bugtraq mailing list - 2007/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 13	³ 11	⁴ 7	⁵ 17	⁶ 3	⁷ 3	⁸
⁹ 12	¹⁰ 21	¹¹ 28	¹² 9	¹³ 19	¹⁴ 8	¹⁵ 1
¹⁶ 6	¹⁷ 14	¹⁸ 25	¹⁹ 13	²⁰ 17	²¹ 6	²²
²³ 27	²⁴ 23	²⁵ 18	²⁶ 16	²⁷ 19	²⁸ 16	²⁹
³⁰ 24	³¹ 12

Messages by day:

July 2 (13 messages)

akocomment SQL INJECTION (all version) (Emanuele Gentili <bathym@...hi.it>)
[SECURITY] [DSA 1327-1] New gsambad packages fix unsafe temporary files (Steve Kemp <skx@...ian.org>)
[ GLSA 200707-01 ] Firebird: Buffer overflow (Raphael Marichez <falco@...too.org>)
[SECURITY] [DSA 1326-1] New fireflier-server packages fix unsafe temporary files (Steve Kemp <skx@...ian.org>)
eTicket v.1.5.1.1 Multiple Cross-Site Scripting (darkz.gsa@...il.com)
FreeDomain.co.nr Clone SQL Injection (teh_lost_byte@...oo.com)
Re: Light Blog 4.1 XSS Vulnerability (prodigy.zero@...il.com)
Advisory : Internet Explorer Zone Domain Specification Dos and Page suppressing. (Aditya K Sood <zeroknock@...niche.org>)
PHPDirector <= 0.21 (SQL injection/Upload SHELL) Remote Vulnerabilities (teh_lost_byte@...oo.com)
AV Arcade 2.1b (view_page.php) Remote SQL Injection (teh_lost_byte@...oo.com)
[SECURITY] [DSA 1328-1] New unicon-imc2 packages fix buffer overflow (Steve Kemp <skx@...ian.org>)
AV Arcade 2.1b (COOKIE[ava_userid]) Get Admin Rights (teh_lost_byte@...oo.com)
High Risk Flaw in Sun's Java Web Start ("NGSSoftware Insight Security Research" <nisr@...software.com>)

July 3 (11 messages)

[ GLSA 200707-02 ] OpenOffice.org: Two buffer overflows (Raphael Marichez <falco@...too.org>)
Two Unpublished IE Cases ("LIUDIEYU dot COM" <liudieyu.com@...il.com>)
Moodle XSS / Liesbeth base CMS sensitive information disclosure (3APA3A <3APA3A@...URITY.NNOV.RU>)
Buffer overflow in HP Instant Support Driver Check (SDD) ActiveX control ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Re[2]: Light Blog 4.1 XSS Vulnerability (BlackHawk <hawkgotyou@...il.com>)
Security on AIR: Local file access through JavaScript (fukami <fukami@...tioneins.de>)
iPhone Security Settings (John Smith <genericjohnsmith@...il.com>)
Cross Site Scripting in Oliver Library Management System ("A. R." <r00t@...thernfortress.net>)
[ MDKSA-2007:138 ] - Updated kdebase packages fix Flash Player interaction vulnerability (security@...driva.com)
[ GLSA 200707-04 ] GNU C Library: Integer overflow (Raphael Marichez <falco@...too.org>)
MySQLDumper vulnerability: Bypassing Apache based access control possible (bugtraq@...ningpingel.de)

July 4 (7 messages)

Re: Remote File Include In Script SoftNews Media Group (foster@....ru)
SQL Injection in saphp "showcat.php" (Sw33t.h4cK3r@...mail.com)
Fujitsu-Siemens ServerView Remote Command Execution (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
Fujitsu-Siemens PRIMERGY BX300 Switch Blade Information Disclosure (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
SQL Injection in SaphpLesson2.0 "show.php" (Sw33t.h4cK3r@...mail.com)
PacSec 2007 Call For Papers (Nov. 29/30, deadline July 27) (Dragos Ruiu <dr@....net>)
Multiple Remote unauthenticated stack overflows in Asterisk chan_sip.c (NGSSoftware Insight Security Research <nisr@...software.com>)

July 5 (17 messages)

