bugtraq mailing list - 2010/01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹	²	³
⁴ 11	⁵ 16	⁶ 8	⁷ 10	⁸ 9	⁹	¹⁰
¹¹ 14	¹² 4	¹³ 16	¹⁴ 15	¹⁵ 12	¹⁶	¹⁷
¹⁸ 22	¹⁹ 24	²⁰ 24	²¹ 21	²² 7	²³	²⁴
²⁵ 17	²⁶ 20	²⁷ 17	²⁸ 4	²⁹ 15	³⁰	³¹

Messages by day:

January 4 (11 messages)

[ GLSA 201001-02 ] Adobe Flash Player: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[USN-876-1] PostgreSQL vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
Secunia Research: PDF-XChange Viewer Content Parsing Memory Corruption Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Java vulnerability (Paul <pvnick@...il.com>)
Latest Intel Pro/10* ethernet adaptor drivers contain vulnerable MSVC runtime! ("Stefan Kanthak" <stefan.kanthak@...go.de>)
WASC Announcement: WASC Threat Classification v2.0 Published (announcements@...appsec.org)
[ GLSA 201001-01 ] NTP: Denial of Service (Stefan Behte <craig@...too.org>)
httpdx webserver v1.5 Remote Source Disclosure (info@...uritylab.ir)
[Tool] DeepToad 1.1.0 (Joxean Koret <joxeankoret@...oo.es>)
Y2K10 spamassassin bug, 2010 year mails discared as spam (Eduardo Romero <edo@....cl>)
Re: Y2K10 spamassassin bug, 2010 year mails discared as spam (Steve Shockley <steve.shockley@...ckley.net>)

January 5 (16 messages)

Re: Y2K10 spamassassin bug, 2010 year mails discared as spam (Rudy Zijlstra <rudy@...mpydevil.homelinux.org>)
UPDATE: MITKRB5-SA-2009-003 [CVE-2009-3295] KDC denial of service in cross-realm referral processing (Tom Yu <tlyu@....edu>)
Re: [Full-disclosure] [Tool] DeepToad 1.1.0 (T Biehn <tbiehn@...il.com>)
REWTERZ-20100102 - Nemesis Player (NSP) Local Denial of Service (DoS) Vulnerability (rewterz security team <advisories@...terz.com>)
Link Injection Redirection Attacks - Exploiting Google Chrome Design Flaw (Aditya K Sood <0kn0ck@...niche.org>)
SyScan'10 Call For Training (CFT) ("organiser@...can.org" <organiser@...can.org>)
REWTERZ-20100101 - n.player Local Heap Overflow Vulnerability (rewterz security team <advisories@...terz.com>)
REWTERZ-20100103 - Ofilter Player Local Denial of Service (DoS) Vulnerability (rewterz security team <advisories@...terz.com>)
Re: [Full-disclosure] [Tool] DeepToad 1.1.0 (Joxean Koret <joxeankoret@...oo.es>)
Re: [Full-disclosure] [Tool] DeepToad 1.1.0 (T Biehn <tbiehn@...il.com>)
Multiple vulnerabilities in LineWeb 1.0.5 (ign.sec@...il.com)
Re: Link Injection Redirection Attacks - Exploiting Google Chrome Design Flaw (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Secunia Research: TSC2 Help Desk CTab ActiveX Control Buffer Overflow (sales@...vantix.com)
[ GLSA 201001-03 ] PHP: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ MDVSA-2009:220-1 ] davfs (security@...driva.com)
{PRL} Novell Netware CIFS And AFP Remote Memory Consumption DoS (Protek Research Lab <protekresearchlab@...oo.ca>)

January 6 (8 messages)

Re: Link Injection Redirection Attacks - Exploiting Google Chrome Design Flaw (Peter Watkins <peterw@....org>)
[USN-879-1] Kerberos vulnerability (Kees Cook <kees@...ntu.com>)
HTTP Digest Integrity: Another look, in light of recent attacks ("Timothy D. Morgan" <tmorgan@...curity.com>)
Re: [WEB SECURITY] Re: Link Injection Redirection Attacks - Exploiting Google Chrome Design Flaw (Aditya K Sood <0kn0ck@...niche.org>)
Critical PowerDNS Recursor Security Vulnerabilities: please upgrade ASAP to 3.1.7.2 (bert hubert <bert.hubert@...herlabs.nl>)
[TOOL RELEASE] Microsoft SQL Server Fingerprint Too BETA-3l!!! ("Nelson Brito" <nbrito@...ure.org>)
Re: Multiple vulnerabilities in LineWeb 1.0.5 (ign.sec@...il.com)
[SECURITY] [DSA-1965-1] New phpldapadmin packages fix remote file inclusion (Giuseppe Iuculano <iuculano@...ian.org>)

