bugtraq mailing list - 2013/03

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2013/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 2	²	³
⁴ 10	⁵ 7	⁶ 21	⁷ 10	⁸ 4	⁹ 6	¹⁰
¹¹ 9	¹² 1	¹³ 12	¹⁴ 6	¹⁵ 13	¹⁶	¹⁷
¹⁸ 13	¹⁹ 4	²⁰ 6	²¹ 2	²² 4	²³	²⁴
²⁵ 1	²⁶ 6	²⁷ 16	²⁸ 6	²⁹	³⁰	³¹

Messages by day:

March 1 (2 messages)

ESA-2013-012: RSA® Authentication Agent 7.1.1 for Microsoft Windows® Access Control Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 2635-1] cfingerd security update (Salvatore Bonaccorso <carnil@...ian.org>)

March 4 (10 messages)

[SECURITY] [DSA 2636-1] xen security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2636-2] xen regression update (Moritz Muehlenhoff <jmm@...ian.org>)
[slackware-security] httpd (SSA:2013-062-01) (Slackware Security Team <security@...ckware.com>)
[SE-2012-01] One more attack affecting Oracle's Java SE 7u15 (Security Explorations <contact@...urity-explorations.com>)
rpi-update tmpfile vulnerability (Technion <technion@...ware.net>)
CVE-2013-1413 (stephan.rickauer@...c.ch)
[CVE-REQUEST] Foscam <= 11.37.2.48 path traversal vulnerability (Frédéric Basse <basse.frederic@...il.com>)
Proofpoint Protection Server Session Persistence (BugsNotHugs <bugsnothugs@...il.com>)
Remote command execution for Ruby Gem ftpd-0.2.1 (larry0@...com)
Remote system freeze thanks to Kaspersky Internet Security 2013 (Marc Heuse <mh@...sec.de>)

March 5 (7 messages)

[IA32] HP Intelligent Management Center v5.1 E0202 topoContent.jsf Non-Persistent Cross-Site Scripting (Inshell Security <info@...hell.net>)
[SECURITY] [DSA 2637-1] apache2 security update (Stefan Fritsch <sf@...ian.org>)
APPLE-SA-2013-03-04-1 Java for OS X 2013-002 and Mac OS X v10.6 Update 14 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 2638-1] openafs security update (Moritz Muehlenhoff <jmm@...ian.org>)
WordPress Count-Per-Day plugin 3.2.5. Type-1 (reflected) Cross Site Scripting (XSS) (alej andr0 <alejandr0.m0f0@...il.com>)
[PT-2013-17] Arbitrary Files Reading in mnoGoSearch (noreply@...ecurity.ru)
RE: [Full-disclosure] Remote system freeze thanks to Kaspersky Internet Security 2013 (SA52053) (Vulnerability Mailbox <Vulnerability@...persky.com>)

March 6 (21 messages)

[SECURITY] [DSA 2639-1] php5 security update (Thijs Kinkhorst <thijs@...ian.org>)
[ MDVSA-2013:017 ] libxml2 (security@...driva.com)
Varnish 2.1.5, 3.0.3 DoS in VRY_Create() while parsing Vary header (tytusromekiatomek@...hmail.com)
Samsung TV DoS (possible overflow) via SOAPACTION (tytusromekiatomek@...hmail.com)
Varnish 2.1.5 DoS in STV_alloc() while parsing Content-Length header (tytusromekiatomek@...hmail.com)
Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (tytusromekiatomek@...hmail.com)
SIP Witch 0.7.4 w/libosip2-4.0.0 DoS via NULL pointer derefence in libosip2 (tytusromekiatomek@...hmail.com)
Varnish 2.1.5, 3.0.3 DoS in http_GetHdr() while parsing Vary header (tytusromekiatomek@...hmail.com)
Squid 3.2.5 httpMakeVaryMark() header value DoS, 2.7.Stable9 memory corruption. (tytusromekiatomek@...hmail.com)
Varnish 2.1.5 DoS in fetch_straight() while parsing Content-Length header (tytusromekiatomek@...hmail.com)
Apache Subversion mod_dav_svn DoS via MKACTIVITY/PROPFIND (tytusromekiatomek@...hmail.com)
Re: Kingcopes AthCon 2012 Slides & Notes --> Video online (king cope <isowarez.isowarez.isowarez@...glemail.com>)
Re: rpi-update tmpfile vulnerability (larry0@...com)
OS Command Injection in CosCms (advisory@...ridge.com)
Multiple XSS vulnerabilities in Events Manager WordPress plugin (advisory@...ridge.com)
[SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples (Mark Thomas <markt@...che.org>)
Verax NMS Authenication Bypass (CVE-2013-1350) (Just Bugs <sometimesbugs@...il.com>)
Verax NMS Password Replay Attack (CVE-2013-1351) (Just Bugs <sometimesbugs@...il.com>)
Verax NMS Hardcoded Private Key (CVE-2013-1352) (Just Bugs <sometimesbugs@...il.com>)
Verax NMS Password Disclosure (CVE-2013-1631) (Just Bugs <sometimesbugs@...il.com>)
[ MDVSA-2013:018 ] openssl (security@...driva.com)

