:: IT Security Neophyte Investigator's MEMO ::: 7月 2009

2009年7月31日金曜日

31日金曜日、先負

+ HS09-016: JP1/Automatic Job Management System 2 - View, JP1/Integrated Management - View, JP1/Cm2/SNMP System Observerが不正な形式のGIFファイルを表示すると異常終了する問題
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS09-016/index.html

JVNDB-2009-000051 株式会社ディーアイシー製 yoyaku_v41 における OS コマンドインジェクションの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000051.html

JVNDB-2009-001835 Wireshark の PCNFSD 解析部におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001835.html

JVNDB-2009-001834 Wireshark における Tektronix .rf5 ファイルの処理に関するサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001834.html

JVNDB-2009-001833 Wireshark の CPHAP 解析部におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001833.html

JVNDB-2009-001832 Windows 上で稼働している Wireshark の LDAP 解析部におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001832.html

JVNDB-2009-001831 Mac OS X 上で稼働している Java における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001831.html

Kernel release: 2.6.30.4
http://www.linux.org/news/2009/07/31/0002.html

Kernel release: 2.6.27.29
http://www.linux.org/news/2009/07/31/0001.html

PHP TestFest 2009 Winners
http://www.php.net/archive/2009.php#id2009-07-30-1

HS09-015: JP1/File Transmission Server/FTPにおける複数の脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/index.html

DNSサーバ BIND の脆弱性について
http://www.ipa.go.jp/security/ciadr/vul/20090731-bind.html

JPCERT/CC Alert 2009-07-31: Adobe Flash Player および Adobe Acrobat/Reader の脆弱性に関する注意喚起
http://www.jpcert.or.jp/at/2009/at090015.txt

JVNVU#259425 Adobe Flash に脆弱性
http://jvn.jp/cert/JVNVU259425/index.html

JVNTA09-204A Adobe Flash Player および他の Adobe 製品に影響を及ぼす Adobe Flash の脆弱性
http://jvn.jp/cert/JVNTA09-204A/index.html

JVN#80436657 株式会社ディーアイシー製 yoyaku_v41 における OS コマンドインジェクションの脆弱性
http://jvn.jp/jp/JVN80436657/index.html

Network Security Services Library Supports Certificates With Weak MD2 Hash Signatures
http://securitytracker.com/alerts/2009/Jul/1022631.html

- Windows Kernel win32k.sys Lets Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2009/Jul/1022630.html

Adobe Flash Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information
http://securitytracker.com/alerts/2009/Jul/1022629.html

Solaris Trusted Extensions Labeled Packet Bug Lets Remote Authenticated Users Deny Service
http://securitytracker.com/alerts/2009/Jul/1022628.html

Apple iPhone SMS Message Processing Bugs Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2009/Jul/1022626.html

+ Solution 264808: Security Vulnerability in Solaris Trusted Extensions Involving the Parsing of Labeled Packets May Result in Denial of Service (DoS)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264808-1
http://secunia.com/advisories/36040/
http://www.securityfocus.com/bid/35882

+ Solution 264828: A Security Vulnerability in Solaris BIND named(1M) Due to Insufficient Input Validation of Dynamic Update Requests Can Lead to Denial of Service (DoS)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264828-1
http://secunia.com/advisories/36086/

+ Linux kernel 2.6.27.29, 2.6.30.4 released
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.29
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.4

+ RHSA-2009:1184-1: Critical: nspr and nss security and bug fix update
http://rhn.redhat.com/errata/RHSA-2009-1184.html

- Solution 252787: A Security Vulnerability in Solaris Kerberos Credential Management May Lead to Unauthorized Access of Kerberized NFS Mount Points
http://sunsolve.sun.com/search/document.do?assetkey=1-66-252787-1

Apache Wicket 1.3.7 marks end of life for Wicket 1.3!
http://www.apache.org/dyn/closer.cgi/wicket/1.3.7

Apache Wicket 1.4 takes type safety to the next level
http://wicket.apache.org/apache-wicket-14-takes-type-safety-to-the-next-level.html

Hands-on: Linux appliances made easy with SUSE Studio
http://www.linux.org/news/2009/07/30/0003.html

What does it take to create business disruption?
http://www.linux.org/news/2009/07/30/0002.html

Is Linux Getting Bloated?, Jul 30
http://www.linux.org/news/2009/07/30/0001.html

Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20090729-bgp.shtml

法人向け製品お問い合わせフォーム緊急メンテナンスのお知らせ(2009年7月30日)
http://www.trendmicro.co.jp/support/news.asp?id=1285

ウイルスバスターコーポレートエディション・Trend Microビジネスセキュリティにおける修正プログラム公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1283

Document ID: 329080: Using vxrlink to attach or detach RLINKs in Veritas Storage Foundation for Windows - Volume Replicator Option
http://seer.entsupport.symantec.com/docs/329080.htm

Document ID: 328951: "0x800713de: The quorum disk could not be located by the cluster server" appears when adding a node to a Microsoft Cluster
http://seer.entsupport.symantec.com/docs/328951.htm

Solution 259148: Security Vulnerability in the Solaris Simple Authentication and Security Layer (SASL) Library (see libsasl(3LIB)) Routine sasl_encode64(3SASL) may Allow Unprivileged Users to Crash Applications Using this Function
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259148-1

Solution 264308: Multiple Security Vulnerabilities in Firefox Versions Prior to 3.5b4 May Allow Execution of Arbitrary Code or Access to Unauthorized Data
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1

Red Hat : Important: bind security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29947

Red Hat : Important: bind security and bug fix update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29948

Red Hat : Important: bind security and bug fix update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29949

Slackware Linux : bind
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29946

Cisco : Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29950

Citrix : Citrix XenCenterWeb Multiple Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29953

JVNTA09-209A Microsoft Windows、Internet Explorer および Active Template Library (ATL) における脆弱性
http://jvn.jp/cert/JVNTA09-209A/index.html

JVNTA09-204A Adobe Flash Player および他の Adobe 製品に影響を及ぼす Adobe Flash の脆弱性
http://jvn.jp/cert/JVNTA09-204A/index.html