[USN-480-1] Gimp vulnerability (Kees Cook <kees@...ntu.com>)
[ MDKSA-2007:139 ] - Updated MySQL packages fix multiple security issues (security@...driva.com)
[ MDKSA-2007:140 ] - Updated apache packages fix multiple security issues (security@...driva.com)
[ MDKSA-2007:141 ] - Updated apache packages fix multiple security issues (security@...driva.com)
[ MDKSA-2007:142 ] - Updated apache packages fix multiple security issues (security@...driva.com)
Session fixation in Zen Cart CMS (tomaz.bratusa@...mintell.com)
[security bulletin] HPSBPI02228 SSRT071404 rev.1 - HP Instant Support - Driver Check Running on Windows XP, Remote Unauthorized Access (security-alert@...com)
Re: Serious holes affecting JFFNMS (not@...moment.thanks)
Redirection Vulnerability in wp-pass.php, WordPress 2.2.1 ("Nick S. Coblentz" <ncoblentz@...urityps.com>)
[NETRAGARD SECURITY ADVISORY][Maia Mailguard 1.0.2 Arbitrary Code Execution][NETRAGARD-20070628] (Netragard Security Advisories <advisories@...ragard.com>)
EnjoySAP, SAP GUI for Windows - Stack Overflow (NGSSoftware Insight Security Research <mark@...software.com>)
SAP Message Server Heap Overflow (NGSSoftware Insight Security Research <mark@...software.com>)
SAP Internet Graphics Server XSS and Heap Overflow (NGSSoftware Insight Security Research <mark@...software.com>)
Internet Communication Manager Denial Of Service Attack (NGSSoftware Insight Security Research <mark@...software.com>)
SAP DB Web Server Stack Overflow (NGSSoftware Insight Security Research <mark@...software.com>)
AsteriDex (Asterisk / Trixbox) remote code execution (Carl Livitt <carl@...u.co.uk>)
[SECURITY] [DSA 1329-1] New gfax packages fix privilege escalation (Steve Kemp <skx@...ian.org>)

July 6 (3 messages)

[ GLSA 200707-05 ] Webmin, Usermin: Cross-site scripting vulnerabilities (Raphael Marichez <falco@...too.org>)
phpTrafficA <=1.4.3 Admin Login Bypass (corrado.liotta@...ce.it)
An Auction Site for Vulnerabilities ("Ivan ." <ivanhec@...il.com>)

July 7 (3 messages)

eTicket version 1.5.5 XSS Attack Vulnerability (securityresearch@...vigilance.com)
[SECURITY] [DSA 1330-1] New php5 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1331-1] New php4 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)

July 9 (12 messages)

[Eleytt] 7LIPIEC2007 (<sapheal@...k.pl>)
PHP Comet-Server (o_0p@...mail.com)
CodeIgniter 1.5.3 vulnerabilities ("Łukasz Pilorz" <lukasz@...orz.net>)
Re: An Auction Site for Vulnerabilities (Radoslav Dejanović <radoslav.dejanovic@...us.hr>)
Another You tube clone script vulnerability ("Samael De Icaro" <samael_de_icaro@...mail.com>)
Firefox wyciwyg:// cache zone bypass (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: [Eleytt] 7LIPIEC2007 (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Re: Re: [Eleytt] 7LIPIEC2007 (michal.bucko@...ytt.com)
[SECURITY] [DSA 1332-1] New vlc packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
EEYE: Sun Java WebStart JNLP Stack Buffer Overflow Vulnerability ("eEye Advisories" <Advisories@...e.com>)
iDefense Security Advisory 07.09.07: Multiple Vendor GIMP Multiple Integer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.09.07: WinPcap NPF.SYS Local Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

July 10 (21 messages)

WinPcap NPF.SYS Privilege Elevation Vulnerability (mballano@...il.com)
Internet Explorer 0day exploit (Thor Larholm <seclists@...holm.com>)
[ MDKSA-2007:143 ] - Updated mplayer packages fix buffer overflow remote vulnerabilities (security@...driva.com)
[security bulletin] HPSBTU02233 SSRT071424 rev.1 - HP Tru64 UNIX Internet Express running Samba, Remote Arbitrary Code Execution or Local … (security-alert@...com)
[USN-481-1] ImageMagick vulnerabilities (Kees Cook <kees@...ntu.com>)
Announce: RFIDIOt PC/SC support - new release 0.1p (July 2007) (Adam Laurie <adam.laurie@...bunker.net>)
Flashbb <= 1.1.7 - Remote File Inclusion Exploit (mata@...rlndoarme.net)
Entertainment CMS Admin Login Bypass (mata@...rlndoarme.net)
Regarding http://www.securityfocus.com/bid/24744 (urtrapped9@...il.com)
Whitepaper - DNS pinning and web proxies ("Dafydd Stuttard" <daf@...software.com>)
iDefense Security Advisory 07.09.07: IBM AIX libodm ODMPATH Stack Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
SYMSA-2007-005: Vista Windows Firewall Incorrectly Applies Filtering to Teredo Interface (research@...antec.com)
Re: Whitepaper - DNS pinning and web proxies ("Amit Klein" <aksecurity@...il.com>)
Re: WinPcap NPF.SYS Privilege Elevation Vulnerability (Gerald Combs <gerald@...eshark.org>)
Re: Re: WinPcap NPF.SYS Privilege Elevation Vulnerability (mballano@...il.com)
[ MDKSA-2007:144 ] - Updated OpenOffice.org packages fix RTF import vulnerability (security@...driva.com)
EEYE: Microsoft Publisher 2007 Arbitrary Pointer Dereference ("eEye Advisories" <Advisories@...e.com>)
TippingPoint IPS Signature Evasion ("Paul Craig" <paul.craig@...urity-assessment.com>)
XSS Tunnelling White Paper and Tool ("Ferruh Mavituna" <ferruh@...ituna.com>)
Multiple .NET Null Byte Injection Vulnerabilities ("Paul Craig" <paul.craig@...urity-assessment.com>)
Re: Re: [Eleytt] 7LIPIEC2007 (gynvael@...dwind.pl)

July 11 (28 messages)

