bugtraq mailing list - 2009/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 2	² 1	³ 3	⁴
⁵ 14	⁶ 6	⁷ 16	⁸ 9	⁹ 10	¹⁰ 5	¹¹
¹² 24	¹³ 15	¹⁴ 27	¹⁵ 21	¹⁶ 11	¹⁷ 2	¹⁸
¹⁹ 8	²⁰ 17	²¹ 12	²² 13	²³ 7	²⁴	²⁵
²⁶ 24	²⁷ 14	²⁸ 11	²⁹ 15	³⁰ 11	³¹

Messages by day:

January 1 (2 messages)

Re: apache 1.x <=> 2.x suphp (suPHP_ConfigPath) bypass safe mode exploit‎ (ms5ote@...mail.fr)
Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit (i9p@...mail.fr)

January 2 (1 message)

A tool to identify the MD5 certs on FF ("Memisyazici, Aras" <arasm@...edu>)

January 3 (3 messages)

[SECURITY] [DSA 1694-1] New xterm packages fix remote code execution (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1695-1] New Ruby packages fix denial of service (Florian Weimer <fw@...eb.enyo.de>)
Re: Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit (joris@...ogroep.be)

January 5 (14 messages)

Top 5-ish Threats to Watch for in 2009 (Pete Herzog <lists@...com.org>)
Destiny Media Player 1.61 (.lst File) Local Stack Overflow Exploit (crimson.loyd@...il.com)
php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ (l1un@...mail.com)
SolucionWeb (main.php?id_area) Remote SQL injection Vulnerability (Ehsan_Hp200@...mail.com)
PollPro 3.0 XSRF VuLn. (b4DchiLd@....Com)
Call for papers and trainers - SeacureIT 2009 (Stefano Zanero <s.zanero@...urenetwork.it>)
Google Chrome FTP PASV IP Malicious Port Scanning Vulnerability. (Aditya K Sood <0kn0ck@...niche.org>)
Re: Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit ("Eugene Teo" <eugeneteo@...nel.sg>)
ANNOUNCE: RFIDIOt ver 01.v released - Jan 2009 (Adam Laurie <adam@...roup.co.uk>)
MSFXDC Metasploit eXploits Development Contest (Jerome Athias <jerome.athias@...e.fr>)
Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ (a@...cd)
Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ (faze0r@....com)
Walusoft TFTPServer2000 Version 3.6.1 Directory Traversal (vuln_research@...nceofnigeria.org)
[USN-702-1] Samba vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)

January 6 (6 messages)

[USN-703-1] xterm vulnerability (Kees Cook <kees@...ntu.com>)
[Suspected Spam]"Security Assessment of the Internet Protocol" & the IETF (Fernando Gont <fernando.gont@...il.com>)
[SECURITY] [DSA 1694-2] New xterm packages fix regression (Florian Weimer <fw@...eb.enyo.de>)
Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏ (Slack Traq <slacktraq@...oo.com>)
New WHID web hacking incidents (Ofer Shezaf <ofer@...zaf.com>)
VUPLAYER BufferOver flow POC (alphanix00@...il.com)

January 7 (16 messages)

Cisco Security Advisory: Cisco Global Site Selector Appliances DNS Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[USN-701-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Secunia Research: HP OpenView Network Node Manager Multiple Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[oCERT-2008-016] Multiple OpenSSL signature verification API misuses ("Will Drewry" <redpig@...rt.org>)
PHP-Fusion Mod Members Bewerb Sql Injection (r3d.w0rm@...oo.com)
Secunia Research: TSC2 Help Desk CTab ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Plunet BusinessManager failure in access controls and multiple stored cross site scripting (Matteo Ignaccolo <matteo.ignaccolo@...urenetwork.it>)
CFP: COLSEC 2009 (Patrice CLEMENTE <patrice.clemente@...i-bourges.fr>)
[USN-701-2] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
PHP-Fusion Mod E-Cart Sql Injection (r3d.w0rm@...oo.com)
Plunet BusinessManager failure in access controls and multiple stored cross site scripting (Matteo Ignaccolo <h725ml@...urenetwork.it>)
[SECURITY] [DSA 1696-1] New icedove packages fix several vulnerabilities (Steffen Joeris <white@...ian.org>)
[SECURITY] [DSA 1697-1] New iceape packages fix several vulnerabilities (Steffen Joeris <white@...ian.org>)
FreeBSD Security Advisory FreeBSD-SA-09:02.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-09:01.lukemftpd (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerabi… ("Williams, James K" <James.Williams@ca.…)

