bugtraq mailing list - 2008/07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 18	² 8	³ 2	⁴ 13	⁵ 5	⁶
⁷ 4	⁸ 16	⁹ 11	¹⁰ 14	¹¹ 8	¹² 5	¹³
¹⁴ 8	¹⁵ 6	¹⁶ 20	¹⁷ 10	¹⁸ 10	¹⁹ 6	²⁰
²¹ 28	²² 16	²³ 12	²⁴ 4	²⁵ 15	²⁶ 4	²⁷
²⁸ 15	²⁹ 20	³⁰ 15	³¹ 14

Messages by day:

July 1 (18 messages)

Re: Rhythmbox Vulnerability (wargame89@...oo.it)
[USN-617-2] Samba regression (Jamie Strandboge <jamie@...onical.com>)
Endless loop in Soldner 33724 (Luigi Auriemma <aluigi@...istici.org>)
[SCANIT-2008-002] Wordtrans-web Remote Command Execution Vulnerability (Scanit Labs <research@...nit.net>)
[SCANIT-2008-003] Wordtrans-web Remote Command Execution Vulnerability (Scanit Labs <research@...nit.net>)
CFP 25C3 - The 25th Chaos Communication Congress 2008 (fukami <lists@....io>)
[SCANIT-2008-001] QNX phgrafx Privilege Escalation Vulnerability (Scanit Labs <research@...nit.net>)
[ GLSA 200807-01 ] Python: Multiple integer overflows (Tobias Heinlein <keytoaster@...too.org>)
[security bulletin] HPSBMA02345 SSRT080039 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting … (security-alert@...com)
[ GLSA 200807-02 ] Motion: Execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
New Paper: More than 600 million users surf at high risk ("Stefan Frei" <stefan.frei@...hzoom.net>)
Vuln name: Ruby rb_ary_fill() DOS (snagg@...urenetwork.it)
RE: New Paper: More than 600 million users surf at high risk ("Larry Seltzer" <larry@...ryseltzer.com>)
RE: New Paper: More than 600 million users surf at high risk ("Larry Seltzer" <larry@...ryseltzer.com>)
Deepsec Talks 2007 are online - registration for 2008 is open (DeepSec 2008 <deepsec@...psec.net>)
Re: Collection of Vulnerabilities in Fully Patched Vim 7.1 ("Jan Minář" <rdancer@...ncer.org>)
[SECURITY] [DSA 1560-1] New sympa packages fix denial of service (Steve Kemp <skx@...ian.org>)
RE: New Paper: More than 600 million users surf at high risk (Paul Schmehl <pauls@...allas.edu>)

July 2 (8 messages)

[USN-619-1] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[tool] ratproxy - passive web application security assessment tool (Michal Zalewski <lcamtuf@...ne.cc>)
RE: New Paper: More than 600 million users surf at high risk (Nick FitzGerald <nick@...us-l.demon.co.uk>)
ISEC 2008(Information Security Conference) Guide (isec@...nnews.com)
Secunia Research: VLC Media Player WAV Processing Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
Release of Pass-The-Hash Toolkit v1.4 ("Hernan Ochoa" <hernan@...il.com>)
Re: New Paper: More than 600 million users surf at high risk (Rainer Duffner <rainer@...ra-secure.de>)
Re: New Paper: More than 600 million users surf at high risk ("Rob Thompson" <my.security.lists@...il.com>)

July 3 (2 messages)

rPSA-2008-0211-1 mercurial mercurial-hgk (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0212-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)

July 4 (13 messages)

[ MDVSA-2008:125 ] - Updated PHP packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:126 ] - Updated PHP packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:127 ] - Updated PHP packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:128 ] - Updated PHP packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1601-1] New wordpress packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
Local vulnerability in WeFi Client v3.2.1.4.1(Update) (XiaShing@...il.com)
Unauthorized reading confirmation from Outlook ("Augusto Paes de Barros" <augusto@...uritybalance.com>)
[ MDVSA-2008:130 ] - Updated PHP packages fix multiple vulnerabilities (security@...driva.com)
[ MDVSA-2008:129 ] - Updated PHP packages fix multiple vulnerabilities (security@...driva.com)
F5 FirePass 1200 SNMP daemon DoS (nnposter@...closed.not)
Novell GroupWise Messenger Client (GWIM) Remote Stack Overflow ("[ISR] - Infobyte Security Research" <noreply@...obyte.com.ar>)
[DSECRG-08-027] Multiple RFI-LFI in 1024 CMS 1.4.3, 1.4.4 RFC ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
[ MDVSA-2008:131 ] - Updated phpMyAdmin packages fix multiple vulnerabilities (security@...driva.com)

