bugtraq mailing list - 2009/12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2009/12

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 9	² 10	³ 24	⁴ 32	⁵	⁶
⁷ 39	⁸ 16	⁹ 39	¹⁰ 13	¹¹ 18	¹²	¹³
¹⁴ 17	¹⁵ 13	¹⁶ 14	¹⁷ 15	¹⁸	¹⁹	²⁰
²¹ 17	²² 6	²³ 6	²⁴	²⁵	²⁶	²⁷
²⁸ 19	²⁹ 7	³⁰ 3	³¹ 2

Messages by day:

December 1 (9 messages)

[ MDVSA-2009:305 ] php (security@...driva.com)
[oCERT-2009-017] PHP multiple issues (Andrea Barisani <lcars@...rt.org>)
** FreeBSD local r00t zeroday (Kingcope <kcope2@...glemail.com>)
Re: [Full-disclosure] ** FreeBSD local r00t zeroday (Ed Carp <erc@...ox.com>)
WinAppDbg 1.3 is out! (Mario Alejandro Vilas Jerez <mvilas@...il.com>)
Re: [Full-disclosure] ** FreeBSD local r00t zeroday (Ryan Steinmetz <rpsfa@....edu>)
Upcoming FreeBSD Security Advisory (FreeBSD Security Officer <cperciva@...ebsd.org>)
AST-2009-010: RTP Remote Crash Vulnerability ("Asterisk Security Team" <security@...erisk.org>)
Theeta CMS (Cross Site Scripting,SQL Injection) Multiple Vulnerabilities (c0dy@...tDefaced.net)

December 2 (10 messages)

[ GLSA 200912-01 ] OpenSSL: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
Re: [rejected] Oracle exploit for CTXSYS.DRVXTABC.CREATE_TABLES and others ("Andrea Purificato" <a.purificato@....it>)
Secunia Research: Roxio Creator Image Rendering Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
40 vulnerabilities in SMF 1.1.10/SMF 2.0RC2 by elhacker.net (Simple Audit) (smf2.review@...il.com)
Re: ** FreeBSD local r00t zeroday (Robert BARABAS <dc@....bme.hu>)
Re: [Full-disclosure] Remote Command Execution in dotDefender Site Management (Andrew Farmer <andfarm@...il.com>)
Same-origin policy bypass vulnerabilities in several VPN products reported (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
Secunia Research: Lateral Arts Photobox uploader ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Re: ** FreeBSD local r00t zeroday (Barkın KILIÇ <barkin@...kin.info>)
Call for Papers - you Sh0t the Sheriff 4 - Security Conference, Brazil (Luiz Eduardo <le@...s.org>)

December 3 (24 messages)

[SECURITY] [DSA 1943-1] New openldap2.3/openldap packages fix SSL certificate verification weakness (Giuseppe Iuculano <iuculano@...ian.org>)
[ MDVSA-2009:121-1 ] lcms (security@...driva.com)
Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps) Overlong DSC Comment Buffer Overflow Exploit (nospam@...il.it)
Re: Millions of PDF invisibly embedded with your internal disk paths (Pavel Machek <pavel@....cz>)
FreeBSD Security Advisory FreeBSD-SA-09:15.ssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-09:16.rtld (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDVSA-2009:197-3 ] nss (security@...driva.com)
FreeBSD Security Advisory FreeBSD-SA-09:17.freebsd-update (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 1945-1] New gforge packages fix denial of service (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:217-3 ] mozilla-thunderbird (security@...driva.com)
[ MDVSA-2009:103-1 ] udev (security@...driva.com)
[ MDVSA-2009:107-1 ] acpid (security@...driva.com)
[ MDVSA-2009:106-1 ] libwmf (security@...driva.com)
[ MDVSA-2009:108-1 ] zsh (security@...driva.com)
[ MDVSA-2009:112-1 ] ipsec-tools (security@...driva.com)
U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) root compromise / VU#433821 (Frank Stuart <fstuart@...uart.com>)
[SECURITY] [DSA 1944-1] New request-tracker packages fix session hijack vulnerability (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:113-1 ] cyrus-sasl (security@...driva.com)
[ MDVSA-2009:309 ] ntp (security@...driva.com)
[USN-863-1] QEMU vulnerability (Jamie Strandboge <jamie@...onical.com>)
CORE-2009-0911: DAZ Studio Arbitrary Command Execution (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[ MDVSA-2009:308 ] gnutls (security@...driva.com)
[ MDVSA-2009:310 ] openssl (security@...driva.com)
FreeBSD Security Advisory FreeBSD-SA-09:15.ssl [REVISED] (FreeBSD Security Advisories <security-advisories@...ebsd.org>)

