bugtraq mailing list - 2008/04

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 14	² 11	³ 11	⁴ 33	⁵ 6	⁶
⁷ 10	⁸ 12	⁹ 15	¹⁰ 11	¹¹ 16	¹² 5	¹³
¹⁴ 27	¹⁵ 27	¹⁶ 18	¹⁷ 19	¹⁸ 18	¹⁹ 3	²⁰
²¹ 15	²² 19	²³ 22	²⁴ 10	²⁵ 4	²⁶ 11	²⁷
²⁸ 12	²⁹ 10	³⁰ 12

Messages by day:

April 1 (14 messages)

iDefense Security Advisory 03.31.08: Macrovision InstallShield InstallScript One-Click Install Untrusted Library Loadin… (iDefense Labs <labs-no-reply@...fense.c…)
EasyNews-40tr Multiple Remote Vulnerabilities (SQL Injection Exploit/XSS/LFI) (irancrash@...il.com)
[SECURITY] [DSA 1536-1] New libxine packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
CAU-2008-0001 - Slowly Closing Door Race Condition ("I)ruid" <druid@...ghq.org>)
Terracotta Personal Edition Multiple vulnerabilities (joseph.giron13@...il.com)
cevado technologies real estate CMS SQL injection (joseph.giron13@...il.com)
[SECURITY] [DSA 1533-2] New exiftags packages fix several vulnerabilities (Devin Carraway <devin@...ian.org>)
TCP/IP security vulnerability disclosed ("J. Oquendo" <sil@...iltrated.net>)
[ GLSA 200804-01 ] CUPS: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Re: Re: Internet explorer 7.0 spoofing (w0lfd33m@...mail.com)
Re: Internet explorer 7.0 spoofing ("Razi Shaban" <razishaban@...il.com>)
Re: Re: Internet explorer 7.0 spoofing (w0lfd33m@...mail.com)
Re: Hamachi Password Disclosure Vulnerability (anonymous@...linator.com)
Re: Re: Internet explorer 7.0 spoofing (w0lfd33m@...mail.com)

April 2 (11 messages)

RE: Internet explorer 7.0 spoofing ("Darth Jedi" <darth.jedi@...ckformoney.com>)
Re: Re: Re: Internet explorer 7.0 spoofing (jplopezy@...il.com)
Writers Block SQL Injection Vulnerabilities (nebelfrost23@....de)
HPSBMA02317 SSRT080026 rev.1 - HP Select Identity Software, Gain Unauthorized Access (security-alert@...com)
Datalife Engine 6.7 XSRF (irancrash@...il.com)
[USN-597-1] OpenSSH vulnerability (Kees Cook <kees@...ntu.com>)
HPSBTU02325 SSRT080006 rev.1 - HP Internet Express for Tru64 UNIX running PostgreSQL, Arbitrary Code Execution, Privilege Elevation, or De… (security-alert@...com)
ANNOUNCE: Apache-SSL security release - apache_1.3.41+ssl_1.59 (Adam Laurie <adam@...roup.co.uk>)
Directory traversal in LANDesk Management Suite 8.80.1.1 (Luigi Auriemma <aluigi@...istici.org>)
RE: Internet explorer 7.0 spoofing ("Mike Diaz" <mikediaz.360@...il.com>)
[ MDVSA-2008:081 ] - Updated CUPS packages fix multiple vulnerabilities (security@...driva.com)

April 3 (11 messages)

[SECURITY] [DSA 1537-1] New xpdf packages fix multiple vulnerabilities (Devin Carraway <devin@...ian.org>)
[ GLSA 200804-02 ] bzip2: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
Webwasher Denial of Service Vulnerability (security@...urecomputing.com)
[USN-598-1] CUPS vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Vulnerabilities in kses-based HTML filters (lpilorz@...linator.com)
Joomla Component com_lms SQL Injection (no-reply@...a-security.net)
Parallels virtuozzo's VZPP multiple csrf vulnerabilities (poplix <poplix@...uasia.org>)
[USN-588-2] MySQL regression (Jamie Strandboge <jamie@...onical.com>)
Recon 2008 CFP last call, early registration open (Recon Conference <cfp2008@...on.cx>)
Cisco Security Advisory: Cisco Unified Communications Disaster Recovery Framework Command Execution Vulnerability (Cisco Systems Product Security Incident Respo…)
POC2008 call for papers (pocadm@...il.com)

April 4 (33 messages)