[ MDKSA-2007:145 ] - Updated wireshark packages fix multiple vulnerabilities (security@...driva.com)
SUN Java JNLP Overflow ("Brett Moore" <brett.moore@...urity-assessment.com>)
durito: enVivo!CMS SQL injection (3APA3A <3APA3A@...URITY.NNOV.RU>)
[USN-482-1] OpenOffice.org vulnerability (Kees Cook <kees@...ntu.com>)
Low Risk Vulnerability in Active Directory (NGSSoftware Insight Security Research <nisr@...software.com>)
Advisory: Arbitrary kernel mode memory writes in AVG (john-lindsay@...software.com)
rPSA-2007-0137-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability (does_not_exist@...-esp.kicks-ass.net)
Advisory - Clam AntiVirus RAR File Handling Denial Of Service Vulnerability. (Metaeye SG <contact@...aeye.org>)
Re: Advisory - Clam AntiVirus RAR File Handling Denial Of Service Vulnerability. (Noam Rathaus <noamr@...ondsecurity.com>)
Re: Advisory - Clam AntiVirus RAR File Handling Denial Of Service Vulnerability. (Metaeye SG <contact@...aeye.org>)
Powered By Dvbbs Version 7.1.0 Sp1 By Pass (RaeD@...Mail.Com)
Cisco Security Advisory: Cisco Unified Communications Manager Overflow Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Unified Communications Manager and Presence Server Unauthorized Access Vulnerabilities (Cisco Systems Product Security Incident R…)
Dotclear remote script execution (Sacha <digimag@...il.com>)
Re: [Full-disclosure] iDefense Security Advisory 07.09.07: WinPcap NPF.SYS Local Privilege Escalation Vulnerability ("KJK::Hyperion" <hackbunny@...tpj.org>)
iDefense Security Advisory 07.11.07: Symantec Backup Exec RPC Remote Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.11.07: Symantec AntiVirus symtdi.sys Local Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
0day linux 2.6 /dev/mem rootkit found ("James E. Jones" <ceriofag@...oo.com>)
Re: XSS Tunnelling White Paper and Tool ("Security Guy" <security@...goinc.com>)
TippingPoint detection bypass (Andres Riancho <ariancho@...sec.com>)
[ GLSA 200707-06 ] XnView: Stack-based buffer overflow (Stefan Cornelius <dercorny@...too.org>)
RE: TippingPoint IPS Signature Evasion ("Paul Craig" <paul.craig@...urity-assessment.com>)
Re: TippingPoint IPS Signature Evasion (3APA3A <3APA3A@...URITY.NNOV.RU>)
iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin gpg_check_sign_pgp_mime() Command Injection Vulnerabilit… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin gpg_help.php Local File Inclusion Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin deleteKey() Command Injection Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.11.07: SquirrelMail G/PGP Plugin gpg_recv_key() Command Injection Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

July 12 (9 messages)

iDefense Security Advisory 07.11.07: Apple QuickTime SMIL File Processing Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
FreeBSD Security Advisory FreeBSD-SA-07:05.libarchive (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
rPSA-2007-0138-1 gimp (rPath Update Announcements <announce-noreply@...th.com>)
MkPortal - Multiple SQL Injection Vulnerabilities (does_not_exist@...-esp.kicks-ass.net)
Re: Re: [Eleytt] 7LIPIEC2007 (Michał Melewski <mike@...stein.kill-9.pl>)
iDefense Security Advisory 07.12.07: Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
FLEA-2007-0031-1: xfs (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Command Injection in XML Digital Signatures (brad@...cpartners.com)
Whitepaper: Command Injection in XML Digital Signatures and Encryption (brad@...cpartners.com)

July 13 (19 messages)

[ MDKSA-2007:146 ] - Updated perl-Net-DNS packages fix multiple vulnerabilities (security@...driva.com)
ZDI-07-039: Symantec AntiVirus Engine RAR File Parsing DoS Vulnerability (zdi-disclosures@...m.com)
ZDI-07-040: Symantec AntiVirus Engine CAB Parsing Heap Overflow Vulnerability (TSRT@...m.com)
TPTI-07-12: Multiple Vendor Progress Server Heap Overflow Vulnerability (TSRT@...m.com)
[scip_Advisory 3159] SiteScape forum prior 7.3 Cross Site Scripting (Marc Ruef <maru@...p.ch>)
ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
ActiveWeb Contentserver CMS Editor Permission Settings Problem (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
ActiveWeb Contentserver CMS SQL Injection Management Interface (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
ActiveWeb Contentserver CMS Multiple Cross Site Scriptings (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
No Patch for IE on Windows Mobile/CE ("LIUDIEYU dot COM" <liudieyu.com@...il.com>)
[Eleytt] 12LIPIEC2007 2007-07-12 (Michal Bucko <michalbucko@...pl>)
[MSA01110707] Flash Player/Plugin Video file parsing Remote Code Execution (Minded Security Research Labs <research@...dedsecurity.com>)
[USN-483-1] libnet-dns-perl vulnerabilities (Kees Cook <kees@...ntu.com>)
Re: [Eleytt] 12LIPIEC2007 2007-07-12 (michal.bucko@...ytt.com)
zdnet reports on java vulnerabilities (Jonathan Smith <smithj@...th.com>)
Bogus BID 24744 (urtrapped9@...il.com)
Calyptix Security Advisory CX-2007-05 - eSoft InstaGate EX2 Cross-Site Request Forgery Attack (Calyptix Security <advisories2007@...yptix.com>)
Re: Internet Explorer 0day exploit (Gadi Evron <ge@...uxbox.org>)
AzDG Dating Gold v3.0.5 ===> Remote File Include Vulnerability (mostafa_ragab@....com)

