ICMP Security Vulnerabilities - NEW (cough) (Fernando Gont <fernando@....utn.edu.ar>)
YaBBSe 1.5.5c Path disclosure problem ("priestmaster" <priest@...estmaster.org>)
1st European Conference on Computer Network Defence (EC2ND) ("Blyth A J C (Comp)" <ajcblyth@...m.ac.uk>)
TSLSA-2005-0036 - multi (Trustix Security Advisor <tsl@...stix.org>)
[SM-ANNOUNCE] Patch available for CAN-2005-2095 (Jonathan Angliss <jon@...irrelmail.org>)
SquirrelMail Arbitrary Variable Overwriting Vulnerability (GulfTech Security Research <security@...ftech.org>)
05_07_14-bitdefender_malicious_content_bypass ("Alexander Hagenah" <webmaster@...mepage.de>)
XSS in forums Simple Message Board Version 2.0 Beta 1 (stormhacker@...mail.com)
[SECURITY] [DSA 746-1] New packages fix remote command execution in phpgroupware (Michael Stone <mstone@...cker.debian.org>)
Re: blogtorrent remote/local user password disclosure (trashtrash@...e.fr)
iDEFENSE Security Advisory 07.14.05: Sophos Anti-Virus Zip File Handling DoS Vulnerability ("iDEFENSE Labs" <labs-no-reply@...fense.com>)

July 15 (26 messages)

MDKSA-2005:120 - Updated mozilla-firefox packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:119 - Updated krb5 packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
[ GLSA 200507-14 ] Mozilla Firefox: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
Multiple ZeroLen Attachments ("{tonyFelice}" <tony@...ckcomm.com>)
Rooting Linux with a floppy (Sumy <sanandres@...il.com>)
Re: Rooting Linux with a floppy ("Kurt Seifried" <listuser@...fried.org>)
Re: Rooting Linux with a floppy (sec-list@...og.org)
RE: Rooting Linux with a floppy ("Lauro, John" <jlauro@...lint.edu>)
Re: Multiple ZeroLen Attachments ("Jerome Athias" <jerome.athias@...e.fr>)
Re: Rooting Linux with a floppy (Dan Becker <geggam@...il.com>)
[ GLSA 200507-15 ] PHP: Script injection through XML-RPC (Thierry Carrez <koon@...too.org>)
several vulnerabilities present in Belkin wireless routers (m123303@...urityfocus.com, "[at]"@securityfocus.com, richmond.ac.uk@...urityfocus.com)
On classifying attacks (Derek Martin <code@...zashack.org>)
RE: Rooting Linux with a floppy (James Longstreet <jlongs2@....edu>)
RE: On classifying attacks ("Bryan McAninch" <bryan@...ninch.org>)
Silently fixed security bugs in Oracle Critical Patch Update July 2005 (ak@...-database-security.com)
Compromising pictures of Microsoft Internet Explorer! (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: several vulnerabilities present in Belkin wireless routers (Steve Kemp <steve@...ve.org.uk>)
LSS Security Advisory: Winamp remote buffer overflow vulnerability (Leon Juranic <ljuranic@....hr>)
Why Vulnerability Databases can't do everything ("Steven M. Christey" <coley@...re.org>)
[ GLSA 200507-16 ] dhcpcd: Denial of Service vulnerability (Thierry Carrez <koon@...too.org>)
AW: Silently fixed security bugs in Oracle Critical Patch Update July 2005 ("Kornbrust, Alexander" <ak@...-database-security.com>)
Re: Compromising pictures of Microsoft Internet Explorer! (Steve Kemp <steve@...ve.org.uk>)
Stack-Based Buffer Overflow in Sybase EAServer 4.2.5 to 5.2 ("SPI Labs" <spilabs@...dynamics.com>)
Re: Silently fixed security bugs in Oracle Critical Patch Update July 2005 ("David Litchfield" <davidl@...software.com>)
Any info on potential 0day RDP vuln? ("Mark" <bugtraq@...bapps.com>)

July 16 (20 messages)