ZDI-08-014: Apple Quicktime Multiple Opcode Memory Corruption Vulnerabilities (zdi-disclosures@...m.com)
ZDI-08-019: Apple QuickTime Malformed VR obji Atom Parsing Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-018: Apple QuickTime Run Length Encoding Heap Overflow Vulnerability (zdi-disclosures@...m.com)
Medium security hole affecting Festival on Debian unstable/testing and Ubuntu Hardy Heron (Tim Brown <timb@...-dimension.org.uk>)
ZDI-08-016: Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-015: Apple QuickTime Clipping Region Heap Overflow Vulnerability (zdi-disclosures@...m.com)
CA Alert Notification Server Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
CA ARCserve Backup for Laptops and Desktops Server and CA Desktop Management Suite Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
KwsPHP Module ConcoursPhoto XSS (hsx@...mail.fr)
ZDI-08-016: Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)
CORE-2008-0314 - Orbit Downloader "Download failed" buffer overflow (CORE Security Technologies Advisories <advisories@...esecurity.com>)
ZDI-08-019: Apple QuickTime Malformed VR obji Atom Parsing Memory Corruption Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 04.02.08: Symantec Internet Security 2008 ActiveDataInfo.LaunchProcess Design Error Vulnerab… (iDefense Labs <labs-no-reply@...fense.c…)
ZDI-08-017: Apple QuickTime Kodak Encoding Heap Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-017: Apple QuickTime Kodak Encoding Heap Overflow Vulnerability (zdi-disclosures@...m.com)
[security bulletin] HPSBMA02323 SSRT080032 rev.1 - HP USB Floppy Drive Key (Option) for ProLiant Servers, Local Virus Infection (security-alert@...com)
ZDI-08-018: Apple QuickTime Run Length Encoding Heap Overflow Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 04.02.08: Symantec Norton Internet Security 2008 ActiveX Control Buffer Overflow Vulnerabili… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 04.03.08: SCO UnixWare pkgadd Directory Traversal Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ZDI-08-016: Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-017: Apple QuickTime Kodak Encoding Heap Overflow Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 04.03.08: Computer Associates Alert Notification Service Multiple RPC Buffer Overflow Vulner… (iDefense Labs <labs-no-reply@...fense.c…)
[SECURITY] [DSA 1538-1] New alsaplayer packages fix arbitrary code execution (Devin Carraway <devin@...ian.org>)
[SECURITY] [DSA 1539-1] New mapserver packages fix multiple vulnerabilities (Devin Carraway <devin@...ian.org>)
rPSA-2008-0136-1 cups (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0138-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0138-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0139-1 gnome-ssh-askpass openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0139-1 gnome-ssh-askpass openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0138-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0139-1 gnome-ssh-askpass openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0138-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0139-1 gnome-ssh-askpass openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)

April 5 (6 messages)

F5 BIG-IP Management Interface Perl Injection (nnposter@...closed.not)
[ GLSA 200804-03 ] OpenSSH: Privilege escalation (Robert Buchholz <rbu@...too.org>)
TheGreenBowVPN, Login Credentials Disclosure (evilcry@...il.com)
Blogator-script 0.95 Change User Password Vulnerbility (hadihadi_zedehal_2006@...oo.com)
Alkacon OpenCms sessions.jsp searchfilter XSS (nnposter@...closed.not)
Blogator-script 0.95 SQL Injection Vulnerbility (hadihadi_zedehal_2006@...oo.com)

April 7 (10 messages)

[ GLSA 200804-05 ] NX: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
openMosix userspace library stack-based buffer overflow (jose@...os.org)
Tumbleweed SecureTransport FileTransfer ActiveX Control Buffer Overflow ("Patrick Webster" <patrick@...hack.com>)
CDNetworks Nefficient Download(NeffyLauncher.dll) Vulnerabilities ("Simon Ryeo" <bar4mi@...il.com>)
[ GLSA 200804-06 ] UnZip: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
Attack Technique: File Download Injection ("Jeff Williams" <jeff.williams@...ectsecurity.com>)
Wikepage Opus 13 2007.2 Directory Traversal Vulnerbility (virangar_nml@...oo.com)
[SECURITY] [DSA 1540-1] New lighttpd packages fix denial of service (Steve Kemp <skx@...ian.org>)
Multiple vulnerabilities in HP OpenView NNM 7.53 (Luigi Auriemma <aluigi@...istici.org>)
[ GLSA 200804-04 ] MySQL: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)

April 8 (12 messages)

Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities (brad.antoniewicz@...ndstone.com)
Re: Wikepage Opus 13 2007.2 Directory Traversal Vulnerbility (yeppy@...eply..org)
WoltLab(R) Community Framework XSS and Full Path Disclosure Vulnerability ("Jessica Hope" <jessicasaulhope@...glemail.com>)
Wayport Public Access PC Authentication Bypass Weakness ("Pascal Cretain" <pascal.cretain@...il.com>)
[security bulletin] HPSBMA02327 SSRT071455 rev.1 - HP Integrity Servers iLO-2 Management Processors (iLO-2 MP), Denial of Service (DoS) (security-alert@...com)
licq remote DoS? (Milen Rangelov <mrangelov@...bul.bg>)
New tool released : Syslog Fuzzer (jaime.blasco@...sec.com)
[security bulletin] HPSBMA02242 SSRT061260 rev.3 - HP OpenView Network Node Manager (OV NNM) Running Shared Trace Service, Remote Arbitrar… (security-alert@...com)
[security bulletin] [security bulletin] HPSBST02318 SSRT080018 rev.1 - HP Storage Essentials Software, Remote Unauthorized Access to Data (security-alert@...com)
Microsoft Windows DNS Stub Resolver Cache Poisoning (MS08-020) (Amit Klein <amit.klein@...steer.com>)
Re: Multiple vulnerabilities in HP OpenView NNM 7.53 (Luigi Auriemma <aluigi@...istici.org>)
ZDI-08-020: Microsoft GDI WMF Parsing Heap Overflow Vulnerability (zdi-disclosures@...m.com)

April 9 (15 messages)

iDefense Security Advisory 04.08.08: Microsoft HxTocCtrl ActiveX Control Invalid Param Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
ZDI-08-021: Adobe Flash Player DeclareFunction2 Invalid Object Use Vulnerability (zdi-disclosures@...m.com)
[SECURITY] [DSA 1541-1] New openldap2.3 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
CAU-2008-0002: Microsoft Windows SharePoint Services Picture Source XSS ("I)ruid" <druid@...ghq.org>)
SAP Netweaver 6.40-7.0 Cross-Site-Scripting (jaime.blasco@...sec.com)
Pu Arcade component for Joomla - SQL injection (netmantis.com@...il.com)
[ GLSA 200804-07 ] PECL APC: Buffer Overflow (Robert Buchholz <rbu@...too.org>)
iDefense Security Advisory 04.08.08: Microsoft Windows Graphics Rendering Engine Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[CVE-2007-5301] alsaplayer PoC - exploit (Albert Sellarès <whats@...k.net>)
[SECURITY] [DSA 1542-1] New libcairo packages fix arbitrary code execution (Devin Carraway <devin@...ian.org>)
[SECURITY] [DSA 1543-1] New vlc packages fix several vulnerabilities (Devin Carraway <devin@...ian.org>)
[ MDVSA-2008:082 ] - Updated php-apc packages fix vulnerability (security@...driva.com)
[USN-599-1] Ghostscript vulnerability (Jamie Strandboge <jamie@...onical.com>)
IOActive Security Advisory: Buffer overflow in Python zlib extension module (Justin Ferguson <jferguson@...ctive.com>)
[SECURITY] [DSA 1544-1] New pdns-recursor packages fix cache poisoning vulnerability (Florian Weimer <fw@...eb.enyo.de>)

April 10 (11 messages)

Re: Alkacon OpenCms sessions.jsp searchfilter XSS (a.westtermann@...acon.com)
paFileDB 3.1 Remote SQL Injection (noreply@...a-security.com)
Re: licq remote DoS? (3APA3A <3APA3A@...URITY.NNOV.RU>)
[ MDVSA-2008:083 ] - Updated audit packages fix vulnerability (security@...driva.com)
Re: openMosix userspace library stack-based buffer overflow (nixpanic@...rs.sourceforge.net)
[ GLSA 200804-08 ] lighttpd: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
Re: Re: licq remote DoS? (mrangelov@...bul.bg)
EUSecWest CFP Closes April 14th (conf May 21/22 2008) (Dragos Ruiu <dr@....net>)
[SECURITY] [DSA 1545-1] New rsync packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200804-10 ] Tomcat: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200804-09 ] am-utils: Insecure temporary file creation (Pierre-Yves Rofes <py@...too.org>)

April 11 (16 messages)

w2b.ru multiple products SQL Injection (noreply@...a-security.com)
[USN-600-1] rsync vulnerability (Kees Cook <kees@...ntu.com>)
iDefense Security Advisory 04.09.08: EMC DiskXtender File System Manager Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC ("Liu Zhen Hua" <alau@....com>)
[SECURITY] [DSA 1546-1] New gnumeric packages fix arbitrary code execution (Devin Carraway <devin@...ian.org>)
iDefense Security Advisory 04.09.08: EMC DiskXtender MediaStor Format String Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.09.08: EMC DiskXtender Authentication Bypass Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.09.08: EMC DiskXtender File System Manager Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.09.08: EMC DiskXtender MediaStor Format String Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities (ascii <ascii@...amail.com>)
[ GLSA 200804-12 ] gnome-screensaver: Privilege escalation (Raphael Marichez <falco@...too.org>)
[ GLSA 200804-11 ] policyd-weight: Insecure temporary file creation (Robert Buchholz <rbu@...too.org>)
[ GLSA 200804-11 ] policyd-weight: Insecure temporary file creation (Robert Buchholz <rbu@...too.org>)
Directory traversal and multiple Denials of Service in HP OpenView NNM 7.53 (Luigi Auriemma <aluigi@...istici.org>)
Trillian 3.1.9.0 DTD File Buffer Overflow (david130490@...mail.com)
IOActive Security Advisory: Incorrect input validation in PyString_FromStringAndSize() leads to multiple buffer overflow… (Justin Ferguson <jferguson@...ctive.com…)

