bugtraq mailing list - 2007/06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 16	² 6	³
⁴ 28	⁵ 15	⁶ 17	⁷ 25	⁸ 10	⁹ 5	¹⁰
¹¹ 19	¹² 20	¹³ 12	¹⁴ 21	¹⁵ 11	¹⁶ 5	¹⁷
¹⁸ 18	¹⁹ 19	²⁰ 14	²¹ 16	²² 11	²³ 7	²⁴
²⁵ 29	²⁶ 13	²⁷ 16	²⁸ 13	²⁹ 7	³⁰ 2

Messages by day:

June 1 (16 messages)

Z-Blog 1.7 Authentication Bypass Database Download Vulnerability (Raed@...Mail.Com)
phpreactor <===1.2.7 remote file include ("pito pito" <the-modest-pirate@...mail.com>)
[OpenPKG-SA-2007.020] OpenPKG Security Advisory (php) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
SEC Consult SA-20070601-0 :: PHP chunk_split() integer overflow (Gerhard Wagner <research@...-consult.com>)
PBSite - PHP Bulletin Site | CMS ====> RFI ("pito pito" <the-modest-pirate@...mail.com>)
static XSS / SQL-Injection in Omegasoft Insel ("MC Iglo" <mc.iglo@...glemail.com>)
Prototype of an PHP application ===> RFI ("pito pito" <the-modest-pirate@...mail.com>)
Full Path Disclosure in SendCard (xx_hack_xx_2004@...mail.com)
n.runs-SA-2007.013 - F-Secure Antivirus LZH parsing BufferOverflow Advisory (<security@...ns.com>)
bugtraq submission (dr.rezen@...il.com)
[MajorSecurity Advisory #49]Calimero.CMS - Session fixation Issue (admin@...orsecurity.de)
Outpost Enforcing system reboot with 'outpost_ipc_hdr' mutex Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
[MajorSecurity Advisory #50]chameleon cms - Session fixation Issue (admin@...orsecurity.de)
RevokeBB Blind SQL Injection / Hash Extractor (BlackHawk <hawkgotyou@...il.com>)
Evenzia CMS XSS (glafkos@...osec.org.uk)
[USN-468-1] Firefox vulnerabilities (Kees Cook <kees@...ntu.com>)

June 2 (6 messages)

jumping sudo using ptrace on Linux/i386 ("Trent Waddington" <trent.waddington@...il.com>)
Linker index.php - Cross-Site Scripting Vulnerability ("vagrant - e-hack.org" <kernel-32@...mail.com>)
MyEvent1.6 (template.php) Remote File Inclusion Vulnerability (yaser@...cturk.net)
iDefense Security Advisory 06.01.07: Symantec VERITAS Storage Foundation Administration Service DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
PBSite - PHP Bulletin Site | CMS ====> RFI ("pito pito" <the-modest-pirate@...mail.com>)
Re: MyEvent1.6 (template.php) Remote File Inclusion Vulnerability (str0ke <str0ke@...w0rm.com>)

June 4 (28 messages)

Comdev Web Blogger 4.1 RFI Vulnerability (johnnytalker@...mail.com)
Comdev eCommerce 4.1 RFI Vulnerability (johnnytalker@...mail.com)
BCS'07 Call For Papers ("Jim Geovedi" <jim.geovedi@...il.com>)
CACTUSHOP 6 Default Installation Allows Remote Database Disclosure (DoZ@...kersCenter.com)
S21Sec-035: F5 FirePass command execution vulnerability (S21sec Labs <labs@...sec.com>)
Assorted browser vulnerabilities (Michal Zalewski <lcamtuf@...ne.ids.pl>)
WebStudio Multiple XSS Vulnerabilities (glafkos@...il.com)
Re: Buffer overflow in BusinessMail email server system 4.60.00 (iant@...cplus.com)
Redlevel Advisory #025 - Vonage VoIP Telephone Adapter Default Misconfiguration (john@...tinelli.com)
2007-06-03: PeerCast streaming server submits cleartext password (mpeg@...eshells.ch)
Dansie Cart Script Exploit Reported (h0tturk@...turk.com)
CERN İmage Map Dispatcher (h0tturk@...turk.com)
Recent OpenSSL exploits ("Ryan's spam address" <lists@...thinkitweprintit.com>)
uTorrent overflow (Dj.r4iDeN@...il.com)
n.runs-SA-2007.014 - F-Secure Antivirus ARJ parsing Infinite Loop Advisory (<security@...ns.com>)
Re: Buffer overflow in BusinessMail email server system 4.60.00 (Steve Tornio <steve@...riol.net>)
n.runs-SA-2007.015 - F-Secure Antivirus FSG packed files parsing Infinite Loop Advisory (<security@...ns.com>)
My Datebook SQL Injection + XSS (ls@...ima.serapis.net)
[SECURITY] [DSA 1291-4] New samba packages fix regression (Moritz Muehlenhoff <jmm@...ian.org>)
Unpatched input validation flaw in Firefox 2.0.0.4 ("Thor Larholm" <larholm@...il.com>)
FLEA-2007-0024-1: libexif (Foresight Linux Essential Advisory Service <foresight-security-noreply@...esightlinux.org>)
SYM07-009,Symantec Storage Foundation for Windows Volume Manager: Authentication Bypass and Potential Code Execution in Scheduler Service (secure@...antec.com)
rPSA-2007-0114-1 mutt (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0115-1 libexif (rPath Update Announcements <announce-noreply@...th.com>)
RE: bugtraq submission ("Warner Moore" <wmoore@....com>)
Re: [PLESK 7.5 Reload] & [PLESK 7.6 for MS Windows] path passing and disclosure vulnerability (leo@...i.com)
Disinfectors for the calculator virus (ti89.Gaara) (Piotr Bania <bania.piotr@...il.com>)
[ MDKSA-2007:110 ] - Updated php-pear packages fix directory traversal vulnerability (security@...driva.com)

