bugtraq mailing list - 2009/03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 20	³ 13	⁴ 2	⁵ 9	⁶ 17	⁷	⁸
⁹ 32	¹⁰ 18	¹¹ 9	¹² 24	¹³ 15	¹⁴	¹⁵
¹⁶ 10	¹⁷ 18	¹⁸ 7	¹⁹ 6	²⁰ 12	²¹ 1	²²
²³ 12	²⁴ 9	²⁵ 13	²⁶ 2	²⁷ 13	²⁸	²⁹
³⁰ 15	³¹ 19

Messages by day:

March 2 (20 messages)

Afian Document Manager Local File Inclusion (contact@...rain.net)
Re: djbdns misformats some long response packets; patch and example attack (Matthew Dempsky <matthew@...psky.org>)
Re: Nokia N95-8 browser denial of service ("MustLive" <mustlive@...security.com.ua>)
Weekly Web Hacking Incidents update for Feb 25th (Ofer Shezaf <ofer@...zaf.com>)
YEKTA WEB Academic Web Tools CMS Multiple XSS (mr.faghani@...il.com)
BlogMan 0.45 Multiple Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[CFP] FRHACK 2nd Call For Papers (Jerome Athias <jerome.athias@...e.fr>)
[security bulletin] HPSBUX02401 SSRT090005 rev.3 - HP-UX Running Apache Web Server Suite, Remote Denial of Service (DoS), Cross-site Scrip… (security-alert@...com)
[SECURITY] [DSA 1719-2] New GNUTLS packages fix regression (Florian Weimer <fw@...eb.enyo.de>)
EZ-Blog Beta 1 Multiple SQL Injection ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Announcing Cap'r Mak'r (kowsik@...il.com)
[SECURITY] [DSA 1729-1] New gst-plugins-bad0.10 packages fix multiple vulnerabilities (Steffen Joeris <steffen.joeris@...lelinux.de>)
rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-ima… (rPath Update Announcements <announce-no…)
[ISecAuditors Security Advisories] eXtplorer Remote Code Execution (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[SECURITY] [DSA 1730-1] New proftpd-dfsg packages fix SQL injection vulnerabilites (Steffen Joeris <steffen.joeris@...lelinux.de>)
[SECURITY] [DSA 1731-1] New ndiswrapper packages fix arbitrary code execution vulnerability (Steffen Joeris <steffen.joeris@...lelinux.de>)
Re: Re: Local vulnerability in suexec + FastCGI + PHP configurations (security.432@...l.com)
[ MDVSA-2009:062 ] shadow-utils (security@...driva.com)
RitsBlog 0.4.2 (Authentication Bypass) SQL Injection Vulnerability / XSS Persistent Vulnerability ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Blogsa <= 1.0 Beta 3 XSS Vulnerability (contact@...ryilmaz.info)

March 3 (13 messages)

[ MDVSA-2009:063 ] eog (security@...driva.com)
[SECURITY] [DSA 1732-1] New squid3 packages fix denial of service (Steffen Joeris <white@...ian.org>)
WARNING - CORRECT: BlindBlog 1.3.1 Multiple Vulnerabilities (SQL Inj - Auth Bypass - LFI) ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Zabbix 1.6.2 Frontend Multiple Vulnerabilities (ascii <ascii@...amail.com>)
Secunia Research: Winamp CAF Processing Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1733-1] New vim packages fix multiple vulnerabilities (Steffen Joeris <white@...ian.org>)
Secunia Research: libsndfile CAF Processing Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[USN-727-1] network-manager-applet vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-726-1] curl vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
BlindBlog 1.3.1 Multiple Vulnerabilities (SQL Inj - Auth Bypass - LFI) ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
NovaBoard <= 1.0.1 / XSS Vulnerability (Jose Luis <pepeluxx@...il.com>)
[ MDVSA-2009:064 ] imap (security@...driva.com)
[USN-727-2] NetworkManager vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)

March 4 (2 messages)

[USN-726-2] curl regression (Marc Deslauriers <marc.deslauriers@...onical.com>)
Cisco Security Advisory: Cisco 7600 Series Router Session Border Controller Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Te…)