January 8 (9 messages)

Re: [Suspected Spam]"Security Assessment of the Internet Protocol" & the IETF (Jerome Athias <jerome.athias@...e.fr>)
[USN-704-1] OpenSSL vulnerability (Jamie Strandboge <jamie@...onical.com>)
PHP-Fusion Mod vArcade 1.8 Sql Injection Vulnerability (irancrash@...il.com)
[IBM Datapower XS40] Denial of Service (erik@...fe.nl)
CORE-2008-1128: Openfire multiple vulnerabilities (CORE Security Technologies Advisories <advisories@...esecurity.com>)
LayerOne 2009 Call for Papers ("LayerOne Call For Papers" <layeronecfp@...il.com>)
Re: [IBM Datapower XS40] Denial of Service (terrordactylspam@...il.com)
[USN-705-1] NTP vulnerability (Jamie Strandboge <jamie@...onical.com>)
AST-2009-001: Information leak in IAX2 authentication ("Asterisk Security Team" <security@...erisk.org>)

January 9 (10 messages)

[USN-706-1] Bind vulnerability (Jamie Strandboge <jamie@...onical.com>)
Re: Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit (Shaochun Wang <scwang@....ac.cn>)
ShakaCon 2009 Call for Papers and Trainers ("Shakacon" <info@...kacon.org>)
Leak of SNMP write password via SNMP read community in NETGEAR WG102 - Prosafe 802.11g Access Point (mad-vaittes@....ing.tu-bs.de)
Re: Plunet BusinessManager failure in access controls and multiple stored cross site scripting (Stefano Zanero <s.zanero@...urenetwork.it>)
[SECURITY] [DSA 1698-1] New gforge packages fix SQL injection (thijs@...ian.org (Thijs Kinkhorst))
Re: Leak of SNMP write password via SNMP read community in NETGEAR WG102 - Prosafe 802.11g Access Point (Simon Richter <Simon.Richter@...yros.de>)
Java Runtime UTF-8 Decoder Smuggling Vector ("William A. Rowe, Jr." <wrowe@...e-clan.net>)
Re: Leak of SNMP write password via SNMP read community in NETGEAR WG102 - Prosafe 802.11g Access Point (Steve Shockley <steve.shockley@...ckley.net>)
Re: Leak of SNMP write password via SNMP read community in NETGEAR WG102 - Prosafe 802.11g Access Point (Simon Richter <Simon.Richter@...yros.de>)

January 10 (5 messages)

[ MDVSA-2009:003 ] python (security@...driva.com)
[ MDVSA-2009:004 ] pam_mount (security@...driva.com)
[ MDVSA-2009:002 ] bind (security@...driva.com)
Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11) (security curmudgeon <jericho@...rition.org>)
Re: Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (DB11) (Joxean Koret <joxeankoret@...oo.es>)

January 12 (24 messages)

[ GLSA 200901-01 ] NDISwrapper: Arbitrary remote code execution (Robert Buchholz <rbu@...too.org>)
[ GLSA 200901-02 ] JHead: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
Hack Aethra SV 1042 Adsl/Voip Router (SmoKe <smokepower@...il.com>)
Comersus Shopping Cart <= v6 Remote User Pass Exploit (ajannhwt@...mail.com)
[ GLSA 200901-03 ] pdnsd: Denial of Service and cache poisoning (Robert Buchholz <rbu@...too.org>)
[BMSA-2009-01] Authentication bypass in Interspire Shopping Cart v4.0.1 and below (Nam Nguyen <namn@...emoon.com.vn>)
RE: Oracle Database Buffer Overflow in SYS.KUPF$FILE_INT.GET_FULL_FILENAME (Oracle CPU April 2008 DB11) ("Integrigy Alerts" <alerts@...egrigy.com>)
[ GLSA 200901-04 ] D-Bus: Denial of Service (Robert Buchholz <rbu@...too.org>)
[USN-707-1] CUPS vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1699-1] New zaptel packages fix privilege escalation (Florian Weimer <fw@...eb.enyo.de>)
PHP Buffer Overflow(popen) (ew1zz@...mail.com)
[ GLSA 200901-05 ] Streamripper: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[TKADV2009-001] Sun Solaris aio_suspend() Kernel Integer Overflow Vulnerability (Tobias Klein <tk@...pkit.de>)
[ GLSA 200901-06 ] Tremulous: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1700-1] New lasso packages fix validation bypass (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2009:005 ] xterm (security@...driva.com)
SyScan'09 Call For Paper - Shanghai, Hong Kong, Singapore, Taipei ("organiser@...can.org" <organiser@...can.org>)
Visuplay CMS SQL injection vulnerability (joseph.giron13@...il.com)
[security bulletin] HPSBMA02392 SSRT071481 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS) (security-alert@...com)
[TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities (Tobias Klein <tk@...pkit.de>)
[ GLSA 200901-07 ] MPlayer: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[SECURITY] [DSA 1701-1] New OpenSSL packages fix cryptographic weakness (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1702-1] New ntp packages fix cryptographic weakness (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1703-1] New bind9 packages fix cryptographic weakness (Florian Weimer <fw@...eb.enyo.de>)

