bugtraq mailing list - 2009/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 10	² 11	³ 3	⁴ 5	⁵	⁶
⁷	⁸ 16	⁹ 27	¹⁰ 10	¹¹ 15	¹²	¹³
¹⁴ 21	¹⁵ 9	¹⁶ 28	¹⁷ 9	¹⁸ 6	¹⁹	²⁰
²¹ 12	²² 10	²³ 20	²⁴ 9	²⁵ 7	²⁶	²⁷
²⁸ 15	²⁹ 4	³⁰ 4

Messages by day:

September 1 (10 messages)

VMSA-2009-0011 VMware Studio 2.0 addresses a security issue in the public beta version of Studio 2.0 (VMware Security team <security@...are.com>)
Norman Internet Update Deamon sends cleartext license key on update (Stefan Bauer <stefan.bauer@...ewerk.de>)
Pwning Opera Unite with Inferno's Eleven ("Inferno" <inferno@...urethoughts.com>)
SEC Consult SA-20090901-0 :: File disclosure vulnerability in JSFTemplating, Mojarra Scales and GlassFish Application S… (Johannes Greil <research@...-consult.co…)
Secunia Research: OpenOffice.org Word Document Table Parsing Integer Underflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: OpenOffice.org Word Document Table Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[BMSA-2009-06] Remote code execution in BKAV eOffice (Nam Nguyen <namn@...emoon.com.vn>)
[ MDVSA-2009:197 ] nss (security@...driva.com)
[SECURITY] [DSA 1876-1] New dnsmasq packages fix remote code execution (Florian Weimer <fw@...eb.enyo.de>)
Re: Norman Internet Update Deamon sends cleartext license key on update (Jeffrey Walton <noloader@...il.com>)

September 2 (11 messages)

[USN-827-1] Dnsmasq vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: [Full-disclosure] Microsoft Internet Information Server ftpd zeroday (Thierry Zoller <Thierry@...ler.lu>)
Re: [Full-disclosure] Microsoft Internet Information Server ftpd zeroday (Guido Landi <lists@...mera.org>)
Re[2]: [Full-disclosure] Microsoft Internet Information Server ftpd zeroday ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
[USN-810-2] NSS regression (Kees Cook <kees@...ntu.com>)
Re[2]: [Full-disclosure] Microsoft Internet Information Server ftpd zeroday ("Vladimir '3APA3A' Dubrovin" <3APA3A@...URITY.NNOV.RU>)
[ADVISORY] NetCache URL DoS - Argentinian ISP ("Arturo 'Buanzo' Busleiman" <buanzo@...nzo.com.ar>)
Re: [Full-disclosure] Microsoft Internet Information Server ftpd zeroday (Guido Landi <lists@...mera.org>)
International Hacking & Security Conference "POC2009" and Call for Paper (pocadm@...il.com)
[SECURITY] [DSA 1877-1] New mysql-dfsg-5.0 packages fix arbitrary code execution (Sebastien Delafond <seb@...ian.org>)
[SECURITY] [DSA 1878-1] New devscripts packages fix remote code execution (Florian Weimer <fw@...eb.enyo.de>)

September 3 (3 messages)

FRHACK OS v1 alpha1 released (Jerome Athias <jerome.athias@...e.fr>)
FRHACK ITSec Conf DVDs and Live Streams (Jerome Athias <jerome.athias@...e.fr>)
New Bug Found By Ostoure Sazan Sharif (ostoure.sazan@...il.com)

September 4 (5 messages)

AST-2009-006: IAX2 Call Number Resource Exhaustion ("Asterisk Security Team" <security@...erisk.org>)
Microsoft Internet Information Services 5.0/6.0 FTP SERVER DENIAL OF SERVICE ("Stack Exhaustion") (Kingcope <kcope2@...glemail.com>)
DvBBS v2.0(PHP) boardrule.php Sql injection (info@...uritylab.ir)
[SECURITY] [DSA 1879-1] New silc-client/silc-toolkit packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
Re: FRHACK OS v1 alpha1 released (Jerome Athias <jerome.athias@...e.fr>)

September 8 (16 messages)

