bugtraq mailing list - 2014/06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2014/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
²	³ 25	⁴ 11	⁵ 17	⁶ 12	⁷	⁸
⁹ 11	¹⁰ 10	¹¹ 14	¹² 5	¹³ 13	¹⁴	¹⁵
¹⁶ 6	¹⁷ 2	¹⁸ 8	¹⁹ 1	²⁰	²¹	²²
²³ 4	²⁴ 2	²⁵ 17	²⁶	²⁷ 8	²⁸	²⁹
³⁰ 10

Messages by day:

June 3 (25 messages)

[SECURITY] [DSA 2939-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 2943-1] php5 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2941-1] lxml security update (Moritz Muehlenhoff <jmm@...ian.org>)
Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress (Yarubo Internet Security Scan <no-reply@...ubo.com>)
[SECURITY] [DSA 2944-1] gnutls26 security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2942-1] typo3-src security update (Moritz Muehlenhoff <jmm@...ian.org>)
Re: OpenCart 1.5.6.4 Directory Traversal Vulnerability (Henri Salo <henri@...v.fi>)
[slackware-security] mariadb (SSA:2014-152-01) (Slackware Security Team <security@...ckware.com>)
CVE-2014-2232 - "Absolute Path Traversal" (CWE-36) vulnerability in "infoware MapSuite" (Christian Schneider <mail@...istian-Schneider.net>)
CVE-2014-2233 - "Server-Side Request Forgery" (CWE-918) vulnerability in "infoware MapSuite" (Christian Schneider <mail@...istian-Schneider.net>)
CVE-2014-2843 - "Reflected Cross-Site Scripting (XSS)" (CWE-79) vulnerability in "infoware MapSuite" (Christian Schneider <mail@...istian-Schneider.net>)
ESA-2014-032: RSAÂ® Adaptive Authentication (Hosted) DOM Cross-Site Scripting Vulnerability (Security Alert <Security_Alert@....com>)
[FD] CVE-2013-6876 s3dvt Root shell (Hector Marco <hecmargi@....es>)
VUPEN Security Research - Adobe Acrobat & Reader XI-X "AcroBroker" Sandbox Bypass (Pwn2Own) (VUPEN Security Research <advisories@...en.com>)
FCKedtior 2.6.10 Reflected Cross-Site Scripting (XSS) (Robin Bailey <Robin.Bailey@...nach.com>)
CVE-2014-1226 s3dvt Root shell (still) (Hector Marco <hecmargi@....es>)
CVE-2013-6825 DCMTK Root Privilege escalation (Hector Marco <hecmargi@....es>)
LSE Leading Security Experts GmbH - LSE-2014-05-22 - F*EX - Multiple Issues (advisories <advisories@...xperts.de>)
NG WifiTransfer Pro 1.1 - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Files Desk Pro v1.4 iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
AllReader v1.0 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
Privacy Pro v1.2 HZ iOS - File Include Web Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
TigerCom My Assistant v1.1 iOS - File Include Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Bluetooth Photo-File Share v2.1 iOS - Multiple Web Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)
iScan Online Mobile 2.0.1 iOS - Command Inject Vulnerability (Vulnerability Lab <admin@...nerability-lab.com>)

June 4 (11 messages)

CVE-2013-6876 s3dvt Root shell (Hector Marco <hecmargi@....es>)
CVE-2013-6825 DCMTK Root Privilege escalation (Hector Marco <hecmargi@....es>)
CVE-2014-1226 s3dvt Root shell (still) (Hector Marco <hecmargi@....es>)
Bug in bash <= 4.3 [security feature bypassed] (Hector Marco <hecmargi@....es>)
CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2 (Portcullis Advisories <advisories@...tcullis-security.com>)
FreeBSD Security Advisory FreeBSD-SA-14:13.pam (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:11.sendmail (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:12.ktrace (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 2945-1] chkrootkit security update (Giuseppe Iuculano <iuculano@...ian.org>)
[CVE-2014-2577] XSS on Transform Foundation Server 4.3.1 and 5.2 from Bottomline Technologies (Fran <jfrancisco.bolivar@...il.com>)
Re: [oss-security] Bug in bash <= 4.3 [security feature bypassed] (Jose Carlos Luna Duran <jose.carlos.luna@...il.com>)