March 5 (9 messages)

Re: iDefense COMRaider 'DeleteFile()' Method Arbitrary File Deletion Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
SupportSoft DNA Editor Module (dnaedit.dll v6.9.2205) remote code execution exploit (IE6/7) (nospam@...il.it)
CelerBB 0.0.2 Multiple Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Re: djbdns misformats some long response packets; patch and example attack (Matthew Dempsky <matthew@...psky.org>)
libc:fts_*():multiple vendors, Denial-of-service (cxib@...urityreason.com)
ZDI-09-013: Mozilla Firefox XUL Linked Clones Double Free Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
iDefense COMRaider, ActiveX controls, and browser configuration ("Steven M. Christey" <coley@...us.mitre.org>)
[ MDVSA-2009:065 ] php4 (security@...driva.com)
[ MDVSA-2009:066 ] php (security@...driva.com)

March 6 (17 messages)

[ MDVSA-2009:067 ] libsndfile (security@...driva.com)
[USN-729-1] Python Crypto vulnerability (Kees Cook <kees@...ntu.com>)
[USN-728-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[Positive Technologies SA:2009-12] UMI.CMS Cross-Site Scripting vulnerability (aanisimov@...ecurity.com)
[USN-728-2] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities (Roberto Muñoz Fernandez <robertomf@...itsu.es>)
[USN-728-3] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-730-1] libpng vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Wili-CMS 0.4.0 Multiple Vulnerabilities (Remote/Local File Inclusion - Authentication Bypass) ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
Re: iDefense COMRaider, ActiveX controls, and browser configuration ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
[SECURITY] CVE-2009-0781 XSS in Apache Tomcat examples web application (Mark Thomas <markt@...che.org>)
DEFCON CTF Submissions are in, DC-16 video online! ("The Dark Tangent" <dtangent@...con.org>)
WarVOX 1.0.0 Released (H D Moore <sflist@...italoffense.net>)
[Positive Technologies SA:2009-13] TinX CMS 3.x SQL Injection Vulnerability (aanisimov@...ecurity.com)
nForum 1.5 Multiple SQL Injection ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[ MDVSA-2009:068 ] poppler (security@...driva.com)
[ GLSA 200903-01 ] Vinagre: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)

March 9 (32 messages)

[ GLSA 200903-02 ] ZNC: Privilege escalation (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200903-03 ] Audacity: User-assisted execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200903-04 ] DevIL: User-assisted execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)
[ MDVSA-2009:069 ] curl (security@...driva.com)
[ MDVSA-2009:068-1 ] poppler (security@...driva.com)
[ GLSA 200903-05 ] PDFjam: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-06 ] nfs-utils: Access restriction bypass (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-07 ] Samba: Data disclosure (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-08 ] gEDA: Insecure temporary file creation (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-09 ] OpenTTD: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
phpCommunity 2 2.1.8 Multiple Vulnerabilities (SQL Injection / Directory Traversal / XSS) ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[ GLSA 200903-10 ] Irrlicht: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
Re: Vulnerability CVE-2008-3671 - MyReview's vulnerability in the access control system (alexchf.fyp@...il.com)
Re: Zabbix 1.6.2 Frontend Multiple Vulnerabilities (Eygene Ryabinkin <rea-sec@...elabs.ru>)
Secunia Research: Foxit Reader JBIG2 Symbol Dictionary Processing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ GLSA 200903-11 ] PyCrypto: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-12 ] OptiPNG: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-13 ] MPFR: Denial of Service (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-14 ] BIND: Incorrect signature verification (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-15 ] git: Multiple vulnerabilties (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-16 ] Epiphany: Untrusted search path (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-17 ] Real VNC: User-assisted execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-18 ] Openswan: Insecure temporary file creation (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-19 ] Xerces-C++: Denial of Service (Robert Buchholz <rbu@...too.org>)
[ GLSA 200903-20 ] WebSVN: Multiple vulnerabilities (Robert Buchholz <rbu@...too.org>)
DDIVRT-2009-22 SMART Board Whiteboard Directory Traversal Vulnerability (ddivulnalert@...frontline.com)
DDIVRT-2009-21 vBook Login Application Cross-site Scripting Vulnerability (ddivulnalert@...frontline.com)
Belkin BullDog Plus UPS-Service Buffer Overflow Vulnerability ("Elazar Broad" <elazar@...hmail.com>)
Re: Vulnerability CVE-2008-3671 - MyReview's vulnerability in the access control system (Julien Thomas <julien.thomas.1@...il.com>)
[ GLSA 200903-21 ] cURL: Arbitrary file access (Tobias Heinlein <keytoaster@...too.org>)
Foxit Reader Multiple Vulnerabilities (CORE-2009-0218) (Core Security Technologies Advisories <advisories@...esecurity.com>)
Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation (Paul Wouters <paul@...net.nl>)

