bugtraq mailing list - 2008/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2008/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 11	² 12	³ 11	⁴ 19	⁵ 8	⁶ 6	⁷
⁸ 20	⁹ 18	¹⁰ 21	¹¹ 18	¹² 6	¹³	¹⁴
¹⁵ 16	¹⁶ 10	¹⁷ 6	¹⁸ 16	¹⁹ 7	²⁰ 3	²¹
²² 22	²³	²⁴ 18	²⁵ 5	²⁶	²⁷	²⁸
²⁹ 12	³⁰ 4	³¹ 4

Messages by day:

December 1 (11 messages)

[SECURITY] [DSA 1673-1] New wireshark packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1674-1] New jailer packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1675-1] New phpmyadmin packages fix cross site scripting (Thijs Kinkhorst <thijs@...ian.org>)
[TKADV2008-013] VLC media player RealMedia Processing Integer Overflow Vulnerability (Tobias Klein <tk@...pkit.de>)
/bin/login gives root to group utmp (Paul Szabo <psz@...hs.usyd.edu.au>)
Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability (het_ebadi@...oo.com)
Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability (zimpel@...nline.de)
[BMSA 2008-09] Two buffer overflow vulnerabilities in Rumpus v6.0 (Nam Nguyen <namn@...emoon.com.vn>)
[USN-681-1] ImageMagick vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-682-1] libvorbis vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1676-1] New flamethrower packages fix denial of service (dann frazier <dannf@...ian.org>)

December 2 (12 messages)

Cpanel fantastico Privilege Escalation "ModSec and PHP restriction Bypass" (l1un@...mail.com)
Dates for SyScan'09 ("organiser@...can.org" <organiser@...can.org>)
Re: /bin/login gives root to group utmp (0xjbrown41@...il.com)
[USN-683-1] Imlib2 vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200812-01 ] OptiPNG: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-05 ] libsamplerate: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-03 ] IPsec-Tools: racoon Denial of Service (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-06 ] libxml2: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-04 ] lighttpd: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-02 ] enscript: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-07 ] Mantis: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[SECURITY] [DSA 1677-1] New CUPS packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))

December 3 (11 messages)

[USN-684-1] ClamAV vulnerability (Kees Cook <kees@...ntu.com>)
VMSA-2008-0019 VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzip2 (VMware Security team <security@...are.co…)
[HACKATTACK Advisory 20081203]Pro Clan Manager 0.4.2 - Session Fixation (office@...kattack.at)
Re: Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability (zimpel@...nline.de)
[SECURITY] [DSA 1678-1] New perl packages fix privilege escalation (Steffen Joeris <white@...ian.org>)
[SECURITY] [DSA 1679-1] New awstats packages fix cross-site scripting (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBUX02389 SSRT080141 rev.1 - HP-UX, Local Denial of Service (DoS) (security-alert@...com)
[SVRT-06-08] MULTI SECURITY VULNERABILITIES IN MVNFORUM ("SVRT-Bkis" <svrt@...v.com.vn>)
Re: [HACKATTACK Advisory 20081127]Social Impress CMS 1.1 - Session Fixation (rene.sato@....de)
Re: VMSA-2008-0019 VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzi… (Steve Shockley <steve.shockley@...ckley…)
[USN-685-1] Net-SNMP vulnerabilities (Kees Cook <kees@...ntu.com>)

December 4 (19 messages)