June 5 (17 messages)

ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability (Security Alert <Security_Alert@....com>)
[SECURITY] [DSA 2947-1] libav security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2948-1] python-bottle security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2946-1] python-gnupg security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMU03033 rev.3 - HP Insight Control Software Components running OpenSSL, Remote Disclosure of Information (security-alert@...com)
Re: [FD] [oss-security] Bug in bash <= 4.3 [security feature bypassed] (Hector Marco <hecmargi@....es>)
Re: [FD] [oss-security] Bug in bash <= 4.3 [security feature bypassed] (lists@...atla.org.uk)
Re: Bug in bash <= 4.3 [security feature bypassed] (Daryl Tester <dt-bugtraq@...dcraftedcomputers.com.au>)
[RT-SA-2014-006] Directory Traversal in DevExpress ASP.NET File Manager (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[SECURITY] [DSA 2950-1] openssl security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2949-1] linux security update (Salvatore Bonaccorso <carnil@...ian.org>)
FreeBSD Security Advisory FreeBSD-SA-14:14.openssl (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
multiple Vulnerability in "WahmShoppes eStore" (cseye_ut@...oo.com)
[security bulletin] HPSBMU03028 rev.2 - HP Matrix Operating Environment and HP CloudSystem Matrix Software Components running OpenSSL, Rem… (security-alert@...com)
ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
[security bulletin] HPSBMU03029 rev.2 - HP Insight Control Server Migration running OpenSSL, Remote Disclosure of Information (security-alert@...com)
Details for CVE-2014-0220 (tucu@...udera.com)

June 6 (12 messages)

[SECURITY] [DSA 2951-1] mupdf security update (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Bug in bash <= 4.3 [security feature bypassed] (Hector Marco <hecmargi@....es>)
Cisco Security Advisory: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
[SECURITY] [DSA 2952-1] kfreebsd-9 security update (Nico Golde <nion@...ian.org>)
Re: [FD] [oss-security] Bug in bash <= 4.3 [security feature bypassed] (Jeffrey Walton <noloader@...il.com>)
[slackware-security] libtasn1 (SSA:2014-156-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] gnutls (SSA:2014-156-01) (Slackware Security Team <security@...ckware.com>)
SEC Consult SA-20140606-0 :: Multiple critical vulnerabilities in WebTitan (SEC Consult Vulnerability Lab <research@...-consult.com>)
[slackware-security] sendmail (SSA:2014-156-04) (Slackware Security Team <security@...ckware.com>)
[slackware-security] openssl (SSA:2014-156-03) (Slackware Security Team <security@...ckware.com>)
[Onapsis Security Advisory 2014-020] SAP SLD Information Tampering (Onapsis Research Labs <research@...psis.com>)
[Onapsis Security Advisories] Multiple Hard-coded Usernames in SAP Components (Onapsis Research Labs <research@...psis.com>)

June 9 (11 messages)

NeginGroup CMS Multiple Vulnerability (iedb.team@...il.com)
CVE-2014-3740 - SpiceWorks Cross-site scripting (Dolev Farhi <dolev@...nflare.org>)
[slackware-security] mozilla-firefox (SSA:2014-157-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2953-1] dpkg security update (Raphael Geissert <geissert@...ian.org>)
DNN (DotNetNuke®) ASPSlideshow Module Arbitrary File Download Vulnerability (cseye_ut@...oo.com)
DNN (DotNetNuke®) CodeEditor Module Arbitrary File Download Vulnerability (cseye_ut@...oo.com)
DNN (DotNetNuke®) EasyDnnGallery Module Arbitrary File Download Vulnerability (cseye_ut@...oo.com)
DNN (DotNetNuke®) eventscalendar Module Arbitrary File Download Vulnerability (cseye_ut@...oo.com)
DNN (DotNetNuke®) responsivesidebar Module Arbitrary File Download Vulnerability (cseye_ut@...oo.com)
DNN (DotNetNuke®) dnnUI_NewsArticlesSlider Module Arbitrary File Download Vulnerability (cseye_ut@...oo.com)
[security bulletin] HPSBMU03024 rev.3 - HP Insight Control Server Deployment on Linux and Windows running OpenSSL with System Management H… (security-alert@...com)

