14日 金曜日、大安

JVNDB-2009-001884 Apache HTTP Server の mod_proxy におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001884.html

JVNDB-2009-001883 Ruby の BigDecimal ライブラリにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001883.html

JVNDB-2009-001882 Pidgin の OSCAR プロトコル実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001882.html

JVNDB-2009-001881 strongSwan および openSwan の ASN.1 パーサにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001881.html

Suhosin Patch 0.9.8 - BETA 1 released
http://www.hardened-php.net/suhosin/download.html

Suhosin-Extension 0.9.28 released
http://www.hardened-php.net/suhosin/changelog.html#version_0.9.28

Adobe Flash Player、Adobe Reader、Acrobat、Adobe AIR の脆弱性について
http://www.ipa.go.jp/security/ciadr/vul/20090803-adobe.html

Microsoft ATL の脆弱性(MS09-037)について
http://www.ipa.go.jp/security/ciadr/vul/20090812-ms09-037.html

「重要インフラ情報セキュリティフォーラム2010開催で使用する会場」に係る事前確認公募について
http://www.ipa.go.jp/security/kobo/21fy/ciip-sem2010/kaijo.html

Fedora update for viewvc
http://secunia.com/advisories/36311/

ViewVC "view" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/36292/

Debian update for libxml
http://secunia.com/advisories/36290/

Red Hat update for curl // 14 views
http://secunia.com/advisories/36218/

+ libpng 1.2.39 released
http://www.libpng.org/pub/png/libpng.html
http://www.libpng.org/pub/png/src/libpng-1.2.39-README.txt

+ Linux kernel 2.4.37.5 released
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5

+ RHSA-2009:1209-1: Moderate: curl security update
http://rhn.redhat.com/errata/RHSA-2009-1209.html

+ RHSA-2009:1211-1: Important: kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2009-1211.html

+ Linux Kernel 'sock_sendpage()' NULL Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/36038

+ Linux Kernel 'binfmt_flat.c' NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/36037

[Announce] Gpg4win 2.0.0 has been released
http://www.gpg4win.org/download.html

[ANNOUNCEMENT] HttpComponents HttpClient 4.0 (GA) release
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES.txt

Solution 265030: Multiple Security Vulnerabilities in libtiff(3) Handling of CODE_CLEAR Code
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265030-1

Solution 264048: Security Vulnerability in the Solaris XScreenSaver (xscreensaver(1)) Program May Allow Unauthorized Access to Sensitive Information
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264048-1

Kernel release: 2.6.31-rc6
http://www.linux.org/news/2009/08/13/0010.html
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6

Kernel release: 2.6.30.5-rc2
http://www.linux.org/news/2009/08/13/0009.html

Kernel release: 2.4.37.5
http://www.linux.org/news/2009/08/13/0008.html

Kernel release: 2.6.30.5-rc1
http://www.linux.org/news/2009/08/13/0007.html

Kernel release: 2.6.27.30-rc1
http://www.linux.org/news/2009/08/13/0006.html

Debian: contempt for "end user" values has to stop!
http://www.linux.org/news/2009/08/13/0005.html

Ubuntu removes multisearch feature after protests
http://www.linux.org/news/2009/08/13/0004.html

Hive Rise: Free RTS now Linux powered
http://www.linux.org/news/2009/08/13/0003.html

More open source software to ease your wallet
http://www.linux.org/news/2009/08/13/0002.html

Ubuntu remixes netbook interface
http://www.linux.org/news/2009/08/13/0001.html

Visual Importer ETL with support for PostgreSQL released
http://www.postgresql.org/about/news.1123

Document ID: 329739: How to perform data migration from an existing array to a new array
http://seer.entsupport.symantec.com/docs/329739.htm

Document ID: 329713: How to use the VxHF.exe tool to install, uninstall and verify what hotfixes are installed on Storage Foundation for Windows, Storage Foundation for Windows High Availability and Veritas Cluster Server version 5.1
http://seer.entsupport.symantec.com/docs/329713.htm

Document ID: 329709: How to uninstall a private fix on a server when using Storage Foundation for Windows , Storage Foundation for Windows High Availability or Veritas Cluster Server version 5.1.
http://seer.entsupport.symantec.com/docs/329709.htm

Document ID: 329704: How to verify what private fixes are installed on a server when using Storage Foundation for Windows , Storage Foundation for Windows High Availability or Veritas Cluster Server version 5.1.
http://seer.entsupport.symantec.com/docs/329704.htm

Document ID: 329702: Following a Disk Group import, volumes remain in a 'Stopped' or 'Missing' state until a refresh or rescan operation is performed in Veritas Enterprise Administrator (VEA). This occurs in Storage Foundation for Windows (SFW) and Storage Foundation for Windows High Availability (SFW-HA) 5.1 when storage is presented from an EMC Invista solution.
http://seer.entsupport.symantec.com/docs/329702.htm

Apple : Security Update 2009-004
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30111