July 5 (5 messages)

[ MDVSA-2008:132 ] - Updated gnome-screensaver packages fix authentication vulnerability (security@...driva.com)
[ MDVSA-2008:133 ] - Updated sympa packages fix DoS vulnerability (security@...driva.com)
[ MDVSA-2008:134 ] - Updated squid packages fix DoS vulnerability (security@...driva.com)
[ MDVSA-2008:135 ] - Updated gnome-screensaver packages fix authentication vulnerability (security@...driva.com)
[SECURITY] [DSA 1602-1] New pcre3 packages fix arbitrary code execution (Florian Weimer <fw@...eb.enyo.de>)

July 7 (4 messages)

[oCERT-2008-007] libpoppler uninitialized pointer (Andrea Barisani <lcars@...rt.org>)
Re: Multiple vulnerabilities in TietoEnator's Procapita school administration system, at least version (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ GLSA 200807-03 ] PCRE: Buffer overflow (Robert Buchholz <rbu@...too.org>)
PHP-NUKE SQL Module's Name 4ndvddb (lovebug@...mail.it)

July 8 (16 messages)

Pwnie Awards 2008 (Alexander Sotirov <alex@...irov.net>)
Call for Papers for the MEITSEC 2008 is now open. ("Meitsec2008 Conference" <meitsec2008@...il.com>)
Re: Local vulnerability in WeFi Client v3.2.1.4.1(Update) (galia@...i.com)
Call for Papers for the MEITSEC 2008 is now open. ("Meitsec2008 Conference" <meitsec2008@...il.com>)
[security bulletin] HPSBMA02348 SSRT080033 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code, Denial o… (security-alert@...com)
[security bulletin] HPSBMA02349 SSRT080043 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Unauthorized Access to Data (security-alert@...com)
[SECURITY] [DSA 1603-1] New bind9 packages fix cache poisoning (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1604-1] BIND 8 deprecation notice (Florian Weimer <fw@...eb.enyo.de>)
XSS in admin logs - vBulletin 3.7.2 and lower, vBulletin 3.6.10 PL2 and lower ("Jessica Hope" <jessicasaulhope@...glemail.com>)
[SECURITY] [DSA 1605-1] DNS vulnerability impact on the libc stub resolver (Florian Weimer <fw@...eb.enyo.de>)
[ GLSA 200807-04 ] Poppler: User-assisted execution of arbitrary code (Matthias Geerdsen <vorlon@...too.org>)
Cisco Security Advisory: Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[USN-622-1] Bind vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2008:136 ] - Updated Firefox packages fix vulnerabilities (security@...driva.com)
Minneapolis DC612 Meeting July 10th, 2008@6pm ("David Bryan" <synackurg@...il.com>)

July 9 (11 messages)

rPSA-2008-0216-1 firefox (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0217-1 vsftpd (rPath Update Announcements <announce-noreply@...th.com>)
Re: [Full-disclosure] iDefense Security Advisory 07.08.08: Microsoft SQL Server Restore Integer Underflow Vulnerability (Cesar <cesarc56@...oo.com>)
[ MDVSA-2008:137 ] - Updated OpenOffice.org fix vulnerability, and a few other bugs (security@...driva.com)
[ MDVSA-2008:138 ] - Updated OpenOffice.org packages fix vulnerability (security@...driva.com)
Re: Unauthorized reading confirmation from Outlook (Alexander Klink <alexander@...nk.name>)
Insomnia : ISVA-080709.1 - Microsoft SQL Server - Corrupt Backup File Heap Overflow ("Brett Moore" <brett.moore@...omniasec.com>)
Local information disclosure in WeFi Client v3.3.3.0 (XiaShing@...il.Com)
[SECURITY] [DSA 1606-1] poppler packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)
rPSA-2008-0218-1 ruby (rPath Update Announcements <announce-noreply@...th.com>)
Microsoft DNS patch KB951748 incompatible with Zonealarm ("Pages-Web.com - Services internet" <info@...es-web.com>)