March 7 (10 messages)

DDIVRT-2013-51 DALIM Dialog Server 'logfile' Local File Inclusion (ddivulnalert@...frontline.com)
[security bulletin] HPSBMU02849 SSRT101124 rev.1 - HP ServiceCenter, Remote Denial of Service (DoS) (security-alert@...com)
[slackware-security] sudo (SSA:2013-065-01) (Slackware Security Team <security@...ckware.com>)
[security bulletin] HPSBPI02851 SSRT101078 rev.1 - Certain HP LaserJet Pro Printers, Unauthorized Access to Data (security-alert@...com)
[ MDVSA-2013:019 ] gnutls (security@...driva.com)
[security bulletin] HPSBGN02854 SSRT100881 rev.1 - HP Intelligent Management Center (iMC), iMC TACACS+ Authentication Manager (TAM), and i… (security-alert@...com)
Untrusted Pointer Dereference Vulnerability in Corel WordPerfect X6 (advisory@...ridge.com)
Multiple NULL Pointer Dereference Vulnerabilities in Corel Quattro Pro X6 (advisory@...ridge.com)
Re: Oracle Auto Service Request /tmp file clobbering vulnerability (larry0@...com)
Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (Kurt Seifried <kseifried@...hat.com>)

March 8 (4 messages)

[ MDVSA-2013:020 ] wireshark (security@...driva.com)
[ MDVSA-2013:021 ] java-1.6.0-openjdk (security@...driva.com)
SEC Consult SA-20130308-0 :: Multiple critical vulnerabilities in GroundWork Monitor Enterprise (part 1) (SEC Consult Vulnerability Lab <research@...-consult.c…)
SEC Consult SA-20130308-1 :: Multiple vulnerabilities in GroundWork Monitor Enterprise (part 2) (SEC Consult Vulnerability Lab <research@...-consult.com>)

March 9 (6 messages)

Stored XSS in Terillion Reviews Wordpress Plugin (nauty.me04@...il.com)
[SECURITY] [DSA 2642-1] sudo security update (Michael Gilbert <mgilbert@...ian.org>)
[slackware-security] mozilla-thunderbird (SSA:2013-068-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] mozilla-firefox (SSA:2013-068-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2641-1] perl security update (Salvatore Bonaccorso <carnil@...ian.org>)
Recon 2013 Call For Papers - June 21-23, 2013 - Montreal, Quebec ("cfp2013@...on.cx" <cfp2013@...on.cx>)

March 11 (9 messages)

OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability (larry0@...com)
[ISecAuditors Security Advisories] Reflected XSS in Asteriskguru Queue Statistics (ISecAuditors Security Advisories <advisories@...cauditors.com>)
Privoxy Proxy Authentication Credential Exposure - CVE-2013-2503 (Chris John Riley <chris.riley@....cc>)
Host tracking in IPv6 (SI6 Networks' IPv6 toolkit v1.3.3) (Fernando Gont <fgont@...networks.com>)
SEC Consult SA-20130311-0 :: Persistent cross-site scripting in jforum (SEC Consult Vulnerability Lab <research@...-consult.com>)
AthCon 2013 Rev. Challenge 2013 (info@...con.org)
Results of a XSLT fuzzing effort (Nicolas Grégoire <nicolas.gregoire@...rri.fr>)
Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (Amos Jeffries <amos@...enet.co.nz>)
Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (Amos Jeffries <squid3@...enet.co.nz>)

March 12 (1 message)

Privoxy Proxy Authentication Credential Exposure - CVE-2013-2503 (contact@....cc)

March 13 (12 messages)

