Re: rssh security announcement

2012-05-10 Thread Derek Martin
[Resent to correct recpients; moderators, please approve THIS message.] rssh is a shell for restricting SSH access to a machine to only scp, sftp, or a small set of similar applications. http://www.pizzashack.org/rssh/ Henrik Erkkonen has discovered that, through clever manipulation of

[SECURITY] [DSA 2464-2] icedove regression update

2012-05-10 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2464-2 secur...@debian.org http://www.debian.org/security/Florian Weimer May 08, 2012

[security bulletin] HPSBMU02775 SSRT100853 rev.2 - HP Performance Insight for Networks Running on HP-UX, Linux, Solaris, and Windows, Remote SQL Injection, Cross Site Scripting (XSS), Privilege Elevat

2012-05-10 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03312417 Version: 2 HPSBMU02775 SSRT100853 rev.2 - HP Performance Insight for Networks Running on HP-UX, Linux, Solaris, and Windows, Remote SQL Injection, Cross Site Scripting (XSS),

Adobe Shockwave Player Remote Code Execution (CVE-2012-2029)

2012-05-10 Thread Rodrigo Rubira Branco (BSDaemon)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Qualys Vulnerability Malware Research Labs (VMRL) http://www.dissect.pe Memory corruption when Adobe Shockwave Player parses .dir media file CVE-2012-2029 INTRODUCTION Adobe Shockwave Player is the Adobe plugin to many different browsers to view

Adobe Shockwave Player Remote Code Execution (CVE-2012-2030)

2012-05-10 Thread Rodrigo Rubira Branco (BSDaemon)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Qualys Vulnerability Malware Research Labs (VMRL) http://www.dissect.pe Memory corruption when Adobe Shockwave Player parses .dir media file CVE-2012-2030 INTRODUCTION Adobe Shockwave Player is the Adobe plugin to many different browsers to view

Adobe Shockwave Player Remote Code Execution (CVE-2012-2031)

2012-05-10 Thread Rodrigo Rubira Branco (BSDaemon)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Qualys Vulnerability Malware Research Labs (VMRL) http://www.dissect.pe Memory corruption when Adobe Shockwave Player parses .dir media file CVE-2012-2031 INTRODUCTION Adobe Shockwave Player is the Adobe plugin to many different browsers to view

[SECURITY] [DSA 2465-1] php5 security update

2012-05-10 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2465-1 secur...@debian.org http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012

[SECURITY] [DSA 2466-1] rails security update

2012-05-10 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2466-1 secur...@debian.org http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012

Re: rssh security announcement

2012-05-10 Thread Derek Martin
On Tue, May 08, 2012 at 08:50:11PM -0400, Nico Kadel-Garcia wrote: Is it still a problem with OpenSSH version 6, which was recently published? Yes. The flaw is in how rssh parses command lines, irrespective of what SSH implementation is used. I've been a bit vague about the details for

[SECURITY] [DSA 2467-1] mahara security update

2012-05-10 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2467-1 secur...@debian.org http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012

[SECURITY] [DSA 2422-2] file regression fix

2012-05-10 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2422-2 secur...@debian.org http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012

[SECURITY] [DSA 2468-1] libjakarta-poi-java security update

2012-05-10 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2468-1 secur...@debian.org http://www.debian.org/security/Florian Weimer May 09, 2012

APPLE-SA-2012-05-09-1 OS X Lion v10.7.4 and Security Update 2012-002

2012-05-10 Thread Apple Product Security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 APPLE-SA-2012-05-09-1 OS X Lion v10.7.4 and Security Update 2012-002 OS X Lion v10.7.4 and Security Update 2012-002 is now available and addresses the following: Login Window Available for: OS X Lion v10.7.3, OS X Lion Server v10.7.3 Impact:

APPLE-SA-2012-05-09-2 Safari 5.1.7

2012-05-10 Thread Apple Product Security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 APPLE-SA-2012-05-09-2 Safari 5.1.7 Safari 5.1.7 is now available and addresses the following: WebKit Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.4, OS X Lion Server v10.7.4, Windows 7, Vista, XP SP2 or later Impact:

Drupal 7.14 = Full Path Disclosure Vulnerability

2012-05-10 Thread pereira
# Drupal 7.14 = Full Path Disclosure Vulnerability # Discovered by: Jean Pascal Pereira pere...@secbiz.de About Drupal: Drupal is an open source content management platform powering millions of

Drupal 7.14 = Full Path Disclosure Vulnerability (Update)

2012-05-10 Thread pereira
# Drupal 7.14 = Full Path Disclosure Vulnerability # Discovered by: Jean Pascal Pereira pere...@secbiz.de About Drupal: Drupal is an open source content management platform powering millions of

Re: Drupal 7.14 = Full Path Disclosure Vulnerability

2012-05-10 Thread pereira
Please note that the hotfix should be: if(is_array($path)) { die(); } I already submitted an update to the mailing list.