January 7 (10 messages)

FreeBSD Security Advisory FreeBSD-SA-10:01.bind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-10:02.ntpd (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[ MDVSA-2009:300-1 ] apache-conf (security@...driva.com)
[ MDVSA-2009:300-2 ] apache-conf (security@...driva.com)
[SECURITY] [DSA 1966-1] New horde3 packages fix cross-site scripting (white@...ian.org (Steffen Joeris))
[USN-880-1] GIMP vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
VMSA-2010-0001 ESX Service Console updates for nss and nspr (VMware Security team <security@...are.com>)
FreeBSD Security Advisory FreeBSD-SA-10:03.zfs (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Security contact at Lexmark? (Protek Research Lab <protekresearchlab@...oo.ca>)
[SECURITY] [DSA 1967-1] New transmission packages fix directory traversal (Moritz Muehlenhoff <jmm@...ian.org>)

January 8 (9 messages)

ZDI-10-001: Novell iManager eDirectory Plugin Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-877-1] Firefox 3.0 and Xulrunner 1.9 regression (Jamie Strandboge <jamie@...onical.com>)
[USN-878-1] Firefox 3.5 and Xulrunner 1.9.1 regression (Jamie Strandboge <jamie@...onical.com>)
Secunia Research: Adobe Illustrator Encapsulated Postscript Parsing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
MacOS X 10.5/10.6 libc/strtod(3) buffer overflow (cxib@...urityreason.com)
[HACKATTACK Advisory 080110] Windows Live Messenger 2009 ActiveX DoS Vulnerability (advisory@...kattack.com)
Google Chrome 3.0.195.38 | Chrome Frame - Reloading Memory Allocation based Tab Crashing (Aditya K Sood <0kn0ck@...niche.org>)
[ MDVSA-2009:316-1 ] expat (security@...driva.com)
TELUS Security Labs VR - ACDSee Systems ACDSee Products XBM File Handling Buffer Overflow (noreply@...us.com)

January 11 (14 messages)

[ MDVSA-2009:316-2 ] expat (security@...driva.com)
NSOADV-2010-001: Panda Security Local Privilege Escalation (NSO Research <nso-research@...iriu.de>)
Re: TELUS Security Labs VR - ACDSee Systems ACDSee Products XBM File Handling Buffer Overflow (Steve Shockley <steve.shockley@...ckley.net>)
Cross-Site Scripting vulnerability in JVClouds3D for Joomla ("MustLive" <mustlive@...security.com.ua>)
[CORELAN-10-001] Audiotran 1.4.1 buffer overflow (Security <security@...elan.be>)
[SECURITY] [DSA 1968-1] New pdns-recursor packages fix potential code execution (Florian Weimer <fw@...eb.enyo.de>)
Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection (ascii <ascii@...amail.com>)
[ MDVSA-2009:316-3 ] expat (security@...driva.com)
XSS vulnerabilities in 34 millions flash files ("MustLive" <mustlive@...security.com.ua>)
[ MDVSA-2010:000 ] firefox (security@...driva.com)
XSS Vulnerability in Active Calendar 1.2.0 (Marty Barbella <martybarbella@...il.com>)
[ MDVSA-2009:227-1 ] freeradius (security@...driva.com)
[ MDVSA-2009:293-1 ] squidGuard (security@...driva.com)
[ MDVSA-2009:241-1 ] squid (security@...driva.com)

January 12 (4 messages)

[ MDVSA-2010:001 ] pidgin (security@...driva.com)
[ MDVSA-2010:002 ] pidgin (security@...driva.com)
Invitation: nullcon Goa 2010 International Security & Hacking Conference (nullcon <nullcon@...lcon.net>)
HITB Ezine 'Reloaded' - Issue #001 (Hafez Kamal <aphesz@...kinthebox.org>)

January 13 (16 messages)