[FLSA-2005:152917] Updated curl packages fix a security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152891] Updated cpio package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152874] Updated samba packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152841] Updated openssl packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152838] Updated gd packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:154272] Updated gdk-pixbuf packages fix a security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:158149] Updated mozilla packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152925] Updated mysql packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152769] Updated kdelibs/kdebase packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
RE: Why Vulnerability Databases can't do everything (<aaron_kempf@...mail.com>)
[FLSA-2005:152900] Updated squirrelmail package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152844] Updated PostgreSQL packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Re: Why Vulnerability Databases can't do everything ("Jason Coombs" <jasonc@...ence.org>)
Re: Why Vulnerability Databases can't do everything ("J.A. Terranson" <measl@....org>)
Re: Rooting Linux with a floppy (als@...ngorodrim.de)
Internet Explorer / MSN ICC Profiles Crash PoC Exploit (edward11@...tmaster.co.uk)
Solaris Runtime Linker - Exploit Detection (petefran@...il.com)
RE: Any info on potential 0day RDP vuln? ("Altheide, Cory B. (IARC)" <AltheideC@...doe.gov>)
Re: On classifying attacks (Derek Martin <code@...zashack.org>)
Installation of software, and security. . . (John Richard Moser <nigelenki@...cast.net>)

July 17 (13 messages)

[HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch (zinho@...kerscenter.com)
Re: On classifying attacks (Indigo Haze <hazer@...pshot.net>)
Re: On classifying attacks (James Longstreet <jlongs2@....edu>)
Re: RE: Why Vulnerability Databases can't do everything (security curmudgeon <jericho@...rition.org>)
Re: [Full-disclosure] Why Vulnerability Databases can't do everything (Joel Maslak <jmaslak@...elope.net>)
Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch (augustusx00@...il.com)
PowerDNS 2.9.18 fixes two security issues affecting users of LDAP backend or limited recursion (bert.hubert@...herlabs.nl)
Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch ("milw0rm Inc." <milw0rm@...il.com>)
[ZH2005-16SA] Insecure temporary file creation in Skype for Linux (badpenguin@...e-h.org)
Re: several vulnerabilities present in Belkin wireless routers (Ian Clelland <ian@...yfresh.com>)
Re: several vulnerabilities present in Belkin wireless routers ("nicolas.ruff@...il.com" <nicolas.ruff@...il.com>)
[gentoo-announce] [ GLSA 200503-16 ] Ethereal: Multiple vulnerabilities (Luke Macken <lewk@...too.org>)
[gentoo-announce] [ GLSA 200503-13 ] mlterm: Integer overflow vulnerability (Luke Macken <lewk@...too.org>)

July 18 (17 messages)

Shorewall MACLIST Problem (Patrick Blitz <blitz@...t891.org>)
Re: Rooting Linux with a floppy (sec-list@...og.org)
[ GLSA 200507-17 ] Mozilla Thunderbird: Multiple vulnerabilities (Thierry Carrez <koon@...too.org>)
[KDE Security Advisory]: Kate backup file permission leak (Dirk Mueller <mueller@....org>)
RE: RE: Why Vulnerability Databases can't do everything (<aaron_kempf@...mail.com>)
Broadcast format string and buffer-overflow in Race Driver 1.20 (Luigi Auriemma <aluigi@...istici.org>)
[SECURITY] [DSA 758-1] New heimdal packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: Compromising pictures of Microsoft Internet Explorer! ("Stefan Kelm" <stefan.kelm@...orvo.de>)
Re: several vulnerabilities present in Belkin wireless routers (ian.latter@...nightcode.org)
HPSBTU01210 SSRT4743, SSRT4884 rev.0 - HP Tru64 UNIX TCP/IP remote Denial of Service (DoS) (Security Alert <secure@...hs.cup.hp.com>)
[SECURITY] [DSA 760-1] New ekg packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 759-1] New phppgadmin packages fix directory traversal vulnerability (joey@...odrom.org (Martin Schulze))
Re: On classifying attacks (Godwin Stewart <gstewart@...mcop.net>)
NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
Re: VoIP-Phones: Weakness in proccessing SIP-Notify-Messages (Javor Ninov <drfrancky@...urax.org>)
MRV In-Reach console server: Port Access Control Bypass Vulnerability (spam@...etter.org)
Re: Installation of software, and security. . . (John Richard Moser <nigelenki@...cast.net>)

July 19 (36 messages)