June 5 (15 messages)

[ MDKSA-2007:113 ] - Updated mutt packages fix vulnerabilities (security@...driva.com)
[ MDKSA-2007:115 ] - Updated clamav packages fix vulnerabilities (security@...driva.com)
[security bulletin] HPSBUX02217 SSRT071337 rev.2 - HP-UX running Kerberos, Remote Arbitrary Code Execution (security-alert@...com)
TPTI-07-08: Symantec Veritas Storage Foundation Scheduler Service Authentication Bypass Vulnerability (TSRT@...m.com)
[ MDKSA-2007:112 ] - Updated mplayer packages fix buffer overflow vulnerability (security@...driva.com)
[ MDKSA-2007:111 ] - Updated util-linux packages address login access policies bypassing issue (security@...driva.com)
TPTI-07-10: Centennial Software XferWan.exe Stack Overflow Vulnerability (TSRT@...m.com)
TPTI-07-09: Macrovision FLEXnet boisweb.dll ActiveX Control Buffer Overflow Vulnerability (TSRT@...m.com)
ZDI-07-035: CA Multiple Product AV Engine CAB Header Parsing Stack Overflow Vulnerability (zdi-disclosures@...m.com)
SYM07-012 Symantec Reporting Server elevation of privilege (secure@...antec.com)
ZDI-07-034: CA Multiple Product AV Engine CAB Filename Parsing Stack Overflow Vulnerability (zdi-disclosures@...m.com)
[ GLSA 200706-01 ] libexif: Integer overflow vulnerability (Raphael Marichez <falco@...too.org>)
[security bulletin] HPSBUX02218 SSRT071424 rev.1 - HP-UX running CIFS Server (Samba), Remote Arbitrary Code Execution (security-alert@...com)
Comicsense SQL Injection Advisory/Exploit (s0cratex@...mail.com)
SYM07-011 Symantec Reporting Server password disclosure (secure@...antec.com)

June 6 (17 messages)

[ MDKSA-2007:114 ] - Updated file packages fix vulnerabilities (security@...driva.com)
[ MDKSA-2007:116 ] - Updated libpng packages fix vulnerability (security@...driva.com)
Re: Dansie Cart Script Exploit Reported ("Steven M. Christey" <coley@...re.org>)
[ MDKSA-2007:117 ] - Updated lha packages fix unsafe temporary files creation issue (security@...driva.com)
[USN-469-1] Thunderbird vulnerabilities (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 06.05.07: Symantec Ghost Multiple Denial of Service Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
Announce - Release RFIDIOt ver 0.1n (June 2007) (Adam Laurie <adam.laurie@...bunker.net>)
ASP Folder Gallery Vulnerabilities (hack2prison@...oo.com)
Light Blog 4.1 XSS Vulnerability (ls@...ima.serapis.net)
FLEA-2007-0021-2: madwifi (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[ GLSA 200706-03 ] ELinks: User-assisted execution of arbitrary code (Raphael Marichez <falco@...too.org>)
IE 6/Microsoft Html Popup Window (mshtml.dll) DoS (no-reply@...samx.net)
Re: uTorrent overflow (Dj.r4iDeN@...il.com)
[ GLSA 200706-02 ] Evolution: User-assisted execution of arbitrary code (Raphael Marichez <falco@...too.org>)
IE 6 / MS Office Outlook Express Address Book Activex DoS (no-reply@...oo.com)
Remote log injection on DenyHosts, Fail2ban and BlockHosts ("Daniel Cid" <daniel.cid@...il.com>)
Re: uTorrent overflow (Jon Ribbens <jon+bugtraq2@...quivocal.co.uk>)

June 7 (25 messages)