[USN-686-1] AWStats vulnerability (Kees Cook <kees@...ntu.com>)
Joomla Component GameQ (r3d.w0rm@...oo.com)
DDIVRT-2008-18 Orb Denial of Service (DDI.VulnerabilityAlert@...frontline.com)
Re: [USN-684-1] ClamAV vulnerability (0xjbrown41@...il.com)
[UPRSN] Ubuntu Privacy Remix 8.04r1 fixes security issues (Ubuntu Privacy Remix Team <security_notice@...vacy-cd.org>)
CVE-2008-2086: Java Web Start File Inclusion via System Properties Override (VSR Advisories <advisories@...curity.com>)
[ MDVSA-2008:236 ] vim (security@...driva.com)
Advisory 06/2008: PHP ZipArchive::extractTo() Directory Traversal Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
[SECURITY] [DSA 1680-1] New clamav packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
Re: XSS in Internet Explorer 6 and 7 ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA 1681-1] New Linux 2.6.24 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
iDefense Security Advisory 12.04.08: Sun Java JRE TrueType Font Parsing Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Joomla Component mydyngallery (r3d.w0rm@...oo.com)
iDefense Security Advisory 12.04.08: Sun Java Web Start GIF Decoding Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 12.04.08: Sun Java JRE Pack200 Decompression Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: Joomla Component GameQ (packet@...ketstormsecurity.org)
[ MDVSA-2008:237 ] apache2 (security@...driva.com)
[USN-687-1] nfs-utils vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
iDefense Security Advisory 12.04.08: Sun Java JRE TrueType Font Parsing Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

December 5 (8 messages)

ZDI-08-077: Trillian AIM IMG Tag Parsing Stack Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-078: Trillian IMG SRC ID Memory Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-079: Trillian AIM Plugin Malformed XML Tag Heap Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-080: Sun Java AWT Library Sandbox Violation Vulnerability (zdi-disclosures@...m.com)
ZDI-08-081: Sun Java Web Start and Applet Multiple Sandbox Bypass Vulnerabilities (zdi-disclosures@...m.com)
[ MDVSA-2008:238 ] libsamplerate (security@...driva.com)
CVE-2008-5079: multiple listen()s on same socket corrupts the vcc table (Hugo Dias <hdias@...chlabs.com>)
RE: DDIVRT-DDIVRT-2008-15 iPhone Configuration Web Utility 1.0 for Windows Directory Traversal (VulnerabilityAlert@...frontline.com)

December 6 (6 messages)

[ MDVSA-2008:239 ] clamav (security@...driva.com)
Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file (Eygene Ryabinkin <rea-sec@...elabs.ru>)
Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file (Ilia Alshanetsky <ilia@...host.org>)
Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file (Eygene Ryabinkin <rea-sec@...elabs.ru>)
[ GLSA 200812-08 ] Mgetty: Insecure temporary file usage (Pierre-Yves Rofes <py@...too.org>)
SecurityReason: PHP 5.2.6 SAPI php_getuid() overload (cxib@...urityreason.com)

December 8 (20 messages)

[SECURITY] [DSA 1682-1] New squirrelmail packages fix cross site scripting (thijs@...ian.org (Thijs Kinkhorst))
Multiple Vendor Anti-Virus Software Malicious WebPage Detection Bypass (xhakerman2006@...oo.com)
Two XSS Flaws in PrestaShop 1.1.0.3 (th3.r00k.ieatpork@...il.pork.com)
XSS in PHPepperShop v 1.4 (th3.r00k.ieatpork@...il.pork.com)
RadAsm <=2.2.1.5 Local Command Execution (xhakerman2006@...oo.com)
Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload (Eygene Ryabinkin <rea-sec@...elabs.ru>)
[DSECRG-08-040] Multiple Local File Include Vulnerabilities in Xoops 2.3.x ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload (Maksymilian Arciemowicz <cxib@...urityreason.com>)
Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload (Eygene Ryabinkin <rea-sec@...elabs.ru>)
[SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops ("SVRT-Bkis" <svrt@...v.com.vn>)
[DSECRG-08-041] Stored XSS Vulnerability in Xoops 2.3.x ("Digital Security Research Group [DSecRG]" <research@...c.ru>)
Re: RadAsm <=2.2.1.5 Local Command Execution ("Li Gen" <superligen@...il.com>)
[security bulletin] HPSBMA02390 SSRT071481 rev.1 - HP OpenView Performance Agent, HP Performance Agent, Remote Denial of Service (DoS) (security-alert@...com)
Neostrada Livebox Remote Network Down PoC Exploit (0in.email@...il.com)
[security bulletin] HPSBMA02391 SSRT071481 rev.1 - HP OpenView Reporter and HP Reporter Running on Windows, Remote Denial of Service (DoS) (security-alert@...com)
DoS Vulnerability in Aruba Mobility Controller Caused by Malformed EAP Frame (Aruba Advisory ID: AID-12808) ("Robbie (Rupinder) Gill" <rgill@...banetworks.com>)
[SECURITY] [DSA 1683-1] New streamripper packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
ZDI-08-082: BMC PatrolAgent Version Logging Format String Vulnerability (zdi-disclosures@...m.com)
Multiple XSRF in DD-WRT (Remote Root Command Execution) (th3.r00k.ieatpork@...il.pork.com)
Re: [Full-disclosure] MS OWA 2003 Redirection Vulnerability - [MSRC 7368br] (Peter Watkins <peterw@....org>)