March 10 (18 messages)

SEC Consult SA-20090305-0 :: NextApp Echo XML Injection Vulnerability (Bernhard Mueller <research@...-consult.com>)
SEC Consult SA-20090305-1 :: IBM Director CIM Server Remote Denial of Service Vulnerability (Bernhard Mueller <research@...-consult.com>)
Re: [ GLSA 200903-18 ] Openswan: Insecure temporary file creation (Robert Buchholz <rbu@...too.org>)
FINAL: Call for Papers on Cyber Warfare (k g <kgconference@...il.com>)
SEC Consult SA-20090305-2 :: IBM Director CIM Server Local Privilege Escalation Vulnerability (Bernhard Mueller <research@...-consult.com>)
Aryanic HighCMS and HighPortal multiple Vulnerabilities (mr.faghani@...il.com)
[ GLSA 200903-22 ] Ganglia: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
Multiple Vulnerabilities in iAntiVirus ("Carsten Eilers" <advisories@...lers-it.de>)
[ MDVSA-2009:070 ] openoffice.org (security@...driva.com)
Paper: Socket Capable Browser Plugins Result In Transparent Proxy Abuse (robert@...appsec.org)
Addonics NAS Adapter Post-Auth DoS (mcyr2@....com)
[USN-731-1] Apache vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-732-1] dash vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
AST-2009-002: Remote Crash Vulnerability in SIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
[ECHO_ADV_104$2009] WeBid <= 0.7.3 RC9 Multiple Remote File Inclution Vulnerabilities (vuln@...dc.org)
[ MDVSA-2009:071 ] kernel (security@...driva.com)
[ISecAuditors Security Advisories] WordPress MU HTTP Header XSS Vulnerability (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[SECURITY] [DSA 1735-1] New znc packages fix privilege escalation (Florian Weimer <fw@...eb.enyo.de>)

March 11 (9 messages)

[SECURITY] [DSA 1736-1] New mahara packages fix cross-site scripting (Steffen Joeris <white@...ian.org>)
Sun Java System Communications Express [HTML Injection] (sosoblood@...mail.com)
[ GLSA 200903-24 ] Shadow: Privilege escalation (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200903-23 ] Adobe Flash Player: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[security bulletin] HPSBUX02411 SSRT080111 rev.1 - HP-UX Running Java, Remote Execution of Arbitrary Code and Other Vulnerabilities (security-alert@...com)
[security bulletin] HPSBMA02412 SSRT080040 rev.1 - WMI Mapper for HP Systems Insight Manager Running on Windows, Remote Unauthorized Acces… (security-alert@...com)
Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Esca… (Cisco Systems Product Security Incident…)
[SECURITY] [DSA 1738-1] New curl packages fix arbitrary file access (Nico Golde <nion@...ian.org>)
Re: Adobe Flash Player plug-in null pointer dereference and browser crash (Matthew Dempsky <matthew@...himedia.com>)

March 12 (24 messages)