[ MDVSA-2010:003 ] sendmail (security@...driva.com)
MITKRB5-SA-2009-004 [CVE-2009-4212] integer underflow in AES and RC4 decryption (Tom Yu <tlyu@....edu>)
Secunia Research: Microsoft Windows Flash Player Movie Unloading Vulnerability (Secunia Research <remove-vuln@...unia.com>)
ZDI-10-002: Oracle Secure Backup observiced.exe Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Cross Site Identification (CSID) attack. Description and demonstration. (Ronen Z <ronen@...ji.com>)
iDefense Security Advisory 01.12.10: Adobe Reader and Acrobat JpxDecode Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[CORELAN-10-004] TurboFTP Server 1.00.712 remote DoS (Security <security@...elan.be>)
[USN-882-1] PHP vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA-1969-1] New krb5 packages fix denial of service (Giuseppe Iuculano <iuculano@...ian.org>)
[USN-881-1] Kerberos vulnerability (Kees Cook <kees@...ntu.com>)
[USN-883-1] network-manager-applet vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Yoono Firefox Extension - Privileged Code Injection (Nick Freeman <nick.freeman@...urity-assessment.com>)
[ MDVSA-2010:004 ] bash (security@...driva.com)
[SECURITY] [DSA-1970-1] New openssl packages fix denial of service (Stefan Fritsch <sf@...ian.org>)
[CORE-2009-1209] Google SketchUp 'lib3ds' 3DS Importer Memory Corruption (CORE Security Advisories <advisories@...esecurity.com>)
[security bulletin] HPSBPI02500 SSRT090263 rev.1 - HP Web Jetadmin, Remote Unauthorized Access to Data, Denial of Service (DoS) (security-alert@...com)

January 14 (15 messages)

[ GLSA 201001-04 ] VirtualBox: Multiple vulnerabilities (Stefan Behte <craig@...too.org>)
[ GLSA 201001-06 ] aria2: Multiple vulnerabilities (Stefan Behte <craig@...too.org>)
[ MDVSA-2010:006 ] krb5 (security@...driva.com)
RE: All China, All The Time ("Thor (Hammer of God)" <thor@...merofgod.com>)
[ MDVSA-2010:005 ] krb5 (security@...driva.com)
XSS Vulnerability in Drupal's Node Blocks contributed module (6.x-1.3 and 5.x-1.1) (Marty Barbella <martybarbella@...il.com>)
[ GLSA 201001-08 ] SquirrelMail: Multiple vulnerabilities (Stefan Behte <craig@...too.org>)
Hellcode Research: OpenOffice File Parsing Null Pointer Vulnerability (karakorsankara@...mail.com)
[ GLSA 201001-09 ] Ruby: Terminal Control Character Injection (Alex Legler <a3li@...too.org>)
[ GLSA 201001-07 ] Blender: Untrusted search path (Stefan Behte <craig@...too.org>)
All China, All The Time ("Thor (Hammer of God)" <thor@...merofgod.com>)
[USN-884-1] OpenSSL vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 201001-05 ] net-snmp: Authorization bypass (Stefan Behte <craig@...too.org>)
[USN-885-1] Transmission vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[security bulletin] HPSBMA02433 SSRT090084 rev.2 - HP Discovery & Dependency Mapping Inventory (DDMI) Running on Windows, Remote Unauthori… (security-alert@...com)

January 15 (12 messages)

rPSA-2010-0004-1 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
Major security risk in the unlock pattern for Android devices (Dan Dascalescu <ddascalescu@...il.com>)
[SECURITY] [DSA-1971-1] New libthai packages fix arbitrary code execution (Giuseppe Iuculano <iuculano@...ian.org>)
SEC Consult SA-20100115-0 :: Local file inclusion/execution and multiple CSRF vulnerabilities in LetoDMS (formerly MyDM… (Lukas Weichselbaum <research@...-consul…)
Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker (Adam Baldwin <adam_baldwin@...nuity-is.com>)
VUPEN Security Research - Adobe Acrobat and Reader U3D Integer Overflow Vulnerability ("VUPEN Security Research" <advisories@...en.com>)
C4 SCADA Security Advisory - Rockwell Automation (Allen Bradley) Multiple Vulnerabilities in Micrologix 1100 & 1400 Seri… ("Eyal Udassin" <eyal.udassin@...securit…)
RE: Major security risk in the unlock pattern for Android devices ("Francis, Shannon" <Shannon.Francis@...blue.com>)
Re: Major security risk in the unlock pattern for Android devices (Brian Altenhofel <brian@...enhofel.com>)
RE: All China, All The Time ("Thor (Hammer of God)" <thor@...merofgod.com>)
Re: All China, All The Time (Gadi Evron <ge@...uxbox.org>)
[security bulletin] HPSBUX02495 SSRT090151 rev.2 - HP-UX Running sendmail, Remote Denial of Service (DoS) (security-alert@...com)

