bugtraq mailing list - 2010/06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2010/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 26	² 11	³ 11	⁴ 10	⁵	⁶
⁷ 13	⁸ 28	⁹ 20	¹⁰ 16	¹¹ 6	¹²	¹³
¹⁴ 10	¹⁵ 6	¹⁶ 8	¹⁷ 19	¹⁸ 3	¹⁹	²⁰
²¹ 21	²² 4	²³ 8	²⁴ 8	²⁵ 5	²⁶	²⁷
²⁸ 9	²⁹ 15	³⁰ 12

Messages by day:

June 1 (26 messages)

Winamp v5.571 malicious AVI file handling DoS Vulnerability (praveen_recker@...y.com)
RE: Ghostscript 8.64 executes random code at startup ("Michael Wojcik" <Michael.Wojcik@...rofocus.com>)
Re: DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera ("John Smith" <at-x@...e.com>)
RE: Nginx 0.8.35 Space Character Remote Source Disclosure (<reply-to-list@...linator.com>)
Re: Nginx 0.8.35 Space Character Remote Source Disclosure (Zach <admin@...ksecurity.net>)
[Bkis-02-2010] Multiple Vulnerabilities in CMS Made Simple - Bkis ("Bkis" <svrt@...v.com.vn>)
DoS vulnerability in Internet Explorer ("MustLive" <mustlive@...security.com.ua>)
SQL injection vulnerability in Ecomat CMS (advisory@...ridge.ch)
Onapsis Research Labs: Onapsis Bizploit - The opensource ERP Penetration Testing framework (Onapsis Research Labs <research@...psis.com>)
XSS vulnerability in Ecomat CMS (advisory@...ridge.ch)
PuTTY private key passphrase stealing attack (Jan Schejbal <jan.mailinglisten@...glemail.com>)
Re: [Full-disclosure] PuTTY private key passphrase stealing attack (Rob Fuller <jd.mubix@...il.com>)
Re: [Full-disclosure] PuTTY private key passphrase stealing attack (Borja Marcos <borjam@...enet.es>)
Re: [Full-disclosure] PuTTY private key passphrase stealing attack (halfdog <me@...fdog.net>)
[ GLSA 201006-01 ] FreeType 1: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 201006-02 ] CamlImages: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 201006-03 ] ImageMagick: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 201006-04 ] xine-lib: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 201006-05 ] Wireshark: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 201006-06 ] Transmission: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 201006-07 ] SILC: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
ZDI-10-090: Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[ GLSA 201006-08 ] nano: Multiple vulnerabilities (Tobias Heinlein <keytoaster@...too.org>)
[ GLSA 201006-09 ] sudo: Privilege escalation (Tobias Heinlein <keytoaster@...too.org>)
Re: RE: Nginx 0.8.35 Space Character Remote Source Disclosure (info@...uritylab.ir)
Applicure dotDefender 4.0 administrative interface cross site scripting (Sandro Gauci <publists@...blesecurity.com>)

June 2 (11 messages)

SFCB vulnerabilities (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: Nginx 0.8.35 Space Character Remote Source Disclosure (Mailing lists at Core Security Technologies <lists@...esecurity.com>)
[20100501] - Core - Joomla! Multiple XSS Vulnerabilities in Back End Administrative Module Core Components (Riyaz Walikar <riyazwalikar@...il.com>)
Trend Micro Data Loss Prevention 5.2 Data Leakage (nitrØus <nitrousenador@...il.com>)
Wing FTP Server - Cross Site Scripting Vulnerability (werew01f <hack.werew01f@...il.com>)
TEHTRI-Security: Many 0days soon released at SyScan Singapore 2010 (Laurent OUDOT at TEHTRI-Security <laurent.oudot@...tri-security.com>)
[ GLSA 201006-10 ] multipath-tools: World-writeable socket (Stefan Behte <craig@...too.org>)
[ GLSA 201006-11 ] BIND: Multiple vulnerabilities (Stefan Behte <craig@...too.org>)
[ GLSA 201006-12 ] Fetchmail: Multiple vulnerabilities (Stefan Behte <craig@...too.org>)
DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera ("MustLive" <mustlive@...security.com.ua>)
[Suspected Spam][USN-946-1] Net-SNMP vulnerability (Kees Cook <kees@...ntu.com>)