December 9 (18 messages)

DoS attacks on MIME-capable software via complex MIME emails (bruhns@...urity-labs.com)
[ MDVSA-2008:236-1 ] vim (security@...driva.com)
PHP safe_mode can be bypassed via proc_open() and custom environment. (gat3way@...3way.eu)
SEC Consult SA-20081109-0 :: Microsoft SQL Server 2000 sp_replwritetovarbin limited memory overwrite vulnerability (Bernhard Mueller <research@...-consult.com>)
Multiple Vendor Anti-Virus Software Malicious WebPage Detection Bypass -Update- (xhakerman2006@...oo.com)
rPSA-2008-0332-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
Re: DoS attacks on MIME-capable software via complex MIME emails ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Secunia Research: Microsoft Word RTF Polyline/Polygon Integer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Microsoft Excel NAME Record Array Indexing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
CORE-2008-1127 - Vinagre show_error() format string vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
iDefense Security Advisory 12.09.08: Microsoft Internet Explorer 5.01 EMBED tag Long File Name Extension Stack Buffer O… (iDefense Labs <labs-no-reply@...fense.c…)
Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows (Secunia Research <remove-vuln@...unia.com>)
iDefense Security Advisory 12.09.08: Microsoft Windows Graphics Device Interface Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
ZDI-08-083: Microsoft Animation ActiveX Control Malformed AVI Parsing Code Execution Vulnerability (zdi-disclosures@...m.com)
ZDI-08-084: Microsoft Office RTF Consecutive Drawing Object Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-08-085: Microsoft Office RTF Drawing Object Heap Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-086: Microsoft Office Word Document Table Property Stack Overflow Vulnerability (zdi-disclosures@...m.com)
ZDI-08-087: Microsoft Internet Explorer Webdav Request Parsing Heap Corruption Vulnerability (zdi-disclosures@...m.com)

December 10 (21 messages)