July 10 (14 messages)

[ GLSA 200807-05 ] OpenOffice.org: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ MDVSA-2008:139 ] - Updated BIND packages fix critical DNS vulnerability (security@...driva.com)
Context IS Advisory - MS08-39 OWA XSS (Context IS - Disclosure <disclosure@...textis.co.uk>)
[ MDVSA-2008:142 ] - Updated ruby packages fix vulnerabilities (security@...driva.com)
Nessus plugins for recent MS Bulletins ("Chandrashekhar B" <bchandra@...pod.com>)
Re: Microsoft DNS patch KB951748 incompatible with Zonealarm FIXED (davee1@...global.net)
gapicms v9.0.2 (dirDepth) Remote File Inclusion Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
[ GLSA 200807-07 ] NX: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
phpuserbase 1.3 (menu) Remote File Inclusion Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
rPSA-2008-0223-1 poppler (rPath Update Announcements <announce-noreply@...th.com>)
London DEFCON July meet - DC4420 - Thursday 10th July (today!) (alien <alien@...420.org>)
[ GLSA 200807-06 ] Apache: Denial of Service (Robert Buchholz <rbu@...too.org>)
[ MDVSA-2008:141 ] - Updated ruby packages fix vulnerabilities (security@...driva.com)
[ MDVSA-2008:140 ] - Updated ruby packages fix vulnerabilities (security@...driva.com)

July 11 (8 messages)

ZDI-08-041: Novell eDirectory dhost Integer Overflow Code Execution Vulnerability (zdi-disclosures@...m.com)
iDefense Security Advisory 07.09.08: Novell eDirectory LDAP Search Request Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: PR07-37: XSS on Apache HTTP Server 413 error pages via malformed HTTP method (mcalautt@...il.com)
[ MDVSA-2008:143 ] - Updated pidgin packages fix MSN protocol handler vulnerability (security@...driva.com)
[SECURITY] [DSA 1607-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200807-08 ] BIND: Cache poisoning (Matthias Geerdsen <vorlon@...too.org>)
[NETRAGARD SECURITY ADVISORY][Apple Core Image Fun House <= 2.0 OS X -- Arbitrary Code Execution][NETRAGARD-20080711] (Netragard Security Advisories <advisori…)
RE: New Paper: More than 600 million users surf at high risk (Jeff Martin <jbmartin6@...oo.com>)

July 12 (5 messages)

[ MDVSA-2008:138-1 ] - Updated OpenOffice.org packages fix vulnerability (security@...driva.com)
[ MDVSA-2008:144 ] - Updated openldap packages fix slapd DoS vulnerability (security@...driva.com)
Re: Microsoft DNS patch KB951748 incompatible with Zonealarm (jgable@...elabs.com)
Re: Microsoft DNS patch KB951748 incompatible with Zonealarm (Steve Shockley <steve.shockley@...ckley.net>)
Re: New Paper: More than 600 million users surf at high risk (Rob Thompson <my.security.lists@...il.com>)

July 14 (8 messages)

Re: Re: Microsoft DNS patch KB951748 incompatible with Zonealarm (nelsrob@....net)
[SECURITY] [DSA 1608-1] New mysql-dfsg-5.0 packages fix authorization bypass (Devin Carraway <devin@...ian.org>)
Simple DNS Plus 5.0/4.1 < remote Denial of Service exploit ("Rotem-BugSec" <rotem@...sec.com>)
Pluck Local File inclusion (admin@...report.ir)
FreeBSD Security Advisory FreeBSD-SA-08:06.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
DeepSec 2008 - Last call for submissions (DeepSec Conference Vienna <deepsec@...psec.net>)
Re: PR07-37: XSS on Apache HTTP Server 413 error pages via malformed HTTP method (ProCheckUp Research <research@...checkup.com>)
Yuhhu Pubs Black Cat Remote SQL Injection Exploit (RM-x@....com)