[SECURITY] [DSA 757-1] New krb5 packages fix multiple vulnerabilities (Michael Stone <mstone@...cker.debian.org>)
Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch (GulfTech Security Research <security@...ftech.org>)
Re: On classifying attacks (James Longstreet <jlongs2@....edu>)
Re: On classifying attacks ("Steven M. Christey" <coley@...re.org>)
Re: On classifying attacks (Mihai Amarandei-Stavila <mihaia@...il.com>)
Anonymous Anonymity - Request For Comments (Gandalf The White <gandalf@...ital.net>)
Re: Installation of software, and security. . . (Klaus Schwenk <zooloo_0@....de>)
Re: On classifying attacks (Crispin Cowan <crispin@...ell.com>)
Anonymous Web Attacks via Dedicated Mobile Services (Petko Petkov <ppetkov@...citizen.org>)
[ISR] - Novell Groupwise WebAccess Cross-Site Scripting (Francisco Amato <famato@...obyte.com.ar>)
MDKSA-2005:121 - Updated nss_ldap/pam_ldap packages fix vulnerabilities (Mandriva Security Team <security@...driva.com>)
[SECURITY] [DSA 761-1] New heartbeat packages fix insecure temporary files (joey@...odrom.org (Martin Schulze))
Re: Anonymous Anonymity - Request For Comments (Craig Skelton <cskelton@...il.com>)
[SECURITY] [DSA 762-1] New affix packages fix arbitrary command and code execution (joey@...odrom.org (Martin Schulze))
Re: Installation of software, and security. . . (Tim Nelson <tim.nelson@...alive.biz>)
HPSBUX01137 SSRT5954 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS) (Security Alert <secure@...hs.cup.hp.com>)
Re: Anonymous Web Attacks via Dedicated MobileServices ("Morning Wood" <se_cur_ity@...mail.com>)
Re: Internet Explorer / MSN ICC Profiles Crash PoC Exploit (mark.handy@...ganstanley.com)
Re: Installation of software, and security. . . (Tino Wildenhain <tino@...denhain.de>)
HPSBUX01164 SSRT4884 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS) (Security Alert <secure@...hs.cup.hp.com>)
Re: On classifying attacks (Adam Shostack <adam@...eport.org>)
Re: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: Installation of software, and security. . . (Kerry Thompson <bugtraq@...urity.geek.nz>)
Oracle Security Advisory: Overwrite any file via desname in Oracle Reports (ak@...-database-security.com)
Re: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
RE: Installation of software, and security. . . ("Burton Strauss" <Burton@...llNetSolutions.com>)
Mozilla cleartext credentials leak bug report to excuse myself (Re[2]: NTLM HTTP Authentication is insecure by design - a new… (3APA3A <3APA3A@...URITY.NNOV.RU>)
Re: On classifying attacks (Crispin Cowan <crispin@...ell.com>)
Re: Anonymous Anonymity - Request For Comments (gandalf@...ital.net)
Re: SiteMinder Multiple Vulnerabilities (solution) ("Williams, James K" <James.Williams@...com>)
Re: Installation of software, and security. . . (Jason Coombs <jasonc@...ence.org>)
Oracle Security Advisory: Run any OS Command via unauthorized Oracle Forms (ak@...-database-security.com)
Re: Installation of software, and security. . . (Matt Beaumont <mbeaumon@...hmc.edu>)
[TOOLS] CIRT.DK WebRoot Version v.1.7 ("CIRT.DK Advisory" <advisory@...t.dk>)
RE: Installation of software, and security. . . ("Burton Strauss" <Burton@...llNetSolutions.com>)
Re: On classifying attacks ("Dustin D. Trammell" <dtrammell@...adel.com>)

July 20 (19 messages)

Oracle Security Advisory: Read parts of any file via desformat in Oracle Reports (ak@...-database-security.com)
Update Your Bookmarks (Valentin Vorovenci <valentin@...o.us>)
(ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS)) (Fernando Gont <fernando@....utn.edu.ar>)
Re: Installation of software, and security. . . ("David F. Skoll" <dfs@...ringpenguin.com>)
Oracle Security Advisory: Read parts of any XML-file via customize parameter in Oracle Reports (ak@...-database-security.com)
Re: Installation of software, and security. . . (Alexander Klimov <alserkli@...ox.ru>)
Pointless discussion (was Re: Installation of software, and security. . .) ("David F. Skoll" <dfs@...ringpenguin.com>)
Oracle Security Advisory: Run any OS Command via unauthorized Oracle Reports (ak@...-database-security.com)
RE: On classifying attacks ("Black, Michael" <black@...exCorp.com>)
Oracle Security Advisory: Various Cross-Site-Scripting Vulnerabilities in Oracle Reports (ak@...-database-security.com)
Re: SiteMinder Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
[ GLSA 200507-18 ] MediaWiki: Cross-site scripting vulnerability (Thierry Carrez <koon@...too.org>)
PeanutHull Local Privilege Escalation Vulnerability ("Sowhat ." <smaillist@...il.com>)
Trivial BGP attacks (ICMP-based blind throughput-reduction attack) (Fernando Gont <fernando@....utn.edu.ar>)
ICMP-based blind performance-degrading attack (Fernando Gont <fernando@....utn.edu.ar>)
Multiple Vulnerabilities in PHP Surveyor (thegreatone2176@...oo.com)
PatchAdvisor Vulnerability Alert - Cisco CallManager Remote Denial of Service Vulnerability (vames@...chadvisor.com)
PHPNews SQL injection vulnerability (ghc@....ru)
[Fwd: phpBB 2.0.17 released] ("Christian Boenning" <security@...loren-im.net>)