January 18 (22 messages)

[ MDVSA-2010:007 ] php (security@...driva.com)
Re: [Full-disclosure] Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker ("A. Ramos" <aramosf@...ec.net>)
GDT and LDT in Windows kernel vulnerability exploitation (paper) (Gynvael Coldwind <gynvael@...dwind.pl>)
Code to mitigate IE event zero-day (CVE-2010-0249) (ds.adv.pub@...il.com)
[ MDVSA-2010:010 ] libthai (security@...driva.com)
[ MDVSA-2010:009 ] php (security@...driva.com)
[ATHCON2010] CFP/1st Call for Papers - AthCon IT Security Conference (Kyprianos Vasilopoulos <kyprianos@...con.org>)
RE: All China, All The Time (Jim Harrison <Jim@...tools.org>)
Browser Fuzzer 3 (krakowlabs@...il.com)
[USN-886-1] Pidgin vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: [Full-disclosure] Sprint / Verizon MiFi CSRF+CSS Gives up GPS info to attacker (Adam Baldwin <adam_baldwin@...nuity-is.com>)
[USN-885-1] LibThai vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
AOL 9.5 ActiveX Heap Overflow Vulnerability (karakorsankara@...mail.com)
Reminder: Campus Party EU 2010 Call For Participants (Campus Party EU Spain <campuseu@...uritybydefault.com>)
[ MDVSA-2010:012 ] mysql (security@...driva.com)
[ MDVSA-2010:011 ] mysql (security@...driva.com)
[ MDVSA-2010:013 ] transmission (security@...driva.com)
[ MDVSA-2010:014 ] transmission (security@...driva.com)
[USN-887-1] LibThai vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
Re: All China, All The Time ("Steven J. Koch" <steve.koch@...il.com>)
[ MDVSA-2010:008 ] php (security@...driva.com)
0day vulnerability Sogou input method to obtain system privileges (k4mr4n_st@...oo.com)

January 19 (24 messages)

[SECURITY] [DSA-1972-1] New audiofile packages fix buffer overflow (Stefan Fritsch <sf@...ian.org>)
Zenoss Multiple Admin CSRF (Adam Baldwin <adam_baldwin@...nuity-is.com>)
QvodPlayer ColorFilter Codec ActiveX Remote Exec (info@...uritylab.ir)
facebook 'routing flaw'? (Michael Scheidell <scheidell@...nap.net>)
Re: All China, All The Time (Marcello Magnifico <rdo-lists@....is-a-geek.net>)
Study of BlackBerry Proof-of-Concept Malicious Applications (Whitepaper) (Mayank Aggarwal <aggarwam@....osu.edu>)
JBroFuzz 1.9 Fuzzer Released! (subere@...on.org)
[ MDVSA-2010:015 ] roundcubemail (security@...driva.com)
Re: facebook 'routing flaw'? (Manny Ponce <reficul@...tymouth.org>)
Xunlei XPPlayer ActiveX Remote Exec 0day POC (superli@...e-mail.net)
Baidu Security Center FireFoxProxy ActiveX Remote Exec 0day POC (superli@...e-mail.net)
Kingsoft DuBa Browser Shield ActiveX Remote Exec 0day POC (superli@...e-mail.net)
ezContents CMS Multiple Vulnerabilities (admin@...report.ir)
Re: All China, All The Time (Neil Dickey <neil@...l.niu.edu>)
Blaze Apps Multiple Vulnerabilities (admin@...report.ir)
[ MDVSA-2010:017 ] ruby (security@...driva.com)
[security bulletin] HPSBMA02485 SSRT090252 rev.1 - HP Power Manager, Remote Execution of Arbitrary Code (security-alert@...com)
Re: facebook 'routing flaw'? (Suramya Tomar <security@...amya.com>)
Re: facebook 'routing flaw'? ("Matthew Leeds" <mleeds@...leeds.net>)
OpenOffice for Windows ".slk" File Parsing Null Pointer Vulnerability (karakorsankara@...mail.com)
[ MDVSA-2010:018 ] phpMyAdmin (security@...driva.com)
[ MDVSA-2010:016 ] wireshark (security@...driva.com)
[CORELAN-10-006] BOF Vulnerability in S.O.M.P.L. Player (Security <security@...elan.be>)
Multiple Vulnerabilities in XOOPS 2.4.3 and earlier (CodeScan Labs Advisories <advisories@...escan.com>)