July 15 (6 messages)

[ MDVSA-2008:145 ] - Updated bluez/bluez-utils packages fix SDP packet parsing vulnerability (security@...driva.com)
CFP now open for ClubHack2008 - India (ClubHack <seclist@...bhack.com>)
[USN-624-1] PCRE vulnerability (Kees Cook <kees@...ntu.com>)
HPSBST02350 SSRT080102 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-037 to MS08-040 (security-alert@...com)
[SECURITY] [DSA 1609-1] New lighttpd packages fix multiple DOS issues (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1610-1] New gaim packages fix execution of arbitrary code (Steve Kemp <skx@...ian.org>)

July 16 (20 messages)

[SECURITY] [DSA 1569-3] New cacti packages fix regression (thijs@...ian.org (Thijs Kinkhorst))
[ GLSA 200807-09 ] Mercurial: Directory traversal (Tobias Heinlein <keytoaster@...too.org>)
[ MDVSA-2008:147 ] - Updated pcre packages fix vulnerability (security@...driva.com)
iDefense Security Advisory 07.15.08: Oracle Internet Directory Pre-Authentication LDAP DoS Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.15.08: Oracle Database DBMS_AQELM Package Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 07.15.08: Oracle Database Local Untrusted Library Path Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDVSA-2008:146 ] - Updated poppler packages fix arbitrary code execution vulnerability (security@...driva.com)
Arbitrary code execution in Netrw version 127, Vim 7.2b ("Jan Minář" <rdancer@...ncer.org>)
[security bulletin] HPSBMA02346 SSRT080097 rev.1 - HP Select Identity Active Directory Bidirectional LDAP Connector, Remote Unauthorized A… (security-alert@...com)
Oracle Application Server PLSQL injection flaw ("David Litchfield" <davidl@...software.com>)
Re: Re: Microsoft DNS patch KB951748 incompatible with Zonealarm (dwg5901@...a.edu)
[security bulletin] HPSBMA02133 SSRT061201 rev.9 - HP Oracle for OpenView (OfO) Critical Patch Update (security-alert@...com)
[ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability (adv@...dc.org)
[DSECRG-08-028] File read in Velocity web-server (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
n.runs-SA-2008.002 - F-Prot Out-of-Bound Memory Access DoS (remote) (<security@...ns.com>)
[SECURITY] [DSA 1544-2] New pdns-recursor packages fix predictable randomness (Florian Weimer <fw@...eb.enyo.de>)
openPro 1.3.1 (LIBPATH) Remote RFI Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
rPSA-2008-0035-1 httpd mod_ssl (rPath Update Announcements <announce-noreply@...th.com>)
IETF Internet-Draft on TCP Port randomization (Fernando Gont <fernando.gont@...il.com>)
[SECURITY] [DSA 1611-1] New afuse packages fix privilege escalation (thijs@...ian.org (Thijs Kinkhorst))

July 17 (10 messages)

[security bulletin] HPSBUX02351 SSRT080058 rev.1 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)
ekoparty security trainings (2008) announcement (ekoparty <no-reply@...party.com.ar>)
[DSECRG-08-029] Local File Include in Dokeos E-Learning System 1.8.5 (Digital Security Research Group <research@...c.ru>)
Oracle Portal XSS fixed by CPU July 2008 (Andrea Purificato <a.purificato@....it>)
HPSBMA02346 SSRT080097 rev.2 - HP Select Identity Active Directory Bidirectional LDAP Connector, Remote Unauthorized Access (security-alert@...com)
[USN-623-1] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
communitycms-0.1 Remote File Includion (n3tr00t3r@...oo.com)
ZDI-08-044: Mozilla Firefox CSSValue Array Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-043: Sun Java Web Start vm args Stack Buffer Overflow (zdi-disclosures@...m.com)
ZDI-08-042: Sun Java Web Start Sandbox Bypass Vulnerability (zdi-disclosures@...m.com)

July 18 (10 messages)