Re: Sudo: local root compromise with krb5 enabled (Thor Lancelot Simon <tls@....tjls.com>)
RUS-CERT 2007-06:01 (1380): Insecure Defaults in A-L OmniPCX 7.0 (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
Hnkaray Duyuru Script Remote SQL İnjection (Dj_ReMix_20@...mail.com)
Re: uTorrent overflow (Andreas Beck <becka-list-bugtraq@...atec.de>)
CSIS Advisory: Microsoft GDI+ Integer division by zero flaw handling .ICO files ("Dennis Rand" <rand@...s.dk>)
Re: uTorrent overflow ("Gavin Hanover" <netmunky@...il.com>)
W1L3D4 WEBmarket Remote SQL İnjection (Dj_ReMix_20@...mail.com)
Re: uTorrent overflow ("Pavel Konov" <luaplevap@...il.com>)
Re: CSIS Advisory: Microsoft GDI+ Integer division by zero flaw handling .ICO files (H D Moore <sflist@...italoffense.net>)
MIT krb5: makes sudo authentication issue MUCH worse. (Thor Lancelot Simon <tls@....tjls.com>)
Atom PhotoBlog v1.0.9 XSS vulnerability (ls@...ima.serapis.net)
[CAID 35395, 35396]: CA Anti-Virus Engine CAB File Buffer Overflow Vulnerabilities ("Williams, James K" <James.Williams@...com>)
WmsCMS < = 2.0 Multiple XSS Vulnerabilities (glafkos@...osec.org.uk)
Sudo: local root compromise with krb5 enabled (Thor Lancelot Simon <tls@....tjls.com>)
Re: [MajorSecurity Advisory #50]chameleon cms - Session fixation Issue (admin@...orsecurity.de)
Re: Sudo: local root compromise with krb5 enabled (James Downs <egon@...n.cc>)
OWASP and WASC Cocktail party at Blackhat USA 2007 ("Anurag Agarwal" <anurag.agarwal@...oo.com>)
phpWebThings ==>1.5.2 RFI (titanichacker titanichacker <titanichacker@....com>)
[SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service (dann frazier <dannf@...ian.org>)
Re: Sudo: local root compromise with krb5 enabled ("Mark Senior" <senatorfrog@...il.com>)
Re: Sudo: local root compromise with krb5 enabled ("Todd C. Miller" <Todd.Miller@...rtesan.com>)
[SECURITY] [DSA 1300-1] New iceape packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Monkey CMS v0.0.3 Remote File Include Vulnerabilitiy (www@....cc)
Re: LuckyBot v3 Remote File Include (info@...asvd.nl)
Zen Help Desk ==> Version 2.1 Bypass/ (titanichacker titanichacker <titanichacker@....com>)

June 8 (10 messages)

PHPMyDesk Beta Release 1.0b ==> RFI (titanichacker titanichacker <titanichacker@....com>)
CSIS Advisory: BlueCoat K9 Web Protection 3.2.36 Overflow ("Dennis Rand" <rand@...s.dk>)
Second Call for Papers: DeepSec IDSC 2007 Europe/Vienna: 20-23 Nov 2007 ("Paul Böhm" <paul@...hm.org>)
Packeteer PacketShaper Web Management Denial of Service (nnposter@...closed.not)
rPSA-2007-0117-1 gd php php-mysql php-pgsql (rPath Update Announcements <announce-noreply@...th.com>)
Wordpress default theme XSS (admin) and other problems ("John Smith" <zamolx3@...il.com>)
[OpenPKG-SA-2007.021] OpenPKG Security Advisory (wordpress) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
TSLSA-2007-0020 - clamav (Trustix Security Advisor <tsl@...stix.org>)
iDefense Security Advisory 06.07.07: Linux Kernel cpuset tasks Information Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
EEYE: Yahoo Webcam ActiveX Controls Multiple Buffer Overflows ("eEye Advisories" <Advisories@...e.com>)

June 9 (5 messages)

[ MDKSA-2007:118 ] - Updated libexif packages fix crash and possible arbitrary code execution issue (security@...driva.com)
[USN-470-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
vSupport Integrated Ticket System 3.*.* SQL injection (stormhacker@...mail.com)
[SECURITY] [DSA 1301-1] New Gimp packages fix arbitrary code execution (Noah Meyerhans <noahm@...ian.org>)
myBloggie 2.1.5 Remote File Include (yaser@...cturk.net)

June 11 (19 messages)