December 4 (32 messages)

[ MDVSA-2009:290-1 ] firefox (security@...driva.com)
[ MDVSA-2009:292-1 ] wireshark (security@...driva.com)
[ MDVSA-2009:132-1 ] libsndfile (security@...driva.com)
RE: Millions of PDF invisibly embedded with your internal disk paths ("Thor (Hammer of God)" <thor@...merofgod.com>)
[ MDVSA-2009:313-1 ] bind (security@...driva.com)
Invision Power Board <= 3.0.4 Local PHP File Inclusion and SQL Injection (Dawid Golunski <golunski@...t.eu>)
[ MDVSA-2009:169-1 ] libtiff (security@...driva.com)
[ MDVSA-2009:203-1 ] curl (security@...driva.com)
[ MDVSA-2009:158-3 ] pango (security@...driva.com)
[InterN0T] Google Analytics plugin for Wordpress - XSS Vulnerability (advisories@...ern0t.net)
[ MDVSA-2009:208-1 ] libgadu (security@...driva.com)
PHP 5.3.1 open_basedir bypass (cxib@...urityreason.com)
Secunia Research: DevIL DICOM "GetUID()" Buffer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2009:311 ] ghostscript (security@...driva.com)
[ MDVSA-2009:142-1 ] jasper (security@...driva.com)
[ MDVSA-2009:287-1 ] xpdf (security@...driva.com)
[ MDVSA-2009:212-1 ] python (security@...driva.com)
[ MDVSA-2009:315 ] libneon (security@...driva.com)
[ MDVSA-2009:211-1 ] expat (security@...driva.com)
[ MDVSA-2009:312 ] dhcp (security@...driva.com)
[ MDVSA-2009:223-1 ] xerces-c (security@...driva.com)
[ MDVSA-2009:157-1 ] perl-Compress-Raw-Zlib (security@...driva.com)
[ MDVSA-2009:206-1 ] wget (security@...driva.com)
[ MDVSA-2009:218-1 ] w3c-libwww (security@...driva.com)
[ MDVSA-2009:200-1 ] libxml (security@...driva.com)
[ MDVSA-2009:130-1 ] gstreamer0.10-plugins-good (security@...driva.com)
[ MDVSA-2009:314 ] apr (security@...driva.com)
[ MDVSA-2009:213-1 ] wxgtk (security@...driva.com)
[ MDVSA-2009:224-1 ] postfix (security@...driva.com)
RE: Millions of PDF invisibly embedded with your internal disk paths ("Ian Bradshaw" <ian@...bradshaw.net>)
[ MDVSA-2009:201-1 ] fetchmail (security@...driva.com)
[ MDVSA-2009:128-1 ] libmodplug (security@...driva.com)

December 7 (39 messages)