Security Vacation Guide (Pete Herzog <lists@...com.org>)
Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution ("Jan Minář" <rdancer@...ncer.org>)
Windows Vista Power Management & Local Security Policy ("Abe Getchell" <me@...getchell.com>)
Def_Blog 1.0.3 Multiple Remote SQL Injection Vulnerabilities (tan_prathan@...mail.com)
Lateral SQL Injection Revisited - No Special Privs Required ("David Litchfield" <davidl@...software.com>)
[ MDVSA-2008:148 ] - Updated Firefox packages fix vulnerabilities (security@...driva.com)
[ISecAuditors Security Advisories] SmbClientParser Perl module allows remote command execution (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Re: Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution ("Nikolai Weibull" <now@...wi.se>)
[DSECRG-08-030] Claroline 1.8.9 Multiple Security Vulnerabilities ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Re: Lateral SQL Injection Revisited - No Special Privs Required (a.polyakov@...c.ru)

July 19 (6 messages)

[security bulletin] HPSBUX02351 SSRT080058 rev.2 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)
rPSA-2008-0231-1 bind bind-utils (rPath Update Announcements <announce-noreply@...th.com>)
Oracle Database Local Untrusted Library Path Vulnerability (Joxean Koret <joxeankoret@...oo.es>)
RE: Lateral SQL Injection Revisited - No Special Privs Required ("David Litchfield" <davidl@...software.com>)
RE: Windows Vista Power Management & Local Security Policy (Jim Harrison <Jim@...tools.org>)
RE: Windows Vista Power Management & Local Security Policy ("Abe Getchell" <me@...getchell.com>)

July 21 (28 messages)

Easybookmarker 40tr Xss Vulnerability By Khashayar Fereidani (irancrash@...il.com)
[ MDVSA-2008:149 ] - Updated mysql packages fix vulnerabilities (security@...driva.com)
Re: Oracle Database Local Untrusted Library Path Vulnerability (jmpascual <jmpascual@...n3s.com>)
EasyPublish 3.0tr Multiple Vulnerabilities ( Xss / Sql Injection Exploit / File Disclosure Exploit ) (irancrash@...il.com)
RE: Windows Vista Power Management & Local Security Policy ("Thor (Hammer of God)" <thor@...merofgod.com>)
Easyecards 310a Multipe Vulerabilities ( Xss / Sql Injection Exploit / File Disclosure Exploit ) By Khashayar Fereidani (irancrash@...il.com)
[ MDVSA-2008:150 ] - Updated mysql packages fix vulnerabilities (security@...driva.com)
EMC Dantz Retrospect 7 backup Client PlainText Password Hash Disclosure Vulnerability (zhliu@...tinet.com)
FGA-2008-16: EMC Dantz Retrospect 7 backup Client 7.5.116 Remote Memory corruption Vulnerability (zhliu@...tinet.com)
Vulnerability CVE-2008-3671 - MyReview's vulnerability in the access control system ("Julien Thomas" <julien.thomas.1@...il.com>)
Maran PHP Blog Xss By Khashayar Fereidani (irancrash@...il.com)
Easydynamicpages 30tr Multipe Vulerabilities ( Xss / Sql Injection Exploit / File Disclosure Exploit ) (irancrash@...il.com)
EZWebAlbum (dlfilename) Remote File Disclosure Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
MyBlog <=0.9.8 Multiple Vulnerabilities (admin@...report.ir)
RE: Windows Vista Power Management & Local Security Policy ("Abe Getchell" <me@...getchell.com>)
RE: Windows Vista Power Management & Local Security Policy (Jim Harrison <Jim@...tools.org>)
RE: Windows Vista Power Management & Local Security Policy ("Abe Getchell" <me@...getchell.com>)
Vim: Improper Implementation of shellescape()/Arbitrary Code Execution ("Jan Minář" <rdancer@...ncer.org>)
FGA-2008-16: EMC Dantz Retrospect 7 backup Client 7.5.116 NULL-Pointer reference Denial of Service Vulnerability (zhliu@...tinet.com)
[DSECRG-08-031] Local File Include Vulnerability in Interact 2.4.1 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Re: Pwnie Awards 2008 ("David Litchfield" <davidl@...software.com>)
Flip V3.0 final (Cru3l.b0y@...il.com)
Re: SchoolCenter URL Handling Cross Site Scripting Vulnerability (Tester@...oo.com)
[White Paper] Abusing HTML 5 Structured Client-side Storage (Alberto Trivero <a.trivero@...discover.com>)
[SECURITY] [DSA 1612-1] New ruby1.8 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200807-10 ] Bacula: Information disclosure (Pierre-Yves Rofes <py@...too.org>)
E-Mail header Injection in HiFriend (Peter Wiesen <broken-error@...mail.com>)
[ GLSA 200807-11 ] PeerCast: Buffer overflow (Pierre-Yves Rofes <py@...too.org>)