EC2ND 2009 CFP - 5th European Conference on Computer Network Defence
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00257.html

wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00254.html

[SECURITY] [DSA 1834-2] New apache/apache2-mpm-itk fix regression
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00255.html

[security bulletin] HPSBUX02421 SSRT090047 rev.1 - HP-UX Running Kerberos, Remote Denial of
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00250.html

EPSON Status Monitor 3 local privilege escalation vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00250.html

rPSA-2009-0113-1 bind bind-utils
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00251.html

RHSA-2009:1186-1: Critical: nspr and nss security, bug fix, and enhancement update
http://rhn.redhat.com/errata/RHSA-2009-1186.html

RHSA-2009:1185-1: Critical: seamonkey security update
http://rhn.redhat.com/errata/RHSA-2009-1185.html

iPhone Hijack
http://isc.sans.org/diary.html?storyid=6892

Happy patching day
http://isc.sans.org/diary.html?storyid=6889

Sun Solaris BIND Dynamic Update Denial of Service Vulnerability
http://secunia.com/advisories/36086/

Drupal Live Module Privilege Escalation Security Issue
http://secunia.com/advisories/36085/

TYPO3 Reset Backend Password Extension SQL Injection
http://secunia.com/advisories/36084/

Drupal Bibliography Module Script Insertion Vulnerability
http://secunia.com/advisories/36083/

TYPO3 CoolURI Extension SQL Injection Vulnerability
http://secunia.com/advisories/36083/

Miniweb Cross-Site Scripting and SQL Injection Vulnerabilities
http://secunia.com/advisories/36081/

WebStatCaffe Cross-Site Scripting and SQL Injection
http://secunia.com/advisories/36068/

x10 Adult Media Script Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/36067/

Model Agency Manager PRO "album" SQL Injection Vulnerability
http://secunia.com/advisories/36066/

Slackware update for bind
http://secunia.com/advisories/36063/

x10 MP3 Automatic Search Engine Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/36059/

OpenBSD update for named
http://secunia.com/advisories/36053/

rPath update for bind and bind-utils
http://secunia.com/advisories/36050/

Cisco IOS Border Gateway Protocol Two Denial of Service Vulnerabilities
http://secunia.com/advisories/36046/

Sun Solaris Trusted Extensions Labeled Packets Denial of Service
http://secunia.com/advisories/36040/

Fedora update for bind
http://secunia.com/advisories/36035/

ReviewPost PHP Pro "date" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/36029/

HP-UX update for Kerberos
http://secunia.com/advisories/36027/

Red Hat update for bind
http://secunia.com/advisories/36024/

Fedora update for wordpress
http://secunia.com/advisories/36021/

Fedora update for pdfedit
http://secunia.com/advisories/36019/

Fedora update for sssd
http://secunia.com/advisories/36018/

Drupal Calendar Script Insertion Vulnerability
http://secunia.com/advisories/36012/

Drupal Date Module Script Insertion Vulnerability
http://secunia.com/advisories/36006/

Cisco IOS Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities
http://www.securiteam.com/unixfocus/5GP0W00RPO.html

HP-UX Running Kerberos Denial Of Service And Execution Of Arbitrary Code
http://www.securiteam.com/unixfocus/5FP0V00RPU.html

Cisco Wireless LAN Controllers Multiple Vulnerabilities
http://www.securiteam.com/unixfocus/5PP0M2ARPS.html

Joomla! Multiple Full Path Disclosure Vulnerabilities
http://www.securiteam.com/unixfocus/5QP0N2ARPU.html

Drupal 6 Date and Calendar XSS Vulnerability
http://www.securiteam.com/unixfocus/5OP0L2ARPS.html

July-30th-2009: Metasploit in Las Vegas
http://www.metasploit.com/

HP-UX Kerberos Code Execution and Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2009/2084

Firebird SQL "op_connect_request" Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/2083

Cisco IOS BGP 4-Byte Autonomous System Number Vulnerabilities
http://www.vupen.com/english/advisories/2009/2082

Microsoft Windows XP (win32k.sys) Local Privilege Escalation Exploit
http://www.milw0rm.com/exploits/9301

ISC BIND 9 Remote Dynamic Update Message Denial of Service PoC
http://www.milw0rm.com/exploits/9300

Apple iPhone SMS Application Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35569

Apache 'mod_proxy' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35565

Adobe Acrobat and Reader Collab 'getIcon()' JavaScript Method Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/34169

Mozilla Firefox NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/35888

Sun Solaris Network File System Version 4 (NFSv4) Unauthorized Network Access Vulnerability
http://www.securityfocus.com/bid/35546

Adobe Acrobat and Reader JBIG2 Image Processing Multiple Remote Code Execution Vulnerabilities
http://www.securityfocus.com/bid/34229

Adobe Acrobat and Reader PDF File Handling JBIG2 Image Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/33751

Adobe Flash Player and AIR Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/35890

Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35846

Drupal Live Module Node Edit Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35884

Apache 'mod_deflate' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35623

Multiple Browser Malicious Proxy HTTPS Man In The Middle Vulnerability
http://www.securityfocus.com/bid/35380

Mozilla Firefox/Thunderbird/SeaMonkey Null Owner Document Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/35383

Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009 -14 through -22 Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/34656

Mozilla Firefox/Thunderbird/SeaMonkey XUL Scripts Content-Policy Check Security Bypass Vulnerability
http://www.securityfocus.com/bid/35377

Mozilla Firefox and SeaMonkey JavaScript Chrome Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35373

ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
http://www.securityfocus.com/bid/35848

Mozilla Firefox/Thunderbird/SeaMonkey 'file://' URI Security Bypass Vulnerability
http://www.securityfocus.com/bid/35386

Mozilla Firefox 'NPObject' Access Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35360

Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35830

Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35828

Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35832

Adobe Shockwave Player Active Template Library Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35845

Microsoft Windows 'MPEG2TuneRequest' ActiveX Control Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35558

Mozilla Firefox and SeaMonkey Address Bar URI Spoofing Vulnerability
http://www.securityfocus.com/bid/35388

Pango 'pango_glyph_string_set_size()' Integer Overflow Vulnerability
http://www.securityfocus.com/bid/34870

MIT Kerberos 'asn1_decode_generaltime()' Uninitialized Pointer Memory Corruption Vulnerability
http://www.securityfocus.com/bid/34409