Debian : New Ruby packages fix several issues
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30112

Digital Security Research Group : SAP Netweaver UDDI - XSS Security Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30113

[SECURITY] [DSA 1861-1] New libxml packages fix several issues
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00118.html

Linux NULL pointer dereference due to incorrect proto_ops initializations
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00116.html

[IMF 2009] Call for Participation
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00117.html

Fwd: Follow-up: Heartland CEO on Data Breach: QSAs Let Us Down
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00113.html

[security bulletin] HPSBMA02447 SSRT090062 rev.1 - Insight Control Suite For Linux (ICE-LX)
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00110.html

Windows 7 Firewire Attacks - and Defense Techniques
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00109.html

Elkapax CMS Cross site scripting vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00108.html

KIWICON ][ - 2009 Call For Papers
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00115.html

Chris Paget Defcon RFID Presentation Slides Now Online
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00112.html

[USN-816-1] fetchmail vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00106.html

Authentication Bypass of Snom Phone Web Interface
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00107.html

Static analysis tool exposition (SATE) 2009 - call for participation
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-08/msg00111.html

CA eTrust update crashes systems
http://isc.sans.org/diary.html?storyid=6955

New and updated cheat sheets
http://isc.sans.org/diary.html?storyid=6958

Tools for extracting files from pcaps
http://isc.sans.org/diary.html?storyid=6961

Fedora update for ocaml-camlimages
http://secunia.com/advisories/36305/

Vietcong 2 Console Output Format String Vulnerability
http://secunia.com/advisories/36301/

Ubuntu update for fetchmail
http://secunia.com/advisories/36300/

Apple Mac OS X update for BIND
http://secunia.com/advisories/36299/

Debian update for ruby1.8 and ruby1.9
http://secunia.com/advisories/36298/

Chavoosh CMS "Cat_id" SQL Injection Vulnerability
http://secunia.com/advisories/36296/

Snom VoIP Phones "Host" Header Authentication Bypass
http://secunia.com/advisories/36293/

SAP NetWeaver Application Server UDDI Client Cross-Site Scripting
http://secunia.com/advisories/36228/

cURL OpenSSL NULL Character Certificate Spoofing Vulnerability
http://www.vupen.com/english/advisories/2009/2263

SquirrelMail Multiple Form Cross Site Request Forgery Vulnerability
http://www.vupen.com/english/advisories/2009/2262

Novell NetWare DNS Dynamic Update Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/2261

Apple Mac OS X BIND Dynamic Update Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/2260

ViewVC "view" Parameter Processing Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2009/2257

THOMSON ST585 (user.ini) Arbitrary Download Vulnerability
http://www.milw0rm.com/exploits/9432

pIPL 2.5.0 (.PLS /.PL) Universal Local Buffer Exploit (SEH)
http://www.milw0rm.com/exploits/9428

FTPShell Client 4.1 RC2 Name Session Stack Overflow Exploit
http://www.milw0rm.com/exploits/9426

libxml2 Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/36010

Mozilla Firefox 3.5.1/3.0.12 Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/35927

IBM Tivoli Key Lifecycle Manager Password Unspecified Vulnerability
http://www.securityfocus.com/bid/35938

nilfs-utils Multiple Local Privilege Escalation Vulnerabilities
http://www.securityfocus.com/bid/35796

Sophos Antivirus Multiple File Processing Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/32748

Mozilla Firefox Incorrect Security Wrapper JavaScript Chrome Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35928

ZNC File Upload Directory Traversal Vulnerability
http://www.securityfocus.com/bid/35757

Multiple AvailScript Products Arbitrary File Upload Vulnerabilities
http://www.securityfocus.com/bid/32821

WS_FTP Server Manager Authentication Bypass and Information Disclosure Vulnerabilities
http://www.securityfocus.com/bid/27654

Ipswitch WS_FTP SFTP Opendir Command Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/27573

Net-SNMP GETBULK Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/32020

Rsync 'xattr' Support Integer Overflow Vulnerability
http://www.securityfocus.com/bid/28726

PHP 5.2.8 and Prior Versions Multiple Vulnerabilities
http://www.securityfocus.com/bid/33927

OpenSSL Multiple Vulnerabilities
http://www.securityfocus.com/bid/34256

OpenSSH CBC Mode Information Disclosure Vulnerability
http://www.securityfocus.com/bid/32319

Linux Kernel RTL8169 NIC Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/35281

Linux Kernel CIFS 'decode_unicode_ssetup()' Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34612

Linux Kernel CIFS Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34453

cURL / libcURL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36032

Microsoft Windows Workstation Service Double Free Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35972

Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/35951

Drupal Printer, e-mail and PDF versions Module Multiple HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/36039

Linux Kernel 'sock_sendpage()' NULL Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/36038

Linux Kernel 'binfmt_flat.c' NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/36037

HP Insight Control Suite for Linux (ICE-LX) Unspecified Security Vulnerability
http://www.securityfocus.com/bid/36036