July 22 (16 messages)

NULL pointer in ZDaemon 1.08.07 (Luigi Auriemma <aluigi@...istici.org>)
Re: [ GLSA 200807-10 ] Bacula: Information disclosure (dan@...gille.org)
[ MDVSA-2008:151 ] - Updated libxslt packages fix buffer overflow vulnerability (security@...driva.com)
[ GLSA 200807-12 ] BitchX: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
FGA-2008-16: EMC Dantz Retrospect 7 backup Server Authentication Module Weak Password Hash Arithmetic Vulnerability (zhliu@...tinet.com)
Vulnerability: SocialEngine (SocialEngine.net) high risk security flaw ("Tim Loshak" <tim.loshak@...il.com>)
[security bulletin] HPSBMA02346 SSRT080097 rev.3 - HP OpenView Select Identity Active Directory Bidirectional LDAP Connector, Remote Unaut… (security-alert@...com)
[SECURITY] [DSA 1613-1] new libgd2 packages fix multiple vulnerabilities (Devin Carraway <devin@...ian.org>)
[DSECRG-08-032] Claroline 1.8.10 Multiple XSS Vulnerabilities ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
PR08-13: Persistent Cross-site Scripting (XSS) on Moodle via blog entry title (ProCheckUp Research <research@...checkup.com>)
PR08-15: Several Webroot Disclosures on Moodle (ProCheckUp Research <research@...checkup.com>)
PR08-16: CSRF (Cross-site Request Forgery) on Moodle edit profile page (ProCheckUp Research <research@...checkup.com>)
[USN-627-1] Dnsmasq vulnerability (Jamie Strandboge <jamie@...onical.com>)
Outpost Security Suite Pro ver. 2009 Multiple vulnerabilities (jplopezy@...il.com)
RE: Windows Vista Power Management & Local Security Policy ("James C. Slora Jr." <james.slora@...a.com>)
RE: Windows Vista Power Management & Local Security Policy (Jim Harrison <Jim@...tools.org>)

July 23 (12 messages)

[ MDVSA-2008:152 ] - Updated wireshark packages fix denial of service vulnerability (security@...driva.com)
AST-2008-011: Traffic amplification in IAX2 firmware provisioning system ("Asterisk Security Team" <security@...erisk.org>)
RE: Windows Vista Power Management & Local Security Policy ("Abe Getchell" <me@...getchell.com>)
AST-2008-010: Asterisk IAX 'POKE' resource exhaustion ("Asterisk Security Team" <security@...erisk.org>)
RE: Windows Vista Power Management & Local Security Policy ("Good Securitypractice" <goodsecuritypractice@...il.com>)
Vim: Flawed Fix of Arbitrary Code Execution Vulnerability in filetype.vim ("Jan Minář" <rdancer@...ncer.org>)
[SECURITY] [DSA 1540-3] New lighttpd packages fix regression (thijs@...ian.org (Thijs Kinkhorst))
[USN-628-1] PHP vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1614-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1615-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Wordpress Malicious File Execution Vulnerability (otto@...odestruct.com)
[ MDVSA-2008:153 ] - Updated emacs packages fix vulnerability (security@...driva.com)

July 24 (4 messages)

[SECURITY] [DSA 1616-1] new clamav packages fix denial of service (Devin Carraway <devin@...ian.org>)
[ MDVSA-2008:154 ] - Updated xemacs packages fix vulnerability (security@...driva.com)
CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning Flaw Exploit ("I)ruid" <druid@...ghq.org>)
[Full-disclosure] [tool] SDT Cleaner 1.0 ("Nahuel C. Riva" <lists@...est.com>)