[USN-865-1] Bind vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2009:231-1 ] htmldoc (security@...driva.com)
[ MDVSA-2009:318 ] xmlsec1 (security@...driva.com)
[ MDVSA-2009:316 ] expat (security@...driva.com)
[ MDVSA-2009:232-1 ] libsamplerate (security@...driva.com)
[ MDVSA-2009:297-1 ] ffmpeg (security@...driva.com)
[ MDVSA-2009:249-1 ] newt (security@...driva.com)
[ MDVSA-2009:319 ] xine-lib (security@...driva.com)
[ MDVSA-2009:307-1 ] libtool (security@...driva.com)
[ MDVSA-2009:272-1 ] libmikmod (security@...driva.com)
[ MDVSA-2009:284-1 ] gd (security@...driva.com)
[ MDVSA-2009:320 ] samba (security@...driva.com)
[ MDVSA-2009:321 ] pidgin (security@...driva.com)
[ MDVSA-2009:215-1 ] audacity (security@...driva.com)
[ MDVSA-2009:260-1 ] imagemagick (security@...driva.com)
[ MDVSA-2009:317 ] netpbm (security@...driva.com)
[ MDVSA-2009:219-1 ] kompozer (security@...driva.com)
Re: Millions of PDF invisibly embedded with your internal disk paths (Nick FitzGerald <nick@...us-l.demon.co.uk>)
[ MDVSA-2009:322 ] mono (security@...driva.com)
[SECURITY] [DSA 1946-1] New belpic packages fix cryptographic weakness (white@...ian.org (Steffen Joeris))
Re: Millions of PDF invisibly embedded with your internal disk paths (Nick FitzGerald <nick@...us-l.demon.co.uk>)
[ MDVSA-2009:323 ] apache (security@...driva.com)
[ MDVSA-2009:234-2 ] silc-toolkit (security@...driva.com)
Re: Re: Re: Re: Back door trojan in acajoom-3.2.6 for joomla (anonymous@...nymous.com)
Re: Millions of PDF invisibly embedded with your internal disk paths (Pavel Machek <pavel@....cz>)
PhpShop Multiple Vulnerabilities (Andrea Fabrizi <andrea.fabrizi@...il.com>)
[ MDVSA-2009:254-1 ] graphviz (security@...driva.com)
CVE-2009-3586: CoreHTTP web server off-by-one buffer overflow vulnerability (Patroklos Argyroudis <argp@...sus-labs.com>)
Mozilla Firefox JavaScript Prompt Spoofing Weakness (tcphttp <tcphttp@...oo.com>)
[ MDVSA-2009:229-1 ] cyrus-imapd (security@...driva.com)
[ MDVSA-2008:233-1 ] libcdaudio (security@...driva.com)
[ MDVSA-2009:324 ] php (security@...driva.com)
[ MDVSA-2009:252-1 ] perl-IO-Socket-SSL (security@...driva.com)
[ MDVSA-2009:243-2 ] freetype2 (security@...driva.com)
[ MDVSA-2009:256-1 ] dbus (security@...driva.com)
[ MDVSA-2009:199-1 ] subversion (security@...driva.com)
[ MDVSA-2009:325 ] ruby (security@...driva.com)
[ MDVSA-2009:326 ] mysql (security@...driva.com)
[USN-866-1] gnome-screensaver vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)

December 8 (16 messages)

[SECURITY] [DSA 1947-1] New Shibboleth packages fix cross-site scripting (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDVSA-2009:282-1 ] cups (security@...driva.com)
Secunia Research: Novell iPrint Client "target-frame" Parameter Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Novell iPrint Client Date/Time Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Security Contact for Netcool at IBM? (Michael Gripenstedt <xpl@....se>)
[ MDVSA-2009:251-1 ] postgresql8.2 (security@...driva.com)
[security bulletin] HPSBMA02481 SSRT090113 rev.1 - HP OpenView Data Protector Application Recovery Manager, Remote Denial (security-alert@...com)
Re: Security Contact for Netcool at IBM? (Troy Bollinger <troy@...tin.ibm.com>)
[ MDVSA-2009:327 ] clamav (security@...driva.com)
[ MDVSA-2009:191-1 ] OpenEXR (security@...driva.com)
Applicure Technologies response (tomer@...licure.com)
[ MDVSA-2009:133-1 ] irssi (security@...driva.com)
[ MDVSA-2009:126-1 ] eggdrop (security@...driva.com)
[ MDVSA-2009:099-1 ] openafs (security@...driva.com)
[ MDVSA-2009:098-1 ] krb5 (security@...driva.com)
[SECURITY] [DSA 1948-1] New ntp packages fix denial of service (Nico Golde <nion@...ian.org>)