Insomnia : ISVA-081209.1 - IE Webdav Request Parsing Heap Corruption Vulnerability ("Brett Moore" <brett.moore@...omniasec.com>)
ISOI 6, Dallas, TX - January 29, 30 (Gadi Evron <ge@...uxbox.org>)
[USN-689-1] Vinagre vulnerability (Kees Cook <kees@...ntu.com>)
[USN-678-2] GnuTLS regression (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1684-1] New lcms packages fix multiple vulnerabilities (Devin Carraway <devin@...ian.org>)
[IVIZ-08-011] ClamAV lzh unpacking segmentation fault ("iViZ Security Advisories" <advisories@...zsecurity.com>)
[IVIZ-08-012] Bitdefender antivirus for Linux multiple vulnerabilities ("iViZ Security Advisories" <advisories@...zsecurity.com>)
[IVIZ-08-013] Avast antivirus for Linux multiple vulnerabilities ("iViZ Security Advisories" <advisories@...zsecurity.com>)
[IVIZ-08-014] AVG antivirus for Linux vulnerability ("iViZ Security Advisories" <advisories@...zsecurity.com>)
[IVIZ-08-015] Sophos Antivirus for Linux vulnerability ("iViZ Security Advisories" <advisories@...zsecurity.com>)
[IVIZ-08-016] F-Secure f-prot Antivirus for Linux corrupted ELF header Security Bypass ("iViZ Security Advisories" <advisories@...zsecurity.com>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) (s.gottschall@...wrt.com)
Microsoft SQL Server 2005 sp_replwritetovarbin memory overwrite (update to SEC Consult SA-20081209) (Bernhard Mueller <research@...-consult.com>)
CORE-2008-0228: Microsoft Word Malformed FIB Arbitrary Free Vulnerability (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[security bulletin] HPSBUX02393 SSRT080057 rev.1 - HP-UX Running DCE, Remote Denial of Service (DoS) (security-alert@...com)
[ GLSA 200812-09 ] OpenSC: Insufficient protection of smart card PIN (Robert Buchholz <rbu@...too.org>)
[ GLSA 200812-10 ] Archive::Tar: Directory traversal vulnerability (Robert Buchholz <rbu@...too.org>)
iDefense Security Advisory 12.10.08: Microsoft Excel Malformed Object Memoy Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Max's Guestbook (XSS) Remote Vulnerability (08253@...rickcollege.nl)
CA ARCserve Backup LDBserver Vulnerability ("Williams, James K" <James.Williams@...com>)
[ MDVSA-2008:240 ] vinagre (security@...driva.com)

December 11 (18 messages)

[ GLSA 200812-11 ] CUPS: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Browser Security Handbook (Michal Zalewski <lcamtuf@...ne.cc>)
AST-2008-012: Remote crash vulnerability in IAX2 ("Asterisk Security Team" <security@...erisk.org>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) (Hanno Böck <hanno@...eck.de>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) ("David E. Thiel" <lx@...undancy.redundancy.org>)
Black Hat: New Webinar, Japan audio now on-line. ("jmoss" <jmoss@...ckhat.com>)
aspProductCatalog Sql Injection (r3d.w0rm@...oo.com)
Meta Cart Free Database Disclosure (r3d.w0rm@...oo.com)
facto Database Disclosure (r3d.w0rm@...oo.com)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) (pUm <hijacka@...glemail.com>)
Re[2]: Multiple XSRF in DD-WRT (Remote Root Command Execution) ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
Secunia Research: CA ARCserve Backup RPC "handle_t" Argument Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) ("Sebastian Gottschall (DD-WRT) " <s.gottschall@...wrt.com>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) ("Sebastian Gottschall (DD-WRT) " <s.gottschall@...wrt.com>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) (dan.crowley@...il.com)
Aspect9: Internet Explorer 8.0 Beta 2 Anti-XSS Filter Vulnerabilities ("Rafel Ivgi" <rafelivgi@...il.com>)
Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) ("David E. Thiel" <lx@...undancy.redundancy.org>)
Re: Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) (dan.crowley@...il.com)

December 12 (6 messages)

ASP-CMS v.1.0 Sql Injection/Database Disclosure (r3d.w0rm@...oo.com)
rPSA-2008-0336-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
Nokia N70/N73 Bluetooth Stack OBEX Implementation Denial of Service (yangdn@...c.org.cn)
[SECURITY] [DSA 1685-1] New uw-imap packages fix multiple vulnerabilities (Steffen Joeris <white@...ian.org>)
Moodle 1.9.3 Remote Code Execution (ascii <ascii@...amail.com>)
[ GLSA 200812-12 ] Honeyd: Insecure temporary file creation (Tobias Heinlein <keytoaster@...too.org>)

December 15 (16 messages)