July 21 (35 messages)

Anonymous Web Attacks via Dedicated Mobile Services (Petko Petkov <ppetkov@...citizen.org>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4 (Fernando Gont <fernando@....utn.edu.ar>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4 (Darren Reed <avalon@...igula.anu.edu.au>)
Re: ICMP-based blind performance-degrading attack (Fernando Gont <fernando@....utn.edu.ar>)
FreeBSD Security Advisory FreeBSD-SA-05:17.devfs (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: UPB: Discussion Board/Web-Site Takeover (rgod@...istici.org)
Re: ICMP-based blind performance-degrading attack (Darren Reed <avalon@...igula.anu.edu.au>)
Re: On classifying attacks (Technica Forensis <forensis.technica@...il.com>)
Re: Anonymous Anonymity - Request For Comments (S_Dorn/CIB@...KCIB.COM)
Re: Installation of software, and security. . . (John Richard Moser <nigelenki@...cast.net>)
[KDE Security Advisory] Multiple libgadu vulnerabilities (Dirk Mueller <mueller@....org>)
RE: Installation of software, and security. . . ("Burton Strauss" <Burton@...llNetSolutions.com>)
SQL Injection in Chinese ASP Webcounter (r_i_t_b_15@...oo.com)
Re: Re: several vulnerabilities present in Belkin wireless routers (steven.salaets@...driver.com)
RE: Installation of software, and security. . . (<Glenn.Everhart@...se.com>)
Re: Anonymous Anonymity - Request For Comments (Moritz Naumann <securityfocus.com@...itz-naumann.com>)
Re: Installation of software, and security. . . (Peter Keel <security@...erlink.ch>)
Re: Installation of software, and security. . . (joop gerritse <jjge@...all.nl>)
[USN-149-1] Firefox vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 (Darren Reed <avalon@...igula.anu.edu.au>)
[USN-150-1] KDE library vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-151-1] zlib vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-152-1] PAM/NSS LDAP vulnerabilitiy (Martin Pitt <martin.pitt@...onical.com>)
Arbitrary code execution in SlimFTPd v3.16 (Raphaël Rigo <ml-bugtraq@...light-hall.net>)
[SECURITY] [DSA 764-1] New cacti packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 (Casper.Dik@....COM)
Re: PHPNews SQL injection vulnerability (foster@....ru)
Re: ICMP-based blind performance-degrading attack (Darren Reed <avalon@...igula.anu.edu.au>)
[SECURITY] [DSA 763-1] New zlib packages fix buffer overflow (Michael Stone <mstone@...cker.debian.org>)
Peter Gutmann data deletion theaory? ("Jared Johnson" <jaredsjazz@...oo.com>)
MDKSA-2005:123 - Updated shorewall packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
Oracle and setting the record straight ("David Litchfield" <davidl@...software.com>)
MDKSA-2005:122 - Updated kdelibs packages fix vulnerability in kate and kwrite (Mandriva Security Team <security@...driva.com>)
Re: ICMP Security Vulnerabilities - NEW (cough) (Vic Vandal <vvandal@...l.com>)
RE: Peter Gutmann data deletion theaory? (Jeremy Epstein <jeremy.epstein@...methods.com>)

July 22 (23 messages)