VMSA-2009-0012 VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues. (VMware Security team <security@...are.com>)
[oCERT-2009-013] yTNEF/Evolution TNEF attachment decoder input sanitization errors (Andrea Barisani <lcars@...rt.org>)
Re: [TZO-08-2009] Bitdefender generic bypass/evasion (noloader@...il.com)
yTNEF/Evolution TNEF Attachment decoder plugin directory traversal & buffer overflow vulnerabilities (Akita Software Security <lists@...tasecurity.nl>)
[ GLSA 200909-01 ] Linux-PAM: Privilege escalation (Alex Legler <a3li@...too.org>)
[ GLSA 200909-02 ] libvorbis: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
Secunia Research: VMWare VMnc Codec Mismatched Dimensions Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1881-1] New cyrus-imapd packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
Various Orion application application server example pages are vulnerable to XSS. (info@...checkup.com)
Novell eDirectory 8.8 SP5 Dhost Http Server DoS (karakorsankara@...mail.com)
[scip_Advisory 4021] IBM Lotus Notes 8.5 RSS Widget Privilege Escalation (Marc Ruef <maru@...p.ch>)
Re: [Full-disclosure] Microsoft Internet Information Server ftpd zeroday (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:225 ] qt4 (security@...driva.com)
Regarding Microsoft srv2.sys SMB2.0 NEGOTIATE BSOD (Reversemode <advisories@...ersemode.com>)
MS09-048 includes fixes for TCP/IP implementation issues reported more than a year ago (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
ZDI-09-062: Microsoft Internet Explorer JScript arguments Invocation Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

September 9 (27 messages)

[USN-828-1] PAM vulnerability (Kees Cook <kees@...ntu.com>)
Open Beta - New Free AV Software (Alfred Huger <alfred@...unet.com>)
SMB SRV2.SYS Denial of Service PoC (igottabug@...etthis.com)
Re: DoS vulnerability in Google Chrome ("MustLive" <mustlive@...security.com.ua>)
TCP/IP Orphaned Connections Vulnerability (Fabian Yamaguchi <fabs@...urity-labs.com>)
[Advisory] ChartDirector Critical File Access ("DokFLeed" <dokfleed@...fleed.net>)
Multiple RDP Connections BSOD DOS (Tim Medin <timmedin@...uritywhole.com>)
SeacureIT Preview Conference 2009 (Stefano Zanero <s.zanero@...urenetwork.it>)
[ GLSA 200909-03 ] Apache Portable Runtime, APR Utility Library: Execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 200909-04 ] Clam AntiVirus: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[ GLSA 200909-05 ] Openswan: Denial of Service (Alex Legler <a3li@...too.org>)
[ GLSA 200909-06 ] aMule: Parameter injection (Alex Legler <a3li@...too.org>)
[ GLSA 200909-07 ] TkMan: Insecure temporary file usage (Alex Legler <a3li@...too.org>)
Re: MS09-048 includes fixes for TCP/IP implementation issues reported more than a year ago (bob@...e.com)
[ GLSA 200909-08 ] C* music player: Insecure temporary file usage (Alex Legler <a3li@...too.org>)
4f: The File Format Fuzzing Framework (Krakow Labs <krakowlabs@...il.com>)
[ GLSA 200909-09 ] Screenie: Insecure temporary file usage (Alex Legler <a3li@...too.org>)
[ GLSA 200909-10 ] LMBench: Insecure temporary file usage (Alex Legler <a3li@...too.org>)
[ GLSA 200909-11 ] GCC-XML: Insecure temporary file usage (Alex Legler <a3li@...too.org>)
[SECURITY] [DSA 1882-1] New xapian-omega packages fix cross-site scripting (Nico Golde <nion@...ian.org>)
CORE-2009-0820 - Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[ MDVSA-2009:226 ] aria2 (security@...driva.com)
Re: Multiple RDP Connections BSOD DOS (Elvedin Trnjanin <trnja001@....edu>)
RE: MS09-048 includes fixes for TCP/IP implementation issues reported more than a year ago (Jim Duncan <jduncan@...iper.net>)
Re: Re: Multiple RDP Connections BSOD DOS (nobody@...here.com)
RE: Re: Multiple RDP Connections BSOD DOS ("Earnhart, Benjamin J" <benjamin-earnhart@...wa.edu>)
Re: Multiple RDP Connections BSOD DOS (John Menerick <jmenerick@...suite.com>)