April 12 (5 messages)

[ MDVSA-2008:084 ] - Updated rsync packages fix vulnerability (security@...driva.com)
DEF CON 16 Retro Announcement! Back to Bang! ("The Dark Tangent" <dtangent@...con.org>)
DEF CON 16 Retro Announcement! Back to Bang! ("The Dark Tangent" <dtangent@...con.org>)
Re: WoltLab(R) Community Framework WCF 1.0.6 (marc.deroche@...s.ch)
Re: WoltLab(R) Community Framework WCF 1.0.6 (marc.deroche@...s.ch)

April 14 (27 messages)

DEF CON 16 Retro Announcement! Back to Bang! ("The Dark Tangent" <dtangent@...con.org>)
project announcement - oCERT - Open Source CERT (Andrea Barisani <lcars@...rt.org>)
[oCERT-2008-003] libpng zero-length chunks incorrect handling (Andrea Barisani <lcars@...rt.org>)
Secunia Research: Lotus Notes kvdocve.dll Path Processing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
OneSecurityDay 2008 - Web application auditing challenge (bugtraq@...ncosmo.com)
Secunia Research: activePDF DocConverter Folio Flat File Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Adobe Flash Player "Declare Function (V7)" Heap Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Lotus Notes htmsr.dll Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
OneSecurityDay 2008 - Web application auditing challenge (bugtraq@...ncosmo.com)
Secunia Research: Symantec Mail Security Folio Flat File Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Lotus Notes Applix Graphics Parsing Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
DOINGSOFT-2008-03-10-001 - XSS issue in BOXiR2 (Sebastien gioria <seb@...ria.org>)
Secunia Research: Lotus Notes Folio Flat File Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Autonomy Keyview Folio Flat File Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: HP OpenView Network Node Manager OpenView5.exe Directory Traversal (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Autonomy Keyview EML Reader Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
OneSecurityDay 2008 - Web application auditing challenge (bugtraq@...ncosmo.com)
Secunia Research: Symantec Mail Security Applix Graphics Parsing Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Lotus Notes EML Reader Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Autonomy Keyview Applix Graphics Parsing Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: activePDF DocConverter Applix Graphics Parsing Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Internet Explorer Data Stream Handling Vulnerability (Secunia Research <remove-vuln@...unia.com>)
S21SEC-041-en:Cezanne SW Cross-Site Scripting ("S21sec labs" <s21seclabs@...sec.com>)
S21SEC-042-en:Cezanne SW Cross-Site Scripting (login required) ("S21sec labs" <s21seclabs@...sec.com>)
S21SEC-043-en:Cezanne SW Blind SQL Injection ("S21sec labs" <s21seclabs@...sec.com>)
Fones Clinic Mart SQL (turkish-warriorr@...mail.com)
[USN-601-1] Squid vulnerability (Jamie Strandboge <jamie@...onical.com>)

April 15 (27 messages)