January 13 (15 messages)

[ GLSA 200901-08 ] Online-Bookmarks: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Secunia Research: DevIL "iGetHdrHeader()" Buffer Overflow Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
PDFBuilderX 2.2 Arbitrary File Overwrite (fakeperson7 <fakeperson7@...n.pl>)
[ GLSA 200901-09 ] Adobe Reader: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ MDVSA-2009:006 ] openoffice.org (security@...driva.com)
ANNOUNCE: DEFCON London - DC4420 - January meet - Thursday 15th Jan 2009 (Major Malfunction <majormal@...ate-radio.org>)
rPSA-2009-0005-1 git gitweb (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0007-1 pam_krb5 (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0006-1 samba samba-client samba-server samba-swat (rPath Update Announcements <announce-noreply@...th.com>)
iDefense Security Advisory 01.13.09: RIM BlackBerry Enterprise Server Attachment Service PDF Distiller 'symWidths' Heap… (iDefense Labs <labs-no-reply@...fense.c…)
ZDI-09-001: Microsoft SMB NT Trans Request Parsing Remote Code Execution Vulnerability (zdi-disclosures@...m.com)
ZDI-09-002: Microsoft SMB NT Trans2 Request Parsing Remote Code Execution Vulnerability (zdi-disclosures@...m.com)
[USN-708-1] HPLIP vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
iDefense Security Advisory 01.13.09: RIM BlackBerry Enterprise Server Attachment Service PDF Distiller 'bitmaps' Heap O… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 01.13.09: RIM BlackBerry Enterprise Server Attachment Service PDF Distiller Uninitialized Me… (iDefense Labs <labs-no-reply@...fense.c…)

January 14 (27 messages)

FreeBSD Security Advisory FreeBSD-SA-09:04.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
WowWee Rovio - Insufficient Access Controls - Covert Audio/Video Snooping Possible ("Brian Dowling" <bjd@...plicity.net>)
iDefense Security Advisory 01.13.09: Oracle Database 10g R2 Summary Advisor Arbitrary File Rewrite Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability (Laurent Butti <laurent.butti@...nge-ftgroup.com>)
phpList <= 2.10.8 Local File inclusion (admin@...report.ir)
iDefense Security Advisory 01.13.09: Oracle Secure Backup Administration Server login.php Command Injection Vulnerabili… (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 01.13.09: Oracle Secure Backup Administration Server login.php Command Injection Vulnerabili… (iDefense Labs <labs-no-reply@...fense.c…)
Oracle CPU Jan 2009 Advisories. (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
Cisco Security Advisory: Cisco ONS Platform Crafted Packet Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Trigger Abuse of MDSYS.SDO_TOPO_DROP_FTBL in Oracle 10g R1 and R2 ("David Litchfield" <davidl@...software.com>)
[ MDVSA-2009:007 ] ntp (security@...driva.com)
RE: DoS code for Cisco VLAN Trunking Protocol Vulnerability ("Paul Oxman (poxman)" <poxman@...co.com>)
PR08-19: XSS on Cisco IOS HTTP Server (ProCheckUp Research <research@...checkup.com>)
DoS code for Cisco VLAN Trunking Protocol Vulnerability (showrun.lee@...il.com)
[ MDVSA-2009:008 ] qemu (security@...driva.com)
Cisco Security Response: Cisco IOS Cross-Site Scripting Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[ MDVSA-2009:009 ] kvm (security@...driva.com)
[ MDVSA-2009:010 ] qemu (security@...driva.com)
Call for Papers: Cyber Warfare (kgconference@...il.com)
Cisco Security Advisory: IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@…)
OTSTurntables 1.00.027 (.ofl) Local Stack Overflow Exploit (crimson.loyd@...il.com)
[TZO-2009-1] Avira Antivir - RAR - Division by Zero & Null Pointer Dereference (Thierry Zoller <Thierry@...ler.lu>)
[SECURITY] [DSA 1704-1] New xulrunner packages fix several vulnerabilities (Steffen Joeris <white@...ian.org>)
ZDI-09-003: Oracle Secure Backup exec_qr() Command Injection Vulnerability (zdi-disclosures@...m.com)
ZDI-09-004: Oracle TimesTen evtdump Remote Format String Vulnerability (zdi-disclosures@...m.com)
Oracle Secure Backup 10g Remote Code Execution (Joxean Koret <joxeankoret@...oo.es>)
Oracle TimesTen Remote Format String (Joxean Koret <joxeankoret@...oo.es>)