July 14 (8 messages)

MSIE7 entrapment again (+ FF tidbit) (Michal Zalewski <lcamtuf@...ne.ids.pl>)
Opera/Konqueror: data: URL scheme address bar spoofing (Robert Swiecki <jagger@...ecki.net>)
Re: Menu Manager Mod for WebAPP - No Input Filtering (info@...-app.net)
WhitePapers By SecNiche Security (Aditya K Sood <zeroknock@...niche.org>)
The dark side of ajax ("Fady Anwar" <fady.anwar@...il.com>)
Re: Opera/Konqueror: data: URL scheme address bar spoofing (Harri Porten <porten@....org>)
RE: zdnet reports on java vulnerabilities ("Stephen Shankland" <Stephen.Shankland@...t.com>)
Session Riding and multiple XSS in WebCit (Christopher Schwardt <nookieman@....de>)

July 15 (1 message)

Re: Internet Explorer 0day exploit (Dragos Ruiu <dr@....net>)

July 16 (6 messages)

[security bulletin] HPSBGN02234 SSRT071435 rev.1 - HP ServiceGuard for Linux, Local Unauthorized Access, Increase in Privilege (security-alert@...com)
ExLibris Aleph and Metalib Cross Site Scripting Attack (Matthew Cook <M.S.Cook@...ro.ac.uk>)
Re: Opera/Konqueror: data: URL scheme address bar spoofing (lockoom@...il.com)
Re: Sudo: local root compromise with krb5 enabled (Thor Lancelot Simon <tls@....tjls.com>)
Official release of SQL Power Injector 1.2 (Francois Larouche <francois.larouche-ml@...powerinjector.com>)
Re: Re: Menu Manager Mod for WebAPP - No Input Filtering (web-app@...mail.com)

July 17 (14 messages)

LFI On SMF 1.1.3 (sirn0n@...oo.com)
Insanely simple blog - Multiple vulnerabilities (joseph.giron13@...il.com)
rPSA-2007-0141-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0142-1 perl-Net-DNS (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0143-1 mysql mysql-bench mysql-server (rPath Update Announcements <announce-noreply@...th.com>)
London DC4420 meet - tommorrow, Wednesday 18th July (Adam Laurie <adam.laurie@...bunker.net>)
iDefense Security Advisory 07.16.07: Trend Micro OfficeScan Session Cookie Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.16.07: Trend Micro OfficeScan Management Console Authorization Bypass Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: iDefense Security Advisory 07.11.07: Apple QuickTime SMIL File Processing Integer Overflow Vulnerability (Dan Harkless <bugtraq06@...kless.org>)
[USN-484-1] curl vulnerability (Kees Cook <kees@...ntu.com>)
Re: Internet Explorer 0day exploit (Gadi Evron <ge@...uxbox.org>)
[USN-487-1] Dovecot vulnerability (Kees Cook <kees@...ntu.com>)
[USN-485-1] PHP vulnerabilities (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 07.17.07: IBM Tivoli Provisioning Manager for OS Deployment TFTP Blocksize DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.c…)

July 18 (25 messages)

ASA-2007-014: Stack buffer overflow in IAX2 channel driver ("Kevin P. Fleming" <kpfleming@...ium.com>)
[USN-488-1] mod_perl vulnerability (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 07.17.07: Computer Associates Alert Notification Server Multiple Buffer Overflow Vulnerabili… (iDefense Labs <labs-no-reply@...fense.c…)
Re: Internet Explorer 0day exploit (Chris Stromblad <cs@...post24.com>)
Clarifications on LedgerSMB vulnerability with Bugtraq ID:24940 (Chris Travers <chris@...atrontech.com>)
ASA-2007-016: Remote crash vulnerability in Skinny channel driver ("Kevin P. Fleming" <kpfleming@...ium.com>)
Re: LFI On SMF 1.1.3 (jkloske@...e.uq.edu.au)
ASA-2007-017: Remote Crash Vulnerability in STUN implementation ("Kevin P. Fleming" <kpfleming@...ium.com>)
Re: iDefense Security Advisory 07.11.07: Apple QuickTime SMIL File Processing Integer Overflow Vulnerability (Steve Shockley <steve.shockley@...ckley.net>)
Oracle Security: Insert / Update / Delete Data via Views (ak@...-database-security.com)
ASA-2007-015: Remote Crash Vulnerability in IAX2 channel driver ("Kevin P. Fleming" <kpfleming@...ium.com>)
Oracle Security: SQL Injection in package DBMS_PRVTAQIS (ak@...-database-security.com)
Oracle Security: SQL Injection in APEX CHECK_DB_PASSWORD (ak@...-database-security.com)
Re: Internet Explorer 0day exploit ("Zow" Terry Brugger <zow@...l.gov>)
Cisco Security Advisory: Denial of Service Vulnerability in Cisco Wide Area Application Services (WAAS) Software (Cisco Systems Product Security Incident Respon…)
Re: Internet Explorer 0day exploit (Bigby Findrake <bigby@...emeron.org>)
Security Advisory: Login bypass in LedgerSMB 1.2.0 through 1.2.6 (Chris Travers <chris@...atrontech.com>)
[SECURITY] [DSA 1334-1] New freetype packages fix arbitary code execution (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1333-1] New libcurl3-gnutls packages fix certificate handling (Steve Kemp <skx@...ian.org>)
iDefense Security Advisory 07.18.07: Ipswitch IMail Server 2006 IMAP Search Command Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.18.07: Microsoft DirectX RLE Compressed Targa Image File Heap Overflow (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1335-1] New gimp packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Oracle Database Buffer overflows and Denial of service vulnerabilities in public procedures of MDSYS.MD (DB12) (Team SHATTER <shatter@...secinc.com>)
Oracle Database Buffer overflow vulnerabilities in procedure DBMS_DRS.GET_PROPERTY (DB03) (Team SHATTER <shatter@...secinc.com>)
[Reversemode Advisory] Microsoft DirectX RLE Compressed Targa Image File Heap Overflow (Reversemode <advisories@...ersemode.com>)