January 20 (24 messages)

RE: facebook 'routing flaw'? ("Sacks, Cailan C" <Cailan.Sacks@...ndardbank.co.za>)
[SECURITY] [DSA 1973-1] New glibc packages fix information disclosure (aurel32@...ian.org (Aurelien Jarno))
Secunia Research: Adobe Shockwave Player Integer Overflow Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: HP Power Manager "formExportDataLogs" Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Adobe Shockwave Player Four Integer Overflow Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
[security bulletin] HPSBMA02474 SSRT090107 rev.2 - HP Power Manager, Remote Execution of Arbitrary Code (security-alert@...com)
Cisco Security Advisory: Cisco IOS XR Software SSH Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Secunia Research: Adobe Shockwave Player 3D Model Two Integer Overflows (Secunia Research <remove-vuln@...unia.com>)
Re: Kingsoft DuBa Browser Shield ActiveX Remote Exec 0day POC (hanzhengqi@...gsoft.com)
vBulletin nulled (validator.php) files/directories disclosure (kw3rln@...ati.org)
[Onapsis Security Advisory 2010-001] SAP WebAS Integrated ITS Remote Command Execution (Onapsis Research Labs <research@...psis.com>)
Secunia Research: Adobe Shockwave Player 3D Model Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[SECURITY] [DSA 1974-1] New gzip packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))
Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor CORBA GIOP Overflow Vulnerability (Cisco Systems Product Security Incident Response Team <p…)
Secunia Research: HP Power Manager "formExportDataLogs" Directory Traversal (Secunia Research <remove-vuln@...unia.com>)
RE: All China, All The Time (Tim Mullen <Thor@...merofgod.com>)
[ MDVSA-2010:019 ] gzip (security@...driva.com)
[USN-888-1] Bind vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-889-1] gzip vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[ MDVSA-2010:020 ] gzip (security@...driva.com)
[USN-890-1] Expat vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[UPDATE] NSOADV-2010-001: Panda Security Local Privilege Escalation (NSO Research <nso-research@...iriu.de>)
Re: All China, All The Time (Lawrence Pingree <ntpeck@...oo.com>)
[ MDVSA-2010:021 ] bind (security@...driva.com)

January 21 (21 messages)

[SECURITY] [DSA-1975-1] Security Support for Debian 4.0 to be discontinued on February 15th (Stefan Fritsch <sf@...ian.org>)
Insufficient User Input Validation in VP-ASP 6.50 Demo Code (CodeScan Labs Advisories <advisories@...escan.com>)
ZDI-10-003: Novell ZENworks Asset Management docfiledownload Remote SQL Injection Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
RE: All China, All The Time (Jim Harrison <Jim@...tools.org>)
ZDI-10-006: RealNetworks RealPlayer GIF Handling Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
eWebeditor Directory Traversal Vulnerability (info@...uritylab.ir)
ZDI-10-008: RealNetworks RealPlayer SIPR Codec Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-005: RealNetworks RealPlayer ASMRulebook Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ MDVSA-2010:022 ] openssl (security@...driva.com)
[ MDVSA-2010:023 ] phpldapadmin (security@...driva.com)
[SECURITY] [DSA-1972-2] New audiofile packages fix buffer overflow (Stefan Fritsch <sf@...ian.org>)
ZDI-10-009: RealNetworks RealPlayer IVR Format Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-004: Cisco CiscoWorks IPM GIOP getProcessName Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-007: RealNetworks RealPlayer SMIL getAtom Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
TheGreenBow VPN Client Local Stack Overflow Vulnerability - Security Advisory - SOS-10-001 ("Lists" <lists@...seofsecurity.com.au>)
ZDI-10-013: Microsoft Internet Explorer Table Layout Reuse Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-014: Microsoft Internet Explorer item Object Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-011: Microsoft Internet Explorer Table Layout Col Tag Cache Update Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.co…)
ZDI-10-010: RealNetworks RealPlayer Skin Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack (Tavis Ormandy <taviso@....lonestar.org>)
ZDI-10-012: Microsoft Internet Explorer Baseline Tag Rendering Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