Re: PHPMyDesk Beta Release 1.0b ==> RFI (the.tiger100@...il.com)
[SECURITY] [DSA 1302-1] New freetype packages fix integer overflow (Steve Kemp <skx@...ian.org>)
Re: myBloggie 2.1.5 Remote File Include (the.tiger100@...il.com)
Cisco Trust Agent Vulnerability (adblake@...oitte.co.uk)
Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service (3APA3A <3APA3A@...URITY.NNOV.RU>)
[SECURITY] [DSA 1303-1] New lighttpd packages fix denial of service (Steve Kemp <skx@...ian.org>)
Maran Blog XSS vulnerability (ls@...ima.serapis.net)
Serious holes affecting JFFNMS (Tim Brown <timb@...-dimension.org.uk>)
SpyBye 0.3 released (Niels Provos <provos@...i.umich.edu>)
WinPT User ID Spoofing Vulnerability (nnposter@...closed.not)
Webwiz vulnerable (spymaster@...kod.net)
[TOOL] w3af - Web Application Attack and Audit Framework ("Andres Riancho" <andres.riancho@...il.com>)
Project CERA Is Up Again : Secniche Initiative (Aditya K Sood <zeroknock@...niche.org>)
MLabs is Shifted Fully : SecNiche Initiative (Aditya K Sood <zeroknock@...niche.org>)
PHPMailer command execution (Thor Larholm <seclists@...holm.com>)
SECNICHE : Dwelling Security is On the Run (Aditya K Sood <zeroknock@...niche.org>)
[ GLSA 200706-04 ] MadWifi: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[USN-439-2] file vulnerability (Kees Cook <kees@...ntu.com>)
[USN-471-1] libexif vulnerability (Kees Cook <kees@...ntu.com>)

June 12 (20 messages)

[USN-472-1] libpng vulnerability (Kees Cook <kees@...ntu.com>)
[USN-473-1] libgd2 vulnerabilities (Kees Cook <kees@...ntu.com>)
RE: [Full-disclosure] Safari for Windows,0day URL protocol handler command injection ("Larry Seltzer" <Larry@...ryseltzer.com>)
Re: Sudo: local root compromise with krb5 enabled (Ken Raeburn <raeburn@....EDU>)
Safari for Windows, 0day URL protocol handler command injection (Thor Larholm <seclists@...holm.com>)
Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service (dann frazier <dannf@...nf.org>)
[SECURITY] [DSA 1306-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
PHP parse_str() arbitrary variable overwrite (gmdarkfig@...il.com)
ZDI-07-036: Arris Cadant C3 CMTS Remote DoS Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 1307-1] New OpenOffice.org packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[security bulletin] HPSBUX02219 SSRT061273 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)
Re: PHP parse_str() arbitrary variable overwrite (admin@...znet.com)
[ MDKSA-2007:119 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
Windows Oday release (Thomas Lim <thomas@...einc.com>)
[ MDKSA-2007:120 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
ZDI-07-037: Microsoft Internet Explorer Language Pack Installation Remote Code Execution Vulnerability (zdi-disclosures@...m.com)
ZDI-07-038: Microsoft Internet Explorer Prototype Dereference Code Execution Vulnerability (zdi-disclosures@...m.com)
Re: Windows Oday release (ge@...uxbox.org)
Menu Manager Mod for WebAPP - No Input Filtering (web-app@...mail.com)
iDefense Security Advisory 06.12.07: Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Acc… (iDefense Labs <labs-no-reply@...fense.c…)

June 13 (12 messages)

[USN-474-1] xscreensaver vulnerability (Kees Cook <kees@...ntu.com>)
Re: PHP parse_str() arbitrary variable overwrite ("Steven M. Christey" <coley@...re.org>)
Apple Safari: cookie stealing (Robert Swiecki <jagger@...ecki.net>)
Re: Windows Oday release (Joanna Rutkowska <joanna@...isiblethings.org>)
Re: Re: PHP parse_str() arbitrary variable overwrite (gmdarkfig@...il.com)
Re: [Full-disclosure] Apple Safari: cookie stealing (Michal Zalewski <lcamtuf@...ne.ids.pl>)
iDefense Security Advisory 06.13.07: Multiple Vendor libexif Integer Overflow Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Windows Oday release ("Steven M. Christey" <coley@...us.mitre.org>)
High risk vulnerability in OpenOffice RTF parser ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Re: PHP parse_str() arbitrary variable overwrite (Chuck Swiger <cswiger@....com>)
[SECURITY] [DSA 1305-1] New icedove packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
FLEA-2007-0025-1: openoffice.org (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)

June 14 (21 messages)

[ MDKSA-2007:123 ] - Updated libwmf packages fix vulnerability (security@...driva.com)
Singapore Gallery fullpath disclosure (hack2prison@...oo.com)
[ MDKSA-2007:122 ] - Updated gd packages fix vulnerability (security@...driva.com)
Re: Sudo: local root compromise with krb5 enabled (Kyle Wheeler <kyle-bugtraq@...oryhole.net>)
rPSA-2007-0119-1 spamassassin (rPath Update Announcements <announce-noreply@...th.com>)
[ MDKSA-2007:124 ] - Updated tetex packages fix vulnerability (security@...driva.com)
[CVE-2007-2450]: Apache Tomcat XSS vulnerability in Manager (Mark Thomas <markt@...che.org>)
[ MDKSA-2007:121 ] - Updated freetype2 packages fix integer overflow vulnerability (security@...driva.com)
Re: Re: BlackBoard Multiple Vulnerabilities (XSS) (anonymous@...kermail.com)
[CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples (Mark Thomas <markt@...che.org>)
[SECURITY] [DSA 1308-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
iDefense Security Advisory 06.14.07: Apache MyFaces Tomahawk JSF Framework Cross-Site Scripting (XSS) Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Elxis CMS <= 2006.4 - banner module - sql injection (Nico Leidecker <nicoLeidecker@....de>)
Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability (accounting@...city.com)
ByPass In PortalApp (Raed@...Mail.Com)
RFI In Script SH-News 3.1 (Raed@...Mail.Com)
Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability ("John M. Martinelli" <john@...tinelli.com>)
Re: Windows Oday release (ge@...uxbox.org)
[ MDKSA-2007:125 ] - Updated spamassassin packages fix possible DoS condition (security@...driva.com)
Re: [Full-disclosure] Windows Oday release (Jared DeMott <demottja@....edu>)
Re: [MajorSecurity Advisory #47]Simple Machines Forum (SMF) - Session fixation Issue (nobody@...ain.com)