July 19 (13 messages)

Geoblog v1 administrator bypass (joseph.giron13@...il.com)
[USN-489-2] redhat-cluster-suite vulnerability (Kees Cook <kees@...ntu.com>)
rPSA-2007-0145-1 lighttpd (rPath Update Announcements <announce-noreply@...th.com>)
iDefense Security Advisory 07.19.07: Opera Software Opera Web Browser BitTorrent Dangling Pointer Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[USN-486-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-489-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
DokuWiki suffers XSS ("Cyrill Brunschwiler" <cyrill.brunschwiler@...c.ch>)
iDefense Security Advisory 07.19.07: Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[CAID 35515]: CA Products Alert Service RPC Procedure Buffer Overflow Vulnerabilities ("Williams, James K" <James.Williams@...com>)
[CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos (Aditya K Sood <zeroknock@...niche.org>)
Re: Internet Explorer 0day exploit ("Zow" Terry Brugger <zow@...l.gov>)
[ANNOUNCE] RSBAC 1.3.5 released (Amon Ott <ao@...ac.org>)
Wii's Internet Channel affected to Flash FLV parser vulnerability (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)

July 20 (17 messages)

SYMSA-2007-006: Citrix EPA ActiveX Control Design Flaw (research@...antec.com)
[USN-490-1] Firefox vulnerabilities (Kees Cook <kees@...ntu.com>)
rPSA-2007-0148-1 firefox thunderbird (rPath Update Announcements <announce-noreply@...th.com>)
rare bug in Opera 9.20 browser (jplopezy@...il.com.ar)
rPSA-2007-0147-1 tcpdump (rPath Update Announcements <announce-noreply@...th.com>)
Elite Forum Full HTML ENject versin 1.0.0.0 (starext@....com)
Re: Internet Explorer 0day exploit (Chris Stromblad <cs@...post24.com>)
Re: LFI On SMF 1.1.3 (Cornelius Riemenschneider <c.r1@....de>)
Re: Internet Explorer 0day exploit (Chris Stromblad <cs@...post24.com>)
Re: Internet Explorer 0day exploit (Chris Stromblad <cs@...post24.com>)
2007-07-20 - n.runs-SA-2007.016 - NOD32 Antivirus CAB parsing Arbitrary Code Execution Advisory (security@...ns.com)
2007-07-20 - n.runs-SA-2007.018 - NOD32 Antivirus ASPACK and FSG parsing Divide by Zero Advisory (security@...ns.com)
FLEA-2007-0032-1: flashplayer (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
UseBB 1.0.x Cross Site Scripting (XSS) (s4mi@...uxMail.org)
Re: Internet Explorer 0day exploit (Chad Perrin <perrin@...theon.com>)
2007-07-20 - n.runs-SA-2007.019 - Panda Antivirus EXE parsing Arbitrary Code Execution Advisory (security@...ns.com)
2007-07-20 - n.runs-SA-2007.017 - NOD32 Antivirus ASPACK parsing Infinite Loop Advisory (security@...ns.com)

July 21 (6 messages)

JBlog 1.0 Creat Admin exploit, xss, Cookie Manipulation (s4mi@...uxMail.org)
[ MDKSA-2007:147 ] - Updated ImageMagick packages fix multiple vulnerabilities (security@...driva.com)
[Aria-Security] Property Pro Remote Login ByPass (Advisory@...a-Security.net)
[Aria-Security] Munch Pro Remote Login ByPass (Advisory@...a-Security.net)
[MajorSecurity Advisory #51]Virtual Hosting Control System - Session fixation Issue (admin@...orsecurity.de)
Oracle bad Views - Exploit released (bunker <bunker@...twebnet.it>)

July 23 (27 messages)