January 15 (21 messages)

[ GLSA 200901-10 ] GnuTLS: Certificate validation error (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200901-11 ] Avahi: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
TFTPUtil GUI TFTP Directory Traversal (vuln_research@...nceofnigeria.org)
TFTPUtil GUI TFTP Server Denial of Service Vulnerability (vuln_research@...nceofnigeria.org)
Windows NTP Time Server Syslog Monitor 1.0.000 Denial of Service Vulnerability (vuln_research@...nceofnigeria.org)
Re: Assurent VR - Oracle BEA WebLogic Server Apache Connector Buffer Overflow (security curmudgeon <jericho@...rition.org>)
[ MDVSA-2009:011 ] virtualbox (security@...driva.com)
Re: iDefense Security Advisory 01.13.09: Oracle Secure Backup Administration Server login.php Command Injection Vulnera… (security curmudgeon <jericho@...rition.…)
Oracle Secure Backup Multiple Denial Of Service vulnerabilities ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
Oracle Secure Backup's observiced.exe Denial Of Service vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
Oracle Secure Backup NDMP_CONECT_CLIENT_AUTH Command Buffer Overflow Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
ANNOUNCE: apache_1.3.41+ssl_1.60 released (Adam Laurie <adam@...roup.co.uk>)
Errata: [TZO-2009-1] Avira Antivir - RAR - Division by Zero & Null Pointer Dereference (Thierry Zoller <Thierry@...ler.lu>)
[TZO-2009-2] Avira Antivir - Priviledge escalation (Thierry Zoller <Thierry@...ler.lu>)
[waraxe-2009-SA#070] - Multiple Vulnerabilities in MKPortal <= 1.2.1 (come2waraxe@...oo.com)
[SECURITY] [DSA 1705-1] New netatalk packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 1706-1] New amarok packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-709-1] tar vulnerability (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1707-1] New iceweasel packages fix several vulnerabilities (Steffen Joeris <white@...ian.org>)
[ MDVSA-2009:012 ] mozilla-thunderbird (security@...driva.com)
[USN-700-2] Perl regression (Kees Cook <kees@...ntu.com>)

January 16 (11 messages)

[ MDVSA-2009:013 ] mplayer (security@...driva.com)
Syslserve 1.058 Denial of Service Vulnerability (vuln_research@...nceofnigeria.org)
[ MDVSA-2009:014 ] mplayer (security@...driva.com)
[ MDVSA-2009:015 ] ffmpeg (security@...driva.com)
DMXReady Blog Manager (SQL/XSS) (pouya.s3rver@...il.com)
Active Bids (pouya.s3rver@...il.com)
[ MDVSA-2009:016 ] xen (security@...driva.com)
Announce: RSBAC 1.4.0 released (Amon Ott <ao@...ac.org>)
[ MDVSA-2009:017 ] kdebase (security@...driva.com)
Excel Viewer OCX 3.1/3.2 Denial of Service PoC (alphanix00@...il.com)
Sagem router f@st 2404 remote reset poc (alphanix00@...il.com)