June 10 (10 messages)

[ MDVSA-2014:105 ] openssl (security@...driva.com)
[SECURITY] [DSA 2954-1] dovecot security update (Salvatore Bonaccorso <carnil@...ian.org>)
[ MDVSA-2014:106 ] openssl (security@...driva.com)
[ MDVSA-2014:107 ] libtasn1 (security@...driva.com)
[ MDVSA-2014:109 ] gnutls (security@...driva.com)
[ MDVSA-2014:108 ] gnutls (security@...driva.com)
[slackware-security] php (SSA:2014-160-01) (Slackware Security Team <security@...ckware.com>)
[ MDVSA-2014:111 ] otrs (security@...driva.com)
[ MDVSA-2014:112 ] python-django (security@...driva.com)
[ MDVSA-2014:110 ] curl (security@...driva.com)

June 11 (14 messages)

Re: MacOSX Safari Firefox Kaspersky RegExp Remote/Local Denial of Service (Pavel Machek <pavel@....cz>)
[ MDVSA-2014:113 ] python-django (security@...driva.com)
[ MDVSA-2014:114 ] squid (security@...driva.com)
[ MDVSA-2014:115 ] php (security@...driva.com)
[ MDVSA-2014:116 ] file (security@...driva.com)
[ MDVSA-2014:117 ] libcap-ng (security@...driva.com)
CodeIgniter <= 2.1.4 Session Decoding Vulnerability (Robin Bailey <Robin.Bailey@...nach.com>)
[ MDVSA-2014:119 ] mediawiki (security@...driva.com)
[ MDVSA-2014:121 ] libgadu (security@...driva.com)
[ MDVSA-2014:118 ] emacs (security@...driva.com)
[ MDVSA-2014:120 ] miniupnpc (security@...driva.com)
[security bulletin] HPSBMU03045 rev.1 - HP Service Virtualization Running AutoPass License Server, Remote Code Execution (security-alert@...com)
NEW : VMSA-2014-0006 - VMware product updates address OpenSSL security vulnerabilities ("\"VMware Security Response Center\"" <security@...are.com>)
CVE-2014-3977 - Privilege Escalation in IBM AIX (Portcullis Advisories <advisories@...tcullis-security.com>)

June 12 (5 messages)

[ MDVSA-2014:123 ] tor (security@...driva.com)
[ MDVSA-2014:122 ] chkrootkit (security@...driva.com)
[SECURITY] [DSA 2956-1] icinga security update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2955-1] iceweasel security update (Moritz Muehlenhoff <jmm@...ian.org>)
Cisco Security Advisory: Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team <ps…)

June 13 (13 messages)

CVE-2014-3427 CRLF Injection and CVE-2014-3428 XSS Injection in Yealink VoIP Phones ("J. Oquendo" <joquendo@...ensive.net>)
[slackware-security] mozilla-thunderbird (SSA:2014-163-01) (Slackware Security Team <security@...ckware.com>)
[SECURITY] [DSA 2957-1] mediawiki security update (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 2958-1] apt security update (Thijs Kinkhorst <thijs@...ian.org>)
AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe Framework ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-007: Exhaustion of Allowed Concurrent HTTP Connections ("Asterisk Security Team" <security@...erisk.org>)
AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions ("Asterisk Security Team" <security@...erisk.org>)
[security bulletin] HPSBST03016 rev.4 - HP P2000 G3 MSA Array Systems, HP MSA 2040 Storage, and HP MSA 1040 Storage running OpenSSL, Remot… (security-alert@...com)
CVE-2014-0228: Apache Hive Authorization vulnerability (Thejas Nair <thejas@...tonworks.com>)
AST-2014-006: Asterisk Manager User Unauthorized Shell Access ("Asterisk Security Team" <security@...erisk.org>)
[security bulletin] HPSBUX03046 SSRT101590 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Code Execution, Security Restric… (security-alert@...com)
[SECURITY] CVE-2013-2251: Apache Continuum affected by Remote Command Execution (Brett Porter <brett@...che.org>)
[ MDVSA-2014:124 ] kernel (security@...driva.com)