[ GLSA 200812-14 ] aview: Insecure temporary file usage (Tobias Heinlein <keytoaster@...too.org>)
[SECURITY] [DSA 1686-1] New no-ip packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200812-15 ] POV-Ray: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200812-16 ] Dovecot: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
CFAGCMS Remote File Inclusion (admin@...report.ir)
[TKADV2008-014] MPlayer TwinVQ Processing Stack Buffer Overflow Vulnerability (Tobias Klein <tk@...pkit.de>)
Re: Moodle 1.9.3 Remote Code Execution (lent@...per.edu)
Multiple XSS Vulnerabilities in World Recipe 2.11 (security@...orize.com)
phpList vulnerability (phplist <info@...list.com>)
[ GLSA 200812-13 ] OpenOffice.org: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Re: Moodle 1.9.3 Remote Code Execution ("Jamie Riden" <jamie.riden@...il.com>)
Re: Re: Multiple XSRF in DD-WRT (Remote Root Command Execution) (0xjbrown41@...il.com)
TmaxSoft JEUS Alternate Data Streams Vulnerability ("Simon Ryeo" <bar4mi@...il.com>)
[ MDVSA-2008:242 ] wireshark (security@...driva.com)
Fwd: TmaxSoft JEUS Alternate Data Streams Vulnerability ("Simon Ryeo" <bar4mi@...il.com>)
[SECURITY] [DSA 1687-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)

December 16 (10 messages)

[ MDVSA-2008:243 ] enscript (security@...driva.com)
Re: Re: Moodle 1.9.3 Remote Code Execution (martin@...dle.com)
Re: Moodle 1.9.3 Remote Code Execution (hackeriri@...oo.com)
[USN-691-1] Ruby vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200812-17 ] Ruby: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
ZDI-08-088: Oracle E-Business Suite Business Intelligence SQL Injection Vulnerability (zdi-disclosures@...m.com)
CVE-2008-1094 - Barracuda Span Firewall SQL Injection Vulnerability (marian.ventuneac@...ie)
CVE-2008-0971 - Barracuda Networks products Multiple Cross-Site Scripting Vulnerabilities (marian.ventuneac@...ie)
Joomla: Session hijacking vulnerability, CVE-2008-4122 (Hanno Böck <hanno@...eck.de>)
[ GLSA 200812-18 ] JasPer: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)

December 17 (6 messages)

Re: ooVoo 1.7.1.35 (URL Protocol) remote unicode buffer overflow poc (philip.robertson@...oo.com)
Re: [IVIZ-08-016] F-Secure f-prot Antivirus for Linux corrupted ELF header Security Bypass (frisk@...rot.com)
RE: [Full-disclosure] ZDI-08-088: Oracle E-Business Suite Self-Service Web Applications SQL Injection Vulnerability ("Integrigy Security" <intadmin@...egrigy.co…)
n.runs-SA-2008.010 - Opera HTML parsing Code Execution (<security@...ns.com>)
Network Security Scanner OpenVAS 2.0.0 Released (Michael Wiegand <michael.wiegand@...evation.de>)
[ MDVSA-2008:244 ] mozilla-firefox (security@...driva.com)

December 18 (16 messages)

[USN-690-1] Firefox and xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
EasySiteNetwork (joke.php?id) Remote SQL injection Vulnerability (Ehsan_Hp200@...mail.com)
[TKADV2008-015] Sun Solaris SIOCGTUNPARAM IOCTL Kernel NULL pointer dereference (Tobias Klein <tk@...pkit.de>)
Firefox cross-domain text theft (CESA-2008-011) ("Chris Evans" <scarybeasts@...il.com>)
Re: Joomla: Session hijacking vulnerability, CVE-2008-4122 (darkz.gsa@...il.com)
[USN-692-1] Gadu vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] CVE-2008-2938 - Apache Tomcat information disclosure vulnerability - Update 2 (Mark Thomas <markt@...che.org>)
[USN-693-1] LittleCMS vulnerability (Kees Cook <kees@...ntu.com>)
[USN-690-2] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-690-3] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-694-1] libvirt vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-695-1] shadow vulnerability (Kees Cook <kees@...ntu.com>)
php python extension safe_mode bypass (amir@...mani.ir)
[ MDVSA-2008:245 ] firefox (security@...driva.com)
CONFidence 2009, CFP (Andrzej Targosz <andrzej.targosz@...idea.org.pl>)
[USN-696-1] Avahi vulnerabilities (Jamie Strandboge <jamie@...onical.com>)