June 3 (11 messages)

[ GLSA 201006-13 ] Smarty: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[ GLSA 201006-14 ] Newt: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[security bulletin] HPSBUX02524 SSRT100089 rev.1 - HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and … (security-alert@...com)
[security bulletin] HPSBUX02531 SSRT100108 rev.1 - HP-UX Running Apache-based Web Server, Remote Denial of Service (DoS), Unauthorized Acc… (security-alert@...com)
[ GLSA 201006-15 ] XEmacs: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 201006-16 ] GD: User-assisted execution of arbitrary code (Alex Legler <a3li@...too.org>)
[ GLSA 201006-17 ] lighttpd: Denial of Service (Alex Legler <a3li@...too.org>)
[security bulletin] HPSBST02536 SSRT100057 rev.1 - HP StorageWorks Storage Mirroring, Remote Unauthorized Access (security-alert@...com)
[security bulletin] HPSBMA02538 SSRT100136 rev.1 - HP ServiceCenter Running on AIX, HP-UX, Linux, Solaris, and Windows, Remote Cross Site … (security-alert@...com)
RE: [ GLSA 201006-13 ] Smarty: Multiple vulnerabilities ("Andrew Morum" <amorum@...ndata.co.uk>)
eFront Multiple Parameter Cross Site Scripting Vulnerabilities ("VUPEN Web Security" <advisories@...en.com>)

June 4 (10 messages)

Multiple vulnerabilities in Exim (Dan Rosenberg <dan.j.rosenberg@...il.com>)
[USN-948-1] GnuTLS vulnerability (Jamie Strandboge <jamie@...onical.com>)
CA20100603-01: Security Notice for CA ARCserve Backup ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[Suspected Spam][USN-947-2] Linux kernel regression (Kees Cook <kees@...ntu.com>)
RSA Key Manager SQL injection Vulnerability ( CVE-2010-1904 ) (Kyle Quest <kyle.c.quest@...mail.com>)
[ GLSA 201006-20 ] Asterisk: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
Re[3]: DoS vulnerabilities in Firefox, Internet Explorer, Chrome, Opera and other browsers ("MustLive" <mustlive@...security.com.ua>)
[ GLSA 201006-19 ] Bugzilla: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
[ GLSA 201006-18 ] Oracle JRE/JDK: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)
Vulnerabilities in Gigya Socialize for WordPress ("MustLive" <mustlive@...security.com.ua>)

June 7 (13 messages)

[SECURITY] [DSA 2054-1] New bind9 packages fix cache poisoning (Florian Weimer <fw@...eb.enyo.de>)
[security bulletin] HPSBUX02451 SSRT090137 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS) (security-alert@...com)
Core FTP mini-sftp-server Several DoS and Directory Traversal Vulnerabilities (leinakesi@...il.com)
[SECURITY] [DSA 2055-1] New OpenOffice.org packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[SECURITY] [DSA 2057-1] New mysql-dfsg-5.0 packages fix several vulnerabilities (Giuseppe Iuculano <iuculano@...ian.org>)
SQL injection vulnerability in CuteSITE CMS (advisory@...ridge.ch)
[SECURITY] [DSA 2056-1] New zonecheck packages fix cross-site scripting (Sebastien Delafond <seb@...ian.org>)
XSS vulnerability in CuteSITE CMS (advisory@...ridge.ch)
SQL injection vulnerability in boastMachine (advisory@...ridge.ch)
Core FTP Server(SFTP module) 'open' and 'stat' Commands Remote Denial of Service Vulnerability (leinakesi@...il.com)
XSRF (CSRF) in CuteSITE CMS (advisory@...ridge.ch)
XSS vulnerability in boastMachine (advisory@...ridge.ch)
Re: RSA Key Manager SQL injection Vulnerability ( CVE-2010-1904 ) (security_alert@....com)

June 8 (28 messages)