June 16 (6 messages)

[ MDVSA-2014:125 ] nspr (security@...driva.com)
ClipBucket CMS Xss Vulnerability (iedb.team@...il.com)
[SECURITY] [DSA 2959-1] chromium-browser security update (Michael Gilbert <mgilbert@...ian.org>)
[SE-2014-01] Security vulnerabilities in Oracle Database Java VM (Security Explorations <contact@...urity-explorations.com>)
[CFP] Hacktivity 2014 CFP is open (ferenc.spala@...ktivity.com)
[SECURITY] [DSA 2960-1] icedove security update (Moritz Muehlenhoff <jmm@...ian.org>)

June 17 (2 messages)

[SECURITY] [DSA 2950-2] openssl update (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 2961-1] php5 security update (Salvatore Bonaccorso <carnil@...ian.org>)

June 18 (8 messages)

[SECURITY] [DSA 2962-1] nspr security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBUX03046 SSRT101590 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Code Execution, Security Restric… (security-alert@...com)
[SECURITY] [DSA 2963-1] lucene-solr security update (Moritz Muehlenhoff <jmm@...ian.org>)
[security bulletin] HPSBMU03048 rev.1 - HP Software Executive Scorecard, Remote Execution of Code, Directory Traversal (security-alert@...com)
SQL Injection in Dolphin (High-Tech Bridge Security Research <advisory@...ridge.com>)
Multiple SQL Injection Vulnerabilities in web2Project (High-Tech Bridge Security Research <advisory@...ridge.com>)
Paypal Inc Bug Bounty #36 - SecurityKey Card Serialnumber Module Vulnerability (Vulnerability Lab <research@...nerability-lab.com>)
Secunia CSI/VIM - Filter Bypass & Persistent Validation Vulnerabilities (Vulnerability Lab <research@...nerability-lab.com>)

June 19 (1 message)

[security bulletin] HPSBOV03047 rev.1 - HP OpenVMS running OpenSSL, Remote Denial of Service (DoS), Code Execution, Unauthorized Access, D… (security-alert@...com)

June 23 (4 messages)

[SECURITY] [DSA 2964-1] iodine security update (Salvatore Bonaccorso <carnil@...ian.org>)
[SECURITY] [DSA 2965-1] tiff security update (Michael Gilbert <mgilbert@...ian.org>)
[SECURITY] [DSA 2966-1] samba security update (Yves-Alexis Perez <corsac@...ian.org>)
[security bulletin] HPSBHF03052 rev.1 - HP Intelligent Management Center (iMC), HP Network Products including H3C and 3COM Routers and Swi… (security-alert@...com)

June 24 (2 messages)

Android KeyStore Stack Buffer Overflow (CVE-2014-3100) (Roee Hay <roeeh@...ibm.com>)
Boolean algebra and CSS history theft (Michal Zalewski <lcamtuf@...edump.cx>)

June 25 (17 messages)

