Re: rssh security announcement

2012-06-07 Thread Derek Martin
On Tue, May 15, 2012 at 10:46:04AM -0500, Derek Martin wrote: > On Tue, May 08, 2012 at 12:24:52PM -0500, Derek Martin wrote: > > Henrik Erkkonen has discovered that, through clever manipulation of > > environment variables on the ssh command line, it is possible to > > circumvent rssh. As far as

ZDI-12-075 : Apple Quicktime RLE Sample Decoding Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-075 : Apple Quicktime RLE Sample Decoding Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-075 June 6, 2012 - -- CVE ID: CVE-2012-0668 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:

ZDI-12-076 : Apple QuickTime MPEG Stream Padding Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-076 : Apple QuickTime MPEG Stream Padding Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-076 June 6, 2012 - -- CVE ID: CVE-2012-0659 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: A

ZDI-12-077 : Apple QuickTime QTVR QTVRStringAtom Parsing Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-077 : Apple QuickTime QTVR QTVRStringAtom Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-077 June 6, 2012 - -- CVE ID: CVE-2012-0667 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected V

ZDI-12-078 : Apple QuickTime SVQ3 Codec mb_skip_run Parsing Remote Code Execution

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-078 : Apple QuickTime SVQ3 Codec mb_skip_run Parsing Remote Code Execution http://www.zerodayinitiative.com/advisories/ZDI-12-078 June 6, 2012 - -- CVE ID: CVE-2012-0669 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Appl

ZDI-12-079 : Apple QuickTime H264 Picture Width Parsing Remote Code Execution Vulnerability

2012-06-07 Thread Zero Day Initiative
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-079 : Apple QuickTime H264 Picture Width Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-079 June 6, 2012 - -- CVE ID: CVE-2012-0665 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vend

ZDI-12-080 : Adobe Flash Player MP4 Stream Decoding Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-080 : Adobe Flash Player MP4 Stream Decoding Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-080 June 6, 2012 - -- CVE ID: CVE-2012-0754 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:

ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-081 June 6, 2012 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Oracle - -

ZDI-12-083 : Oracle Java OpenAL Library Pointer Manipulation Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-083 : Oracle Java OpenAL Library Pointer Manipulation Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-083 June 6, 2012 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Oracle - -- Affe

ZDI-12-084 : RealNetworks RealPlayer RV10 Encoded Height/Width Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-084 : RealNetworks RealPlayer RV10 Encoded Height/Width Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-084 June 6, 2012 - -- CVE ID: CVE-2012-0926 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - -- Affect

ZDI-12-085 : RealNetworks RealPlayer dmp4 esds Width Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-085 : RealNetworks RealPlayer dmp4 esds Width Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-085 June 6, 2012 - -- CVE ID: CVE-2011-4261 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendo

ZDI-12-086 : RealNetworks RealPlayer rvrender RMFF Flags Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-086 : RealNetworks RealPlayer rvrender RMFF Flags Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-086 June 6, 2012 - -- CVE ID: CVE-2012-0922 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected V

ZDI-12-087 : RealNetworks RealPlayer raac.dll stsz Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-087 : RealNetworks RealPlayer raac.dll stsz Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-087 June 6, 2012 - -- CVE ID: CVE-2011-4260 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendor

ZDI-12-088 : HP DataDirect OpenAccess GIOP Opcode 0x0E Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-088 : HP DataDirect OpenAccess GIOP Opcode 0x0E Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-088 June 6, 2012 - -- CVE ID: CVE-2011-4163 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vend

ZDI-12-089 : HP DataDirect OpenAccess GIOP Parsing Remote Code Execution Vulnerability

2012-06-07 Thread ZDI Disclosures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ZDI-12-089 : HP DataDirect OpenAccess GIOP Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-089 June 6, 2012 - -- CVE ID: CVE-2011-4164 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors

Secunia Research: Network Instruments Observer SNMP OID Processing Denial of Service

2012-06-07 Thread Secunia Research
== Secunia Research 07/06/2012 - Network Instruments Observer - - SNMP OID Processing Denial of Service Vulnerability - ==

Secunia Research: Network Instruments Observer SNMP Processing Buffer Overflows

2012-06-07 Thread Secunia Research
== Secunia Research 07/06/2012 - Network Instruments Observer - - SNMP Processing Buffer Overflows - =

Mybb 1.6.8 Sql Injection Vulnerabilitiy

2012-06-07 Thread Amir
a bug in Mybb 1.6.8 that allows to us to occur a Sql Injection on a Remote machin. # # Exploit Title : Mybb 1.6.8 Sql Injection Vulnerabilitiy # # Author: IrIsT.Ir # # Discovered By : Am!r # # Home

ComSndFTP Server Remote Format String Overflow Vulnerability

2012-06-07 Thread demonalex
Title: ComSndFTP Server Remote Format String Overflow Vulnerability Software : ComSndFTP FTP Server Software Version : ComSndFTP 1.3.7 Beta Vendor: http://ftp.comsnd.com/ Vulnerability Published : 2012-06-07 Vulnerability Update Time : Status : Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:

[SECURITY] [DSA 2480-3] request-tracker3.8 regression update

2012-06-07 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2480-3 secur...@debian.org http://www.debian.org/security/Florian Weimer June 07, 2012