July 25 (15 messages)

Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution ("Jan Minář" <rdancer@...ncer.org>)
[USN-629-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution (Robert Buchholz <rbu@...too.org>)
[SECURITY] [DSA 1617-1] New refpolicy packages fix incompatible policy (Devin Carraway <devin@...ian.org>)
Secunia Research: RealPlayer SWF Frame Handling Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
XRMS 1.99.2 (RFI/XSS/IG) Multiple Remote Vulnerabilities (azzcoder@...mail.com)
ezContents CMS Renote File inclusion (security@...or.net)
SECOBJADV-2008-02: Cygwin Installation and Update Process can be Subverted Vulnerability (advisories@...t.security-objectives.com)
Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution ("Steven M. Christey" <coley@...us.mitre.org>)
Re: [Full-disclosure] CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning Flaw Exploit (Ganbold <ganbold@...om.mng.net>)
Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution (Robert Buchholz <rbu@...too.org>)
Re: Re: [Full-disclosure] CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning ("Tuc at T-B-O-H.NET" <ml@...-o-h.net>)
ZDI-08-045: Apple Safari StyleSheet ownerNode Heap Corruption Vulnerability (zdi-disclosures@...m.com)
http://www.zerodayinitiative.com/advisories/ZDI-08-046 (zdi-disclosures@...m.com)
ZDI-08-047: RealNetworks RealPlayer rmoc3260 ActiveX Control Memory Corruption Vulnerability (zdi-disclosures@...m.com)

July 26 (4 messages)

[SECURITY] [DSA 1616-2] New clamav packages fix denial of service (Devin Carraway <devin@...ian.org>)
[ MDVSA-2008:155 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1618-1] New ruby1.9 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution ("Jan Minář" <rdancer@...ncer.org>)

July 28 (15 messages)

[SECURITY] [DSA 1619-1] New python-dns packages fix DNS response spoofing (Devin Carraway <devin@...ian.org>)
Re: how to request a cve id? ("Steven M. Christey" <coley@...us.mitre.org>)
[SECURITY] [DSA 1620-1] New python2.5 packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
how to request a cve id? ("xpzhang" <tsecond@...h.net>)
[ MDVSA-2008:155-1 ] - Updated Thunderbird packages fix multiple vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1621-1] New icedove packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Security Bypass Vulnerabilities AXESSTEL (Bboyhacks@...il.com)
[DSECRG-08-033] Local File Include Vulnerability in Pixelpost 1.7.1 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Tool release: [evilgrade] - Using DNS cache poisoning to exploit poor update implementations ("[ISR] - Infobyte Security Research" <noreply@...obyte.com.ar>)
[security bulletin] HPSBMA02353 SSRT080066 rev.1 - HP OpenView Internet Services Running Probe Builder, Remote Denial of Service (DoS) (security-alert@...com)
JamRoom <= 3.3.8 Authentication Bypass (GulfTech Security Research <security@...ftech.org>)
RE: Windows Vista Power Management & Local Security Policy ("Greg" <bugtraq1@...andyman.com.au>)
Multiple Cross-Site Scripting Vulnerabilities in Web Wiz Rich Text Editor version 4.02 (supportrup@...il.com)
ViArt <= 3.5 SQL Injection (GulfTech Security Research <security@...ftech.org>)
Cross Site Scripting (XSS) in Owl <=0.95, CVE-2008-3100 (Fabian Fingerle <fabian@...ensalat.eu>)

July 29 (20 messages)