September 10 (10 messages)

Nullam Blog Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Re: Multiple RDP Connections BSOD DOS (Tim Medin <timmedin@...uritywhole.com>)
[SECURITY] [DSA 1883-1] New nagios2 packages fix several cross-site scriptings (white@...ian.org (Steffen Joeris))
SecurityTubeCon CFP, Venue: Cyberspace! (Vivek Ramachandran <vivek@...uritytube.net>)
[ MDVSA-2009:226 ] freeradius (security@...driva.com)
T-HTB Manager Mutiple Blind SQL Injection (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[USN-821-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
ZDI-09-064: Apple QuickTime FlashPix Sector Size Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-063: Apple QuickTime H.264 Nal Unit Length Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-065: Mozilla Firefox TreeColumns Dangling Pointer Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

September 11 (15 messages)

[USN-829-1] Qt vulnerability (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA 1878-2] New devscripts packages fix regressions (Florian Weimer <fw@...eb.enyo.de>)
[ MDVSA-2009:229 ] cyrus-imapd (security@...driva.com)
Siemens Gigaset SE361 Wlan - Remote Reboot (crashbrz@...il.com)
Regular Expression Denial of Service ("Alex Roichman" <Alexr@...ckmarx.com>)
[ MDVSA-2009:230 ] pidgin (security@...driva.com)
Re: Regular Expression Denial of Service (Gadi Evron <ge@...uxbox.org>)
iphone email client does not validate ssl certificates (Bill Borskey <wborskey@...il.com>)
[ MDVSA-2009:231 ] htmldoc (security@...driva.com)
ShmooCon 2010 CFP (Bruce Potter <gdead@...oo.com>)
[ MDVSA-2009:228 ] libneon (security@...driva.com)
Re[2]: Regular Expression Denial of Service (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:197-2 ] nss (security@...driva.com)
[ MDVSA-2009:232 ] libsamplerate (security@...driva.com)
Re: Regular Expression Denial of Service (Gadi Evron <ge@...uxbox.org>)

September 14 (21 messages)

Re: Re[2]: Regular Expression Denial of Service (Jeffrey Walton <noloader@...il.com>)
vBulletin 3.8.2 Denial of Service Exploit (snip3r ir4Q <iq.submitter@...il.com>)
nullcon Goa 2010 Call For Papers (nullcon nullcon <nullcon@...lcon.net>)
[ GLSA 200909-12 ] HTMLDOC: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 200909-13 ] irssi: Execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 200909-14 ] Horde: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[ GLSA 200909-15 ] Lynx: Arbitrary command execution (Alex Legler <a3li@...too.org>)
War FTP Daemon Remote Denial Of Service Vulnerability (Jarle Aase <jgaa@...a.com>)
Re: [Full-disclosure] FreeBSD <= 6.1 kqueue() NULL pointer dereference (Przemyslaw Frasunek <venglin@...ebsd.lublin.pl>)
Re: Regular Expression Denial of Service (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
[ GLSA 200909-16 ] Wireshark: Denial of Service (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 200909-17 ] ZNC: Directory traversal (Tobias Heinlein <keytoaster@...too.org>)
Re: Regular Expression Denial of Service (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
[SECURITY] [DSA 1883-2] New nagios2 packages fix regression (white@...ian.org (Steffen Joeris))
[ECHO_ADV_111$2009] Joomla Hotel Booking System Component XSS/SQL Injection Multiple Vulnerability (adv@...dc.org)
[SECURITY] [DSA 1884-1] New nginx packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 1885-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1886-1] New iceweasel packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-830-1] OpenSSL vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-831-1] OpenEXR vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[TKADV2009-007] Apple iPhone OS AudioCodecs Heap Buffer Overflow (Tobias Klein <tk@...pkit.de>)

September 15 (9 messages)