Recon 2010 - Speaker list, new additional capacity for sold-out training, party details (Hugo Fortier <hfortier@...on.cx>)
VUPEN Security Research - Apple Safari WebKit HTML Button Use-after-free Vulnerability (CVE-2010-1392) ("VUPEN Security Research" <advisories@...en.com>)
DoS attacks on email clients via protocol handlers ("MustLive" <mustlive@...security.com.ua>)
The XCon2010 is coming (xcon@...yongxingan.com)
Paessler - PRTG Traffic Grapher XSS (Patrick Webster <patrick@...hack.com>)
Blue Arc Group - IgnitionSuite CMS WebDMailer unsubscribe issue (Patrick Webster <patrick@...hack.com>)
ArpON (Arp handler inspectiON) 2.0 released! (Andrea Di Pasquale <spikey.it@...il.com>)
[ MDVSA-2010:111 ] glibc (security@...driva.com)
ZDI-10-097: Apple Webkit ContentEditable moveParagraphs Uninitialized Element Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoin…)
ZDI-10-091: Apple Webkit Attribute Child Removal Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-098: Apple Webkit First-Letter Pseudo-Element Style Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-096: Apple Webkit Recursive Use Element Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-099: Apple Webkit ProcessInstruction Target Error Message Insertion Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.c…)
ZDI-10-100: Apple Webkit ConditionEventListener Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-095: Apple Webkit DOCUMENT_POSITION_DISCONNECTED Attribute Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-101: Apple Webkit SVG RadialGradiant Run-in Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-094: Apple Webkit SelectionController via Marquee Event Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-093: Apple Webkit CSS Charset Text Transformation Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-092: Apple Webkit Option Element ContentEditable Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-103: Microsoft Office Excel DBQueryExt Record Unspecified ADO Object Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.…)
ZDI-10-104: Microsoft Office Excel SxView Record Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-106: Hewlett-Packard OpenView NNM ovutil.dll getProxiedStorageAddress Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint…)
IS-2010-002 - Linksys WAP54Gv3 Remote Debug Root Shell (Cristofaro Mune <pulsoid@...silence.org>)
tool: ref_fuzz (CVE-2010-1259 / MS10-035 and more) (Michal Zalewski <lcamtuf@...edump.cx>)
ZDI-10-105: Hewlett-Packard OpenView NNM ovwebsnmpsrv.exe Bad Option Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBMA02537 SSRT010027 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
ZDI-10-102: Microsoft Internet Explorer Stylesheet Array Removal Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[CORE-2010-0415] SQL Injection in CubeCart PHP Free & Commercial Shopping Cart Application (CORE Security Technologies Advisories <advisories@...esecurity.com>)

June 9 (20 messages)

Dlink Di-604 router authenticated user ping tool Xss and DoS (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
VUPEN Security Research - Microsoft Office Excel OBJ Stack Overflow Vulnerability (CVE-2010-0822) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel RTD Heap Corruption Vulnerability (CVE-2010-1247) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel EDG Heap Overflow Vulnerability (CVE-2010-1250) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel SxView Memory Corruption Vulnerability (CVE-2010-1245) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel RTD Stack Overflow Vulnerability (CVE-2010-1246) ("VUPEN Security Research" <advisories@...en.com>)
Re: [oss-security] [oCERT-2010-001] multiple http client unexpected download filename vulnerability (Marcus Meissner <meissner@...e.de>)
[USN-950-1] MySQL vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)
[MajorSecurity SA-070]Plume CMS - change Admin Password via Cross-site Request Forgery (david.kurz@...orsecurity.net)
RE: RSA Key Manager SQL injection Vulnerability ( CVE-2010-1904 ) (Kyle Quest <kyle.c.quest@...mail.com>)
VUPEN Security Research - Microsoft Office Excel WOPT Heap Corruption Vulnerability (CVE-2010-0824) ("VUPEN Security Research" <advisories@...en.com>)
Cisco Security Advisory: Vulnerabilities in Cisco Unified Contact Center Express (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco Application Extension Platform Privilege Escalation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@c…)
CA20100608-01: Security Notice for CA PSFormX and WebScan ActiveX Controls ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[MajorSecurity SA-069]Invision Power Board - stored Cross site Scripting (david.kurz@...orsecurity.net)
VUPEN Security Research - Microsoft Office Excel HFPicture Buffer Overflow Vulnerability (CVE-2010-1248) ("VUPEN Security Research" <advisories@...en.com>)
[MajorSecurity SA-068]Anantasoft Gazelle CMS - change admin password via Cross-site Request Forgery (david.kurz@...orsecurity.net)
VUPEN Security Research - Microsoft Windows Kernel "GetDCEx()" Memory Corruption Vulnerability (CVE-2010-0484) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Microsoft Office Excel ExternName Buffer Overflow Vulnerability (CVE-2010-1249) ("VUPEN Security Research" <advisories@...en.com>)
McAfee UTM Firewall Help Reflected Cross-Site Scripting (Adam Baldwin <adam_baldwin@...nuity-is.com>)