TOORCAMP 2009 CALL FOR PARTICIPATION (h1kari@...rcon.org)
Re: Sun Java System Communications Express [HTML Injection] (sosoblood@...mail.com)
[ MDVSA-2009:073 ] sarg (security@...driva.com)
[ MDVSA-2009:072 ] perl-MDK-Common (security@...driva.com)
POP Peeper 3.4.0.0 Date Remote Buffer Overflow Vulnerability (Krakow Labs <krakowlabs@...il.com>)
[USN-726-1] curl vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-724-1] Squid vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-728-2] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
TikiWiki 2.2 XSS Vulnerability in URI (iliz-z@...dex.rui)
Trellis Desk v1.0 XSS Vulnerability (larry@...gica.com)
[USN-729-1] Python Crypto vulnerability (Kees Cook <kees@...ntu.com>)
[ MDVSA-2009:074 ] libneon0.27 (security@...driva.com)
[ GLSA 200903-25 ] Courier Authentication Library: SQL Injection vulnerability (Pierre-Yves Rofes <py@...too.org>)
[USN-726-2] curl regression (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1737-1] New wesnoth packages fix several vulnerabilities (white@...ian.org (Steffen Joeris))
[USN-728-3] Firefox vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-727-2] NetworkManager vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200903-26 ] TMSNC: Execution of arbitrary code (Robert Buchholz <rbu@...too.org>)
Re: Adobe Flash Player plug-in null pointer dereference and browser crash (Alex Legler <a3li@...too.org>)
flv2mpeg4: Malformed parameters Denial of Service (Anon@...acker.net)
[USN-727-1] network-manager-applet vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[oCERT-2008-015] glib and glib-predecessor heap overflows (Will Drewry <redpig@...rt.org>)
[Suspected Spam][PT-2009-11] SlySoft Multiple Products ElbyCDIO.sys Denial of Service ("Valery Marchuk" <tecklord@...uritylab.ru>)
[security bulletin] HPSBMA02413 SSRT080040 rev.1 - HP WMI Mapper for Windows Server 2003 and Windows Server 2008 for Itanium-based Servers… (security-alert@...com)

March 13 (15 messages)

rPSA-2009-0042-1 curl (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0041-1 dhclient dhcp libdhcp4client (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200903-27 ] ProFTPD: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
rPSA-2009-0040-1 tshark wireshark (rPath Update Announcements <announce-noreply@...th.com>)
Apple iTunes DAAP Messages Handling Denial of Service Vulnerability . ("secresearch@...tinet.com" <secresearch@...tinet.com>)
Re: TikiWiki 2.2 XSS Vulnerability in URI (danny@...onrobots.co.uk)
rPSA-2009-0045-1 glib (rPath Update Announcements <announce-noreply@...th.com>)
rPSA-2009-0046-1 libpng (rPath Update Announcements <announce-noreply@...th.com>)
GeoVision LiveAudio ActiveX Control GetAudioPlayingTime() remote freed-memory access exploit (nospam@...il.it)
[Positive Technologies SA:2009-15] Living CMS Cross-Site Scripting vulnerability (aanisimov@...ecurity.com)
[Positive Technologies SA:2009-14] BLOG CMS Cross-Site Scripting vulnerability (aanisimov@...ecurity.com)
[Positive Technologies SA:2009-20] A.CMS Multiple Vulnerabilities (aanisimov@...ecurity.com)
[ MDVSA-2009:075 ] firefox (security@...driva.com)
[SECURITY] [DSA 1739-1] New mldonkey packages fix information disclosure (Florian Weimer <fw@...eb.enyo.de>)
Infopop UBB.Threads Admin Credentials via SQL Injection (swhite@...urestate.com)

March 16 (10 messages)

[SECURITY] [DSA 1740-1] New yaws packages fix denial of service (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1741-1] New psi packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[ GLSA 200903-28 ] libpng: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[Bkis-04-2009] GOM Encoder Heap-based Buffer Overflow ("Bkis" <svrt@...v.com.vn>)
[ MDVSA-2009:076 ] avahi (security@...driva.com)
NGENUITY-2009-005 OpenCart Order By Blind SQL Injection (Adam Baldwin <adam_baldwin@...nuity-is.com>)
reporting CVE (rahimeh.khodadadi@...il.com)
[Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36 ("Bkis" <svrt@...v.com.vn>)
rosoft media player local BOF exploit multi tagets (maroc-anti-connexion@...mail.com)
[SECURITY] [DSA 1742-1] New libsnd packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)