RE: Peter Gutmann data deletion theaory? (<Glenn.Everhart@...se.com>)
Multiple vulnerabilities in libgadu and ekg package (Wojtek Kaniewski <wojtekka@...ygen.net>)
RE: Peter Gutmann data deletion theaory? ("Barbara Lockwood" <barbis@...lityit.net>)
Re: Peter Gutmann data deletion theaory? ("Jay D. Dyson" <jdyson@...achery.net>)
Mozilla XPCOM Library Race Condition (GulfTech Security Research <security@...ftech.org>)
ICMP-based blind connection-reset attack (Fernando Gont <fernando@....utn.edu.ar>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 (Fernando Gont <fernando@....utn.edu.ar>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 (Fernando Gont <fernando@....utn.edu.ar>)
[ GLSA 200507-19 ] zlib: Buffer overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 rev.4 - HP-UX TCP/IP Remote Denial of Service (DoS)) (Dennis Lubert <plasmahh@...ormatik.uni-brem…)
[ GLSA 200507-20 ] Shorewall: Security policy bypass (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Re: Peter Gutmann data deletion theaory? (Simple Nomad <thegnome@...c.org>)
Re: Re: [HSC Security Group] Invision PowerBoard 1.3.x - 2-x Exploit and Patch (h4cky0u@...urityfocus.com, "[at]"@securityfocus.com, gmail@...urityfocus.c…)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 (Darren Reed <avalon@...igula.anu.edu.au>)
Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954 (Dana Hudes <dhudes@...es.org>)
[USN-151-2] zlib vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
RE: Peter Gutmann data deletion theaory? ("D. Weiss" <David@...dgw.net>)
SlimFTPd Server: PoC Exploit (Dim K0r0l <dim@...lytez.com>)
Advisory 11/2005: Multiple vulnerabilities in Contrexx (Christopher Kunz <christopher.kunz@...dened-php.net>)
eBay phishing - phishers are getting better (John Gateley <gateley@...ver.com>)
RE: Peter Gutmann data deletion theaory? ("Tiago Halm" <thalm@...mail.com>)
Re: Peter Gutmann data deletion theaory? (Volker Tanger <vtlists@...e.de>)
Re: Oracle and setting the record straight (Adam Laurie <adam.laurie@...bunker.net>)

July 23 (15 messages)

Re: several vulnerabilities present in Belkin wireless routers (Roman Daszczyszak <romandas@...il.com>)
[PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released. (Alexander Anisimov <anisimov@...ecurity.com>)
[Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package (Cesar <cesarc56@...oo.com>)
Re: Peter Gutmann data deletion theaory? (Dana Hudes <dhudes@...-ip.info>)
Re: Peter Gutmann data deletion theaory? ("Vincent DUVERNET (Nolmë Informatique)" <vincent.duvernet@...me.com>)
Re: RE: Peter Gutmann data deletion theaory? (underwood-de@...mail.com)
RE: Peter Gutmann data deletion theaory? ("Earnhart, Benjamin J" <benjamin-earnhart@...wa.edu>)
RE: Peter Gutmann data deletion theaory? ("Jared Johnson" <jaredsjazz@...oo.com>)
Re: Peter Gutmann data deletion theaory? (Robin Whittle <rw@...stpr.com.au>)
Re: Peter Gutmann data deletion theaory? ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: Peter Gutmann data deletion theaory? ("Robert Thompson Jr." <rthompson@...umbiabank.com>)
User privilege escalation exploit. (sunos5.8@...mail.com)
Critical Patch Update April 2005 for Database 9.2 and 10.1 Update - Correction (unbelievable@...ch_me.com)
ICMP attacks against TCP: Conclusions (Fernando Gont <fernando@....utn.edu.ar>)
Strange and very small email - new virus (security-list@...ktrack.com)

July 24 (6 messages)

RE: Anonymous Web Attacks via DedicatedMobileServices ("Bojan Zdrnja" <Bojan.Zdrnja@....hr>)
MDKSA-2005:124 - Updated zlib packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
GoodTech SMTP server 5.16 RCPT TO command remote buffer overflow (Raphaël Rigo <ml-bugtraq@...light-hall.net>)
Realchat user impersonation - BSA 200506110001 (Andreas Beck <becka-list-bugtraq@...atec.de>)
[FLSA-2005:154276] Updated krb5 packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2005:152842] Updated lvm package fixes security issue (Marc Deslauriers <marcdeslauriers@...eotron.ca>)

July 25 (16 messages)