[ GLSA 200804-14 ] Opera: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Troopers08 Security Conference, April 23/24 (Munich/Germany) (Enno Rey <erey@...w.de>)
KwsPHP (Upload) Remote Code Execution Exploit (ajax@...mail.com)
[ GLSA 200804-15 ] libpng: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200804-13 ] Asterisk: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability (Morgan ARMAND <armand_m@...tech.net>)
[ MDVSA-2008:085 ] - Updated python packages fix arbitrary code execution vulnerability (security@...driva.com)
BosNews v4.0 Remote add user admin (houssamix@...mail.fr)
clamav: Endless loop / hang with crafter arj, CVE-2008-1387 (Hanno Böck <hanno@...eck.de>)
BosNews 2002-2006 Remote add user admin (houssamix@...mail.fr)
clamav: Endless loop / hang with crafter arj, CVE-2008-1387 (Hanno Böck <hanno@...eck.de>)
BosNews v4.0 Remote add user admin (houssamix@...mail.fr)
clamav: Endless loop / hang with crafter arj, CVE-2008-1387 (Hanno Böck <hanno@...eck.de>)
BosNews 2002-2006 Remote add user admin (houssamix@...mail.fr)
BosNews 2002-2006 Remote add user admin (houssamix@...mail.fr)
[ MDVSA-2008:086 ] - Updated kernel packages fix vulnerability (security@...driva.com)
Re: Secunia Research: Lotus Notes Folio Flat File Parsing Buffer Overflows (Luigi Auriemma <aluigi@...istici.org>)
BosNews v4.0 Remote add user admin (houssamix@...mail.fr)
[SECURITY] [DSA 1540-2] New lighttpd packages fix denial of service (Steve Kemp <skx@...ian.org>)
Koobi CMS 4.2.4/4.2.5/4.3.0 Multiple Remote SQL Injection Vulnerabilities (sys-project@...mail.com)
WordPress 2.5 - Salt cracking vulnerability ("J. Carlos Nieto" <xiam@...teslibres.org>)
Koobi Pro 6.25 poll Remote SQL Injection Vulnerability (Sabun@...mail.com)
remote file include (win32.exe@...n)
iDefense Security Advisory 04.14.08: ClamAV libclamav PE WWPack Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
remote file include (win32.exe@...n)
DIVX Player <= 6.7.0 Buffer Overflow PoC ( .SRT ) (securfrog@...il.com)
[ MDVSA-2008:086 ] - Updated kernel packages fix vulnerability (security@...driva.com)

April 16 (18 messages)

VMSA-2008-0007 Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus (VMware Security team <security@...are.com>)
Oracle - SQL Injection in package SDO_GEOM [DB06] (ak@...-database-security.com)
Carbon Communities forum Multiple Vulnerabilities. (admin@...report.ir)
BigAnt Server 2.2 PreAuth Remote SEH Overflow Exploit (0day) (admin@...lt.wikipediatr.com)
Oracle - SQL Injection in package SDO_IDX [DB07] (ak@...-database-security.com)
Oracle - SQL Injection Vulnerability in SDO_UTIL [DB05] (ak@...-database-security.com)
[INFIGO-2008-04-08]: ICQ 6 remote buffer overflow vulnerability ("infocus" <infocus@...igo.hr>)
Oracle - Hardcoded Password and Password Reset of OUTLN User [DB13] (ak@...-database-security.com)
Cisco Security Advisory: Cisco Network Admission Control Shared Secret Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
CA DSM gui_cm_ctrls ActiveX Control Vulnerability ("Williams, James K" <James.Williams@...com>)
iDefense Security Advisory 04.15.08: Oracle Application Express Privilege Escalation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.09.08: IBM DB2 Universal Database Administration Server File Creation Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.09.08: IBM DB2 Universal Database db2dasStartStopFMDaemon Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.co…)
Re: PHPSlideShow (toonchapter8.php) Cross-Site Scripting Vulnerability (contact@...eluxe.com)
Classifieds Caffe (index.php cat_id) Remote SQL Injection (sys-project@...mail.com)
Classifieds Caffe (index.php cat_id) Remote SQL Injection (sys-project@...mail.com)
ZDI-08-022: Apple Safari WebKit PCRE Handling Integer Overflow Vulnerability (zdi-disclosures@...m.com)
Classifieds Caffe (index.php cat_id) Remote SQL Injection (sys-project@...mail.com)

April 17 (19 messages)

FreeBSD Security Advisory FreeBSD-SA-08:05.openssh (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDVSA-2008:087 ] - Updated policykit package fixes format string vulnerability (security@...driva.com)
[oCERT-2008-004] multiple speex implementations insufficient boundary checks (Andrea Barisani <lcars@...rt.org>)
[SECURITY] [DSA 1547-1] New OpenOffice.org packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[ GLSA 200804-16 ] rsync: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200804-17 ] Speex: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200804-18 ] Poppler: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[security bulletin] HPSBMA02133 SSRT061201 rev.8 - HP Oracle for OpenView (OfO) Critical Patch Update (security-alert@...com)
[security bulletin] HPSBST02329 SSRT080048 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-018 to MS08-025 (security-alert@...com)
[security bulletin] HPSBMA02328 SSRT071293 rev.2 - HP OpenView Network Node Manager (OV NNM) Running Apache, Remote Cross Site Scripting (… (security-alert@...com)
Microsoft Works 7 WkImgSrv.dll crash POC (wsn1983@...il.com)
Announcement - DeepSec Conference 2008, Nov 11-14 2008 ("DeepSec Conference" <deepsec@...psec.net>)
[SECURITY] [DSA 1548-1] New xpdf packages fix arbitrary code exitution (Devin Carraway <devin@...ian.org>)
[USN-603-1] poppler vulnerability (Kees Cook <kees@...ntu.com>)
[USN-603-2] KOffice vulnerability (Kees Cook <kees@...ntu.com>)
Re: BigAnt Server 2.2 PreAuth Remote SEH Overflow Exploit (0day) (m.memelli@...mind.com)
[SECURITY] [DSA 1549-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [Full-disclosure] Secunia Research: Lotus Notes Folio Flat File Parsing Buffer Overflows (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[SECURITY] [DSA 1550-1] New suphp packages fix local privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)