June 10 (16 messages)

TPTI-10-03: Sophos Anti-Virus SAVOnAccessFilter Local Privilege Escalation Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Tavis Ormandy <taviso@...xchg8b.com>)
PR09-17: Juniper Secure Access seriers (Juniper IVE) authenticated XSS & REDIRECTION (research <research@...checkup.com>)
[ MDVSA-2010:113 ] wireshark (security@...driva.com)
Awcm Cms Local File Inclusion Vulnerability (x0.root@...il.com)
[SECURITY] [DSA 2058-1] New glibc packages fix several vulnerabilities (Aurelien Jarno <aurel32@...ian.org>)
Vulnerabilities in Belavir for WordPress ("MustLive" <mustlive@...security.com.ua>)
Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Susan Bradley <sbradcpa@...bell.net>)
Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Susan Bradley <sbradcpa@...bell.net>)
Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Tavis Ormandy <taviso@...xchg8b.com>)
Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Susan Bradley <sbradcpa@...bell.net>)
[SECURITY] [DSA 2059-1] New pcsc-lite packages fix privilege escalation (Thijs Kinkhorst <thijs@...ian.org>)
[MajorSecurity SA-071]phpFaber CMS - Multiple stored Cross-site Scripting issues (david.kurz@...orsecurity.net)
Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly (Jhfjjf Hfdsjj <taser3000@...oo.com>)
iDefense Security Advisory 06.07.10: Multiple Vendor WebKit HTML Caption Use After Free Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)

June 11 (6 messages)

ZDI-10-107: Multiple Sourcefire Products Static Web SSL Keys Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
iDefense Security Advisory 06.10.10: Adobe Flash Player Out Of Bounds Memory Indexing Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 06.10.10: Adobe Flash Player Use-After-Free Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Secunia Research: Creative Software AutoUpdate Engine 2 ActiveX Control Buffer Overflow (Secunia Research <remove-vuln@...unia.com>)
[ MDVSA-2010:114 ] dhcp (security@...driva.com)
Re: [oss-security] [oCERT-2010-001] multiple http client unexpected download filename vulnerability (Solar Designer <solar@...nwall.com>)

June 14 (10 messages)

[advisory] httpd Timeout detection flaw (mod_proxy_http) CVE-2010-2068 ("William A. Rowe Jr." <wrowe@...che.org>)
SQL injection vulnerability in MODx CMS and Application Framework (advisory@...ridge.ch)
SQL injection vulnerability in AneCMS (advisory@...ridge.ch)
[ MDVSA-2010:115 ] perl (security@...driva.com)
SQL injection vulnerability in MODx CMS and Application Framework (advisory@...ridge.ch)
Cherokee Web Server 0.5.3 Multiple Vulnerabilities (info@...uritylab.ir)
Stored XSS vulnerability in AneCMS blog module (advisory@...ridge.ch)
[ MDVSA-2010:116 ] perl (security@...driva.com)
SQL injection vulnerability in MODx CMS (advisory@...ridge.ch)
[MajorSecurity SA-073]Subdreamer CMS - SQL injection vulnerability (david.kurz@...orsecurity.net)

June 15 (6 messages)

Re: SQL injection vulnerability in boastMachine (security curmudgeon <jericho@...rition.org>)
[security bulletin] HPSBMA02537 SSRT010027 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code (security-alert@...com)
[security bulletin] HPSBPI02532 SSRT100111 rev.2 - HP MFP Digital Sending Software Running on Windows, Local Unauthorized Access (security-alert@...com)
DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA 2060-1] New cacti packages fix SQL injection (Nico Golde <nion@...ian.org>)
[ GLSA 201006-21 ] UnrealIRCd: Multiple vulnerabilities (Alex Legler <a3li@...too.org>)

June 16 (8 messages)