MIT Kerberos SPNEGO and ASN.1 Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/34408

CoreGraphics Font Glyph Rendering Library Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35774

MIT Kerberos 'NegTokenInit' Token Handling Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/34257

Miniweb Site Builder Module Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35871

Miniweb Survey Pro Module SQL Injection and Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35870

PunBB 'pun_user[language]' Parameter Multiple Local File Include Vulnerabilities
http://www.securityfocus.com/bid/32360

Intesync LLC Miniweb Publisher Module SQL Injection and Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35869

Xpdf JBIG2 Processing Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/34568

Poppler Multiple Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/33749

CUPS and Xpdf JBIG2 Symbol Dictionary Processing Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34791

TYPO3 Webesse Image Gallery Extension Unspecified SQL Injection Vulnerability
http://www.securityfocus.com/bid/35878

TYPO3 Myth download Extension Unspecified SQL Injection Vulnerability
http://www.securityfocus.com/bid/35881

TYPO3 Tour Extension Unspecified SQL Injection Vulnerability
http://www.securityfocus.com/bid/35880

TYPO3 datamints Newsticker Extension Unspecified SQL Injection Vulnerability
http://www.securityfocus.com/bid/35879

TYPO3 Webesse E-Card Extension Unspecified Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/35877

TYPO3 Front End News Submitter Extension SQL Injection and Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35875

TYPO3 Reset backend password Extension Unspecified SQL Injection Vulnerability
http://www.securityfocus.com/bid/35876

TYPO3 Twitter Search Extension Unspecified Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/35874

TYPO3 Mailform Extension Unspecified Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/35873

TYPO3 CoolURI Extension Unspecified SQL Injection Vulnerability
http://www.securityfocus.com/bid/35872

Cisco IOS Malformed BGP Anonymous System Path Denial of Service Vulnerability
http://www.securityfocus.com/bid/35862

Cisco IOS Malformed Border Gateway Protocol Update Denial of Service Vulnerability
http://www.securityfocus.com/bid/35860

VMware Multiple Hosted Products Display Function Code Execution Vulnerability
http://www.securityfocus.com/bid/34471

RETIRED: VMware Multiple Products SVGA II FIFO 3D Capabilities Code Execution Vulnerability
http://www.securityfocus.com/bid/35866

PHP Interruptions and Calltime Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/35867

Fedora SSSD BE Database No Password Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35868

Sun Solaris Trusted Extensions Labeled Packets Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35882

Mozilla SeaMonkey Regular Expression Parsing Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35891

Absolute Software Computrace LoJack for Laptops Security Bypass Vulnerability
http://www.securityfocus.com/bid/35889

HTC Touch 3G Windows Mobile SMS Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35887

Open Handset Alliance Android SMS Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35886

EPSON Status Monitor Insecure File Permissions Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35883

2009年7月30日木曜日

30日木曜日、友引

[ANNOUNCE] Apache Tika 0.4 Released
http://www.apache.org/dist/lucene/tika/CHANGES-0.4.txt

+ HPSBUX02421 SSRT090047 rev.1 - HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01717795-1

+ Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities
http://www.cisco.com/en/US/products/products_security_advisory09186a0080aea4c9.shtml
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00238.html
http://securitytracker.com/alerts/2009/Jul/1022619.html
http://www.securityfocus.com/bid/35862
http://www.securityfocus.com/bid/35860

+ Solution 259148: Security Vulnerability in the Solaris Simple Authentication and Security Layer (SASL) Library (see libsasl(3LIB)) Routine sasl_encode64(3SASL) may Allow Unprivileged Users to Crash Applications Using this Function
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259148-1

+ RHSA-2009:1181-1: Important: bind security and bug fix update
http://rhn.redhat.com/errata/RHSA-2009-1181.html
http://rhn.redhat.com/errata/RHSA-2009-1180.html

+ VMware Multiple Products SVGA II FIFO 3D Capabilities Code Execution Vulnerability
http://www.securityfocus.com/bid/35866

+ PHP Interruptions and Calltime Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/35867

[ANNOUNCE] Apache Tuscany/SCA 2.0 M3 released
http://tuscany.apache.org/sca-java-releases.html

Apache 2.2.12 がリリースされました
http://www.apache.jp/

Kernel release: 2.6.30.4-rc1
http://www.linux.org/news/2009/07/28/0007.html

Navicat PostgreSQL GUI for Windows ver. 8.2.11 is now available
http://www.postgresql.org/about/news.1121

ウイルスバスターコーポレートエディション・Trend Microビジネスセキュリティにおける修正プログラム公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1283

ServerProtect for Linux 3.0 用 Service Pack 1 Patch 1 公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1282

VMware ESX and ESXi Comparison
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1006543&sliceId=1&docTypeID=DT_KB_1_1

Debian : New Linux 2.6.24 packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29933

Debian : New Linux 2.6.26 packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29934

Debian : New kvm packages fix denial of service
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29935

Debian : New bind9 packages fix denial of service
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29936

FreeBSD : bind
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29938

Mandriva : pidgin
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29921

Mandriva : perl-Compress-Raw-Zlib
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29922

Mandriva : pango
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29923

Mandriva : git
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29924

Mandriva : ruby
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29925

Mandriva : squid
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29926

Mandriva : mysql
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29927

Mandriva : compface
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29928

Ubuntu Security Notice : Bind vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29930

Cisco : Cisco Active Template Library (ATL) Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29937

Core Security Technologies : Firebird SQL op_connect_request main listener shutdown vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29940

DNSサーバー「BIND9」にぜい弱性，JPRSが緊急パッチを呼びかけ
http://itpro.nikkeibp.co.jp/article/NEWS/20090729/334734/?ST=security

過去に類を見ないほど“怖い”脆弱性、MSがパッチを緊急リリース
開発ツールのライブラリーに“穴”、他社製品にも影響、Webアクセスだけで被害
http://itpro.nikkeibp.co.jp/article/NEWS/20090729/334737/?ST=security

米国版「2ちゃん」をAT＆Tが一時遮断，「DoS攻撃を防止するため」と説明
http://itpro.nikkeibp.co.jp/article/NEWS/20090729/334532/?ST=security