Re: Anonymous Web Attacks via DedicatedMobileServices (Petko Petkov <ppetkov@...citizen.org>)
ClamAV Multiple Rem0te Buffer Overflows (list@...0te.com)
Atomic Photo Album (APA) apa_phpinclude.inc.php remote file include (gr0up.pclabs@...il.com)
[Conectiva-updates] [CLA-2005:980] Conectiva Security Announcement - php4 (Conectiva Updates <secure@...ectiva.com.br>)
Arbitrary code execution in SlimFTPd v3.16 - Exploit (redsand@...sand.net)
PHP FirstPost remote file include vulnerability (gb.network@...il.com)
ECI router login bypass ("D ." <d.is.evil@...il.com>)
Chroot Security Group Advisory 2005-07-25 -- ftplocate (newbug@...urityfocus.com, "[at]"@securityfocus.com, chroot.org@...urityfocus.com)
Beehive Forum Multiple Vulnerabilities (thegreatone2176@...oo.com)
Corsaire Security Advisory: SAP Internet Graphics Server traversal issue (advisories <advisories@...saire.com>)
Siemens SANTIS 50 Authentication Vulnerability (luca.carettoni@...urenetwork.it)
[ GLSA 200507-21 ] fetchmail: Buffer Overflow (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200507-22 ] sandbox: Insecure temporary file handling (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[ GLSA 200507-23 ] Kopete: Vulnerability in included Gadu library (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[security bulletin] SSRT5954 rev.5 - HP-UX TCP/IP Remote Denial of Service (DoS) (security-alert@...com)
[security bulletin] SSRT4884 rev.5 - HP-UX TCP/IP Remote Denial of Service (DoS) (security-alert@...com)

July 26 (20 messages)

[USN-149-2] Fixed Firefox packages for USN-149-1 (Martin Pitt <martin.pitt@...onical.com>)
Denial of service vulnerability in FTPshell Server Version 3.38 (Reed Arvin <reedarvin@...il.com>)
SPIDynamics WebInspect Cross-Application Scripting (XAS) (3APA3A <3APA3A@...URITY.NNOV.RU>)
[USN-153-1] fetchmail vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Re: ClamAV Multiple Rem0te Buffer Overflows (nick <nick@...ilia.it>)
Re: Re: ClamAV Multiple Rem0te Buffer Overflows (Stelian Ene <stelian.ene@...adtech.com>)
[USN-154-1] vim vulnerability (Martin Pitt <martin.pitt@...onical.com>)
Ares FileShare 1.1 'Long Searched String' Buffer Overflow Vulnerability (kozan@...instructors.com)
fetchmail security announcement fetchmail-SA-2005-01 (Matthias Andree <ma+nomail@...e-technik.uni-dortmund.de>)
Vulnerability in IBM access (sylvain.roger@...ucom.fr)
[HSC Security Group] XSS in CartWiz (zinho@...kerscenter.com)
RE: ClamAV Multiple Rem0te Buffer Overflows ("Sec-Tec Lists" <zen31438@....co.uk>)
[ GLSA 200507-24 ] Mozilla Suite: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
Internet Explorer AJAX Bug (anakin@...5.pl)
Re: Local privilege escalation using runasp V3.5.1 (securityfocus.5.stele@...mgourmet.com)
Re: Re: Local privilege escalation using runasp V3.5.1 (securityfocus.5.stele@...mgourmet.com)
3Com launches vulnerability-buying program ("Ghaith Nasrawi" <libero@...egypt.edu>)
CYBSEC - Security Advisory: Default Configuration Information Disclosure in Lotus Domino (Leandro Meiners <lmeiners@...sec.com>)
[ GLSA 200507-25 ] Clam AntiVirus: Integer overflows (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-155-1] Mozilla vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)

July 27 (21 messages)