December 19 (7 messages)

Re: CONFidence 2009, CFP ("Dominik 'Rathann' Mierzejewski" <D.Mierzejewski@....edu.pl>)
SEC Consult SA-20081219-0 :: Fujitsu-Siemens WebTransactions remote command injection vulnerability (Bernhard Mueller <research@...-consult.com>)
[security bulletin] HPSBST02394 SSRT080183 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-070 to MS08-077 (security-alert@...com)
HTC Touch vCard over IP Denial of Service (Mobile Security Lab <mseclab@...is.it>)
PHP APC vulnerable to local attacks (Moritz Naumann <security@...itz-naumann.com>)
rPSA-2008-0338-1 cups (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200812-19 ] PowerDNS: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)

December 20 (3 messages)

[SECURITY] [DSA 1688-1] New courier-authlib packages fix SQL injection (Steffen Joeris <white@...ian.org>)
chicomas <=2.0.4 Multiple Vulnerabilities (admin@...report.ir)
Re: chicomas <=2.0.4 Multiple Vulnerabilities (security curmudgeon <jericho@...rition.org>)

December 22 (22 messages)

Secunia Research: Trend Micro HouseCall "notifyOnLoadNative()" Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1678-2] New perl packages fix regression (Florian Weimer <fw@...eb.enyo.de>)
[USN-699-1] Blender vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-698-1] Nagios vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1691-1] New moodle packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
[USN-698-2] Nagios3 vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
POC for CVE-2008-5619 (roundcubemail PHP arbitrary code injection) (Jacobo Avariento Gimeno <advisories@...istic.net>)
[UPRSN] Ubuntu Privacy Remix 8.04r2 introduces "noexec"-mounting by default (Ubuntu Privacy Remix Team <security_notice@...vacy-cd.org>)
FreeSSHd Multiple Remote Stack Overflow Vulnerabilities (writ3r-dont-want-bugtraq-spam-@...il.com)
Secunia Research: Trend Micro HouseCall ActiveX Control Arbitrary Code Execution (Secunia Research <remove-vuln@...unia.com>)
CoolPlayer 2.19 (Skin File) Local Buffer Overflow Exploit (writ3r-dont-want-bugtraq-spam-@...il.com)
[USN-697-1] Imlib2 vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-698-1] Nagios vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200812-20 ] phpCollab: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
CORE-2008-1210: Qemu and KVM VNC server remote DoS (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[SECURITY] [DSA 1689-1] New proftpd-dfsg packages fix Cross-Site Request Forgery (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 1690-1] New avahi packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
[ISecAuditors Security Advisories] Wordpress is vulnerable to an unauthorized upgrade and XSS (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[ISecAuditors Security Advisories] Multiple vulnerabilities in WiFi router COMTREND CT-536/HG-536+ (ISecAuditors Security Advisories <advisories@...cauditors.c…)
rPSA-2008-0341-1 dovecot (rPath Update Announcements <announce-noreply@...th.com>)
Re: [IVIZ-08-016] F-Secure f-prot Antivirus for Linux corrupted ELF header Security Bypass (mikael.albrecht@...ecure.com)
[ MDVA-2008:241 ] mailscanner (security@...driva.com)

December 24 (18 messages)