「偽ソフト」の新手口、実行中のプログラムを勝手に終了
システムファイル以外を実行不能に、「実行したければ本製品の購入を」
http://itpro.nikkeibp.co.jp/article/NEWS/20090729/334700/?ST=security

JPCERT/CC Alert 2009-07-29
Microsoft ATL を使用した複数製品の脆弱性に関する注意喚起
Vulnerabilities in Microsoft ATL affect Multiple Products
http://www.jpcert.or.jp/at/2009/at090014.txt

JPCERT/CC WEEKLY REPORT 2009-07-29
http://www.jpcert.or.jp/wr/2009/wr092901.html

JVNVU#725188 ISC BIND 9 におけるサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/cert/JVNVU725188/index.html

VNTA09-209A Microsoft Windows、Internet Explorer および Active Template Library (ATL) における脆弱性
http://jvn.jp/cert/JVNTA09-209A/index.html

JVN#59748723 MySQL Connector/J における SQL インジェクションの脆弱性
http://jvn.jp/jp/JVN59748723/index.html

JVNDB-2009-001830 複数の Mozilla 製品におけるポリシーチェックの不備によるアクセス制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001830.html

JVNDB-2009-001829 Mozilla Firefox/SeaMonkey におけるロケーションバーを偽装される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001829.html

JVNDB-2009-001828 Mozilla Firefox における不正なプリンシパルの処理に関するアクセス制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001828.html

JVNDB-2009-001827 Mozilla Firefox/SeaMonkey における任意の Cookie を読まれる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001827.html

JVNDB-2009-001826 複数の Mozilla 製品における CONNECT レスポンスに関する任意の Web スクリプトを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001826.html

JVNDB-2009-001825 複数の Mozilla 製品における任意の Web スクリプトを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001825.html

[ MDVSA-2009:181 ] bind
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00248.html

Pre-Beta Invite , New (Free) Anti-Virus Software
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00237.html

Cisco Security Advisory: Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Num
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00238.html

[ MDVSA-2009:180 ] compface
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00247.html

[ MDVSA-2009:179 ] mysql
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00245.html

[ MDVSA-2009:178 ] squid
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00244.html

[ MDVSA-2009:177 ] ruby
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00243.html

[ MDVSA-2009:176 ] git
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00242.html

[ MDVSA-2009:175 ] pango
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00241.html

[ MDVSA-2009:174 ] perl-Compress-Raw-Zlib
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00240.html

[SECURITY] [DSA 1847-1] New bind9 packages fix denial of service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00239.html

[USN-808-1] Bind vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00235.html

[SECURITY] [DSA 1846-1] New kvm packages fix denial of service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00234.html

[SECURITY] [DSA 1845-1] New Linux 2.6.26 packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00233.html

[ MDVSA-2009:173 ] pidgin
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00231.html

[SECURITY] [DSA 1844-1] New Linux 2.6.24 packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00232.html

FreeBSD Security Advisory FreeBSD-SA-09:12.bind
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00230.html

[ MDVSA-2009:172 ] dhcp
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00236.html

[ MDVSA-2009:170 ] initscripts
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00229.html

[ MDVSA-2009:171 ] pulseaudio
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00228.html

Increasing number of attacks on security sites
http://isc.sans.org/diary.html?storyid=6883

BIND 9 DoS attacks in the wild
http://isc.sans.org/diary.html?storyid=6886

RHSA-2009:1179-2: Important: bind security update
http://rhn.redhat.com/errata/RHSA-2009-1179.html

Fedora update for kdelibs
http://secunia.com/advisories/36062/

Debian update for bind9
http://secunia.com/advisories/36061/

Ubuntu update for bind9
http://secunia.com/advisories/36060/

Fedora update for bugzilla
http://secunia.com/advisories/36058/

Fedora update for kdelibs3
http://secunia.com/advisories/36057/

NetBSD update for BIND
http://secunia.com/advisories/36056/

Debian update for kvm
http://secunia.com/advisories/36055/

Debian update for linux-2.6
http://secunia.com/advisories/36054/

Cisco Unity Active Template Library Security Bypass Vulnerability
http://secunia.com/advisories/36052/

Debian update for linux-2.6.24
http://secunia.com/advisories/36051/

Adobe Shockwave Player Active Template Library Vulnerabilities
http://secunia.com/advisories/36049/

Slackware update for mozilla-firefox
http://secunia.com/advisories/36048/

Debian update for squid3
http://secunia.com/advisories/36047/

Ubuntu update for kernel
http://secunia.com/advisories/36045/

NetBSD SHA2 Implementation Buffer Overflow Vulnerability
http://secunia.com/advisories/36044/

NetBSD update for ISC DHCP
http://secunia.com/advisories/36043/

ISC BIND Dynamic Update Denial of Service Vulnerability
http://secunia.com/advisories/36038/

Ultrize TimeSheet "config[include_dir]" File Inclusion Vulnerability
http://secunia.com/advisories/36033/

TinyBrowser Cross-Site Scripting and Cross-Site Request Forgery
http://secunia.com/advisories/36031/

Firebird "op_connect_request" Packet Denial of Service
http://secunia.com/advisories/36026/

PaoLink/PaoBacheca/PaoLiber Authentication Bypass Vulnerability
http://secunia.com/advisories/36023/

PunBB Reputation Plugin "poster" SQL Injection Vulnerability
http://secunia.com/advisories/36020/

MySQL Connector/J SQL Injection Vulnerability
http://secunia.com/advisories/35995/

HP ProLiant Onboard Administrator Powered By LO100i Denial of Service
http://secunia.com/advisories/35990/

Linux Kernel eCryptfs Two Vulnerabilities
http://secunia.com/advisories/35985/

FreeBSD update for bind
http://secunia.com/advisories/35981/

Tukanas Classifieds Script "b" SQL Injection Vulnerability
http://secunia.com/advisories/35977/

Joomla UIajaxIM Component Script Insertion Vulnerability
http://secunia.com/advisories/35968/

PHP Open Classifieds Script Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/35929/

Ajax IM Script Insertion Vulnerability
http://secunia.com/advisories/35927/

Cisco IOS 4-Byte ASN Support Bugs in Processing BGP Updates Let Remote Users Deny Service
http://www.securitytracker.com/id?1022619