[security bulletin] HPSBMU03051 rev.1 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Denial of Service (DoS)… (security-alert@...com)
[HITB-Announce] #HITB2014KUL round 1 CFP submission deadline in < 1 week (Hafez Kamal <aphesz@...kinthebox.org>)
[security bulletin] HPSBMU03053 rev.1 - HP Software Database and Middleware Automation, OpenSSL Vulnerability, Remote Unauthorized Access … (security-alert@...com)
FreeBSD Security Advisory FreeBSD-SA-14:15.iconv (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
FreeBSD Security Advisory FreeBSD-SA-14:16.file (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[slackware-security] gnupg2 (SSA:2014-175-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] gnupg (SSA:2014-175-02) (Slackware Security Team <security@...ckware.com>)
[slackware-security] bind (SSA:2014-175-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] samba (SSA:2014-175-04) (Slackware Security Team <security@...ckware.com>)
[slackware-security] seamonkey (SSA:2014-175-05) (Slackware Security Team <security@...ckware.com>)
NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library ("\"VMware Security Response Center\"" <security@...are.c…)
Reflected Cross-Site Scripting (XSS) Vulnerability in Storesprite (High-Tech Bridge Security Research <advisory@...ridge.com>)
[RT-SA-2013-002] Endeca Latitude Cross-Site Request Forgery (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[RT-SA-2013-003] Endeca Latitude Cross-Site Scripting (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
CVE-2014-2385 - Multiple Cross Site Scripting in Sophos Antivirus Configuration Console (Linux) (Portcullis Advisories <advisories@...tcullis-security.com>)
CVE-2014-3752 - Arbitrary Code Execution in G Data TotalProtection 2014 (Portcullis Advisories <advisories@...tcullis-security.com>)
[SECURITY] [DSA 2967-1] gnupg security update (Salvatore Bonaccorso <carnil@...ian.org>)

June 27 (8 messages)

[RT-SA-2014-008] Python CGIHTTPServer File Disclosure and Potential Code Execution (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
CFP 1st International Conference on Information Systems Security and Privacy - ICISSP 2015 (calendarsites@...ticc.org)
[security bulletin] HPSBMU03058 rev.1 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Informatio… (security-alert@...com)
[SECURITY] [DSA 2968-1] gnupg2 security update (Salvatore Bonaccorso <carnil@...ian.org>)
[security bulletin] HPSBMU03061 rev.1 - HP Release Control, Disclosure of Privileged Information and Elevation of Privilege (security-alert@...com)
[security bulletin] HPSBMU03057 rev.1 - HP Version Control Agent (HP VCA) running OpenSSL on Linux and Windows, Remote Denial of Service (… (security-alert@...com)
[security bulletin] HPSBMU03056 rev.1 - HP Version Control Repository Manager (HP VCRM) running OpenSSL on Linux and Windows, Remote Denia… (security-alert@...com)
[SECURITY] [DSA 2969-1] libemail-address-perl security update (Salvatore Bonaccorso <carnil@...ian.org>)

June 30 (10 messages)

[SECURITY] [DSA 2970-1] cacti security update (Moritz Muehlenhoff <jmm@...ian.org>)
ESA-2014-055: EMC Network Configuration Manager (NCM) Session Fixation Vulnerability (Security Alert <Security_Alert@....com>)
ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities (Security Alert <Security_Alert@....com>)
SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS (SEC Consult Vulnerability Lab <research@...-consult.com>)
APPLE-SA-2014-06-30-1 Safari 6.1.5 and Safari 7.0.5 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-06-30-2 OS X Mavericks 10.9.4 and Security Update 2014-003 (Apple Product Security <product-security-noreply@...ts.apple.com>)
[security bulletin] HPSBST03000 rev.4 - HP StoreEver ESL G3 Tape Library and Enterprise Library LTO-6 Tape Drives running OpenSSL, Remote … (security-alert@...com)
APPLE-SA-2014-06-30-3 iOS 7.1.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
APPLE-SA-2014-06-30-4 Apple TV 6.1.2 (Apple Product Security <product-security-noreply@...ts.apple.com>)
ESA-2014-060: EMC Documentum eRoom Multiple Cross-Site Scripting Vulnerabilities (Security Alert <Security_Alert@....com>)

176 messages

Powered by blists - more mailing lists