January 22 (7 messages)

[USN-890-2] Python 2.5 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
FortiGuard Advisory: Microsoft Internet Explorer Remote Memory Corruption Vulnerability ("noreply-secresearch@...tinet.com" <noreply-secresearch@...tinet.com>)
[USN-890-3] Python 2.4 vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
IdeaCMS v1.0 (fck) Remote Arbitrary File Upload (whh_iran@...oo.com)
[SECURITY] [DSA-1976-1] New dokuwiki packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
iBoutique v4.0 (flashcreazione@...il.com)
Kayako SupportSuite Multiple Persistent Cross Site Scripting (Current Versions) (pen-test@...odo.com)

January 25 (17 messages)

CVE-2009-3583, confirming problem and adding info (Chris Travers <chris@...atrontech.com>)
Silverstripe <= v2.3.4: two XSS vulnerabilities (Moritz Naumann <security@...itz-naumann.com>)
Publique! CMS SQL Injection Vulnerabilities (Christophe dlf <cdlfnewsletters@...il.com>)
e107 latest download link is backdoored (Bogdan Calin <bogdan@...netix.com>)
Abusing weak PRNGs in PHP applications (gat3way@...3way.eu)
London DEFCON January meet - DC4420 - Wed 27th Jan 2010 (Major Malfunction <majormal@...ate-radio.org>)
Safari 4.0.4 Crash (systemx00@...il.com)
[SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2009-2902 Apache Tomcat unexpected file deletion in work directory (Mark Thomas <markt@...che.org>)
[SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy (Mark Thomas <markt@...che.org>)
Re: e107 latest download link is backdoored (Chris Travers <chris@...atrontech.com>)
Security improvements of Microsoft Silverlight Build 3.0.50106.0? (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[ MDVSA-2010:025 ] php-pear-Mail (security@...driva.com)
Re: e107 latest download link is backdoored ("Valery Marchuk" <vulns@...uritylab.ru>)
DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability (ddivulnalert@...frontline.com)
FWD: LedgerSMB Security Advisory: Multiple Vulnerabilities (Chris Travers <chris@...atrontech.com>)
[ MDVSA-2010:024 ] coreutils (security@...driva.com)

January 26 (20 messages)

[SECURITY] [DSA-1977-1] New python packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
Secunia Research: Google Chrome Pop-Up Block Menu Handling Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Setting arbitrary Personas without user interaction in Firefox 3.6 (Artur Janc <artur@...gro.com>)
Re: [Full-disclosure] e107 latest download link is backdoored (David Sopas <davidsopas@...il.com>)
Re: [Full-disclosure] e107 latest download link is backdoored (Gregor Schneider <rc46fi@...glemail.com>)
Microsoft IE 6&7 Crash Exploit (info@...uritylab.ir)
[IBM Datapower XS40] Denial of Service (erik@...fe.nl)
[security bulletin] HPSBMA02477 SSRT090177 rev.4 - HP OpenView Network Node Manager (OV NNM), Remote Denial of Service (DoS) (security-alert@...com)
Re: e107 latest download link is backdoored ("Carsten Eilers" <ceilers-lists@....de>)
[ MDVSA-2010:026 ] openldap (security@...driva.com)
Cross-Site Scripting vulnerability in 3D Cloud for Joomla ("MustLive" <mustlive@...security.com.ua>)
Paper: Weaning the Web off of Session Cookies ("Timothy D. Morgan" <tmorgan@...curity.com>)
[SECURITY] [DSA 1978-1] New phpgroupware packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
The future of XSS attacks ("MustLive" <mustlive@...security.com.ua>)
Netsupport gateway remote DoS (watcher60@...mail.com)
More information on CVE-2009-3580 (Chris Travers <chris@...atrontech.com>)
Re: [Full-disclosure] e107 latest download link is backdoored (Fernando Augusto <fernando@...ecreator.com.br>)
Re: Re: e107 latest download link is backdoored (track@...ksnet.org)
RE: Microsoft IE 6&7 Crash Exploit ("Santhosh" <santgutz2000@...e.com>)
[USN-890-4] PyXML vulnerabilities (Jamie Strandboge <jamie@...onical.com>)