HP ProLiant Server Lights-Out Bug Lets Remote Users Deny Service
http://www.securitytracker.com/id?1022617

BIND Dynamic Update Bug in dns_db_findrdataset() Lets Remote Users Deny Service
http://www.securitytracker.com/id?1022613

Asterisk RTP Text Frames Handling Remote Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/2067

Adobe Shockwave Player Active Template Library Vulnerability
http://www.vupen.com/english/advisories/2009/2066

Adobe Flash Player Active Template Library Code Execution Vulnerability
http://www.vupen.com/english/advisories/2009/2065

Cisco Unity Active Template Library Code Execution Vulnerability
http://www.vupen.com/english/advisories/2009/2064

Linux Kernel eCryptfs Tag 3 and 11 Packets Buffer Overflow Vulnerabilities
http://www.vupen.com/english/advisories/2009/2041

ISC BIND Dynamic Update Message Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/2036

OpenEXR Multiple Integer Overflow and Memory Corruption Vulnerabilities
http://www.vupen.com/english/advisories/2009/2035

Microsoft Visual Studio ATL Memory Corruption Vulnerabilities (MS09-035)
http://www.vupen.com/english/advisories/2009/2034

Microsoft Internet Explorer Memory Corruption Vulnerabilities (MS09-034)
http://www.vupen.com/english/advisories/2009/2033

IXXO Cart! "parent" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2032

Allomani Movies and Clips "username" Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2031

Allomani Songs and Clips "username" Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2030

Allomani Mobile "username" Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2029

Inout Adserver "id" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2028

Super Mod System "s" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2027

VS PANEL "Cat_ID" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2026

iWiccle Local File Inclusion and Remote SQL Injection Vulnerabilities
http://www.vupen.com/english/advisories/2009/2025

URA "cat" Parameter Handling Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/2024

Garage Sales "key" Parameter SQL Injection and Cross Site Scripting
http://www.vupen.com/english/advisories/2009/2023

Sun Solaris Auditing Extended File Attributes Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/2022

Cisco Wireless Products Configuration Modification and DoS Vulnerabilities
http://www.vupen.com/english/advisories/2009/2021

VLC Media Player "real_get_rdt_chunk_header() Integer Underflow Issue
http://www.vupen.com/english/advisories/2009/2020

MPlayer RTSP "real_get_rdt_chunk()" Integer Underflow Vulnerability
http://www.vupen.com/english/advisories/2009/2019

VMware Multiple Products SVGA II FIFO 3D Capabilities Code Execution Vulnerability
http://www.securityfocus.com/bid/35866

WordPress Comment Author URI Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/35755

IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
http://www.securityfocus.com/bid/34345

ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
http://www.securityfocus.com/bid/35848

Multiple Vendor Browser 'HTMLSelectElement' Denial of Service Vulnerability
http://www.securityfocus.com/bid/35446

Compface '.xbm' File Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35863

Django URL Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35859

Drupal Bibliography Module 'title' HTML Injection Vulnerability
http://www.securityfocus.com/bid/35865

Sun Ray Server Multiple Vulnerabilities
http://www.securityfocus.com/bid/35713

Linux Kernel 'tun_chr_pool()' NULL Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/35724

Sun Ray Server Software 'utdmsession' Command Security Bypass Vulnerability
http://www.securityfocus.com/bid/35711

Sun Solaris IP Filter (ipf(5)) Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35715

Sun Solaris SCTP Packet Processing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35712

Sun Solaris NFS Version 4 Kernel Module Local Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35714

eCryptfs 'parse_tag_3_packet()' Packet Heap Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35850

Matterdaddy Market 'index.php' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/35856

TinyBrowser Multiple Vulnerabilities
http://www.securityfocus.com/bid/35855

Joomla! Permis ('com_groups') Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/35849

Firebird 'op_connect_request' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35842

Mozilla Firefox 'XPCCrossOriginWrapper' Multiple Cross Domain Scripting Vulnerabilities
http://www.securityfocus.com/bid/35773

Mozilla Firefox and Thunderbird Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/35769

Mozilla Firefox 'watch()' and ' __defineSetter__ ()' Functions Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35772

Mozilla Firefox Flash Player Unloading Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35767

Mozilla Firefox and Thunderbird RDF File Handling Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35775

Mozilla Firefox/Thunderbird Double Frame Construction Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/35770

Mozilla Firefox 'setTimeout()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35766

Mozilla Firefox and Thunderbird Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/35765

Squid Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/35812

Pango 'pango_glyph_string_set_size()' Integer Overflow Vulnerability
http://www.securityfocus.com/bid/34870

Ruby BigDecimal Library Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35278

Joomla! UIajaxIM Component Arbitrary Script Injection Vulnerability
http://www.securityfocus.com/bid/35798

Git Parameter Processing Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35338

'Compress::Raw::Zlib' Perl Module Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35307

PulseAudio setuid Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35721

Pidgin Multiple Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/35067

PHP 'exif_read_data()' JPEG Image Processing Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35440

Multiple Drupal Modules Date Wizard HTML Injection Vulnerability
http://www.securityfocus.com/bid/35790

JasPer JPC_QCX_GetCompParm Function JP2 File Handling Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/24052

JasPer 1.900.1 Multiple Vulnerabilities
http://www.securityfocus.com/bid/31470

Little CMS Memory Leak and Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/34185

Intel System Management Mode Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35861

Little CMS Monochrome Profiles Null Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/34411

MySQL Connector/J Unicode Character String SQL Injection Vulnerability
http://www.securityfocus.com/bid/35858

MySQL 'sql_parse.cc' Multiple Format String Vulnerabilities
http://www.securityfocus.com/bid/35609

Mandriva 'initscripts' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35854

NetBSD SHA2 Implementation Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35853

ISC DHCP Server Host Definition Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35669

University of Washington IMAP 'smtp.c' Null Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/32280

University of Washington IMAP c-client Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/32958

University of Washington IMAP 'tmail' and 'dmail' Local Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/32072

Apache 'mod_proxy' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35565

Apache 'mod_deflate' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35623

Cisco IOS Malformed BGP Anonymous System Path Denial of Service Vulnerability
http://www.securityfocus.com/bid/35862