January 17 (2 messages)

[ MDVSA-2009:018 ] tomcat5 (security@...driva.com)
FBI XSS Vulnerability (sohrab_behroozian@...oo.com)

January 19 (8 messages)

Ralinktech wireless cards drivers vulnerability (springsec@...il.com)
53KF Web IM 2009 Cross-Site Scripting Vulnerabilities (Heart <xisigr@...il.com>)
[Wintercore Research ] Fujitsu SystemcastWizard Lite PXEService Remote Buffer Overflow. (vulns@...tercore.com)
Advisory: Oracle EBusiness Suite Sensitive Information Disclosure Vulnerability (Aditya K Sood <0kn0ck@...niche.org>)
[ GLSA 200901-12 ] noip-updater: Execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Web Hacking Incidents update for Jan 19th (Ofer Shezaf <ofer@...zaf.com>)
[ MDVSA-2009:019 ] imlib2 (security@...driva.com)
[SECURITY] [DSA 1708-1] New Git packages fix remote code execution (Florian Weimer <fw@...eb.enyo.de>)

January 20 (17 messages)

Secunia Research: EasyHDR Pro Radiance RGBE Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Cybershade CMS Remote File include vulnerability (security@...or.net)
[ANNOUNCE] Apache Jackrabbit 1.5.2 released ("Jukka Zitting" <jukka@...che.org>)
Re: Remote Cisco IOS FTP exploit ("Russell L. Smoak" <rsmoak@...co.com>)
Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server 10g (10.1.3.1.0) Oracle HTTP Server ("Eduardo Vela" <sirdarckcat@...il.com>)
Secunia Research: Trend Micro Network Security Component Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPSBMA02400 SSRT080144 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
MoinMoin Wiki Engine XSS Vulnerability (swhite@...urestate.com)
Microsoft Bluetooth Stack OBEX Directory Traversal (alberto.morenot@...il.com)
Re: Remote Cisco IOS FTP exploit (security curmudgeon <jericho@...rition.org>)
Secunia Research: OpenSG Radiance RGBE Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
rPSA-2009-0008-1 openssl (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0009-1 bind bind-utils (rPath Update Announcements <announce-noreply@...th.com>)
Videos from HITBSecConf2008 - Malaysia released! (Praburaajan <prabu@...kinthebox.org>)
rPSA-2009-0011-1 perl (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200901-13 ] Pidgin: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
rPSA-2009-0010-1 ntp ntp-utils (rPath Update Announcements <announce-noreply@...th.com>)

January 21 (12 messages)

rPSA-2009-0014-1 hplip (rPath Update Announcements <announce-noreply@...th.com>)
CfP: 16th ACM Conference on Computer and Communications Security (CCS) 2009 (Christopher Kruegel <chris@...ucsb.edu>)
[SECURITY] [DSA 1709-1] New shadow packages fix privilege escalation (thijs@...ian.org (Thijs Kinkhorst))
[SECURITY] [DSA 1693-2] New phppgadmin packages fix regression (thijs@...ian.org (Thijs Kinkhorst))
[DSECRG-09-004] AXIS 70U Network Document Server - Privilege Escalation and XSS (Digital Security Research Group <research@...c.ru>)
Cisco Security Advisory: Cisco Security Manager Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Unified Communications Manager CAPF Denial of Service Vulnerability` (Cisco Systems Product Security Incident Response Team <psir…)
Joomla component beamospetition 1.0.12 Sql Injection (vds_s@...oo.com)
Re: [Full-disclosure] Oracle Containers For Java Directory Traversal (OC4J) Oracle Application Server 10g (10.1.3.1.0) Oracle HT… (Mark Thomas <markt@...che.org>)
Digital Security opens a site of its research center DSec Research Group (Digital Security Research Group <research@...c.ru>)
[IMF 2009] Call for Papers (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
[ GLSA 200901-14 ] Scilab: Insecure temporary file usage (Pierre-Yves Rofes <py@...too.org>)

January 22 (13 messages)