Local privilege escalation vulnerability in Protector Plus Antivirus (Proland Software) (ss_contacts@...mail.com)
[ MDVSA-2009:233 ] kernel (security@...driva.com)
[ MDVSA-2009:234 ] silc-toolkit (security@...driva.com)
[ MDVSA-2009:234-1 ] silc-toolkit (security@...driva.com)
[ MDVSA-2009:235 ] silc-toolkit (security@...driva.com)
[SECURITY] [DSA 1887-1] New rails packages fix cross-site scripting (white@...ian.org (Steffen Joeris))
3rd party patch for XP for MS09-048? ("Aras \"Russ\" Memisyazici" <nowhere@...null.com>)
Improper Authentication Mechanism in 3Com Wireless8760 Dual Radio 11a/b/g Poe Access Point (Yossi Yakubov <yos20053@...il.com>)
Re: 3rd party patch for XP for MS09-048? (Jeffrey Walton <noloader@...il.com>)

September 16 (28 messages)

Re: 3rd party patch for XP for MS09-048? (Eric Kimminau <eak@...minau.org>)
Re: 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
Re: 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
Re: 3rd party patch for XP for MS09-048? ("Eric C. Lukens" <eric.lukens@....edu>)
[SECURITY] [DSA 1888-1] New openssl packages deprecate MD2 hash signatures (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Improper Authentication Mechanism in 3Com Wireless8760 Dual Radio 11a/b/g Poe Access Point (Tom Neaves <tom@...neaves.co.uk>)
Re: 3rd party patch for XP for MS09-048? (Jeffrey Walton <noloader@...il.com>)
Re: 3rd party patch for XP for MS09-048? (Matt Riddell <matt@...turevoip.com>)
Re: 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Thor (Hammer of God)" <thor@...merofgod.com>)
RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Larry Seltzer" <larry@...ryseltzer.com>)
Re: Re: 3rd party patch for XP for MS09-048? (Elizabeth.a.greene@...il.com)
Exploiting Chrome and Opera's inbuilt ATOM/RSS reader with Script Execution and more ("Inferno" <inferno@...urethoughts.com>)
RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Thor (Hammer of God)" <thor@...merofgod.com>)
[security bulletin] HPSBUX02458 SSRT090104 rev.1 - HP-UX Running bootpd, Remote Denial of Service (DoS) (security-alert@...com)
ANNOUNCE: RFIDIOt release - v0.z - 16th September, 2009 (Adam Laurie <adam@...roup.co.uk>)
Re: 3rd party patch for XP for MS09-048? (Tom Grace <tom@...thbycomputers.co.uk>)
Re: 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: [Full-disclosure] 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
Iret #GP on pre-commit handling failure: the NetBSD case (CVE-2009-2793) (Julien TINNES <julien@....org>)
Re: [Full-disclosure] 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: 3rd party patch for XP for MS09-048? (Rob Thompson <my.security.lists@...il.com>)
[SECURITY] [DSA 1889-1] New icu packages correct multibyte sequence parsing (Moritz Muehlenhoff <jmm@...ian.org>)
[USN-832-1] FreeRADIUS vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Larry Seltzer" <larry@...ryseltzer.com>)

September 17 (9 messages)

RE: [Full-disclosure] 3rd party patch for XP for MS09-048? ("Aras \"Russ\" Memisyazici" <nowhere@...null.com>)
nginx internal DNS cache poisoning (Matthew Dempsky <matthew@...psky.org>)
Re: nginx internal DNS cache poisoning (Maxim Dounin <mdounin@...unin.ru>)
Quiksoft EasyMail 6.0.3.0 imap connect() ActiveX stack overflow exploit (Sebastian Wolfgarten <sebastian@...fgarten.com>)
Re: [Full-disclosure] 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
Re: [Full-disclosure] 3rd party patch for XP for MS09-048? (John Morrison <john.morrison101@...glemail.com>)
SEC Consult SA-20090917-0 :: RADactive I-Load Multiple Vulnerabilities (Stefan Streichsbier <research@...-consult.com>)
Re: [Full-disclosure] 3rd party patch for XP for MS09-048? (Susan Bradley <sbradcpa@...bell.net>)
Peiter "Mudge" Zatko petition to be named U.S. Cybersecurity Chief (The Sp3ctacle <sp3ctacle@...il.com>)