December 9 (39 messages)

[ MDVSA-2009:093-1 ] mpg123 (security@...driva.com)
ZDI-09-086: Microsoft Internet Explorer XHTML DOM Manipulation Memory Corruption Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2009:091-1 ] mod_perl (security@...driva.com)
ZDI-09-089: Microsoft Windows Intel Indeo Codec Parsing Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2009:038-1 ] blender (security@...driva.com)
[security bulletin] HPSBUX02495 SSRT090151 rev.1 - HP-UX Running sendmail, Remote Denial of Service (DoS) (security-alert@...com)
Notepad++ buffer overflow issue (Don HO <don.h@...e.fr>)
ZDI-09-087: Microsoft Internet Explorer CSS Race Condition Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2009:046-1 ] dia (security@...driva.com)
IPB v2.x up to 3.0.4 XSS vulnerability (Xacker <old.good.xacker@...il.com>)
Fortinet Advisory: Fortinet Discovers Vulnerability in Indeo Codec (noreply-secresearch@...tinet.securityfocus.com, com@...urityfocus.com)
ZDI-09-093: Adobe Flash Player ActionScript Exception Handler Integer Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-092: Adobe Flash Player JPEG Parsing Heap Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-090: Microsoft Windows Intel Indeo Codec Parsing Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
UPDATE: DISA Unix SRR root compromise / CVE-2009-4211 / VU#433821 (Frank Stuart <fstuart@...uart.com>)
ZDI-09-091: Hewlett-Packard Application Recovery Manager MSG_PROTOCOL Stack Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Advisory 03/2009: Piwik Cookie unserialize() Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
Fortinet Advisory: Fortinet Discovers Microsoft Office Project Vulnerability (noreply-secresearch@...tinet.securityfocus.com, com@...urityfocus.com)
Zen Cart local file disclosure vulnerability (Bogdan Calin <bogdan@...netix.com>)
[USN-867-1] Ntp vulnerability (Jamie Strandboge <jamie@...onical.com>)
[ MDVSA-2009:059-1 ] xchat (security@...driva.com)
Advisory 02/2009: PHPIDS Unserialize() Vulnerability (Stefan Esser <stefan.esser@...tioneins.de>)
[ MDVSA-2009:276-1 ] python-django (security@...driva.com)
ZDI-09-094: Hewlett-Packard OpenView NNM Multiple Command Injection Vulnerabilities (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-868-1] GRUB 2 vulnerability (Jamie Strandboge <jamie@...onical.com>)
ZDI-09-096: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable vsprintf Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2009:328 ] ntp (security@...driva.com)
ZDI-09-097: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable strcat Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-088: Microsoft Internet Explorer IFrame Attributes Circular Reference Dangling Pointer Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-09-095: Hewlett-Packard OpenView NNM Snmp.exe Oid Variable Buffer Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-09-08: HP OpenView NNM ovlogin.exe CGI userid/passwd Heap Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
TPTI-09-09: HP OpenView NNM ovsessionmgr.exe userid/passwd Heap Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
[ MDVSA-2009:030-1 ] amarok (security@...driva.com)
TPTI-09-10: HP OpenView NNM webappmon.exe CGI Host Header Buffer Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
TPTI-09-11: HP OpenView NNM OvWebHelp.exe CGI Topic Heap Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
TPTI-09-12: HP OpenView NNM ovalarm.exe CGI Accept-Language Stack Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
TPTI-09-13: HP OpenView NNM snmpviewer.exe CGI Host Header Stack Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
TPTI-09-14: HP OpenView NNM ovwebsnmpsrv.exe OVwSelection Stack Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
ZDI-09-098: Symantec Multiple Products VRTSweb.exe Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

December 10 (13 messages)