April 18 (18 messages)

iDefense Security Advisory 04.17.08: Multiple Vendor OpenOffice OLE DocumentSummaryInformation Heap Overflow Vulnerabil… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 04.17.08: Multiple Vendor OpenOffice EMF EMR_BITBLT Record Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
iDefense Security Advisory 04.17.08: Multiple Vendor OpenOffice QPRO Multiple Heap Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 04.17.08: Multiple Vendor OpenOffice QPRO File Parsing Integer Underflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200804-19 ] PHP Toolkit: Data disclosure and Denial of Service (Robert Buchholz <rbu@...too.org>)
[ MDVSA-2008:088 ] - Updated clamav packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:089 ] - Updated poppler packages fix vulnerability (security@...driva.com)
Wikepage Wiki v.2007-2 Cross-Site Scripting (darkz.gsa@...il.com)
BitTorrent Clients and CSRF (th3.r00k.nospam@...k.gmail.com)
[ GLSA 200804-20 ] Sun JDK/JRE: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
LightNEasy v.1.2.2 flat Multiple Vulnerabilities (darkz.gsa@...il.com)
5th avenue Shopping Cart SQL Injection (noreply@...a-security.com)
[ GLSA 200804-21 ] Adobe Flash Player: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Team SHATTER Security Advisory: Multiple DoS in JAR files manipulation procedures (Team SHATTER <shatter@...secinc.com>)
Team SHATTER Security Advisory: IBM DB2 UDB Arbitrary file overwrite in SYSPROC.NNSTAT procedure (Team SHATTER <shatter@...secinc.com>)
[ GLSA 200804-22 ] PowerDNS Recursor: DNS Cache Poisoning (Robert Buchholz <rbu@...too.org>)
Team SHATTER Security Advisory: IBM DB2 UDB Arbitrary code execution in ADMIN_SP_C/ADMIN_SP_C2 procedures (Team SHATTER <shatter@...secinc.com>)
ANNOUNCE: RFIDIOt-0.1s release (now available for Windows) (Adam Laurie <adam@...roup.co.uk>)

April 19 (3 messages)

[SECURITY] [DSA 1551-1] New python2.4 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1552-1] New mplayer packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Token Kidnapping (Microsoft Security Advisory 951306) presentation available (Cesar <cesarc56@...oo.com>)

April 21 (15 messages)

Deciphering the PHP-Nuke Capthca (Michael.Brooks.SPAM@...k.rooksecurity.com)
Deciphering the Simple Machines Forum audio Captcha (Michael.Brooks.SPAM@...k.rooksecurity.com)
Acidcat CMS Multiple Vulnerabilities (admin@...report.ir)
SyScan'08 Singapore - Call for Paper ("organiser@...can.org" <organiser@...can.org>)
[ MDVSA-2008:090 ] - Updated OpenOffice.org packages fix vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1553-1] New ikiwiki packages fix cross-site request forgery (Florian Weimer <fw@...eb.enyo.de>)
IRM Security Advisory : RedDot CMS SQL injection vulnerability ("Mark Crowther" <mark.crowther@...plc.com>)
Powered by gCards v1.46 SQL (turkish-warriorr@...mail.com)
[ GLSA 200804-23 ] CUPS: Integer overflow vulnerability (Matthias Geerdsen <vorlon@...too.org>)
Re: Re: Smf 1.1.4 Remote File Inclusion Vulnerabilities (douchbag@...ch.org)
ANNOUNCE: Security Implications of Windows Access Tokens Whitepaper (luke.jennings@...infosecurity.com)
Xoops All Version -Articles- Article.PHP (ID) Blind SQL Injection ExpL0it (crazy_kinq@...mail.co.uk)
[ GLSA 200804-24 ] DBmail: Data disclosure (Matthias Geerdsen <vorlon@...too.org>)
Sea-Surfing on the Motorola Surfboard (th3.r00k.nospam@...k.gmail.com)
Re: Powered by gCards v1.46 SQL (packet@...ketstormsecurity.org)

April 22 (19 messages)