March 17 (18 messages)

[USN-734-1] FFmpeg vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-738-1] GLib vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-733-1] evolution-data-server vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
CPANEL File Manager XSS Vulnerability (rizki.wicaksono@...il.com)
HP Laserjet multiple models web management CSRF vulnerability & insecure default configuration (Henri Lindberg <henri.lindberg@...lehouse.com>)
[USN-736-1] GStreamer Good Plugins vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200903-29 ] BlueZ: Arbitrary code execution (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1743-1] New libtk-img packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
PHPRunner SQL Injection (admin@...report.ir)
[USN-735-1] GStreamer Base Plugins vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ GLSA 200903-30 ] Opera: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[USN-737-1] libsoup vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ECHO_ADV_105$2009] chaozzDB <= 1.2 Critical File Disclosure Vulnerability (vuln@...dc.org)
[ECHO_ADV_107$2009] FubarForum <= 1.6 Critical File Disclosure Vulnerability (vuln@...dc.org)
[USN-739-1] Amarok vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
DEFCON London DC4420 March meeting - Thursday 19th March (Major Malfunction <majormal@...ate-radio.org>)
[ECHO_ADV_106$2009] FireAnt <= 1.3 Critical File Disclosure Vulnerability (vuln@...dc.org)
[ GLSA 200903-31 ] libcdaudio: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)

March 18 (7 messages)

[USN-740-1] NSS vulnerability (Jamie Strandboge <jamie@...onical.com>)
iDefense Security Advisory 03.17.09: Autonomy KeyView Word Perfect File Parsing Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Sitecore .NET 5.3.x - web service information disclosure (security.assurance@....com.au)
Layered Defense Research Advisory: Format String Vulnerablity in Symantec PcAnywhere v10-12.5 (dh@...ereddefense.com)
Re: iDefense Security Advisory 03.17.09: Autonomy KeyView Word Perfect File Parsing Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1744-1] New weechat packages fix denial of service (Nico Golde <nion@...ian.org>)
CDex v1.70b2 (.ogg) local buffer overflow exploit poc (nospam@...il.it)

March 19 (6 messages)

[ GLSA 200903-32 ] phpMyAdmin: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[ISecAuditors Security Advisories] ModSecurity < 2.5.9 remote Denial of Service (DoS) (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[USN-742-1] JasPer vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Command Execution in Hannon Hill Cascade Server (Elliot Kendall <elliot.kendall@...ry.edu>)
rPSA-2009-0050-1 ghostscript (rPath Update Announcements <announce-noreply@...th.com>)
Slides from uCon Security Conference 2009 available online (uCon Security Conference <ucon@...n-conference.org>)

March 20 (12 messages)

Bs.Player <= 2.34 Build 980 (.bsl) local buffer overflow 0day exploit (seh) (nospam@...il.it)
LittleCMS vulnerabilities (OpenJDK, Firefox, GIMP, etc. impacted) (Chris Evans <scarybeasts@...il.com>)
[ MDVSA-2009:060-1 ] nfs-utils (security@...driva.com)
[security bulletin] HPSBMA02338 SSRT080024, SSRT080041 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Co… (security-alert@...com)
[USN-741-1] Thunderbird vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1748-1] New libsoup packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1745-1] New lcms packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ GLSA 200903-33 ] FFmpeg: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
[SECURITY] [DSA 1746-1] New ghostscript packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1747-1] New glib2.0 packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[oCERT-2009-003] LittleCMS integer errors (Andrea Barisani <lcars@...rt.org>)
[ GLSA 200903-34 ] Amarok: User-assisted execution of arbitrary code (Tobias Heinlein <keytoaster@...too.org>)

March 21 (1 message)

[SECURITY] [DSA 1749-1] New Linux 2.6.26 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)

March 23 (12 messages)