CA20091208-01: Security Notice for CA Service Desk ("Kotas, Kevin J" <Kevin.Kotas@...com>)
iDefense Security Advisory 12.08.09: Microsoft Internet Explorer HTML Layout Engine Uninitialized Memory Vulnerability (iDefense Labs <labs-no-reply@...fense.c…)
iDefense Security Advisory 12.08.09: Microsoft WordPad Word97 Converter Integer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 12.08.09: Microsoft Windows Indeo32 Codec Parsing Heap Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
RE: Millions of PDF invisibly embedded with your internal disk paths ("Thor (Hammer of God)" <thor@...merofgod.com>)
CORE-2009-1013: Multiple XSS and Injection Vulnerabilities in TestLink Test Management and Execution System (CORE Security Technologies Advisories <advisories@…)
[security bulletin] HPSBUX02480 SSRT090253 rev.1 - HP-UX Running VRTSweb, Remote Execution of Arbitrary Code, Increase of Privilege (security-alert@...com)
[USN-869-1] Linux kernel vulnerabilities (Kees Cook <kees@...ntu.com>)
[ MDVSA-2009:329 ] kernel (security@...driva.com)
[security bulletin] HPSBMA02483 SSRT090257 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMA02477 SSRT090177 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS) (security-alert@...com)
[ MDVSA-2009:330 ] kdelibs (security@...driva.com)
[ MDVSA-2009:331 ] kdegraphics (security@...driva.com)

December 11 (18 messages)

[USN-870-1] PyGreSQL vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-871-1] KDE vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-871-2] KDE 4 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
E-Store SQL Injection Vulnerability (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[USN-872-1] KDE 4 Runtime vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Re: TLS / SSLv3 vulnerability explained (New ways to leverage the vulnerability) (Thierry Zoller <Thierry@...ler.lu>)
[ MDVSA-2009:332 ] gimp (security@...driva.com)
[security bulletin] HPSBMA02400 SSRT080144 rev.3 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
phpCollegeExchange 0.1.5c Multiple SQL Injection Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[security bulletin] HPSBMA02424 SSRT080125 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBMA02425 SSRT080091 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBPI02472 SSRT090196 rev.2 - Certain HP Color LaserJet Printers, Remote Unauthorized Access to Data, Denial of Servi… (security-alert@...com)
[security bulletin] HPSBMA02483 SSRT090257 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[ MDVSA-2009:296-1 ] gimp (security@...driva.com)
Flock 2.5.2 Remote Array Overrun (Arbitrary code execution) (cxib@...urityreason.com)
Camino 1.6.10 Remote Array Overrun (Arbitrary code execution) (cxib@...urityreason.com)
[ MDVSA-2009:259-1 ] snort (security@...driva.com)

December 14 (17 messages)

B2C Booking Centre Systems - SQL Injection Vulnerability (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Miniweb 2.0 Full Path Disclosure (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
Re: E-Store SQL Injection Vulnerability (Packet Storm <bugtraq@...ketstormsecurity.org>)
Hacktics Advisory Dec09: Oracle eBusiness Suite - Multiple Vulnerabilities Allow Remote Takeover ("Ofer Maor" <ofer.maor@...sp.org>)
[SECURITY] [DSA 1949-1] New php-net-ping packages fix arbitrary code execution (geissert@...ian.org (Raphael Geissert))
Zabbix Server : Multiple remote vulnerabilities (Nicob <nicob@...ob.net>)
Loggix Project <= 9.4.5 Multiple Remote File Inclusion Vulnerabilities (admin@...n0x.com)
WX Guest Book 1.1.208 (SQL/XSS) Multiple Remote Vulnerabilities (admin@...n0x.com)
Zabbix Agent : Bypass of EnableRemoteCommands=0 (Nicob <nicob@...ob.net>)
Re: IPB v2.x up to 3.0.4 XSS vulnerability ("MustLive" <mustlive@...security.com.ua>)
Cross-Site Scripting vulnerabilities in Invision Power Board ("MustLive" <mustlive@...security.com.ua>)
EEGshop v1.2 (secu_lab_ir@...oo.com)
Monkey HTTPd improper input validation vulnerability (Patroklos Argyroudis <argp@...sus-labs.com>)
[SECURITY] [DSA-1950-1] New webkit packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
DC4420 - London DEFCON - Christmas drinks - Wednesday 16th December (Major Malfunction <majormal@...ate-radio.org>)
[security bulletin] HPSBUX02409 SSRT080171 rev.3 - HP-UX Running VERITAS File System (VRTSvxfs) or VERITAS Oracle Disk (security-alert@...com)
Exposing HMS HICP Protocol + Intellicom NetBiterConfig.exe Remote Buffer Overflow (Not patched) (Reversemode <advisories@...ersemode.com>)