Cisco IOS Malformed Border Gateway Protocol Update Denial of Service Vulnerability
http://www.securityfocus.com/bid/35860

Linux Kernel 'PER_CLEAR_ON_SETID' Incomplete Personality List Access Validation Weakness
http://www.securityfocus.com/bid/35647

Linux Kernel RTL8169 NIC Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35281

Linux Kernel 'kvm_arch_vcpu_ioctl_set_sregs()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/35529

Linux Kernel 'e1000/e1000_main.c' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35185

Linux Kernel eCryptfs 'parse_tag_11()' Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35851

Linux Kernel NFS 'MAY_EXEC' Security Bypass Vulnerability
http://www.securityfocus.com/bid/34934

Linux Kernel 'splice(2)' Double Lock Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/35143

Linux Kernel CIFS 'decode_unicode_ssetup()' Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34612

Linux Kernel '/proc/iomem' Sparc64 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/35415

Citrix XenCenterWeb Multiple Input Validation Vulnerabilities
http://www.securityfocus.com/bid/35592

HP ProLiant Onboard Administrator Powered by LO100i Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35852

WebKit Numeric Character References Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35607

WebKit SVGList Objects Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/34924

WebKit JavaScript Garbage Collector Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35309

WebKit CSS 'Attr' Function Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35318

WebKit DOM Event Handler Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35271

phpArcadeScript 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/35843

LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
http://www.securityfocus.com/bid/35451

LibTIFF Multiple Remote Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/35652

Fedora SSSD BE Database No Password Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35868

PHP Interruptions and Calltime Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/35867

2009年7月29日水曜日

29日水曜日、先勝

JVNDB-2009-000050 MySQL Connector/J における SQL インジェクションの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000050.html

JVNDB-2009-001824 複数の Mozilla 製品のガベージコレクション実装における任意の JavaScript を実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001824.html

JVNDB-2009-001823 Mozilla Firefox の NPObjWrapper_NewResolve 関数における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001823.html

JVNDB-2009-001822 複数の Mozilla 製品の JavaScript エンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001822.html

JVNDB-2009-001821 複数の Mozilla 製品におけるダブルフレームコンストラクションに関する任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001821.html

JVNDB-2009-001820 複数の Mozilla 製品のブラウザエンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001820.html

JVNDB-2009-000020 Movable Type におけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000020.html

+ BIND 9.4.3-P3, 9.5.1-P3, 9.6.1-P1 released
http://oldwww.isc.org/sw/bind/view/?release=9.4.3-P3&noframes=1
http://oldwww.isc.org/sw/bind/view/?release=9.5.1-P3&noframes=1
http://oldwww.isc.org/sw/bind/view/?release=9.6.1-P1&noframes=1

+ Apache 2.2.12 Released
http://www.apache.org/dist/httpd/Announcement2.2.html

+ マイクロソフトセキュリティ情報 MS09-034 - 緊急: Internet Explorer 用の累積的なセキュリティ更新プログラム (972260)
http://www.microsoft.com/japan/technet/security/Bulletin/MS09-034.mspx
http://www.microsoft.com/technet/security/Bulletin/MS09-034.mspx
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29908
http://secunia.com/advisories/35962/
http://securitytracker.com/alerts/2009/Jul/1022611.html
http://www.kb.cert.org/vuls/id/456745
http://www.securityfocus.com/bid/35827
http://www.securityfocus.com/bid/35826
http://www.securityfocus.com/bid/35831

+ Solution 264429: Race Condition Security Vulnerability in Solaris Auditing Related to Extended File Attributes May Allow Local Unprivileged Users to Panic the System
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264429-1
http://secunia.com/advisories/36042/
http://securitytracker.com/alerts/2009/Jul/1022609.html
http://www.securityfocus.com/bid/35835

+ Vulnerability Note VU#725188: ISC BIND 9 vulnerable to denial of service via dynamic update request
http://www.kb.cert.org/vuls/id/725188
http://www.securityfocus.com/bid/35848

+ Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35840

+ Linux Kernel eCryptfs 'parse_tag_11()' Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35851

[ANNOUNCE] DBD::Pg version 2.14.0 released
http://search.cpan.org/dist/DBD-Pg/

+ [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-09:12.bind
http://security.freebsd.org/advisories/FreeBSD-SA-09:12.bind.asc

Solution 264628: SUN ALERT WEEKLY SUMMARY REPORT - Week of 19-Jul-2009 to 25-Jul-2009
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264628-1

HPSBMA02438 SSRT090092 rev.1 - HP ProLiant DL/ML 100 Series G5/G6 Servers with ProLiant Onboard Administrator Powered by LO100i, Remote Denial of Service (DoS)
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01767394-1&docLocale=en&admit=109447626+1248834525920+28353475

Kernel release: 2.6.27.29-rc1
http://www.linux.org/news/2009/07/28/0006.html

What is Ubuntu linux, and is it ready for me?
http://www.linux.org/news/2009/07/28/0005.html

GNOME, KDE, and Xfce: Which Desktop is Right for You?
http://www.linux.org/news/2009/07/28/0004.html

Finding Linux Bugs Before they Become Exploits
http://www.linux.org/news/2009/07/28/0003.html
No thanks, Google?we've got Ubuntu
http://www.linux.org/news/2009/07/28/0002.html

IBM, Novell to slash Linux prices for mainframes
http://www.linux.org/news/2009/07/28/0001.html

Announce: Rakudo Perl 6 development release #19
http://use.perl.org/article.pl?sid=09/07/28/105208&from=rss

Courses with Damian Conway in Zurich
http://use.perl.org/articles/09/07/28/101221.shtml

Dave Rolsky at Italian Perl Workshop 2009
http://use.perl.org/article.pl?sid=09/07/28/0957257&from=rss

Cisco Security Advisory: Active Template Library (ATL) Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090728-activex.shtml

MS09-035: Visual Studio の Active Template Library の脆弱性により、リモートでコードが実行される (969706)
http://www.microsoft.com/japan/technet/security/Bulletin/MS09-035.mspx

Debian : New openexr packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29897

Microsoft : Cumulative Security Update for Internet Explorer
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29908