Re: rare bug in Opera 9.20 browser (kaneda@...ater.net)
Buffer overflow in Areca CLI, version <= 1.72.250 (Sebastian Wolfgarten <sebastian@...fgarten.com>)
SEC Consult SA-20070722-0 :: Remote command execution in Joomla! CMS (Johannes Greil <research@...-consult.com>)
CVE-2007-3383: XSS in Tomcat send mail example (Mark Thomas <markt@...che.org>)
[SECURITY] [DSA 1336-1] New mozilla-firefox packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1337-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
n.runs-SA-2007.020 - Norman Antivirus ACE parsing Arbitrary Code Execution Advisory (security@...ns.com)
[security bulletin] HPSBUX02153 SSRT061181 rev.4 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial … (security-alert@...com)
n.runs-SA-2007.022 - Norman Antivirus DOC parsing Detection Bypass Advisory (security@...ns.com)
n.runs-SA-2007.021 - Norman Antivirus LZH parsing Arbitrary Code Execution Advisory (security@...ns.com)
PHMe CMS 0.0.2 local File Include Vulnerabilitiy (h4ck3riran@...oo.com)
Re: PHMe CMS 0.0.2 local File Include Vulnerabilitiy (BlackHawk <hawkgotyou@...il.com>)
[Aria-Security] Image Racer SearchResults.asp SQL INJECTION vuln. (Advisory@...a-Security.net)
Re: Re: Internet Explorer 0day exploit (piercede@....edu)
Re: Internet Explorer 0day exploit ("Aaron Katz" <atkatz@...il.com>)
Webspell 4.x Local File Inclusion (f00@...ayyyy.de)
n.runs-SA-2007.023 - Norman Antivirus DOC parsing Divide by Zero Advisory (security@...ns.com)
[SECURITY] [DSA 1338-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Minb Is Not A Blog default password directory (Joseph.giron13@...il.com)
Re: Internet Explorer 0day exploit ("Aaron Katz" <atkatz@...il.com>)
Re: [Eleytt] 7LIPIEC2007 (activereports.support@...adynamics.com)
[security bulletin] HPSBST02243 SSRT071446 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-036 to MS07-041 (security-alert@...com)
The Pwnie Awards! (Alexander Sotirov <alex@...irov.net>)
iDefense Security Advisory 07.23.07: Ipswitch Instant Messaging Server Denial of Service Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
RE: Internet Explorer 0day exploit ("Ken Kousky" <kkousky@...inc.com>)
Secure Computing - Security Reporter Auth Bypass and Directory Traversal Vulnerability (Oliver Karow <oliver.karow@....de>)
Re: [WEB SECURITY] [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos (Pranay Kanwar <warl0ck@...aeye.org>)

July 24 (23 messages)

Oracle E-Business Suite - Multiple Vulnerabilities ("Integrigy Alerts" <alerts@...egrigy.com>)
RE: Internet Explorer 0day exploit (Hugo van der Kooij <hvdkooij@...derkooij.org>)
dbdisplay.pl(all versions) Remote execut Vulnerability (hadihadi_zedehal_2006@...oo.com)
PR07-21: Webbler CMS forms are susceptible to spamming and phishing abuses (research@...checkup.com)
"BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Amit Klein <amit.klein@...steer.com>)
PR07-19: Cross-site Scripting (XSS) / HTML injection on Webbler CMS admin login page (2) (research@...checkup.com)
RE: Internet Explorer 0day exploit ("Roger A. Grimes" <roger@...neretcs.com>)
[SECURITY] [DSA 1339-1] New iceape packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
PR07-20: Webroot disclosure on Webbler CMS (research@...checkup.com)
printenv.pl(all versions) cross site scripting Vulnerability (hadihadi_zedehal_2006@...oo.com)
[SECURITY] [DSA 1340-1] New ClamAV packages fix denial of service (joey@...odrom.org (Martin Schulze))
PR07-18: Cross-site Scripting (XSS) / HTML injection on Webbler CMS admin login page (1) (research@...checkup.com)
FLEA-2007-0033-1: firefox thunderbird (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (securityfocus@...workontap.com)
Cisco Security Advisory: Wireless ARP Storm Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
ZDI-07-042: Ipswitch IMail Server GetIMailHostEntry Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-07-041: Panda Software AdminSecure Agent Heap Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-07-043: Ipswitch IMail IMAP Daemon SUBSCRIBE Stack Overflow Vulnerability (zdi-disclosures@...m.com)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) ("Amit Klein" <aksecurity@...il.com>)
cPanel 10.9.1 XSS (Advisory@...a-Security.net)
TPTI-07-13: Borland Interbase ibserver.exe Create-Request Buffer Overflow Vulnerability (TSRT@...m.com)
iDefense Security Advisory 07.24.07: Computer Associates AntiVirus CHM File Handling DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.24.07: Computer Associates eTrust Intrusion Detection CallCode ActiveX Control Code Execu… (iDefense Labs <labs-no-reply@...fense.c…)

July 25 (18 messages)