June 15 (11 messages)

Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing (Robert Swiecki <jagger@...ecki.net>)
Kaspersky Multiple insufficient argument validation of hooked SSDT function Vulnerability (Matousec - Transparent security Research <research@...ousec.com>)
rPSA-2007-0123-1 squirrelmail (rPath Update Announcements <announce-noreply@...th.com>)
Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing ("Mark Senior" <senatorfrog@...il.com>)
rPSA-2007-0124-1 kernel xen (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0126-1 util-linux (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0122-1 evolution-data-server (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200706-05 ] ClamAV: Multiple Denials of Service (Raphael Marichez <falco@...too.org>)
Re: Sudo: local root compromise with krb5 enabled (Ken Raeburn <raeburn@....EDU>)
Papoo CMS - Multiple Cross Site Scripting (Nico Leidecker <nicoLeidecker@....de>)
PhpListPro Persistent XSS Vulnerability (corrado.liotta@...ce.it)

June 16 (5 messages)

[ MDKSA-2007:126 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1304-1] New Linux kernel 2.6.8 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Sitellite cms <= 4.2.12 RFI Vuln (CarcaBot@...caBot.ro)
Local Denial of Service in Safari (azizov@...efence.ru)
Having Fun With PostgreSQL (Nico Leidecker <nicoLeidecker@....de>)

June 18 (18 messages)

[SECURITY] [DSA 1309-1] New PostgreSQL 8.1 packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2007:126-1 ] - Updated Firefox packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1309-1] New libexif packages fix integer overflow (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1310-1] New libexif packages fix integer overflow (Steve Kemp <skx@...ian.org>)
WSPortal version 1.0 Path Disclosure Vulnerability (securityresearch@...vigilance.com)
Utopia News Pro version 1.4.0 XSS Attack Vulnerability (securityresearch@...vigilance.com)
WSPortal version 1.0 SQL Injection Vulnerability (securityresearch@...vigilance.com)
[SECURITY] [DSA 1311-1] New PostgreSQL 7.4 packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1312-1] New libapache-mod-jk packages fix information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Menu Manager Mod for WebAPP - No Input Filtering (webapp@...-app.org)
ShAnKaR: Simle machines forum CAPTCHA bypass and PHP injection (3APA3A <3APA3A@...URITY.NNOV.RU>)
PHP hosting Biller (rm@...ima.serapis.net)
Re: Having Fun With PostgreSQL (Ray Stell <stellr@....vt.edu>)
[security bulletin] HPSBMA02224 SSRT071334 rev.1 - HP System Management Homepage (SMH) for Linux, Remote Privileged Access (security-alert@...com)
Webif.cgi local file inclusion (maiosyet@...k.org)
fuzzylime (forum) XSS (rm@...ima.serapis.net)
Fusetalk SQL injection submission. ("Charles Kim" <charleskim.us@...il.com>)
iDefense Security Advisory 06.18.07: Cerulean Studios Trillian UTF-8 Word Wrap Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

June 19 (19 messages)

FLEA-2007-0026-1: evolution-data-server (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Re: Sitellite cms <= 4.2.12 RFI Vuln (lux@...ian.ca)
[CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing (Mark Thomas <markt@...che.org>)
rPSA-2007-0127-1 fetchmail (rPath Update Announcements <announce-noreply@...th.com>)
fusetalk SQL (autherror.cfm) (Ivan Almuina <list-bugtraq@...tcom-technology.com>)
CfP: 5th ACM Workshop on Recurring Malware (WORM) - Deadline extension (chris@...lab.tuwien.ac.at)
iG Shop 1.4 eval Inclusion Vulnerability (ifx@...u.us)
MaraDNS denial of service vulnerabilities (jantunes@...fc.ul.pt)
Local File Include Vulnerabilities in YaBB <= 2.1(all version) (krasza@...il.com)
Persistent cross-site scripting in wordpress.com dashboard (Matteo Carli <matteo@...teocarli.com>)
Re: Having Fun With PostgreSQL (Frank Berek <frank.berek@...or.de>)
[SECURITY] [DSA 1313-1] New MPlayer packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Windows Oday release (Hugo van der Kooij <hvdkooij@...derkooij.org>)
Re: RedLevel Advisory #23 - SalesCart Shopping Cart SQL Injection Vulnerability (Jon Ribbens <jon+bugtraq2@...quivocal.co.uk>)
[SECURITY] [DSA 1314-1] New open-iscsi packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1315-1] New libphp-phpmailer packages fix arbitrary shell command execution (Moritz Muehlenhoff <jmm@...ian.org>)
W1L3D4 WEBmarket v0,1 SQL Injection Vuln (crackers_child@...ersavascilar.com)
[ GLSA 200706-06 ] Mozilla products: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200706-07 ] PHProjekt: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)