Microsoft : Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29909

Cisco : Multiple Vulnerabilities in Cisco Wireless LAN Controllers
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29898

Independent Researcher : PHP Support Ticket 2.2 <= Multiple Vulnerabilities http://www.criticalwatch.com/support/security-advisories.aspx?AID=29899

Independent Researcher : DOMPDF Arbitrary File Read <= 0.5.1 http://www.criticalwatch.com/support/security-advisories.aspx?AID=29900

Independent Researcher : The Movie Player and VLC Media Player Real Data Transport parsing integer underflow.
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29901

Independent Researcher : GMAIL-LITE Arbitrary File Upload 0.10 <= http://www.criticalwatch.com/support/security-advisories.aspx?AID=29903

Independent Researcher : CodeIgniter Global XSS Filtering Bypass Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29904

Independent Researcher : Remote File Inclusion in aiocp
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29905

Independent Researcher : cross site scripting the browser google "chrome"
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29907

Kingcope : NcFTPd <= 2.8.5 remote jail breakout http://www.criticalwatch.com/support/security-advisories.aspx?AID=29902

Mandriva : mysql
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29894

Mandriva : ruby
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29895

Mandriva : squid
http://www.criticalwatch.com/support/security-advisories.aspx?AID=29896

US-CERT Technical Cyber Security Alert TA09-209A -- Microsoft Windows, Internet Explorer, and Active Template Library (ATL) Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/Cert/2009-07/msg00003.html

[ MDVSA-2009:168 ] apache
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00226.html

[ MDVSA-2009:167 ] php
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00223.html

[ MDVSA-2009:166 ] c-client
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00225.html

[security bulletin] HPSBMA02438 SSRT090092 rev.1 - HP ProLiant DL/ML 100 Series G5/G6 Servers wi
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00224.html

[ MDVSA-2009:165 ] ghostscript
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00222.html

[RISE-2009003] Linux eCryptfs parse_tag_3_packet Encrypted Key Buffer Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00220.html

[ MDVSA-2009:164 ] jasper
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00219.html

[RISE-2009002] Linux eCryptfs parse_tag_11_packet Literal Data Buffer Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00218.html

CORE-2009-0707: Firebird SQL op_connect_request main listener shutdown vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00215.html

Cisco Security Advisory: Active Template Library (ATL) Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00217.html

[ MDVSA-2009:163 ] tomcat5
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00216.html

[ MDVSA-2009:162 ] java-1.6.0-openjdk
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00214.html

[SECURITY] [DSA 1843-1] New squid3 packages fix denial of service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00213.html

Fwd: Google Chrome About:blank Spoof
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00210.html

[SECURITY] [DSA 1842-1] New openexr packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00208.html

Fwd: cross site scripting the browser google "chrome"
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00207.html

[ MDVSA-2009:161 ] squid
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00206.html

[ MDVSA-2009:160 ] ruby
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-07/msg00209.html

BIND 9 Issue
http://isc.sans.org/diary.html?storyid=6880

YYAMCCBA
http://isc.sans.org/diary.html?storyid=6871

MS released two OOB bulletins and an advisory
http://isc.sans.org/diary.html?storyid=6874

Twitter spam/phish
http://isc.sans.org/diary.html?storyid=6877

Sun Solaris Auditing Extended File Attributes Race Condition Denial of Service
http://secunia.com/advisories/36042/

MPlayer "real_get_rdt_chunk()" Buffer Overflow Vulnerability
http://secunia.com/advisories/36041/

Asterisk RTP Text Frames Denial of Service Vulnerability
http://secunia.com/advisories/36039/

VLC Media Player "real_get_rdt_chunk()" Buffer Overflow
http://secunia.com/advisories/36037/

Basilic "author" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/36036/

68 Classifieds Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/36034/

Debian update for openexr
http://secunia.com/advisories/36032/

OpenEXR Multiple Vulnerabilities
http://secunia.com/advisories/36030/

Smart ASP Survey "catid" SQL Injection Vulnerability
http://secunia.com/advisories/36028/

Free Arcade Script "keyword" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/36025/

dompdf "input_file" Local File Disclosure Vulnerability
http://secunia.com/advisories/36022/

GarageSalesJunkie "key" SQL Injection Vulnerability
http://secunia.com/advisories/36017/

Ultimate Regnow Affiliate "cat" SQL Injection Vulnerability
http://secunia.com/advisories/36016/

iWiccle Directory Traversal Vulnerabilities
http://secunia.com/advisories/36015/

IXXO Cart Products "parent" SQL Injection Vulnerability
http://secunia.com/advisories/36009/

Limny "CheckLogin()" SQL Injection Vulnerability
http://secunia.com/advisories/35993/

PunBB Automatic Image Upload with Thumbnails SQL Injection
http://secunia.com/advisories/35987/

NcFTPd Server ".message" Handling Security Bypass
http://secunia.com/advisories/35986/

Millennium MP3 Studio M3U Playlist Processing Buffer Overflow
http://secunia.com/advisories/35984/

Cisco Wireless LAN Controllers Multiple Vulnerabilities
http://secunia.com/advisories/35982/

Inout Adserver "id" SQL Injection Vulnerability
http://secunia.com/advisories/35975/

Super Mod System "s" SQL Injection Vulnerability
http://secunia.com/advisories/35973/

PHP Paid 4 Mail Script "page" File Inclusion Vulnerability
http://secunia.com/advisories/35972/

Microsoft Visual Studio Active Template Library Three Vulnerabilities
http://secunia.com/advisories/35967/

Xoops Celepar Multiple Vulnerabilities
http://secunia.com/advisories/35966/

Internet Explorer Three Vulnerabilities
http://secunia.com/advisories/35962/

PHP Melody Arbitrary File Upload Vulnerability
http://secunia.com/advisories/35956/

VS PANEL "results.php" SQL Injection Vulnerability
http://secunia.com/advisories/35953/

Microsoft Internet Explorer Memory Corruption Bugs Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2009/Jul/1022611.html

Microsoft Visual Studio Active Template Library Bugs Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id?1022610

Solaris Auditing Race Condition Lets Local Users Deny Service
http://www.securitytracker.com/id?1022609

Asterisk RTP Frame Processing Bug Lets Remote Users Deny Service
http://www.securitytracker.com/id?1022608