December 15 (13 messages)

APC Switched Rack PDU XSS Vulnerability (jpecou@...il.com)
[security bulletin] HPSBUX02482 SSRT090249 rev.2 - HP-UX Running OpenSSL, Remote Unauthorized Data Injection, Denial of Service (DoS) (security-alert@...com)
Trango Broadband Wireless Rogue SU Authentication Bug (Blair <jediblair@...il.com>)
Re: WX Guest Book 1.1.208 (SQL/XSS) Multiple Remote Vulnerabilities (Packet Storm <bugtraq@...ketstormsecurity.org>)
WSCreator 1.1 Blind SQL Injection (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing (white@...ian.org (Steffen Joeris))
[SECURITY] [DSA 1952-1] New asterisk packages fix several vulnerabilities (white@...ian.org (Steffen Joeris))
Daloradius XSS Vulnerability (hadikiamarsi@...mail.com)
[BMSA-2009-08] Multiple Vulnerabilities in PyForum (Nam Nguyen <namn@...emoon.com.vn>)
[scip-Advisory 4063] PasswordManager Pro 6.1 Script Injection Vulnerability ("Stefan Friedli" <stfr@...p.ch>)
[ MDVSA-2009:333 ] postgresql (security@...driva.com)
VMSA-2009-0017 VMware vCenter, ESX patch and vCenter Lab Manager releases address cross-site scripting issues (VMware Security Team <security@...are.com>)
[SECURITY] [DSA 1952-2] End-of-life announcement for asterisk in oldstable (white@...ian.org (Steffen Joeris))

December 16 (14 messages)

[SECURITY] [DSA-1953-1] New expat packages fix denial of service (Stefan Fritsch <sf@...ian.org>)
FW: [Full-disclosure] File Access Vulnerability in Easy File Sharing Web Server ("Thor (Hammer of God)" <thor@...merofgod.com>)
File Access Vulnerability in Easy File Sharing Web Server ("Thor (Hammer of God)" <thor@...merofgod.com>)
[ISecAuditors Security Advisories] WP-Forum <= 2.3 SQL Injection vulnerabilities (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Family Connections <= 2.1.3 Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>)
[SECURITY] [DSA 1954-1] New cacti packages fix insufficient input sanitising (white@...ian.org (Steffen Joeris))
VideoCache 1.9.2 vccleaner root vulnerability (Dominick LaTrappe <seraf@...0.COM>)
Kaspersky Lab Multiple Products Local Privilege Escalation Vulnerability (ss_contacts@...mail.com (Maxim A. Kulakov))
[security bulletin] HPSBMA02416 SSRT090008 rev.4 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
{PRL} QuickHeal antivirus 2010 Local Privilege Escalation (Protek Research Lab <protekresearchlab@...oo.ca>)
Cisco Security Advisory: Multiple Cisco WebEx WRF Player Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 1955-1] New network-manager/network-manager-applet packages fix information disclosure (white@...ian.org (Steffen Joeris))
rPSA-2009-0161-1 hwdata kernel (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] [DSA 1956-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)

December 17 (15 messages)