June 20 (14 messages)

[ MDKSA-2007:127 ] - Updated apache packages fix mod_mem_cache issue (security@...driva.com)
New post Topic Hijacking XSS All vBulletin v 3.x.x (2) (stormhacker@...mail.com)
Comersus Shop Cart 7.07 SQL Injection & XSS (DoZ@...kersCenter.com)
Apache Prefork MPM vulnerabilities - Report (Blazej Miga <bla@....poznan.pl>)
[ MDKSA-2007:129 ] - Updated jasper packages fix vulnerability (security@...driva.com)
New Include Redirect Bug XSS All vBulletin v 3.x.x (stormhacker@...mail.com)
Pixy - An Open-Source Vulnerability Scanner for PHP Applications (pixy-noreply@...lab.tuwien.ac.at)
FLEA-2007-0027-1: thunderbird (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[ MDKSA-2007:128 ] - Updated libexif packages fix integer overflow flaw (security@...driva.com)
fusetalk CSS (comfinish.cfm) (Ivan Almuina <list-bugtraq@...tcom-technology.com>)
fusetalk CSS (autherror.cfm) (Ivan Almuina <list-bugtraq@...tcom-technology.com>)
[security bulletin] HPSBPI02226 SSRT061274 rev.1 - HP Help and Support Center Running on HP Notebook Computers Running with Windows XP, Re… (security-alert@...com)
[security bulletin] HPSBTU02218 SSRT071424 rev.1 - HP Tru64 UNIX Internet Express running Samba, Remote Arbitrary Code Execution or Local … (security-alert@...com)
HTTP SERVER (httpsv1.6.2) source code disclosure (imprili@...il.com)

June 21 (16 messages)

MyServer-0.8.9 - source code disclosure (imprili@...il.com)
MyServer-0.8.9 - xss in sample cgi page (imprili@...il.com)
HTTP SERVER (httpsv1.6.2) 404 Denial of Service (imprili@...il.com)
[ MDKSA-2007:130 ] - Updated proftpd packages fix authentication bypass vulnerability (security@...driva.com)
[ MDKSA-2007:131 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1316-1] New emacs21 packages fix denial of service (Steve Kemp <skx@...ian.org>)
Re: New Include Redirect Bug XSS All vBulletin v 3.x.x (scott-REMOVE-@...lletin.com)
Re: New post Topic Hijacking XSS All vBulletin v 3.x.x (2) (scott-REMOVE-@...lletin.com)
VLC 0.8.6b format string vulnerability & integer overflow (David Thiel <david@...cpartners.com>)
Re: New Include Redirect Bug XSS All vBulletin v 3.x.x (kaneda@...ater.net)
[ MDKSA-2007:132 ] - Updated madwifi-source, wpa_supplicant packages fix vulnerabilities (security@...driva.com)
NetClassifieds [multiple vulnerabilities] (laurent.gaffie@...il.com)
[security bulletin] HPSBGN02199 SSRT071312 rev.3 - Mercury Quality Center ActiveX, Remote Unauthorized Arbitrary Code Executio (security-alert@...com)
HPSBST02231 SSRT071438 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-030 to MS07-035 (security-alert@...com)
Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x ("Steven M. Christey" <coley@...re.org>)
iDefense Security Advisory 06.21.07: Ingres Database Multiple Heap Corruption Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)

June 22 (11 messages)

[ MDKSA-2007:133 ] - Updated emacs packages fix DoS vulnerability (security@...driva.com)
[ MDKSA-2007:134 ] - Updated xfsdump packages fix unsafe temporary directory creation issue (security@...driva.com)
MS07-034: Executing arbitrary script with mhtml: protocol handler ("HASEGAWA Yosuke " <yosuke.hasegawa@...il.com>)
[USN-475-1] evolution-data-server vulnerability (Kees Cook <kees@...ntu.com>)
Re: Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x (scott-REMOVE-@...lletin.com)
All Of the Mambo & Joomla Script Remote File Inclussion Bugs.. (spymeta@...oo.com)
[CAID 35450, 35451, 35452, 35453]: CA Products That Embed Ingres Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: Re: New Include Redirect Bug XSS All vBulletin v 3.x.x (scott-REMOTE-@...lletin.com)
eNdonesia 8.4 [multiple injection sql] (laurent.gaffie@...il.com)
[USN-476-1] redhat-cluster-suite vulnerability (Kees Cook <kees@...ntu.com>)
FLEA-2007-0028-1: libexif (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)