CORE-2010-0514: XnView MBM Processing Heap Overflow (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[SECURITY] [DSA 2054-2] New bind9 packages fix cache poisoning (joey@...odrom.org (Martin Schulze))
TitanFTP Server Arbitrary File Disclosure (bill@...ensussecurity.com)
Re: Dlink Di-604 router authenticated user ping tool Xss and DoS (swbaes@...nbiro.com)
Nakid CMS (fckeditor) Remote Arbitrary File Upload Exploit (g1xsystem@...dowslive.com)
VUPEN Security Research - Adobe Flash Player GIF/JPEG Data Parsing Heap Overflow Vulnerabilities (CVE-2010-2167) ("VUPEN Security Research" <advisories@...en.co…)
VUPEN Security Research - Adobe Flash Player "newclass" Invalid Pointer Vulnerability (CVE-2010-2173) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Adobe Flash Player "newfunction" Invalid Pointer Vulnerability (CVE-2010-2174) ("VUPEN Security Research" <advisories@...en.com>)

June 17 (19 messages)

ZDI-10-108: HP OpenView NNM ovwebsnmpsrv.exe Command Line Argument Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[Onapsis Security Advisory 2010-005] SAP J2EE Telnet Administration Security Check Bypass (Onapsis Research Labs <research@...psis.com>)
[ MDVSA-2010:117 ] cacti (security@...driva.com)
[SECURITY] [DSA 2061-1] New samba packages fix arbitrary code execution (Nico Golde <nion@...ian.org>)
[USN-951-1] Samba vulnerability (Kees Cook <kees@...ntu.com>)
ZDI-10-110: Adobe Flash Player Multiple Tag JPEG Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-109: Adobe Flash Player Multiple Atom MP4 Parsing Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[security bulletin] HPSBOV02540 SSRT090249 rev.1 - HP SSL for OpenVMS, Remote Unauthorized Data Injection, Denial of Service(Dos) (security-alert@...com)
iDefense Security Advisory 06.16.10: Samba 3.3.12 Memory Corruption Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
[MajorSecurity SA-074]CMS RedAks 2.0 - Multiple Cross-site Scripting issues (david.kurz@...orsecurity.net)
TurboFTP Server Directory Traversal Vulnerability (leinakesi@...il.com)
[SECURITY] [DSA 2062-1] New sudo packages fix environment sanitization bypass vulnerability (Giuseppe Iuculano <iuculano@...ian.org>)
[ MDVSA-2010:118 ] sudo (security@...driva.com)
[ MDVSA-2010:119 ] samba (security@...driva.com)
TEHTRI-Security released 13 0days against web tools used by evil attackers (Laurent OUDOT at TEHTRI-Security <laurent.oudot@...tri-security.com>)
[security bulletin] HPSBUX02543 SSRT100152 rev.1 - HP-UX Running Apache with PHP, Remote Denial of Service (DoS), Unauthorized Access, (security-alert@...com)
Vulnerabilities in Firebook ("MustLive" <mustlive@...security.com.ua>)
[SECURITY] [DSA 2063-1] New pmount packages fix denial of service (Giuseppe Iuculano <iuculano@...ian.org>)
TitanFTP Server COMB directory traversal (bill@...ensussecurity.com)

June 18 (3 messages)

CVE-2010-1622: Spring Framework execution of arbitrary code (s2-security <s2-security@...are.com>)
XCon 2010 XFocus Information Security Conference Call for Paper (xcon@...yongxingan.com)
Re: Nakid CMS (fckeditor) Remote Arbitrary File Upload Exploit (Jaison Salu John <jaison.sj@...il.com>)

June 21 (21 messages)