[USN-602-1] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Correcting CVEs (was Re: [Full-disclosure] Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387)) (Hanno Böck <hanno@...eck.de>)
[USN-604-1] Gnumeric vulnerability (Kees Cook <kees@...ntu.com>)
[USN-602-1] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-604-1] Gnumeric vulnerability (Kees Cook <kees@...ntu.com>)
Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387) (Hanno Böck <hanno@...eck.de>)
Correcting CVEs (was Re: [Full-disclosure] Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387)) (Hanno Böck <hanno@...eck.de>)
[USN-602-1] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387) (Hanno Böck <hanno@...eck.de>)
Correcting CVEs (was Re: [Full-disclosure] Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387)) (Hanno Böck <hanno@...eck.de>)
[USN-602-1] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Safari 3.1.1 Multiple Vulnerabilities for windows (jplopezy@...il.com)
Firefox 3.0 beta 5 crash (jplopezy@...il.com)
Re: Firefox 3.0 beta 5 crash ("Gianluca Borello" <g.borello@...il.com>)
[SECURITY] [DSA 1554-1] New roundup packages fix cross-site scripting vulnerability (Noah Meyerhans <noahm@...ian.org>)
Default key algorithm in Thomson and BT Home Hub routers ("Adrian Pastor" <ap@...citizen.org>)
Default key algorithm in Thomson and BT Home Hub routers ("Adrian Pastor" <ap@...citizen.org>)
Default key algorithm in Thomson and BT Home Hub routers ("Adrian Pastor" <ap@...citizen.org>)
Default key algorithm in Thomson and BT Home Hub routers ("Adrian Pastor" <ap@...citizen.org>)

April 23 (22 messages)

Re: Default key algorithm in Thomson and BT Home Hub routers (ap@...citizen.org)
NetClassifieds Sql Injection (noreply@...a-security.com)
LayerOne 2008 - Final Pre-Con Update ("Layer One" <layeronecfp@...il.com>)
AST-2008-006 - 3-way handshake in IAX2 incomplete (Security Officer <security@...erisk.org>)
Horde Webmail XSS [Aria-Security] (noreply@...a-security.com)
LayerOne 2008 - Final Pre-Con Update ("Layer One" <layeronecfp@...il.com>)
NetClassifieds Sql Injection (noreply@...a-security.com)
Zune software - arbitrary file overwrite (info@...onsecurity.ch)
Horde Webmail XSS [Aria-Security] (noreply@...a-security.com)
LayerOne 2008 - Final Pre-Con Update ("Layer One" <layeronecfp@...il.com>)
[SECURITY] [DSA 1555-1] New iceweasel packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200804-25 ] VLC: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200804-26 ] Openfire: Denial of Service (Robert Buchholz <rbu@...too.org>)
Re: NetClassifieds Sql Injection (laurent.gaffie@...il.com)
PR07-43: Cross-domain redirect on RSA Authentication Agent (ProCheckUp Research <research@...checkup.com>)
PR07-44: XSS on RSA Authentication Agent login page (ProCheckUp Research <research@...checkup.com>)
PR07-43: Cross-domain redirect on RSA Authentication Agent (ProCheckUp Research <research@...checkup.com>)
xine-lib NES Sound Format Demuxer Buffer Overflow (laurent.gaffie@...il.com)
PR07-44: XSS on RSA Authentication Agent login page (ProCheckUp Research <research@...checkup.com>)
PR07-44: XSS on RSA Authentication Agent login page (ProCheckUp Research <research@...checkup.com>)
[W01-0408] Realtek HD Audio Codec Drivers (Vista) - Local Privilege Escalation (vulns@...tercore.com)
PR07-44: XSS on RSA Authentication Agent login page (ProCheckUp Research <research@...checkup.com>)

April 24 (10 messages)

Re: xine-lib NES Sound Format Demuxer Buffer Overflow (Guido Landi <lists@...mera.org>)
[ GLSA 200804-27 ] SILC: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200804-28 ] JRockit: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
Trillian 3.1 basic nick crash (jplopezy@...il.com)
DDIVRT-2008-11 BadBlue uninst.exe DoS (vulnerabilityresearch@...italdefense.net)
A New Class of Vulnerability in Oracle: Lateral SQL Injection ("David Litchfield" <davidl@...software.com>)
HPSBGN02333 SSRT080031 rev.1 - HP Software Update HPeDiag Running on Windows, Remote Disclosure of Information and Execution of Arbitrary … (security-alert@...com)
[SECURITY] [DSA 1557-1] New phpmyadmin packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1534-2] New iceape packages fix regression (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1556-1] New perl packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)

April 25 (4 messages)

[SECURITY] [DSA 1558-1] New xulrunner packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2008:091 ] - Updated wireshark packages fix denial of service vulnerabilities (security@...driva.com)
Lotus expeditor rcplauncher uri handler vulnerability ("Thomas Pollet" <thomas.pollet@...il.com>)
R.I.P. rgod (ipsdix@...il.com)

April 26 (11 messages)