June 23 (7 messages)

[ MDKSA-2007:135 ] - Updated webmin packages fix XSS vulnerability (security@...driva.com)
[SECURITY] [DSA 1318-1] New ekg packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1317-1] New tinymux packages fix buffer overflow (Steve Kemp <skx@...ian.org>)
Re: Re: PHPMyDesk Beta Release 1.0b ==> RFI (no-spam@...vacy.com)
[SECURITY] [DSA 1319-1] New maradns packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1321-1] New evolution-data-server packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1320-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

June 25 (29 messages)

[GOODFELLAS - VULN] BarCodeAx.dll v. 4.9 ActiveX Control Remote Stack Buffer Overflow (GOODFELLAS SRT <goodfellas@...llcode.com.ar>)
SHTTPD V1.38 server source code disclosure (imprili@...il.com)
Ingres Unauthenticated Pointer Overwrite 2 (NGSSoftware Insight Security Research <nisr@...software.com>)
KF Web Server 3.1.0 admin console XSS (imprili@...il.com)
Ingres verifydb local stack overflow (NGSSoftware Insight Security Research <nisr@...software.com>)
Papoo CMS 3.6 - SQL Injection (Nico Leidecker <nico@...decker.info>)
Ingres Unauthenticated Pointer Overwrite 1 (NGSSoftware Insight Security Research <nisr@...software.com>)
POWER PHLOGGER v.2.2.5 (username) SQL Injection (darkz.gsa@...il.com)
Ingres stack overflow in uuid_from_char function (NGSSoftware Insight Security Research <nisr@...software.com>)
Ingres wakeup setuid(ingres) file truncation (NGSSoftware Insight Security Research <nisr@...software.com>)
LiteWEB 2.7 404 Denial of Services (imprili@...il.com)
Pluxml 0.3.1 Remote Code Execution Exploit (gmdarkfig@...il.com)
Calendarix version 0.7. 20070307 Multiple Path Disclosure Vulnerabilities (securityresearch@...vigilance.com)
Calendarix version 0.7. 20070307 Multiple XSS Attacks (securityresearch@...vigilance.com)
Safari Bookmarks Buffer Overflow Vulnerability (azizov@...efence.ru)
phpTrafficA < 1.4.2 (laurent.gaffie@...il.com)
Calendarix version 0.7. 20070307 Multiple Path Disclosure Vulnerabilities (securityresearch@...vigilance.com)
Papoo CMS 3.6 - Access Restriction Bypass (Nico Leidecker <nicoLeidecker@....de>)
Re: Re: [MajorSecurity Advisory #47]Simple Machines Forum (SMF) - Session fixation Issue (motokochan@...plemachines.org)
Safari XMLHttpRequest HTTP header injection (Richard Moore <rich@...tpoint.ltd.uk>)
"run as" local denial-of-service enables administrative account processes to be killed (Eitan Caspi <eitancaspi@...oo.com>)
rPSA-2007-0131-1 libexif (rPath Update Announcements <announce-noreply@...th.com>)
[security bulletin] HPSBUX02225 SSRT071295 rev.1 - HP-UX Running Xserver, Local Denial of Service (DoS) (security-alert@...com)
MyNews version 0.10 SQL Injection Vulnerability (securityresearch@...vigilance.com)
Calendarix version 0.7. 20070307 Multiple SQL Injection Vulnerabilities (securityresearch@...vigilance.com)
Re: Apple Safari: idn urlbar spoofing (Robert Swiecki <jagger@...ecki.net>)
Re: [Full-disclosure] Apple Safari: idn urlbar spoofing (Michal Zalewski <lcamtuf@...ne.ids.pl>)
RE: [Full-disclosure] Apple Safari: idn urlbar spoofing ("Larry Seltzer" <Larry@...ryseltzer.com>)
[ISR] :: Infobyte Security Research :: release (ISR-sqlget.pl) v1.0.0 ("Francisco Amato" <famato@...obyte.com.ar>)

June 26 (13 messages)