Announcing ChronIC - a wearable Sub-GHz RF hacking tool (Adam Laurie <adam@...roup.co.uk>)
Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (Kurt Seifried <kseifried@...hat.com>)
TagScanner v5.1 - Stack Buffer Overflow Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
[SECURITY] [DSA 2643-1] puppet security update (Yves-Alexis Perez <corsac@...ian.org>)
Open-Xchange Security Advisory 2013-03-13 (Martin Braun <martin.braun@...n-xchange.com>)
SEC Consult SA-20130313-0 :: QlikView Desktop Client Integer Overflow (SEC Consult Vulnerability Lab <research@...-consult.com>)
[ MDVSA-2013:022 ] openssh (security@...driva.com)
[CVE-2013-1814] Apache Rave exposes User over API (Matt Franklin <mfranklin@...che.org>)
[ MDVSA-2013:023 ] coreutils (security@...driva.com)
Cisco Video Surveillance Operations Manager Multiple vulnerabilities (b.saleh@....com)
Re: [CVE-REQUEST] Foscam <= 11.37.2.48 path traversal vulnerability (Frédéric BASSE <basse.frederic@...il.com>)
[ MDVSA-2013:024 ] firefox (security@...driva.com)

March 14 (6 messages)

Re: SQLi found in Kodak Insite (chris.joughin@...ak.com)
[slackware-security] perl (SSA:2013-072-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2013-072-02) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2013:025 ] pidgin (security@...driva.com)
[SECURITY] [DSA 2644-1] wireshark security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2640-1] zoneminder security update (Salvatore Bonaccorso <carnil@...ian.org>)

March 15 (13 messages)

APPLE-SA-2013-03-14-1 OS X Mountain Lion v10.8.3 and Security Update 2013-001 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2013-03-14-2 Safari 6.0.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[SECURITY] [DSA 2645-1] inetutils security update (Yves-Alexis Perez <corsac@...ian.org>)
Curl Ruby Gem Remote command execution (Larry0@...com)
MiniMagic ruby gem remote code execution (Larry0@...com)
DDIVRT-2013-50 EverFocus EPARA264-16X1 Directory Traversal (ddivulnalert@...frontline.com)
Skype Click to Call Update Service local privilege escalation (Oliver-Tobias Ripka <otr@...kcay.de>)
[SECURITY] [DSA 2647-1] firebird2.1 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2648-1] firebird2.5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
n.runs-SA-2013.002 - Polycom - Firmware Update Command Injection (<security@...ns.com>)
n.runs-SA-2013.003 - Polycom - H.323 CDR Database SQL Injection (<security@...ns.com>)
n.runs-SA-2013.004 - Polycom - H.323 Format String Vulnerability (<security@...ns.com>)
n.runs-SA-2013.001 - Polycom - Command Shell Grants System-Level Access (<security@...ns.com>)

March 18 (13 messages)

[SECURITY] [DSA 2646-1] typo3-src security update (Yves-Alexis Perez <corsac@...ian.org>)
[SECURITY] [DSA 2649-1] lighttpd security update (Yves-Alexis Perez <corsac@...ian.org>)
[SECURITY] [DSA 2650-1] libvirt-bin security update (Yves-Alexis Perez <corsac@...ian.org>)
[slackware-security] ruby (SSA:2013-075-01) (Slackware Security Team <security@...ckware.com>)
Remote command execution in fastreader ruby gem (larry0@...com)
[SECURITY] [DSA 2650-2] libvirt regression update (Yves-Alexis Perez <corsac@...ian.org>)
[SE-2012-01] The "allowed behavior" in Java SE 7 (Issue 54) (Security Explorations <contact@...urity-explorations.com>)
[ MDVSA-2013:026 ] sudo (security@...driva.com)
[ MDVSA-2013:027 ] clamav (security@...driva.com)
[ MDVSA-2013:028 ] nagios (security@...driva.com)
NGS00440 Patch Notification: Windows USB RNDIS driver kernel pool overflow (NCC Group Research <research@...group.com>)
Cisco Security Response: Cisco IOS and Cisco IOS XE Type 4 Passwords Issue (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
NOPcon 2013 - Call for paper - Istanbul , Turkey (info@...con.org)

March 19 (4 messages)

Remote command execution in Ruby Gem Command Wrap (Larry0@...com)
VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Use-After-Free (MFSA-2013-29 / CVE-2013-0787) (VUPEN Security Research <advisories@...en.com>)
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "OnResize" Use-after-free (MS13-021 / CVE-2013-0087) (VUPEN Security Research <advisories@...e…)
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "OnMove" Use-after-free (MS13-021 / CVE-2013-0087) (VUPEN Security Research <advisories@...en.…)