New Whitepaper "Software Misuse: from malicious actions to mind control" ("Andrey Bayora" <andrey@...urityelf.org>)
[ISR] - Novell GroupWise Client Remote Buffer Overflow (Francisco Amato <famato@...obyte.com.ar>)
[ GLSA 200507-26 ] GNU Gadu, CenterICQ, Kadu, EKG, libgadu: Remote code execution in Gadu library (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[NILESA-20050701] UnixWare 7.x RPC portmapper Dos Vulnerability ("Jonglim Yun" <abc@...l.nilesoft.co.kr>)
[SECURITY] [DSA 765-1] New heimdal packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
FreeBSD Security Advisory FreeBSD-SA-05:19.ipsec (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS (sylvain.roger@...ucom.fr)
Re: RE: Peter Gutmann data deletion theaory? (Ron van Daal <ronvdaal@....nl>)
Re: Peter Gutmann data deletion theaory? (Jake Appelbaum <jacob@...elbaum.net>)
Shared section vulnerability when opening microsoft office document resulting in DoS (sylvain.roger@...ucom.fr)
[SECURITY] [DSA 768-1] New phpbb2 packages fix cross-site scripting (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 767-1] New ekg packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: Peter Gutmann data deletion theaory? (Andreas Beck <becka-list-bugtraq@...atec.de>)
FreeBSD Security Advisory FreeBSD-SA-05:18.zlib (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
RE: SPIDynamics WebInspect Cross-ApplicationScripting (XAS) ("DAN MORRILL" <dan_20407@....com>)
RE: On classifying attacks ("Black, Michael" <black@...exCorp.com>)
Re: Peter Gutmann data deletion theaory? (Casper.Dik@....COM)
RE: Peter Gutmann data deletion theaory? ("Bret Morey" <bam159@....edu>)
Re: Getting round website authentication with Firefox ("Shalom Carmel" <shalom@...era.com>)
Re: Peter Gutmann data deletion theaory? ("Alexander L. Ivanchev" <alexander@...nchev.org>)
Spyware database lists (Paul Laudanski <zx@...tlecops.com>)

July 28 (33 messages)

Re: On classifying attacks (Crispin Cowan <crispin@...ell.com>)
[SECURITY] [DSA 766-1] New webcalendar package fixes information disclosure (joey@...odrom.org (Martin Schulze))
Getting round website authentication with Firefox (account.throw@...il.com)
Re: Peter Gutmann data deletion theaory? (devnull@...ents.Montreal.QC.CA)
Re: Peter Gutmann data deletion theaory? (Casper.Dik@....COM)
RE: Peter Gutmann data deletion theaory? ("dave kleiman" <dave@...cureu.com>)
Re: Peter Gutmann data deletion theaory? (Volker Kuhlmann <list0570@...adise.net.nz>)
UnixWare 7.1.4 UnixWare 7.1.3 UnixWare 7.1.1 : RPCBind updated to prevent remote Denial of Service attack (please_reply_to_security@....com)
[ GLSA 200507-27 ] Ethereal: Multiple vulnerabilities (Sune Kloppenborg Jeppesen <jaervosz@...too.org>)
[USN-149-3] Ubuntu 4.10 update for Firefox vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
HP OpenView Radia Management Agent remote command execution via directory traversal (NGSSoftware Insight Security Research <nisr@...tgenss.com>)
MDKSA-2005:125 - Updated clamav packages fix more vulnerabilities (Mandriva Security Team <security@...driva.com>)
[OpenPKG-SA-2005.014] OpenPKG Security Advisory (zlib) (OpenPKG <openpkg@...npkg.org>)
SUSE Security Announcement: zlib denial of service (SUSE-SA:2005:043) (Ludwig Nussel <ludwig.nussel@...e.de>)
GNU Mailutils imap4d v0.6 remote format string exploit (coki@...ystem.com.ar)
[OpenPKG-SA-2005.016] OpenPKG Security Advisory (fetchmail) (OpenPKG <openpkg@...npkg.org>)
HAURI live update. Arbitrary remote file download and execute vulnerability (saintlinu@...l2root.org)
Re: several vulnerabilities present in Belkin wireless routers ("E. Kellinis" <me@...her.org.uk>)
Re: Getting round website authentication with Firefox (Christopher Kunz <christopher.kunz@...dened-php.net>)
Re: 3Com launches vulnerability-buying program (Matt Palmer <mpalmer@...matt.org>)
uguestbook exploit (l--s@...mail.com)
Re: 3Com launches vulnerability-buying program (Paul Schmehl <pauls@...allas.edu>)
Re: RE: Peter Gutmann data deletion theaory? (Simple Nomad <thegnome@...c.org>)
Re: LSS Security Advisory: Winamp remote buffer overflow vulnerability (b0fnet@...oo.com)
[USN-155-2] Updated Epiphany packages to match Mozilla security update (Martin Pitt <martin.pitt@...onical.com>)
Re: Getting round website authentication with Firefox (Nate Smith <nate@...backrow.net>)
PhpList Sql Injection and Path Disclosure (thegreatone2176@...oo.com)
Re: PHP Code Snippet Library Multiple Cross-Site Scripting (XSS) Vulnerabilities (stuartc1@...urityfocus.com, hotmail@...urityfocus.com (at), com@...urityfocu…)
Re: Getting round website authentication with Firefox (James Tait <james.tait@...ddreams.org>)
Vulnerability in Linksys Router access (Nick Simicich <njs@...fi.squawk.com>)
Re: On classifying attacks (Crispin Cowan <crispin@...ell.com>)
Re: eBay phishing - phishers are getting better (Ivaylo Zashev <zashev@...il.com>)
Thomson Web Skill Vantage Manager (walter.sobchak@...hmail.com)