[ GLSA 200707-07 ] MPlayer: Multiple buffer overflows (Raphael Marichez <falco@...too.org>)
[ GLSA 200707-08 ] NVClock: Insecure file usage (Raphael Marichez <falco@...too.org>)
[CAID 35524]: CA eTrust Intrusion Detection caller.dll Vulnerability ("Williams, James K" <James.Williams@...com>)
[CAID 35525, 35526]: CA Products Arclib Library Denial of Service Vulnerabilities ("Williams, James K" <James.Williams@...com>)
[CAID 35527]: CA Message Queuing (CAM / CAFT) Buffer Overflow Vulnerability ("Williams, James K" <James.Williams@...com>)
[OpenPKG-SA-2007.022] OpenPKG Security Advisory (bind) (OpenPKG GmbH <openpkg-noreply@...npkg.com>)
n.runs-SA-2007.024 - CA eTrust Antivirus Infinite Loop DoS (remote) Advisory (<security@...ns.com>)
[USN-491-1] Bind vulnerability (Kees Cook <kees@...ntu.com>)
Mitridat Form Processor Pro XSS ("Charles Kim" <charleskim.us@...il.com>)
Mozilla protocol abuse (Thor Larholm <seclists@...holm.com>)
Re: [Full-disclosure] Mozilla protocol abuse (bugtraq@...security.net)
[ GLSA 200707-09 ] GIMP: Multiple integer overflows (Raphael Marichez <falco@...too.org>)
[ MDKSA-2007:148 ] - Updated tcpdump packages fix BGP dissector vulnerability (security@...driva.com)
ZDI-07-044: BakBone NetVault Reporter Scheduler Heap Overflow Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 1341-1] New bind9 packages fix DNS cache poisoning (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2007:149 ] - Updated BIND9 packages fix vulnerabilities (security@...driva.com)
[ GLSA 200707-10 ] Festival: Privilege elevation (Raphael Marichez <falco@...too.org>)
[ GLSA 200707-11 ] MIT Kerberos 5: Arbitrary remote code execution (Raphael Marichez <falco@...too.org>)

July 26 (16 messages)

[ MDKSA-2007:150 ] - Updated clamav packages fix vulnerabilities (security@...driva.com)
RE: [CAID 35525, 35526]: CA Products Arclib Library Denial of Service Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: Mozilla protocol abuse (Thor Larholm <seclists@...holm.com>)
Dependet Forums (Username Field) Remote SQL Injection (Advisory@...a-security.net)
SolpotCrew Advisory #14 (S4M3K) - PhpHostBot (login_form) Remote File Inclusion (s4m3k@...teng.la)
[security bulletin] HPSBMA02133 SSRT061201 rev.5 - HP Oracle for OpenView (OfO) Critical Patch Update (security-alert@...com)
FLEA-2007-0034-1: (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[SECURITY] [DSA 1342-2] New bind9 packages fix DNS cache poisoning (Moritz Muehlenhoff <jmm@...ian.org>)
libvorbis 1.1.2 - Multiple memory corruption flaws (David Thiel <david@...cpartners.com>)
Guidance Software response to iSEC report on EnCase (larry.gill@...dancesoftware.com)
iDefense Security Advisory 07.26.07: IBM AIX pioout Arbitrary Library Loading Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.26.07: IBM AIX capture Terminal Control Sequence Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.26.07: IBM AIX ftp gets() Multiple Buffer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
Re: Guidance Software response to iSEC report on EnCase (fwd) (jf <jf@...glingpointers.net>)
PHPSysInfo Index.php Cross Site Scripting (DoZ@...kersCenter.com)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) ("Jamie Riden" <jamie.riden@...il.com>)

July 27 (19 messages)

Breakpoint Security: Encase Pre-Advisory (announce@...akpointsecurity.net)
Re: Guidance Software response to iSEC report on EnCase (fwd) (Alexander Sotirov <alex@...irov.net>)
Re: Guidance Software response to iSEC report on EnCase ("Alex Stamos" <alex@...cpartners.com>)
rPSA-2007-0149-1 bind bind-utils (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2007-0150-1 libvorbis (rPath Update Announcements <announce-noreply@...th.com>)
sBlog 0.7.3 Beta XSS Vulnerabilitie (Guns@...0.com.ar)
Re: Retrieving "deleted" sms/mms from Nokia phone (Symbian S60) (abrash_han@...mail.com)
PHP Safe_mode bypass exploit (win32service) (nima_501@...oo.com)
Metyus Forum Portal v1.0 (crazy_king@...7.org)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Theo de Raadt <deraadt@....openbsd.org>)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Tim <tim-security@...tinelchicken.org>)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Gadi Evron <ge@...uxbox.org>)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Amit Klein <aksecurity@...il.com>)
Solaris finger bug (Jim Mellander <jmellander@....gov>)
FLEA-2007-0035-1: libvorbis (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
BTsniff - Bleutooth sniffing under *nix (Thierry Zoller <Thierry@...ler.lu>)
Anti XSS AJAX ("Fady Anwar" <fady.anwar@...il.com>)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Tim Newsham <newsham@...a.net>)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) (Amit Klein <aksecurity@...il.com>)

July 28 (16 messages)