[security bulletin] HPSBMA02252 SSRT061258, SSRT061259 rev.1 - HP OpenView Storage Data Protector, Remote Arbitrary Code Execution (security-alert@...com)
Secunia Research: Winamp Oktalyzer Parsing Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Winamp Impulse Tracker Sample Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Winamp Impulse Tracker Instrument Parsing Buffer Overflows (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2009:334 ] poppler (security@...driva.com)
Secunia Research: Winamp Ultratracker File Parsing Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
SEC Consult SA-20091217-0 :: Authentication bypass and file manipulation in Sitecore Staging Module (Lukas Weichselbaum <research@...-consult.com>)
[ISecAuditors Security Advisories] Cisco ASA <= 8.x VPN SSL module Clientless URL-list control bypass (ISecAuditors Security Advisories <advisories@...cauditor…)
[ISecAuditors Security Advisories] Horde 3.3.5 "PHP_SELF" Cross-Site Scripting vulnerability (ISecAuditors Security Advisories <advisories@...cauditors.com>)
VUPEN Security Research - Winamp PNG and JPEG Data Integer Overflow Vulnerabilities ("VUPEN Security Research" <advisories@...en.com>)
[ISecAuditors Security Advisories] QuiXplorer <=2.4.1beta Remote Code Execution vulnerability (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[ MDVSA-2009:335 ] ffmpeg (security@...driva.com)
[Suspected Spam][oCERT-2009-019] Ganeti path sanitization errors (Andrea Barisani <lcars@...rt.org>)
Rumba XML XSS vulnerability (hadikiamarsi@...mail.com)
Campus Party Eu 2010 Security Challenge - Call For Participants (Campus Party EU Spain <campuseu@...uritybydefault.com>)

December 21 (17 messages)

ZDI-09-099: Hewlett-Packard OpenView Data Protector Backup Client Service Buffer Overflow Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TPTI-09-15: HP OpenView Data Protector Cell Manager Heap Overflow Vulnerability (dvlabs <dvlabs@...pingpoint.com>)
Re: Powered By Dvbbs Version 7.1.0 Sp1 By Pass (macaco-listo@...mail.com)
[ MDVSA-2009:336 ] koffice (security@...driva.com)
[ISecAuditors Security Advisories] Simple PHP Blog <= 0.5.1 Local File Include vulnerability (ISecAuditors Security Advisories <advisories@...cauditors.com>)
[ISecAuditors Security Advisories] PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability (ISecAuditors Security Advisories <advisorie…)
[USN-875-1] Red Hat Cluster Suite vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
SMF (Simple Machine Forum) 1.1.11 XSS - Discovered by : Khashayar Fereidani (irancrash@...il.com)
[USN-873-1] Firefox 3.0 and Xulrunner 1.9 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-874-1] Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[SECURITY] [DSA-1959-1] New ganeti packages fix arbitrary command execution (Raphael Geissert <geissert@...ian.org>)
[SECURITY] [DSA 1960-1] New acpid packages fix weak file permissions (geissert@...ian.org (Raphael Geissert))
[ GLSA 200912-02 ] Ruby on Rails: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
phpPollScript - 1.3 Remote File Include (admin@...n0x.com)
SQL-Ledger – several vulnerabilities (Alexander Klink <alexander.klink@....fraunhofer.de>)
pragmaMx CMS Blind SQL/XPath Injection vulnerability (hadikiamarsi@...mail.com)
TLS Renegotiation Vulnerability: Proof of Concept Code (Python) (RedTeam Pentesting GmbH <release@...team-pentesting.de>)

December 22 (6 messages)

RE: TLS Renegotiation Vulnerability: Proof of Concept Code (Python) ("Barry Raveendran Greene" <bgreene@...ki.org>)
ClarkConnect XSS vulnerability (edgard.chammas@...ond-security.org)
[security bulletin] HPSBUX02498 SSRT090264 rev.1 - HP-UX Running Apache, Remote Unauthorized Data Injection, Denial of (security-alert@...com)
Re: phpPollScript - 1.3 Remote File Include (Packet Storm <bugtraq@...ketstormsecurity.org>)
[ MDVSA-2009:337 ] proftpd (security@...driva.com)
Remote Buffer Overflow Exploit (TFTP Daemon Version 1.9) by Socket_0x03 (Socket_0x03@...aexe.com)