[ MDVSA-2009:024 ] php4 (security@...driva.com)
Asp-project Cookie Handling (r3d.w0rm@...oo.com)
[ MDVSA-2009:020 ] xine-lib (security@...driva.com)
ZDI-09-006: Apple QuickTime AVI Header nBlockAlign Heap Corruption Vulnerability (zdi-disclosures@...m.com)
[ MDVSA-2009:022 ] php (security@...driva.com)
ZDI-09-005: Apple QuickTime VR Track Header Atom Heap Corruption Vulnerability (zdi-disclosures@...m.com)
ZDI-09-008: Apple QuickTime STSD JPEG Atom Heap Corruption Vulnerability (zdi-disclosures@...m.com)
[ GLSA 200901-15 ] Net-SNMP: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
VUPlayer 2.49 .ASX local universal BOF exploit (maroc-anti-connexion@...mail.com)
[ MDVSA-2009:023 ] php (security@...driva.com)
[ MDVSA-2009:021 ] php (security@...driva.com)
ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability (zdi-disclosures@...m.com)
[TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities (Tobias Klein <tk@...pkit.de>)

January 23 (7 messages)

[ MDVSA-2009:025 ] pidgin (security@...driva.com)
PHP-Nuke 8.0 Downloads Blind Sql Injection (r3d.w0rm@...oo.com)
BBSxp Xss vulnerability (arashps0@...il.com)
Secunia Research: AXIS Camera Control "image_pan_tilt" Property Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2009:026 ] phpMyAdmin (security@...driva.com)
ZDI-09-009: EMC AutoStart Backbone Engine Trusted Pointer Code Execution Vulnerability (zdi-disclosures@...m.com)
Oblog XSS valnerability (arash.setayeshi@...il.com)

January 26 (24 messages)

Problems with syscall filtering technologies on Linux (Chris Evans <scarybeasts@...il.com>)
[HACKATTACK Advisory 25012009]ConPresso CMS 4.07 - Session Fixation, XFS, XSS (office@...kattack.at)
Re: munky-bliki lfi (security curmudgeon <jericho@...rition.org>)
VUplayer (.wax file) local buffer overflow crash exploit (storms0uth@...mail.com)
MediaMonkey 3.0.6 (.m3u file) Local Buffer Overflow PoC (alphanix00@...il.com)
SonyEricsson WAP Push Denial of Service (Mobile Security Lab <mseclab@...is.it>)
Browser3D 3.5 (.sfs File) Local Stack Overflow Exploit (c) (maroc-anti-connexion@...mail.com)
Lootan(kedor) Sql Injection vulnerability (arash.setayeshi@...il.com)
Nokia Multimedia Player (.AVI File) Null Dereference Pointer Exploit (alphanix00@...il.com)
LDF Sql injection vulnerability (arash.setayeshi@...il.com)
Browse3d (.sfs file) Local Stack Overflow Exploit (alphanix00@...il.com)
Re: ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability (security curmudgeon <jericho@...rition.org>)
Re: [Full-disclosure] ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Benchmarking attacks and major security weakness on all recent Windows versions up to Windows 200 (thadeum@...il.com)
EleCard MPEG PLAYER (.m3u file) Local Stack Overflow Exploit (alphanix00@...il.com)
[ MDVSA-2009:027 ] cups (security@...driva.com)
CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Re: Oblog XSS valnerability (dan.crowley@...il.com)
[SECURITY] [DSA 1710-1] New ganglia-monitor-core packages fix remote code execution (Steffen Joeris <white@...ian.org>)
WB News v2.0.X Remote File include .. (security@...or.net)
/bin/login DoS remains after DSA-1709 (Paul Szabo <psz@...hs.usyd.edu.au>)
[USN-710-1] xine-lib vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1711-1] New TYPO3 packages fix remote code execution (Nico Golde <nion@...ian.org>)
[USN-711-1] KTorrent vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)

January 27 (14 messages)

Re: FUD Forum < 2.7.1 PHP code injection vurnelability (riklaunim@...il.com)
NewsCMSlite Insecure Cookie Handling (admin@...report.ir)
ACROS Security: HTML Injection in BEA (Oracle) WebLogic Server Console (ASPR #2009-01-27-1) ("ACROS Security" <lists@...os.si>)
[USN-712-1] Vim vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Secunia Research: OpenX Multiple Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
OpenX 2.6.3 - Local File Inclusion (admin@...tes0ft.com)
CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1) ("Williams, James K" <James.Williams@...com>)
JetAudio Basic 7.0.3 BufferOverFlow PoC (alphanix00@...il.com)
SAP NetWeaver XSS Vulnerability (Martin Suess <martin.suess@...c.ch>)
Total video player 1.3.7 local buffer overflow universal exploit (maroc-anti-connexion@...mail.com)
CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
Max.Blog <= 1.0.6 (show_post.php) SQL Injection Vulnerability ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[ MDVSA-2009:030 ] amarok (security@...driva.com)
Max.Blog <= 1.0.6 (submit_post.php) SQL Injection Vulnerability ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)