September 18 (6 messages)

[USN-833-1] KDE-Libs vulnerability (Jamie Strandboge <jamie@...onical.com>)
Multiple Remote Command Execution vulnerabilities on Avaya Intuity Audix LX (plus some client-side bugs) (Adrian P <unknown.pentester@...il.com>)
Advisory 01/2009: Horde_Form_Type_image Arbitrary File Overwrite Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
[security bulletin] HPSBST02459 SSRT080134 rev.2 - HP StorageWorks Remote Management Interface (RMI) for MSL Tape Libraries and 1/8 G2 Tap… (security-alert@...com)
Advisory: Crypto backdoor in Qnap storage devices (CVE-2009-3200) (Marc Heuse <mh@...eline-security.de>)
[ GLSA 200909-18 ] nginx: Remote execution of arbitrary code (Alex Legler <a3li@...too.org>)

September 21 (12 messages)

Mambo 4.6.3 arbitrary file upload (Paweł Łaskarzewski <kl3ryk@...il.com>)
[SECURITY] [DSA 1890-1] New wxwidgets packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ GLSA 200909-19 ] Dnsmasq: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
Dawaween V 1.03 <<----SQL Injection Exploit (Dazz.band@...mail.com)
rubrique 'rubrique.php' SQL Injection Vulnerability (CrAzY_CrAcKeR@...mail.com)
[ MDVSA-2009:236 ] firefox (security@...driva.com)
[scip_Advisory 4020] Check Point Connectra R62 Login Script Injection Vulnerability ("Stefan Friedli" <stfr@...p.ch>)
[UPRSN] Ubuntu Privacy Remix 9.04r2 fixes security issues (Ubuntu Privacy Remix Team <security_notice@...vacy-cd.org>)
[USN-834-1] PostgreSQL vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2009:237 ] openssl (security@...driva.com)
[Suspected Spam][USN-835-1] neon vulnerabilities (Kees Cook <kees@...ntu.com>)
[ MDVSA-2009:238 ] openssl (security@...driva.com)

September 22 (10 messages)

[security bulletin] HPSBGN02441 SSRT090082 rev.1 - HP ProCurve Identity Driven Manager (IDM) Running on Microsoft IAS or NPS, Local Unauth… (security-alert@...com)
ToorCon 11 Preliminary Lineup Announced! (h1kari@...rcon.org)
[MajorSecurity Advisory #55]moziloCMS - Directory Traversal, Cross Site Scripting and Session Fixation Issues (david@...orsecurity.info)
[SECURITY] [DSA 1891-1] New changetrack packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:239 ] openssl (security@...driva.com)
[ MDVSA-2009:240 ] apache (security@...driva.com)
[ MDVSA-2009:241 ] squid (security@...driva.com)
[security bulletin] HPSBUX02457 SSRT090174 rev.1 - HP-UX Running Role-Based Access Control (RBAC), Local Unauthorized Access (security-alert@...com)
[ MDVSA-2009:242 ] dovecot (security@...driva.com)
[ MDVSA-2009:242-1 ] dovecot (security@...driva.com)

September 23 (20 messages)

Re: [Full-disclosure] 3rd party patch for XP for MS09-048? (Mailing lists at Core Security Technologies <lists@...esecurity.com>)
[ MDVSA-2009:243 ] freetype2 (security@...driva.com)
cour supreme 'index.php' SQL Injection & Local File Include Vulnerability (CrAzY_CrAcKeR@...mail.com)
nginx - low risk webdav destination bug (Kingcope <kcope2@...glemail.com>)
[DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities (research@...c.ru)
[USN-836-1] WebKit vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerabilit… (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Network Time Protocol Packet Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Crafted Encryption Packet Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <ps…)
Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Resource Exhaustion Vulnerability (Cisco Systems Product Security Incident Response Team <psir…)
Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Bypass Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@…)
Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <…)
Avast aswMon2.sys kernel memory corruption and Local Privilege Escalation. (contact.fingers@...il.com)
[SECURITY] [DSA 1893-1] New cyrus-imapd-2.2/kolab-cyrus-imapd packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:244 ] xfig (security@...driva.com)
[SECURITY] [DSA 1892-1] New dovecot packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
Cisco Security Advisory: Cisco Unified Communications Manager Express Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
ZDI-09-066: Adobe RoboHelp Server Arbitrary File Upload and Execute Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