December 23 (6 messages)

[ MDVSA-2009:338 ] firefox (security@...driva.com)
[ MDVSA-2009:339 ] firefox (security@...driva.com)
[SECURITY] [DSA 1961-1] New bind9 packages fix cache poisoning (Florian Weimer <fw@...eb.enyo.de>)
[SECURITY] [DSA-1962-1] New kvm packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
XSS Vulnerability in JpGraph 3.0.6 (Martin Barbella <barbella@....upenn.edu>)
RE: TLS Renegotiation Vulnerability: Proof of Concept Code (Python) ("Ivan Buetler" <ivan.buetler@...c.ch>)

December 28 (19 messages)

[SECURITY] [DSA 1963-1] New unbound packages fix DNSSEC validation (Florian Weimer <fw@...eb.enyo.de>)
Microsoft IIS 0Day Vulnerability in Parsing Files (semi-colon bug) (bugreport@...uard.info)
Remote Buffer Overflow Exploit (TFTP Daemon Version 1.9) by Socket_0x03 (Socket_0x03@...aexe.com)
Vulnerability in Joomulus for Joomla ("MustLive" <mustlive@...security.com.ua>)
ClubHack2009 presentations are now online (ClubHack <seclist@...bhack.com>)
[ MDVSA-2009:340 ] jpgraph (security@...driva.com)
[ MDVSA-2009:341 ] dstat (security@...driva.com)
[tools] hostmap-0.2.1 released (Alessandro Tanasi <alessandro@...erunners.net>)
[ MDVSA-2009:342 ] acpid (security@...driva.com)
[ MDVSA-2009:343 ] acpid (security@...driva.com)
[InterN0T] LiveZilla - XSS Vulnerability (advisories@...ern0t.net)
DBHCMS Web Content Management System v1.1.4 RFI Vulnerability (info@...uritylab.ir)
Sheedravi CMS SQL Injection Vulnerability (faghani@...c.ir)
[SECURITY] [DSA 1957-1] New aria2 packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
[ MDVSA-2009:244-1 ] xfig (security@...driva.com)
[ MDVSA-2009:344 ] perl-DBD-Pg (security@...driva.com)
Code to mitigate IIS semicolon zero-day (ds.adv.pub@...il.com)
[ MDVSA-2009:189-1 ] apache-mod_auth_mysql (security@...driva.com)
MITKRB5-SA-2009-003 [CVE-2009-3295] KDC denial of service in cross-realm referral processing (Tom Yu <tlyu@....EDU>)

December 29 (7 messages)

[ MDVSA-2009:146-1 ] imap (security@...driva.com)
Tests about semicolon zero-day (BID 37460) (Crash - DcLabs <crashbrz@...il.com>)
[ MDVSA-2009:345 ] acl (security@...driva.com)
FreeWebshop.org: multiple vulnerabilities (Akita Software Security <lists@...tasecurity.nl>)
Secunia Research: AproxEngine Multiple Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1958-1] New libtool packages fix privilege escalation (geissert@...ian.org (Raphael Geissert))
RE: Tests about semicolon zero-day (BID 37460) ("Nelson Brito" <nbrito@...ure.org>)

December 30 (3 messages)

RE: Tests about semicolon zero-day (BID 37460) ("Nelson Brito" <nbrito@...ure.org>)
[ MDVSA-2009:346 ] kde (security@...driva.com)
Re: RE: Tests about semicolon zero-day (BID 37460) (crashbrz@...il.com)

December 31 (2 messages)

[SECURITY] [DSA-1953-2] New expat packages fix regression (Stefan Fritsch <sf@...ian.org>)
[SECURITY] [DSA-1964-1] New PostgreSQL packages fix several vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)

319 messages

Powered by blists - more mailing lists