[USN-626-1] Firefox and xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
iDefense Security Advisory 07.28.08: Hewlett-Packard OVIS Probe Builder Arbitrary Process Termination Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDVSA-2008:156 ] - Updated libpng packages fix vulnerability (security@...driva.com)
[USN-626-1] Firefox and xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
rPSA-2008-0236-1 httpd mod_ssl (rPath Update Announcements <announce-noreply@...th.com>)
PhpJobScheduler 3.1 Remote File Inclusion Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
rPSA-2008-0237-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2008-0238-1 firefox (rPath Update Announcements <announce-noreply@...th.com>)
[USN-631-1] poppler vulnerability (Kees Cook <kees@...ntu.com>)
[USN-631-1] poppler vulnerability (Kees Cook <kees@...ntu.com>)
plugin Rss Remote File Inclusion Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
[DSECRG-08-034] Local File Include Vulnerability in Minishowcase v09b136 ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Gregarius <= 0.5.4 SQL Injection (GulfTech Security Research <security@...ftech.org>)
VMSA-2008-00011 Updated ESX service console packages for Samba and vmnix (VMware Security team <security@...are.com>)
rPSA-2008-0235-1 fetchmail fetchmailconf (rPath Update Announcements <announce-noreply@...th.com>)
[USN-630-1] ffmpeg vulnerability (Kees Cook <kees@...ntu.com>)
n.runs-SA-2008.004 - AVG Anti-Virus Divide by Zero - DoS (remote) (<security@...ns.com>)
Remote Cisco IOS FTP exploit ("Andy Davis" <iosftpexploit@...glemail.com>)
Re: E-Mail header Injection in HiFriend (Adrian Pastor <adrian.pastor@...checkup.com>)
[ MDVSA-2008:157 ] - ffmpeg (security@...driva.com)

July 30 (15 messages)

shoutbox Remote Database Dawnload Exploit (Ghost hacker <ghost-r00t@...mail.com>)
Cisco IOS shellcode explanation ("Andy Davis" <iosftpexploit@...glemail.com>)
HIOX Star Rating System 1.0 Remote File Inclusion Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
Memory corruption and NULL pointer in Unreal Tournament III 1.2 (Luigi Auriemma <aluigi@...istici.org>)
RE: Remote Cisco IOS FTP exploit ("Paul Oxman (poxman)" <poxman@...co.com>)
HIOX Random Ad 1.3 (hioxRandomAd.php hm) RFI Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
HIOX Browser Statistics 2.0 Remote File Inclusion Vulnerability (Ghost hacker <ghost-r00t@...mail.com>)
NULL pointer in Unreal Tournament 2004 v3369 (Luigi Auriemma <aluigi@...istici.org>)
MJGuest 6.8 GT Cross Site Scripting Vulnerability (irancrash@...il.com)
RealNetworks RealPlayer ActiveX Illegal Resource Reference Vulnerability (cocoruder <cocoruder@...il.com>)
Tool: PorkBind Nameserver Security Scanner (super@...u.org)
Cisco IOS shellcode explanation - additional ("Andy Davis" <iosftpexploit@...glemail.com>)
[ MDVSA-2008:158 ] silc-toolkit (security@...driva.com)
DEV WMS Multiple Vulnerabilities (irancrash@...il.com)
Citrix MetaFrame Privilege Escalation ("Wendel Guglielmetti Henrique" <wsguglielmetti@...il.com>)

July 31 (14 messages)

[ MDVSA-2008:159 ] licq (security@...driva.com)
[oCERT-2008-009] libxslt heap overflow (Andrea Barisani <lcars@...rt.org>)
Secunia Research: Blue Coat K9 Web Protection "Referer" Header Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPSBUX02286 SSRT071466 rev.1 - HP-UX Running System Administration Manager (SAM), Unintended Remote Access (security-alert@...com)
Pligg <= 9.9.0 Multiple Vulnerabilities (GulfTech Security Research <security@...ftech.org>)
Secunia Research: Blue Coat K9 Web Protection Response Handling Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1622-1] New newsx packages fix arbitrary code execution (thijs@...ian.org (Thijs Kinkhorst))
[~] Greetz : Me93fg & Mr.SaFa7 (Ghost hacker <ghost-r00t@...mail.com>)
iDefense Security Advisory 07.30.08: SAP MaxDB dbmsrv Untrusted Execution Path Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ GLSA 200807-15 ] Pan: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1623-1] New dnsmasq packages fix cache poisoning (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200807-14 ] Linux Audit: Buffer overflow (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200807-13 ] VLC: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1624-1] New libxslt packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)

307 messages

Powered by blists - more mailing lists