Scientific Linux Security Update : mailman on SL7.x x86_64 (20150623)

-- It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman. CVE-2015-2775 Previously, it was impossible to configure Mailman in a way that Domain-based Message...

RedHat Update for mailman RHSA-2015:1153-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 7 : mailman (CESA-2015:1153)

Updated mailman packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

RHEL 7 : mailman (RHSA-2015:1153)

Updated mailman packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

Moderate: Red Hat Security Advisory: mailman security and bug fix update

Updated mailman packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

Whisper: Missing DMARC record

Valid when posted however no longer applies...

Block.io: SMPT Protection not used, I can hijack your email server.

Description Companies like Coinbase, Yahoo,Google,Facebook and even hackerone implemented a strict email security policy combining SPF, DKIM, and DMARC but I don't see taht from block.io , You should apply strict SMPT policy to stop spoofed email sending from your domain. POC is attached. Exploit...

DEBIAN-CVE-2014-2957

The dmarcprocess function in dmarc.c in Exim before 4.82.1, when EXPERIMENTALDMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expandstring function...

CVE-2014-2957

The dmarcprocess function in dmarc.c in Exim before 4.82.1, when EXPERIMENTALDMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expandstring function...

Code injection

The dmarcprocess function in dmarc.c in Exim before 4.82.1, when EXPERIMENTALDMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expandstring function...

PT-2014-4982

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.82.1 Description The issue allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand string function. This occurs when the EXPERIMENTAL DMARC feature is enabled...

openSUSE Security Update : exim (openSUSE-SU-2014:0983-1)

"Changes in exim : - Silence static checkers; beo1506. - update to 4.83 This release of Exim includes one incompatible fix : + the behavior of expansion of arguments to math comparison functions , was unexpected, expanding the values twice; CVE-2014-2972; bnc888520 This release contains the...

FreeBSD : exim -- Remote Code Execution (f99a4686-e694-11e3-9032-000c2980a9f3)

The exim development team reports : When built with DMARC support, 4.82 is vulnerable to a remote code exeuction flaw. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated security patch has been cancelled. Disabled on 2014/06/02. C Tenable Network Security, Inc. Th...

Yahoo's New DMARC Policy Destroys Every Mailing List across the World

Yahoo! The one who enabled the HTTPS connections by default from the beginning of this year, the one who encrypts traffic moving between its data centers from 31st March, now has been accused of harming every Mailing List across the world. Experts from the Internet Engineering Council John R...

Twitter added DMARC support to prevent email phishing

Twitter announced via its blog today that it has begun using a new method called Domain-based Message Authentication, Reporting and Conformance DMARC to help prevent email phishing. DMARC is actually a standard for preventing email spoofing, in order to make it harder for attackers to send phishi...

Twitter added DMARC support to prevent email phishing

Twitter announced via its blog today that it has begun using a new method called Domain-based Message Authentication, Reporting and Conformance DMARC to help prevent email phishing. DMARC is actually a standard for preventing email spoofing, in order to make it harder for attackers to send phishi...

Facebook Privacy Vulnerability Create Private Messages from Anyone

Facebook's DMARC fail! Facebook Privacy Vulnerability! This is private exploit. You can buy it at https://0day.today...

M3AAWG Recommends New DKIM Best Practices

The Messaging, Malware and Mobile Anti-Abuse Working Group on Tuesday recommended businesses replace 512- and 768-bit verification keys with 1024-bit or higher encryption to counter a current vulnerability that allows the shorter keys to be cracked within 72 hours using cheap cloud-based services...

Google, Facebook and Others Join to Write New Email-Authentication Spec Called DMARC

Google, Yahoo, AOL and a group of other large email senders and receivers have banded together to develop a new framework for sending and receiving email that is designed to stop phishing attacks and other email-borne scams. Called DMARC.org, the new group has come up with a specification called...