Remote Arbitrary Code Execution Vulnerability in UFO: Alien Invasion (jason@...software.com)
[MajorSecurity SA-075]CMS RedAks 2.0 - SQL injection vulnerability (david.kurz@...orsecurity.net)
NSOADV-2010-008: AnNoText Third-Party ActiveX Control Buffer Overflow (NSO Research <nso-research@...iriu.de>)
NSOADV-2010-009: AnNoText Third-Party ActiveX Control file overwrite vulnerability (NSO Research <nso-research@...iriu.de>)
Vulnerabilities in eSitesBuilder ("MustLive" <mustlive@...security.com.ua>)
Wing FTP Server PORT Command DoS Vulnerability (sk <sk10_0@...oo.com>)
XSS vulnerability in Scribe CMS (advisory@...ridge.ch)
XSS vulnerability in Scribe CMS (advisory@...ridge.ch)
XSS vulnerability in Scribe CMS (advisory@...ridge.ch)
Stored XSS vulnerability in synType CMS comment text field (advisory@...ridge.ch)
XSS vulnerability in the search module of synType CMS (advisory@...ridge.ch)
Sysax Multi Server "open", "unlink", "mkdir", "scp_get" Commands DoS Vulnerabilities (leinakesi@...il.com)
[ MDVSA-2010:120 ] squirrelmail (security@...driva.com)
ZDI-10-111: Adobe Flash Player LocalConnection Memory Corruption Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-112: Novell Access Manager Arbitrary File Upload Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-954-1] tiff vulnerabilities (Kees Cook <kees@...ntu.com>)
[USN-955-1] OPIE vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-955-2] libpam-opie vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
[USN-953-1] fastjar vulnerability (Marc Deslauriers <marc.deslauriers@...onical.com>)
CSRF in PHPWCMS 1.4.5 (labs@...teamsecure.com)
[USN-952-1] CUPS vulnerabilities (Marc Deslauriers <marc.deslauriers@...onical.com>)

June 22 (4 messages)

[scip_Advisory 4142] Skype Client for Mac Chat Unicode Denial of Service (Marc Ruef <maru@...p.ch>)
[ MDVSA-2010:121 ] pango (security@...driva.com)
[security bulletin] HPSBUX02541 SSRT100145 rev.1 - HP-UX Running Tomcat Servlet Engine, Remote Increase in Privilege, A… ("Morris, John R. (SSRT)" <john.morris@h…)
[ MDVSA-2010:122 ] fastjar (security@...driva.com)

June 23 (8 messages)

Microsoft Help Files (.CHM): 'Locked File' Feature Bypass (Paul Craig <paul.craig@...urity-assessment.com>)
IS-2010-003 - Linksys WAP54Gv3 debug.cgi Cross-Site Scripting (Cristofaro Mune <pulsoid@...silence.org>)
[security bulletin] HPSBMA02439 SSRT080082 rev.2 - HP OpenView SNMP Emanate Master Agent Running on HP-UX, Linux, Solaris, and Windows, Re… (security-alert@...com)
Weborf DCA-00012 Vulnerability Report (Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>)
Apache Axis Session Fixation Vulnerability (Tiago Ferreira Barbosa <tiago@...pest.com.br>)
RE: [Full-disclosure] Microsoft Help Files (.CHM): 'Locked File' Feature Bypass ("Thor (Hammer of God)" <Thor@...merofgod.com>)
[ MDVSA-2010:123 ] libneon0.27 (security@...driva.com)
ZDI-10-113: Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)

June 24 (8 messages)

CORE-2010-0316 - Novell iManager Multiple Vulnerabilities (CORE Security Technologies Advisories <advisories@...esecurity.com>)
[ MDVSA-2010:124 ] pulseaudio (security@...driva.com)
[ MDVSA-2010:125 ] firefox (security@...driva.com)
XSS vulnerability in ForumCMS (advisory@...ridge.ch)
SQL injection vulnerability in WebDB (advisory@...ridge.ch)
[ MDVSA-2010:126 ] mozilla-thunderbird (security@...driva.com)
SQL injection vulnerability in WebDB (advisory@...ridge.ch)
[Suspected Spam]Vulnerabilities in Cimy Counter for WordPress ("MustLive" <mustlive@...security.com.ua>)

June 25 (5 messages)

VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel (VMware Security team <security@...are.com>)
ZDI-10-114: Adobe Flash Player AVM2 getouterscope Opcode Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
ZDI-10-115: Adobe Flash Player AVM newFrameState Integer Overfow Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[SWRX-2010-001] Cisco ASA HTTP Response Splitting Vulnerability (ctu-no-reply@...ureworks.com)
[security bulletin] HPSBUX02544 SSRT100107 rev.1 - HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code (security-alert@...com)

June 28 (9 messages)