September 24 (9 messages)

Black Hat DC Call for Papers is now OPEN ("Jeff Moss" <jmoss@...ckhat.com>)
[ MDVSA-2009:243-1 ] freetype2 (security@...driva.com)
[SECURITY] [DSA 1894-1] New newt packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:245 ] glib2.0 (security@...driva.com)
[USN-837-1] Newt vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Engeman - SQL Injection Vulnerability (vendor url erratum) (crashbrz@...il.com)
Cross-Site Scripting vulnerability in E107 ("MustLive" <mustlive@...security.com.ua>)
Call for Participation - ACM Conference on Computer and Communications Security (CCS) (Christopher Kruegel <chris@...ucsb.edu>)
[SECURITY] [DSA 1895-1] New xmltooling packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)

September 25 (7 messages)

Cisco ACE XML Gateway <= 6.0 Internal IP disclosure (nitrØus <nitrousenador@...il.com>)
COMPENG 2010 - Extended Submission Deadline ("Federico Maggi" <federico.maggi@...il.com>)
Multiple Vulnerabilities ("Dr_IDE" <dr_ide@...hmail.com>)
[ GLSA 200909-20 ] cURL: Certificate validation error (Alex Legler <a3li@...too.org>)
[ MDVSA-2009:246 ] php (security@...driva.com)
[ MDVSA-2009:247 ] php (security@...driva.com)
[ MDVSA-2009:248 ] php (security@...driva.com)

September 28 (15 messages)

Multiple Vulnerabilities (Jerome Athias <jerome.athias@...e.fr>)
Re: iphone email client does not validate ssl certificates (Pavel Machek <pavel@....cz>)
[MajorSecurity Advisory #59]PHP <=5.3 - mysqli_real_escape_string() full path disclosure (David Vieira-Kurz <david@...orsecurity.info>)
(edited) [DSECRG-09-044] SAP GUI 7.1 Insecure Methods (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
[MajorSecurity Advisory #57]PHP <=5.3 - preg_match() full path disclosure (David Vieira-Kurz <david@...orsecurity.info>)
[SECURITY] [DSA 1897-1] New horde3 packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
Re: Regular Expression Denial of Service (hackerwebzine@...il.com)
[USN-838-1] Dovecot vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2009:249 ] newt (security@...driva.com)
[DSECRG-09-043] SAP GUI 7.1 Insecure Method (Alexandr Polyakov <alexandr.polyakov@...c.ru>)
Local privilege escalation vulnerability in Trustport security software (ss_contacts@...mail.com)
Vulnerabilities in E107 ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA 1896-1] New Shibboleth 1.x packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBMA02461 SSRT090187 rev.1 - HP Remote Graphics Software (RGS) Sender, Remote Unauthorized Access (security-alert@...com)
Cross-Site Scripting vulnerability in eCaptcha ("MustLive" <mustlive@...security.com.ua>)

September 29 (4 messages)

WinRAR v3.80 - ZIP Filename Spoofing (chr1x <chr1x@...tester.net>)
Re: iphone email client does not validate ssl certificates (Steve Shockley <steve.shockley@...ckley.net>)
Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges (nospam@...il.it)
FlatPress 0.804-0.812.1 Local File Inclusion to Remote Command Execution (Giuseppe Fuggiano <giuseppe.fuggiano@...il.com>)

September 30 (4 messages)

MD5 hash extension attack breaks API authentication of Flickr and others (Juliano Rizzo <netiferasnospam@...ifera.com>)
C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness ("Eyal Udassin" <eyal.udassin@...security.com>)
[ MDVSA-2009:176 ] postgresql (security@...driva.com)
[ MDVSA-2009:177 ] postgresql (security@...driva.com)

251 messages

Powered by blists - more mailing lists