[ GLSA 200804-29 ] Comix: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Re: Firefox 3.0 beta 5 crash (Slightly unrelated) (Skratz0r <roryflyguy@...glemail.com>)
Re: Firefox 3.0 beta 5 crash (Mauro Faccenda <mauro@...cenda.org>)
Curious vulnerability in Excel 2007 (jplopezy@...il.com)
Re: Curious vulnerability in Excel 2007 (jplopezy@...il.com)
GroupWise 7 attached bugs (jplopezy@...il.com)
Wordpress 2.5 Cookie Integrity Protection Vulnerability ("Steven J. Murdoch" <bugtraq+Steven.Murdoch@...cam.ac.uk>)
rPSA-2008-0149-1 idle python (rPath Update Announcements <announce-noreply@...th.com>)
IMF 2008 - 2nd Call for Papers (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
Re: Simple Machines Forum "SMF Shoutbox" Mod Persistent XSS (pobore@...il.com)
Re: Simple Machines Forum "SMF Shoutbox" Mod Persistent XSS (pobore@...il.com)

April 28 (12 messages)

Re: R.I.P. rgod (blacklight@...istici.org)
[SECURITY] [DSA 1556-2] New perl packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1560-1] New kronolith2 packages fix cross site scripting (thijs@...ian.org (Thijs Kinkhorst))
GroupWise 7.0 mailto: scheme buffer overflow (jplopezy@...il.com)
bug report (hadikiamarsi@...mail.com)
[SECURITY] [DSA 1561-1] New ldm packages fix information disclosure (thijs@...ian.org (Thijs Kinkhorst))
London DEFCON meet - Thursday 1st May - DC4420 (Major Malfunction <majormal@...ate-radio.org>)
Minibb 2.2a XSS Vulnerability (irancrash@...il.com)
Microsoft SWI blog inaccuracies (Amit Klein <amit.klein@...steer.com>)
[SECURITY] [DSA 1562-1] New iceape packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ECHO_ADV_88$2008] Prozilla Hosting Index (directory.php cat_id) Blind Sql Injection Vulnerability (erdc@...o.or.id)
[ECHO_ADV_89$2008] Softbiz Web Host Directory Script (search_result.php host_id) Blind Sql Injection Vulnerability (erdc@...o.or.id)

April 29 (10 messages)

CORE-2008-0320 - Insufficient argument validation of hooked SSDT functions on multiple Antivirus and Firewalls (CORE Security Technologies Advisories <advisori…)
Re: h2desk helpdesk path disclosure vulnerability (john@...thcosoft.com)
[ GLSA 200804-30 ] KDE start_kdeinit: Multiple vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)
SugarCRM Community Edition Local File Disclosure Vulnerability (roberto.suggi@...urity-assessment.com)
rPSA-2008-0151-1 libpng (rPath Update Announcements <announce-noreply@...th.com>)
Re: Yourfreeworld Styleish Text Ads Script (rohit@...rfreeworld.com)
XSS Attack (hadikiamarsi@...mail.com)
Re: R.I.P. rgod (Christian Kujau <lists@...dbynature.de>)
[ MDVSA-2008:092 ] - Updated gstreamer-plugins-good packages fix vulnerabilities (security@...driva.com)
[ MDVSA-2008:093 ] - Updated vorbis-tools packages fix vulnerabilities (security@...driva.com)

April 30 (12 messages)

[security bulletin] HPSBMA02331 SSRT080000 rev.1 - HP-UX running WBEM Services, Remote Execution of Arbitrary Code, Gain Extended Privileg… (security-alert@...com)
Critical Vulnerability in SNMPc (NGSSoftware Insight Security Research <nisr@...software.com>)
Re: rPSA-2008-0151-1 libpng (Liran Cohen <theog@....co.il>)
CFP: Workshop on Open Source Software for Computer and Network Forensics (Stefano Zanero <zanero@...t.polimi.it>)
heanet.dl.sourceforge.net hacked? (Michael Scheidell <scheidell@...nap.net>)
Re: heanet.dl.sourceforge.net hacked? (Pieter de Boer <pieter@...darkside.nl>)
Re: heanet.dl.sourceforge.net hacked? (mirrors@...net.ie)
Re: heanet.dl.sourceforge.net hacked? (Rainer Duffner <rainer@...ra-secure.de>)
[SECURITY] [DSA 1563-1] New asterisk packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Re: heanet.dl.sourceforge.net hacked? (Marshall Eubanks <tme@...ticasttech.com>)
Re: Re: heanet.dl.sourceforge.net hacked? (securityfocus.com@...rmoman.de)
Re: R.I.P. rgod ("Christian Kujau" <lists@...dbynature.de>)

371 messages

Powered by blists - more mailing lists