[ MDVSA-2009:077 ] pam (security@...driva.com)
[SECURITY] [DSA 1750-1] New libpng packages fix several vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA 1751-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
ExpressionEngine Persistent Cross-Site Scripting (Adam Baldwin <adam_baldwin@...nuity-is.com>)
Rittal CMC-TC Processing Unit II multiple vulnerabilities (Henri Lindberg - Smilehouse Oy <henri.lindberg@...lehouse.com>)
FreeBSD Security Advisory FreeBSD-SA-09:06.ktimer (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDVSA-2009:078 ] evolution-data-server (security@...driva.com)
CORE-2009-0122: HP OpenView Buffer Overflows (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[SECURITY] [DSA 1752-1] New webcit packages fix potential remote code execution (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2009:079 ] postgresql (security@...driva.com)
[USN-743-1] Ghostscript vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-744-1] LittleCMS vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)

March 24 (9 messages)

[ GLSA 200903-35 ] Muttprint: Insecure temporary file usage (Pierre-Yves Rofes <py@...too.org>)
[ GLSA 200903-36 ] MLDonkey: Information disclosure (Pierre-Yves Rofes <py@...too.org>)
PHPizabi v0.848b C1 HFP1 proc.inc.php remote privilege escalation (php.ini independent) (nospam@...il.it)
[security bulletin] HPSBMA02416 SSRT090008 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[ GLSA 200903-37 ] Ghostscript: User-assisted execution of arbitrary code (Pierre-Yves Rofes <py@...too.org>)
ZDI-09-014: Adobe Acrobat getIcon() Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBUX02409 SSRT080171 rev.1 - HP-UX Running VERITAS File System (VRTSvxfs) or VERITAS Oracle Disk Manager (VRTSodm), … (security-alert@...com)
iDefense Security Advisory 03.24.09: Adobe Reader and Acrobat JBIG2 Encoded Stream Heap Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[SECURITY] [DSA 1753-1] End-of-life announcement for Iceweasel in oldstable (Moritz Muehlenhoff <jmm@...ian.org>)

March 25 (13 messages)

[ GLSA 200903-38 ] Squid: Multiple Denial of Service vulnerabilities (Pierre-Yves Rofes <py@...too.org>)
Secunia Research: Adobe Reader JBIG2 Symbol Dictionary Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1745-2] New lcms packages fix regression (white@...ian.org (Steffen Joeris))
Cisco Security Advisory: Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@c…)
Cisco Security Advisory: Cisco IOS Software WebVPN and SSLVPN Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS cTCP Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Secure Copy Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
Re: Secunia Research: Adobe Reader JBIG2 Symbol Dictionary Buffer Overflow (Florian Weimer <fw@...eb.enyo.de>)
Re: Secunia Research: Adobe Reader JBIG2 Symbol Dictionary Buffer Overflow ("Eric C. Lukens" <eric.lukens@....edu>)
Re[2]: Secunia Research: Adobe Reader JBIG2 Symbol Dictionary Buffer Overflow ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
CFP RAID 2009 (Corrado Leita <corrado_leita@...antec.com>)
[SECURITY] [DSA 1755-1] New systemtap packages fix local privilege escalation (Moritz Muehlenhoff <jmm@...ian.org>)

March 26 (2 messages)

[ GLSA 200903-39 ] pam_krb5: Privilege escalation (Pierre-Yves Rofes <py@...too.org>)
[Bkis-05-2009] PowerCHM Stack-based Buffer Overflow (Bkis <svrt@...v.com.vn>)

March 27 (13 messages)

ICAP adaptation: missing data flow control to client side (Martin Huter <m.huter@...on.com>)
iDefense Security Advisory 03.26.09: Sun Java Runtine Environment (JRE) Type1 Font Parsing Integer Signedness Vulnerabi… (iDefense Labs <labs-no-reply@...fense.c…)
[USN-746-1] xine-lib vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-747-1] ICU vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
iDefense Security Advisory 03.26.09: Sun Java Web Start (JWS ) GIF Decoding Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[ MDVSA-2009:080 ] glib2.0 (security@...driva.com)
[USN-748-1] OpenJDK vulnerabilities (Kees Cook <kees@...ntu.com>)
Aurora Nutritive Analysis Module Multiple XSS (Bugs NotHugs <bugsnothugs@...il.com>)
Moodle: Sensitive File Disclosure (Christian Eibl <chreibl@....de>)
iDefense Security Advisory 03.26.09: Sun Java Runtine Environment (JRE) GIF Decoding Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 03.26.09: Sun Java Web Start (JWS ) PNG Decoding Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 03.26.09: Sun Java Runtime Environment (JRE) Pack200 Decompression Integer Overflow Vulnerab… (iDefense Labs <labs-no-reply@...fense.c…)
Novell Netstorage Multiple Vulnerabilities (Bugs NotHugs <bugsnothugs@...il.com>)