Nuance OmniPage 16 Professional installs multiple vulnerable Microsoft runtime libraries ("Stefan Kanthak" <stefan.kanthak@...go.de>)
Re: Sysax Multi Server "open", "unlink", "mkdir", "scp_get" Commands DoS Vulnerabilities (rob@...ensussecurity.com)
[SECURITY] [DSA 2064-1] New xulrunner packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2065-1] New kvirc packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Denial-of-Service Vulnerability in IDA Pro (jason@...software.com)
IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote Configuration (Cristofaro Mune <pulsoid@...silence.org>)
New IETF Internet-Drafts on TCP timestamps (Fernando Gont <fernando.gont@...il.com>)
ref_fuzz and other fun bugs (Michal Zalewski <lcamtuf@...edump.cx>)
London DEFCON June meet - DC4420 - Wed 30th June 2010 (alien DC4420 <alien@...420.org>)

June 29 (15 messages)

iDefense Security Advisory 06.21.10: Multiple Vendor LibTIFF 3.9.2 Stack Buffer Overflow Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
SQL injection vulnerability in TomatoCMS (advisory@...ridge.ch)
XSS vulnerability in PortalApp (advisory@...ridge.ch)
SQL injection vulnerability in Grafik CMS (advisory@...ridge.ch)
XSS vulnerability in Grafik CMS (advisory@...ridge.ch)
XSS vulnerability in PortalApp (advisory@...ridge.ch)
XSS vulnerability in PortalApp (advisory@...ridge.ch)
XSS vulnerability in Grafik CMS (advisory@...ridge.ch)
Extended deadline, Call for Papers EC2ND 2010 (Konrad Rieck <konrad.rieck@...berlin.de>)
IS-2010-005 - D-Link DAP-1160 Authentication Bypass (Cristofaro Mune <pulsoid@...silence.org>)
Secunia Research: TaskFreak "password" SQL Injection Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: TaskFreak "tznMessage" Cross-Site Scripting Vulnerability (Secunia Research <remove-vuln@...unia.com>)
SAP's web module OLK SQL Injection vulnerability (salchoman@...il.com)
[USN-927-4] nss vulnerability (Jamie Strandboge <jamie@...onical.com>)
[USN-927-5] nspr update (Jamie Strandboge <jamie@...onical.com>)

June 30 (12 messages)

[USN-930-1] Firefox and Xulrunner vulnerabilities (Jamie Strandboge <jamie@...onical.com>)
[USN-930-2] apturl, Epiphany, gecko-sharp, gnome-python-extras, liferea, rhythmbox, totem, ubufox, yelp update (Jamie Strandboge <jamie@...onical.com>)
[0day] Microsoft mshtml.dll CTimeoutEventList::InsertIntoTimeoutList memory leak (Reversemode <advisories@...ersemode.com>)
Secunia Research: Adobe Reader JPEG Uninitialised Memory Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Adobe Reader GIF Image Parsing Array-Indexing Vulnerability (Secunia Research <remove-vuln@...unia.com>)
Secunia Research: Joomla BookLibrary Component Four SQL Injection Vulnerabilities (Secunia Research <remove-vuln@...unia.com>)
VUPEN Security Research - Adobe Acrobat and Reader #1023 Tag Buffer Overflow Vulnerability (CVE-2010-2212) ("VUPEN Security Research" <advisories@...en.com>)
VUPEN Security Research - Adobe Acrobat and Reader "newfunction" Memory Corruption Vulnerability (CVE-2010-2168) ("VUPEN Security Research" <advisories@...en.co…)
VUPEN Security Research - Adobe Acrobat and Reader "pushstring" Memory Corruption Vulnerability (CVE-2010-2201) ("VUPEN Security Research" <advisories@...en.com…)
VUPEN Security Research - Adobe Acrobat and Reader "newclass" Memory Corruption Vulnerability (CVE-2010-1285) ("VUPEN Security Research" <advisories@...en.com>)
ZDI-10-116: Adobe Reader CLOD Progressive Mesh Continuation Resolution Remote Code Execution Vulnerability (ZDI Disclosures <zdi-disclosures@...pingpoint.com>)
[USN-930-3] Firefox regression (Jamie Strandboge <jamie@...onical.com>)

269 messages

Powered by blists - more mailing lists