January 27 (17 messages)

Re: Microsoft IE 6&7 Crash Exploit (Berend-Jan Wever <berendjanwever@...il.com>)
[InterN0T] ShareTronix 1.0.4 - HTML Injection Vulnerability (advisories@...ern0t.net)
Mod_proxy from apache 1.3 - Integer overflow which causes heap overflow. (pi3@...ec.pl)
PR09-02 Multiple Cross-Site Scripting (XSS) / Cross Domain redirects and Server path information disclosure on SAP Busi… (Rolando Fuentes <rolando.fuentes@...CHE…)
Re: RE: Microsoft IE 6&7 Crash Exploit (sdasdasd@...asd.com)
[security bulletin] HPSBMA02502 SSRT090171 rev.1 - HP OpenView Storage Data Protector, Local Unauthorized Access (security-alert@...com)
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Re: [Full-disclosure] e107 latest download link is backdoored (Gregor Schneider <rc46fi@...glemail.com>)
[ MDVSA-2010:027 ] kdelibs4 (security@...driva.com)
[ MDVSA-2010:028 ] kdelibs4 (security@...driva.com)
[USN-803-2] Dhcp vulnerability (Jamie Strandboge <jamie@...onical.com>)
[RT-SA-2010-002] Geo++(R) GNCASTER: Insecure handling of NMEA-data (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
PR09-15: XSS injection vulnerability within HP System Management Homepage (Insight Manager) (research <research@...checkup.com>)
[SECURITY] [DSA-1979-1] New lintian packages fix multiple vulnerabilities (Raphael Geissert <geissert@...ian.org>)
[RT-SA-2010-003] Geo++(R) GNCASTER: Faulty implementation of HTTP Digest Authentication (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2010-001] Geo++(R) GNCASTER: Insecure handling of long URLs (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[SECURITY] [DSA 1980-1] New ircd-hybrid/ircd-ratbox packages fix arbitrary code execution (white@...ian.org (Steffen Joeris))

January 28 (4 messages)

Firefox Observation Plugin Attack ("Ivan Buetler" <ivan.buetler@...c.ch>)
[security bulletin] HPSBMA02502 SSRT090171 rev.1 - HP OpenView Storage Data Protector, Local Unauthorized Access (security-alert@...com)
[USN-891-1] lintian vulnerabilities (Kees Cook <kees@...ntu.com>)
Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit (dlrow1991@...il.com)

January 29 (15 messages)

[SECURITY] [DSA 1981-1] New maildrop packages fix privilege escalation (white@...ian.org (Steffen Joeris))
PR09-19: Cross-Site Scripting (XSS) on CommonSpot server (research <research@...checkup.com>)
[USN-893-1] Samba vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[SECURITY] [DSA 1981-2] New maildrop packages fix regression (white@...ian.org (Steffen Joeris))
[USN-892-1] FUSE vulnerability (Kees Cook <kees@...ntu.com>)
[SECURITY] [DSA 1968-2] New pdns-recursor packages fix cache poisoning (Florian Weimer <fw@...eb.enyo.de>)
Re: Microsoft IE 6&7 Crash Exploit (k4mr4n_st@...oo.com)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies (James Landis <jcl24@...nell.edu>)
Re: [Webappsec] Paper: Weaning the Web off of Session Cookies ("Arian J. Evans" <arian.evans@...chronic.com>)
Multiple vulnerabilities in XAMPP (advisories #1 and #2) ("MustLive" <mustlive@...security.com.ua>)
Multiple vulnerabilities in XAMPP (advisories #3 and #4) ("MustLive" <mustlive@...security.com.ua>)
Multiple vulnerabilities in XAMPP (advisories #5 and #6) ("MustLive" <mustlive@...security.com.ua>)
Multiple vulnerabilities in XAMPP (advisory #7) ("MustLive" <mustlive@...security.com.ua>)
[ MDVSA-2010:029 ] rootcerts (security@...driva.com)
OCS Inventory NG Server <= 1.3b3 (login) Remote Authentication Bypass (Nicolas DEROUET <nicolas.derouet@...il.com>)

286 messages

Powered by blists - more mailing lists