July 29 (17 messages)

Advisory 12/2005: UseBB Multiple Vulnerabilities (Stefan Esser <sesser@...dened-php.net>)
Re: several vulnerabilities present in Belkin wireless routers ("E. Kellinis" <me@...her.org.uk>)
[OpenPKG-SA-2005.015] OpenPKG Security Advisory (spamassassin) (OpenPKG <openpkg@...npkg.org>)
Cross Site Scripting vulnerabilities in GForge (Joxean Koret <joxeankoret@...oo.es>)
Re: Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS (sylvain.roger@...ucom.fr)
Re: eBay phishing - phishers are getting better (info@...urityfocus.com, "[at]"@securityfocus.com, orebla.it@...urityfocus.com)
Website Baker Project Multiple Vulnerabilities (thegreatone2176@...oo.com)
[FLSA-2005:163559] Updated php packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
nProtect solutions arbitrary file download and execute vulnerability (Park Gyutae <saintlinu@...oo.co.kr>)
[USN-156-1] TIFF vulnerability (Martin Pitt <martin.pitt@...onical.com>)
SPIDynamics WebInspect Cross-ApplicationScripting (XAS) (Security-Alert <security-alert@...dynamics.com>)
MDKSA-2005:126 - Updated fetchmail packages fix vulnerability (Mandriva Security Team <security@...driva.com>)
MDKSA-2005:127 - Updated mozilla-thunderbird packages fix multiple vulnerabilities (Mandriva Security Team <security@...driva.com>)
[SECURITY] [DSA 769-1] New gaim packages fix denial of service (joey@...odrom.org (Martin Schulze))
Cisco Security Advisory: IPv6 Crafted Packet Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re[2]: [Full-disclosure] SPIDynamics WebInspect Cross-ApplicationScripting (XAS) (3APA3A <3APA3A@...URITY.NNOV.RU>)
[SECURITY] [DSA 770-1] New gopher packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))

July 30 (12 messages)

Kshout Data Disclosure ("group@...lblack.com.ar" <group@...lblack.com.ar>)
RE: [VOIPSEC] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages ("Walton, John Michael (John)" <jmwalton@...ya.com>)
RE: [Full-disclosure] Anonymous Web Attacks via DedicatedMobileServices (Alexander Klimov <alserkli@...ox.ru>)
Kayako liveResponse Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
PC-EXPERIENCE/TOPPE CMS Security Advisory (rat@...ocmaffia.com)
Kent's Guestbook database exploit (l--s@...mail.com)
Tool release: Xprobe2 v0.3 (Ofir Arkin <bugtraq@...-security.com>)
Trillian Ver 3.1 saves password's in plain Text (Suramya Tomar <security@...amya.com>)
[HSC Security Group] SQL Injection in Product Cart 2.6 (zinho@...kerscenter.com)
RO CP root exploit (fjlj@....com)
[ GLSA 200507-28 ] AMD64 x86 emulation base libraries: Buffer overflow (Thierry Carrez <koon@...too.org>)
Undisclosed Sudo Vulnerability ? ("Esler, Joel - Contractor" <joel.esler@...rt-s.army.mil>)

July 31 (6 messages)

The Java applet sandbox and stateful firewalls (Florian Weimer <fw@...eb.enyo.de>)
Re: Undisclosed Sudo Vulnerability ? ("Kurt Seifried" <bt@...fried.org>)
Re: Undisclosed Sudo Vulnerability ? (babarr@...il.com)
Did you miss us yet? (Phrack Staff <phrackstaff@...il.com>)
Re: Undisclosed Sudo Vulnerability ? (Jim Clausing <jclausing@....sans.org>)
[ GLSA 200507-29 ] pstotext: Remote execution of arbitrary code (Stefan Cornelius <dercorny@...too.org>)

598 messages

Powered by blists - more mailing lists