Squid Request and Response Processing Bugs Let Remote Users Deny Service
http://www.securitytracker.com/id?1022607

Cisco Wireless LAN Controller Lets Remote Users Gain Control of the Target Device
http://www.securitytracker.com/id?1022606

Cisco Wireless LAN Controller SSH and Web Interface Bugs Let Remote Users Deny Service
http://www.securitytracker.com/id?1022605

Microsoft Internet Explorer ATL Killbit Evasion
http://www.iss.net/threats/337.html

Multiple Vulnerabilities in the Microsoft Visual Studio Active Template Library Could Allow Remote Code Execution
http://www.iss.net/threats/338.html

WINMOD 1.4 (.lst) Local Stack Overflow Exploit XP SP3 (RET+SEH) #3
http://www.milw0rm.com/exploits/9299

Millenium MP3 Studio 1.0 .mpf File Local Stack Overflow Exploit #2
http://www.milw0rm.com/exploits/9298

MP3 Studio v1.0 (mpf File) Local BOF Exploit (SEH)
http://www.milw0rm.com/exploits/9291

MP3 Studio 1.0 (.mpf /.m3u File) Local Stack Overflow Exploit (SEH)
http://www.milw0rm.com/exploits/9286

Sun Java Runtime Environment and Java Development Kit Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/34240

Sun Java Applet Font.createFont Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/17981

Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
http://www.securityfocus.com/bid/35193

Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
http://www.securityfocus.com/bid/35196

Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35263

Apache Tomcat XML Parser Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35416

Bugzilla Bug Status Modification Security Bypass Vulnerability
http://www.securityfocus.com/bid/35604

Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability
http://www.securityfocus.com/bid/34308

OpenEXR Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/35838

Asterisk RTP Text Frames Processing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35837

CELEPAR Xoops Celepar Module Multiple SQL Injection and Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35820

NcFTPD Symbolic Link Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35822

LibTIFF Multiple Remote Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/35652

LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
http://www.securityfocus.com/bid/35451

PG Roommate Finder Solution 'part' Parameter Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/35814

Apache 'mod_proxy' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35565

Apache 'mod_deflate' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35623

MODx Context Policy Loading Unspecified Vulnerability
http://www.securityfocus.com/bid/35824

PHP 'exif_read_data()' JPEG Image Processing Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35440

SkaDate Multiple Input Validation Vulnerabilities
http://www.securityfocus.com/bid/35813

Linux Kernel 'PER_CLEAR_ON_SETID' Incomplete Personality List Access Validation Weakness
http://www.securityfocus.com/bid/35647

Linux Kernel 'kvm_arch_vcpu_ioctl_set_sregs()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/35529

Linux Kernel RTL8169 NIC Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35281

PG eTraining Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35834

AIOCP 'cp_html2txt.php' Remote File Include Vulnerability
http://www.securityfocus.com/bid/35811

IXXO Cart! 'parent' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/35810

PunBB Reputation Module 'poster' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/35844

Joomla! 'com_user' Component 'view' Parameter URI Redirection Vulnerability
http://www.securityfocus.com/bid/35836

ISC DHCP 'dhclient' 'script_write_params()' Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35668

Automatic Image Upload with Thumbnails for PunBB 'uploadimg.php' Arbitrary File Delete Vulnerability
http://www.securityfocus.com/bid/35825

Automatic Image Upload with Thumbnails 'uploadimg_view.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/35823

XZeroScripts XZero Community Classifieds Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35809

University of Washington IMAP c-client Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/32958

University of Washington IMAP 'smtp.c' Null Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/32280

University of Washington IMAP 'tmail' and 'dmail' Local Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/32072

Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35832

JasPer 1.900.1 Multiple Vulnerabilities
http://www.securityfocus.com/bid/31470

Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35830

Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35828

Cisco Unity ActiveX Header Active Template Library Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35847

Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35846

Little CMS Monochrome Profiles Null Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/34411

Little CMS Memory Leak and Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/34185

WebKit CSS 'Attr' Function Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35318

Adobe Shockwave Player Active Template Library Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35845

WebKit SVGList Objects Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/34924

WebKit Numeric Character References Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35607

WebKit JavaScript Garbage Collector Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35309

WebKit DOM Event Handler Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35271

Almond Classifieds Component for Joomla! Cross-Site Scripting and SQL-Injection Vulnerabilities
http://www.securityfocus.com/bid/35815

JasPer JPC_QCX_GetCompParm Function JP2 File Handling Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/24052

AlmondSoft Almond Classifieds SQL Injection and Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35816

PG Matchmaking Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/35808

TrackMania Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/35807

Google Chrome 'About:blank' Address Bar URI Spoofing Vulnerability
http://www.securityfocus.com/bid/35839

Star Wars Battlefront II Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35806

RETIRED: Microsoft Visual Studio Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35804

Pixaria Gallery 'file' Parameter Directory Traversal Vulnerability
http://www.securityfocus.com/bid/35802

Microsoft Internet Explorer (CVE-2009-1919) Uninitialized Memory Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35827

Microsoft Internet Explorer HTML Table Object Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35826

Microsoft Windows 'MPEG2TuneRequest' ActiveX Control Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35558

Squid Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/35812

Google Chrome 'chrome://history/' URI Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/35841

Microsoft Internet Explorer Deleted Object CVE-2009-1917 Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35831

Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35840

Scripteen Free Image Hosting Script Insecure Cookie Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35801

Scripteen Free Image Hosting Script Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/35800

SaphpLesson 'admin/login.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/35795

Sun Solaris Auditing Race Condition Local Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35835

MPlayer and VLC Player Real Data Transport Remote Integer Underflow Vulnerability
http://www.securityfocus.com/bid/35821

MySQL 'sql_parse.cc' Multiple Format String Vulnerabilities
http://www.securityfocus.com/bid/35609

HP ProLiant Onboard Administrator Powered by LO100i Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35852

Linux Kernel eCryptfs 'parse_tag_11()' Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35851

eCryptfs 'parse_tag_3_packet()' Packet Heap Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35850

Joomla! Permis ('com_groups') Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/35849

ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
http://www.securityfocus.com/bid/35848

phpArcadeScript 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/35843

Firebird 'op_connect_request' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35842

登録: 投稿 (Atom)