Re: Solaris finger bug (Joep Vesseur <Joep.Vesseur@....COM>)
Berthanas Ziyaretci Defteri v2.0 (tr) Sql (yollubunlar@...lubunlar.org)
WebStore - Online Store Application Template SQL INJECTION (Advisory@...a-security.net)
Real Estate listing website application template SQL Injection (Advisory@...a-security.net)
Pay Roll - Time Sheet and Punch Card Application With Web Interface SQL Injection (Advisory@...a-security.net)
Message Board / Threaded Discussion Forum SQL INJECTION (Advisory@...a-security.net)
PHPBlogger cookie privilege escalation (darthballsbr@...mail.com)
phpCoupon Vulnerabilities (hack2prison@...oo.com)
TSLSA-2007-0023 - multi (Trustix Security Advisor <tsl@...stix.org>)
Re: Anti XSS AJAX (Ronald Chmara <ron@...s1.COM>)
SuskunDuygular - yelik Sistemi v.1 Sql (yollubunlar@...lubunlar.org)
WebEvents: Online Event Registration Template Username Fields SQL INJECTION (Advisory@...a-security.net)
WebEvents: Online Event Registration Template Username Fields SQL INJECTION (Advisory@...a-security.net)
Friend Script 2.5 - 2.4 Remote File İnclude (yollubunlar@...lubunlar.org)
[ GLSA 200707-12 ] VLC media player: Format string vulnerabilities (Raphael Marichez <falco@...too.org>)
[ GLSA 200707-13 ] Fail2ban: Denial of Service (Raphael Marichez <falco@...too.org>)

July 30 (24 messages)

[ GLSA 200707-14 ] tcpdump: Integer overflow (Raphael Marichez <falco@...too.org>)
[Aria-security] itcms 0.2 Cross-site Scripting (XSS) (h4ck3riran@...oo.com)
E-commerceScripts ALL Apps (Auction Script, Shopping Cart Script and Multi-Vendor E-Shop Script) admin.aspx SQL (Advisory@...a-security.net)
[Aria-security] community Cross-site Scripting (XSS) (h4ck3riran@...oo.com)
security@...or.net (security@...or.net)
TS-2007-001-0: BlueCat Networks Adonis Linux-HA heartbeat DoS Vulnerability ("anonymous.c7ffa4057a" <anonymous.c7ffa4057a@...nymousspeech.com>)
ASA-2007-018: Resource exhaustion vulnerability in IAX2 channel driver (Security Response Team <security@...erisk.org>)
wolioCMS SQL Injection (k1tk4t@...hack.org)
FLEA-2007-0036-1 vim vim-minimal gvim (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
[DRUPAL-SA-2007-018] Drupal 4.7.7 and 5.2 fix multiple cross site scripting vulnerabilities (Heine Deelstra <hdeelstra@...il.com>)
[DRUPAL-SA-2007-017] Drupal 5.2 fixes multiple CSRF vulnerabilities (Heine Deelstra <hdeelstra@...il.com>)
[SECURITY] [DSA 1342-1] New xfs packages fix privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)
RIG Image Gallery (dir_abs_src) Remote File Include Vulnerability (ilkerkandemir@...et.com)
phpWebFileManager v0.5 (PN_PathPrefix) Remote File Include Vulnerability (ilkerkandemir@...et.com)
Madoa Poll v1.1 Remote File Include Vulnerabilities (ilkerkandemir@...et.com)
Phorm v3.0 Remote File Upload Vulnerability (ilkerkandemir@...et.com)
phpVoter v0.6 Remote File Include Vulnerability (ilkerkandemir@...et.com)
Dora Emlak Script v1.0 (tr) Admin Login ByPass (ilkerkandemir@...et.com)
BellaBiblio Admin Login Bypass (ilkerkandemir@...et.com)
Exploit In Internet Explorer (RaeD@...Mail.Com)
RFI ====> vBulletin v3.6.5 (RaeD@...Mail.Com)
Re: Exploit In Internet Explorer (paraw <paraw@...oo.it>)
RE: Exploit In Internet Explorer ("Larry Seltzer" <Larry@...ryseltzer.com>)
Re: Exploit In Internet Explorer (Nick FitzGerald <nick@...us-l.demon.co.uk>)

July 31 (12 messages)

CAL-20070730-1 BlueSkyCat ActiveX Remote Heap Overflow vulnerability (Code Audit Labs <vulnhunt@...il.com>)
rPSA-2007-0151-1 gvim vim vim-minimal (rPath Update Announcements <announce-noreply@...th.com>)
BellaBook Admin Bypass/Remote Code Execution (ilkerkandemir@...et.com)
FLEA-2007-0037-1 unrar (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Re: RFI ====> vBulletin v3.6.5 (scott-REMOVE@...lletin.com)
[USN-492-1] tcpdump vulnerability (Kees Cook <kees@...ntu.com>)
security contact for uat.edu needed (Hans Wolters <php@...all.nl>)
Re: RFI ====> vBulletin v3.6.5 (no-reply@...a-security.net)
[BuHa-Security] Winamp 5.35 (Infinite) M3U File Inclusion DoS Vulnerability (bugtraq@...ph3us.org)
Re: [BuHa-Security] Winamp 5.35 (Infinite) M3U File Inclusion DoS Vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Really, really, penultimate, PacSec CFP deadline, Aug 10. (Dragos Ruiu <dr@....net>)
[SECURITY] [DSA 1343-1] New file packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)

388 messages

Powered by blists - more mailing lists