March 30 (15 messages)

[ MDVSA-2009:081 ] libsoup (security@...driva.com)
[USN-745-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1756-1] New xulrunner packages fix multiple vulnerabilities (Noah Meyerhans <noahm@...ian.org>)
[tool release] Watcher v1.0.0 - passive Web-app security testing and compliance auditing ("Chris Weber" <chris@...kout.net>)
[ GLSA 200903-40 ] Analog: Denial of Service (Pierre-Yves Rofes <py@...too.org>)
glFusion <= 1.1.2 COM_applyFilter()/order sql injection exploit (nospam@...il.it)
Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow (Bugs NotHugs <bugsnothugs@...il.com>)
[SECURITY] [DSA 1757-1] New auth2db packages fix SQL injection (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:082 ] krb5 (security@...driva.com)
CVE-2009-0790: ISAKMP DPD Remote Vulnerability with Openswan & Strongswan IPsec (Paul Wouters <paul@...erance.com>)
Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3 (Positron Security <advisories@...itronsecurity.com>)
Family Connections 1.8.1 Multiple Remote Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[USN-749-1] libsndfile vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
DeepSec 2009 - Call for Papers is open (DeepSec Conference <deepsec@...psec.net>)
Community CMS 0.5 Multiple SQL Injection Vulnerabilities ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)

March 31 (19 messages)

[SECURITY] [DSA 1759-1] New strongswan packages fix denial of service (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1758-1] New nss-ldapd packages fix information disclosure (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1760-1] New openswan packages fix denial of service (white@...ian.org (Steffen Joeris))
ZDI-09-015: Mozilla Firefox XUL _moveToEdgeShift() Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Re: Family Connections 1.8.1 Multiple Remote Vulnerabilities (r_haudenschilt@...mail.com)
aspWebCalendar Free Edition bug (joseph.giron13@...il.com)
Zabbix Multiple Frontend CSRF (Password reset & command execution) (Adam Baldwin <adam_baldwin@...nuity-is.com>)
Re: [ECHO_ADV_103$2009] taifajobs <= 1.0 (jobid) Remote SQL Injection Vulnerability (tiha@...faweb.net)
Cisco ASA5520 Web VPN Host Header XSS (Bugs NotHugs <bugsnothugs@...il.com>)
[ECHO_ADV_108$2009] JobHut <= 1.2 (pk) Remote Sql Injection Vulnerability (vuln@...dc.org)
[Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabili… ("Valery Marchuk" <tecklord@...uritylab.…)
webEdition 6.0.0.4 Local File Inclusion ("Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>)
[USN-750-1] OpenSSL vulnerability (Jamie Strandboge <jamie@...onical.com>)
[ GLSA 200903-41 ] gedit: Untrusted search path (Pierre-Yves Rofes <py@...too.org>)
[DSECRG-09-013] IBM WebSphere Application Server 7.0 Multiple XSS Vulnerabilities (DSecRG <research@...crg.com>)
[security bulletin] HPSBMA02416 SSRT090008 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[DSECRG-09-016] SAP SAPDB Multiple XSS (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[DSECRG-09-030] PrecisionID Datamatrix ActiveX control - Arbitrary File overwriting (DSecRG <research@...crg.com>)
CORE-2009-0108: Multiple vulnerabilities in Sun Calendar Express Web Server (CORE Security Technologies Advisories <advisories@...esecurity.com>)

296 messages

Powered by blists - more mailing lists