[SECURITY] [DSA 1688-2] New courier-authlib packages fix regression (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBST02397 SSRT080187 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-078 (security-alert@...com)
FreeBSD Security Advisory FreeBSD-SA-08:13.protosw (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Re: rPSA-2008-0341-1 dovecot (olga@...skoyepole.ru)
[USN-677-2] OpenOffice.org Internationalization update (Jamie Strandboge <jamie@...onical.com>)
[ISecAuditors Security Advisories] PSI remote integer overflow DoS (ISecAuditors Security Advisories <advisories@...cauditors.com>)
DDIVRT-2008-16 Citrix Broadcast Server 6.0 login.asp SQL Injection --- Update for BID 32832 (VulnerabilityResearch@...frontline.com)
[USN-700-1] Perl vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-698-3] Nagios vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200812-23 ] Imlib2: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Personal Sticky Threads v1.0.3c vbulletin Add-on problem (xl4nothing@...il.com)
FRHACK Registration open (Christmas offer) (Jerome Athias <jerome.athias@...e.fr>)
[ GLSA 200812-22 ] Ampache: Insecure temporary file usage (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200812-24 ] VLC: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200812-21 ] ClamAV: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
FreeBSD Security Advisory FreeBSD-SA-08:12.ftpd (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
PGP Desktop 9.0.6 Denial Of Service - ZeroDay (contact.fingers@...il.com)
Google Chrome Browser (ChromeHTML://) remote parameter injection POC (nospam@...l.it)

December 25 (5 messages)

MS Windows Media Player * (.WAV) Remote Integrer Overflow (Laurent.gaffie@...il.com)
Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC (Already-sended-information-to-security-focus@...linator.com)
joomla com_lowcosthotels sql injection (lovebug@...mail.it)
Castlecops security site closed for good (Michael Scheidell <scheidell@...nap.net>)
PHP-Fusion Mod TI - Blog System Sql Injection (r3d.w0rm@...oo.com)

December 29 (12 messages)

Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC (nospam@...l.it)
ClubHack2008 presentations are now online (ClubHack <seclist@...bhack.com>)
Joomla Component mdigg 2.2.8 Blind SQL Injection Exploit (hadihadi_zedehal_2006@...oo.com)
[SECURITY] [DSA 1692-1] New php-xajax packages fix cross-site scripting (Steffen Joeris <white@...ian.org>)
hm? new vulnerabilities? wav windows media (anonymous@...nym.an)
Madrese-Portal Sql Injection (r3d.w0rm@...oo.com)
ViArt Shopping Cart v3.5 Multiple Remote Vulnerabilities (XiaShing@...il.com)
MagpieRSS XSS 0day (admin@...tes0ft.com)
[SECURITY] [DSA 1693-1] New phppgadmin packages fix several vulnerabilities (thijs@...ian.org (Thijs Kinkhorst))
MSN messenger sends IP addresses Public and Private (Carmelo Brancato <carmelobrancato@...ero.it>)
[ MDVSA-2008:246 ] kernel (security@...driva.com)
Mavi Emlak Sql Injection (r3d.w0rm@...oo.com)

December 30 (4 messages)

reliable IOS exploitation (Gadi Evron <ge@...uxbox.org>)
Re: MagpieRSS XSS 0day (Antone Roundy <electriceel@...il.com>)
Megacubo 5.0.7 (mega://) remote eval() injection exploit (pyro@...pam.it)
php-nuke 8.0 module sections artid blind sql inj vuln. (the.dumenci@...il.com)

December 31 (4 messages)

MD5 Considered Harmful Today: Creating a rogue CA certificate (Alexander Sotirov <alex@...irov.net>)
Re: php-nuke 8.0 module sections artid blind sql inj vuln. (John Haywood <john@...e-authors.com>)
apache 1.x <=> 2.x suphp (suPHP_ConfigPath) bypass safe mode exploit‎ (v8i@...mail.com)
CFP uCon Security Conference 2009 - Recife, Brazil (uCon Security Conference <cfp@...n-conference.org>)

273 messages

Powered by blists - more mailing lists