March 20 (6 messages)

CA20130319-01: Security Notice for SiteMinder products using SAML ("Kotas, Kevin J" <Kevin.Kotas@...com>)
[waraxe-2013-SA#098] - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 (come2waraxe@...oo.com)
Re: VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "OnResize" Use-after-free (MS13-021 / CVE-2013-0087) ("Thomas D." <whistl0r@...glemail.com>)
APPLE-SA-2013-03-19-1 iOS 6.1.3 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2013-03-19-2 Apple TV 5.2.1 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[IA49] Photodex ProShow Producer v5.0.3310 ScsiAccess Local Privilege Escalation (Inshell Security <info@...hell.net>)

March 21 (2 messages)

[SECURITY] [DSA 2641-2] libapache2-mod-perl2 update related to DSA 2641-1 (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2651-1] smokeping security update (Salvatore Bonaccorso <carnil@...ian.org>)

March 22 (4 messages)

[SE-2011-01] PoC code for digital SAT TV research released (Security Explorations <contact@...urity-explorations.com>)
[security bulletin] HPSBUX02856 SSRT101104 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Unauthorized Disclosure (security-alert@...com)
[waraxe-2013-SA#099] - Update Spoofing Vulnerability in LibreOffice 4.0.1.2 (come2waraxe@...oo.com)
DC4420 - London DEFCON - March meet - Tuesday 26th March 2013 (Major Malfunction <majormal@...ate-radio.org>)

March 25 (1 message)

[slackware-security] php (SSA:2013-081-01) (Slackware Security Team <security@...ckware.com>)

March 26 (6 messages)

[security bulletin] HPSBPV02855 SSRT100512 rev.1 - HP ProCurve 1700-8(J9079A) and 1700-24(J9080A) Switches, Cross Site Request Forgery (CS… (security-alert@...com)
[SECURITY] [DSA 2652-1] libxml2 security update (Michael Gilbert <mgilbert@...ian.org>)
Report OWASP WAF Naxsi bypass Vulnerability (safe3q@...il.com)
SynConnect PMS SQL Injection Vulnerability (bhadresh.k.patel@...eroam.com)
ESA-2013-016: EMC Smarts Network Configuration Manager (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBOV02852 SSRT101108 rev.1 - HP SSL for OpenVMS, Remote Denial of Service (DoS), Unauthorized Disclosure of Informat… (security-alert@...com)

March 27 (16 messages)

[security bulletin] HPSBUX02857 SSRT101103 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vu… (security-alert@...com)
[SECURITY] [DSA 2653-1] icinga security update (Florian Weimer <fw@...eb.enyo.de>)
Re: Report OWASP WAF Naxsi bypass Vulnerability (Jeffrey Walton <noloader@...il.com>)
[slackware-security] dhcp (SSA:2013-086-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bind (SSA:2013-086-01) (Slackware Security Team <security@...ckware.com>)
Path Traversal in AWS XMS (advisory@...ridge.com)
McAfee Virtual Technician ActiveX Control Insecure Method (advisory@...ridge.com)
[security bulletin] HPSBST02848 SSRT101112 rev.1 - HP XP P9000 Command View Advanced Edition Suite Products, Remote Disclosure of Informat… (security-alert@...com)
Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Session Initiation Protocol Inspection Denial of … (Cisco Systems Product Security Incident…)
Cisco Security Advisory: Cisco IOS Software IP Service Level Agreement Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Protocol Translation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Smart Install Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.c…)
Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Vulnerability (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
Cisco Security Advisory: Cisco IOS Software Resource Reservation Protocol Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Tea…)
ESA-2013-018: EMC Smarts Product - Cross Site Scripting Vulnerability (Security Alert <Security_Alert@....com>)

March 28 (6 messages)

AST-2013-001: Buffer Overflow Exploit Through SIP SDP Header ("Asterisk Security Team" <security@...erisk.org>)
AST-2013-003: Username disclosure in SIP channel driver ("Asterisk Security Team" <security@...erisk.org>)
WordPress podPress Plugin XSS in SWF (hip@...ight-labs.org)
Workshop Proposal/Paper Submission Deadlines (asemailing@...il.com)
[SECURITY] [DSA 2655-1] rails security update (Moritz Muehlenhoff <jmm@...ian.org>)
AST-2013-002: Denial of Service in HTTP server ("Asterisk Security Team" <security@...erisk.org>)

159 messages

Powered by blists - more mailing lists