January 28 (11 messages)

Max.Blog <= 1.0.6 (offline_auth.php) Offline Authentication Bypass ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[USN-713-1] openjdk-6 vulnerabilities (Kees Cook <kees@...ntu.com>)
CONFidence 2009, Final CfP (Andrzej Targosz <andrzej.targosz@...idea.org.pl>)
Web Hacking Incidents update for Jan 28th (Ofer Shezaf <ofer@...zaf.com>)
Internet explorer 7.0 stack overflow (jplopezy@...il.com)
Re: DoS attacks on MIME-capable software via complex MIME emails (Dave English <dave.english@...s.net>)
CORE-2008-1211: Amaya web editor XML and HTML parser vulnerabilities (Core Security Technologies Advisories <advisories@...esecurity.com>)
Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability. (Aditya K Sood <adi_ks@...niche.org>)
[SECURITY] [DSA 1712-1] New rt2400 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[TKADV2009-004] FFmpeg Type Conversion Vulnerability (Tobias Klein <tk@...pkit.de>)
[SECURITY] [DSA 1713-1] New rt2500 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)

January 29 (15 messages)

[SECURITY] [DSA 1714-1] New rt2570 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability. (Michal Zalewski <lcamtuf@...edump.cx>)
[SECURITY] [DSA 1715-1] New moin packages fix insufficient input sanitising (Devin Carraway <devin@...ian.org>)
[security bulletin] HPSBMA02403 SSRT090007 rev.1 - HP Select Access Running on HP-UX, Linux, Solaris, and Windows, Remote Cross Site Scrip… (security-alert@...com)
dBpowerAMP Audio Player v2 ( .pls file) LoCaL BufferOverFlow Exploit (alphanix00@...il.com)
[security bulletin] HPSBMP02404 SSRT090014 rev.1 - MPE/iX Running BIND/iX, Remote DNS Cache Poisoning (security-alert@...com)
Re: Internet explorer 7.0 stack overflow (jplopezy@...il.com)
Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet) (DoZ@...kersCenter.com)
Re: Secunia Research: OpenX Multiple Vulnerabilities (scott.switzer@...nx.org)
Oracle Application Server 10g Cross Site Scripting Vulnerability (DoZ@...kersCenter.com)
Motorola Wimax Modem CPEi300 Multiple Vulnerabilities (usman <usman@...re.net>)
rPSA-2009-0021-1 sudo (rPath Update Announcements <announce-noreply@...th.com>)
Re: XSS vulnerabilty in ASP.Net [with details] (m.rajeshpawar@...il.com)
[SECURITY] [DSA 1704-2] Updated netatalk packages fix denial of service (Nico Golde <nion@...ian.org>)
PerlSoft Guestbook v1.7b Bruteforcer + RCE! (Perforin <broken-error@...mail.com>)

January 30 (11 messages)

Re[2]: Internet explorer 7.0 stack overflow ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
[USN-715-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[OPENX-SA-2009-001] OpenX 2.4.10 and 2.6.4 fix multiple vulnerabilities (Matteo Beccati <php@...cati.com>)
ANNOUNCE - RFIDIOt 0.1w released - January 2009 (Adam Laurie <adam@...roup.co.uk>)
Bugs Online v2.14 Sql Injection (r3d.w0rm@...oo.com)
CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities (Sam Johnston <samj@...j.net>)
[USN-716-1] MoinMoin vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
PR08-22: Persistent XSS on Novell GroupWise WebAccess (ProCheckUp Research <research@...checkup.com>)
PR08-21: Cross-site Request Forgery (CSRF) on Novell GroupWise WebAccess allows email theft and other attacks (ProCheckUp Research <research@...checkup.com>)
PR08-23: XSS on Novell GroupWise WebAccess (ProCheckUp Research <research@...checkup.com>)
Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC (come2waraxe@...oo.com)

298 messages

Powered by blists - more mailing lists