Re: KF Web Server 3.1.0 admin console XSS (support@...focus.net)
CFP: ISOI III (a DA workshop) (Gadi Evron <ge@...uxbox.org>)
rPSA-2007-0133-1 emacs emacs-leim (rPath Update Announcements <announce-noreply@...th.com>)
SYMSA-2007-004: Multiple Vulnerabilities in Xythos Server Products (research@...antec.com)
RE: "run as" local denial-of-service enables administrative account processes to be killed ("James C. Slora Jr." <james.slora@...a.com>)
MITKRB5-SA-2007-004: kadmind multiple RPC lib vulnerabilities (Tom Yu <tlyu@....EDU>)
MITKRB5-SA-2007-005: kadmind vulnerable to buffer overflow (Tom Yu <tlyu@....EDU>)
iDefense Security Advisory 06.26.07: Multiple Vendor Kerberos kadmind Rename Principal Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
Calyptix Security Advisory CX-2007-04 - Cross-Site Request Forgery Attack Against Check Point Safe@...ice Device (Calyptix Security <advisories2007@...yptix.co…)
iDefense Security Advisory 06.26.07: RealNetworks RealPlayer/HelixPlayer SMIL wallclock Stack Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
[GOODFELLAS - VULN ] Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write (GOODFELLAS SRT <goodfellas@...llcode.com.ar>)
[ GLSA 200706-09 ] libexif: Buffer overflow (Raphael Marichez <falco@...too.org>)
[ GLSA 200706-08 ] emul-linux-x86-java: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)

June 27 (16 messages)

[USN-477-1] krb5 vulnerabilities (Kees Cook <kees@...ntu.com>)
[ MDKSA-2007:137 ] - Updated krb5 packages fix vulnerabilities (security@...driva.com)
SAP Web Dynpro Java (BC-WD-JAV) Vulnerability ("Ivan Buetler" <ivan.buetler@...c.ch>)
[USN-478-1] libexif vulnerability (Kees Cook <kees@...ntu.com>)
PHP 4/5 htaccess safemode and open_basedir Bypass (cxib@...urityreason.com)
SAP Internet Communication Framework (BC-MID-ICF) Vulnerability ("Ivan Buetler" <ivan.buetler@...c.ch>)
[ MDKSA-2007:136 ] - Updated evolution packages fix vulnerability (security@...driva.com)
Re: Apple Safari: idn urlbar spoofing (Robert Swiecki <jagger@...ecki.net>)
Openedge _mprosrv buffer overflow (suresync@...il.com)
Conti FTP Server v1.0 DoS (<esc6@...h.com>)
HPSBTU02207 SSRT061239 rev.2 - HP Tru64 UNIX OpenSSL and BIND Remote Arbitrary Code Execution or Denial of Service (DoS) (security-alert@...com)
Contact request - nVidia (john-lindsay@...software.com)
Juniper SBR V 6.0.1 CRL-Checking problem (USprotte@....de)
CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability (Henri Lindberg - Louhi Networks Oy <henri.lindberg@...hi.fi>)
rPSA-2007-0135-1 krb5 krb5-server krb5-services krb5-test krb5-workstation (rPath Update Announcements <announce-noreply@...th.com>)
[GOODFELLAS - VULN] hpqxml.dll 2.0.0.133 from HP Digital Imaging Arbitary Data Write. (Goodfellas SRT <goodfellas@...llcode.com.ar>)

June 28 (13 messages)

[SECURITY] [DSA 1322-1] New wireshark packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
eTicket version 1.5.5 Path Disclosure Vulnerability (securityresearch@...vigilance.com)
eTicket version 1.5.5 XSS Attack Vulnerability (securityresearch@...vigilance.com)
rPSA-2007-0136-1 httpd mod_ssl (rPath Update Announcements <announce-noreply@...th.com>)
FLEA-2007-0029-1: krb5 krb5-workstation (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
XEForum Cookie Modification Privilege Escalation Vulnerability (Firewall1954@...mail.com)
[SecurInfos] PCSoft WinDEV .wdp Project File Handling Buffer Overflow (Jerome Athias <jerome.athias@...e.fr>)
Secunia Research: Symantec Mail Security for SMTP Boundary Errors (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: KVIrc irc:// URI Handler Command Execution Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPSBTU02232 SSRT071429 rev.1 - Secure Web Server for HP Tru64 UNIX Powered by Apache (SWS) or HP Internet Express for … (security-alert@...com)
FLEA-2007-0030-1: avahi avahi-glib avahi-sharp (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[SECURITY] [DSA 1324-1] New hiki packages fix missing input sanitising (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1323-1] New krb5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

June 29 (7 messages)

[USN-479-1] MadWifi vulnerabilities (Kees Cook <kees@...ntu.com>)
TSLSA-2007-0021 - kerberos5 (Trustix Security Advisor <tsl@...stix.org>)
[SECURITY] [DSA 1325-1] New evolution packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
flac123 0.0.9 - Stack overflow in comment parsing (David Thiel <david@...cpartners.com>)
SQL Injection In Script VBZooM V1.12 (RaeD@...Mail.Com)
Re: eTicket version 1.5.5 XSS Attack Vulnerability (sf@...k.org)
Airscanner Advisory #07062901: FlexiSPY Victim/User Database Exposure (Full world readable access to ALL SMS/Emails/Voi… ("Airscanner Corp." <seth@...scanner.com…)

June 30 (2 messages)

Re: Re: Progress Webspeed exploit for all releases (suresync@...il.com)
WheatBlog 1.1 RFI/SQL Injection (underwater@...efence.ru)

375 messages

Powered by blists - more mailing lists