7日 水曜日、友引

+ Solution 267808: Buffer Underflow Vulnerability in the Solaris Tag Image File Format Library libtiff(3) may Lead to a Denial of Service (DoS) Condition
http://sunsolve.sun.com/search/document.do?assetkey=1-66-267808-1

[ANN] Maven Resources Plugin 2.4.1 Released
http://maven.apache.org/plugins/maven-resources-plugin/

[ANN] Maven Repository Plugin 2.3 Released
http://maven.apache.org/plugins/maven-repository-plugin/

Solution 266908: Security vulnerability in Solaris Pidgin (see pidgin(1)), Versions Prior to 2.5.9 may Lead to Execution of Arbitrary Code or a Denial of Service (DoS) Condition
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1

JPCERT/CC WEEKLY REPORT 2009-10-07
http://www.jpcert.or.jp/wr/2009/wr093801.html

JVNDB-2009-002073 Microsoft IIS の FTP サーバにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002073.html

JVNDB-2009-002072 Microsoft IIS の FTP サーバにおけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002072.html

JVNDB-2009-002071 dnsmasq の tftp_request 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002071.html

JVNDB-2009-002070 dnsmasq の tftp_request 関数における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002070.html

JVNDB-2009-001940 Mozilla Firefox の XPCCrossOriginWrapper の処理におけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001940.html

JVNDB-2009-001939 Mozilla Firefox の Flash オブジェクトの処理における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001939.html

JVNDB-2009-001938 Mozilla Firefox の setTimeout 関数における任意の JavaScript を実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001938.html

JVNDB-2009-001937 Mozilla Firefox の SVG 要素の処理における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001937.html

JVNDB-2009-001936 Mozilla Firefox/Thunderbird の JavaScript エンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001936.html

JVNDB-2009-001935 Mozilla Firefox/Thunderbird におけるダブルフレームコンストラクションにより任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001935.html

JVNDB-2009-001934 Mozilla Firefox/Thunderbird における RDF ファイルのロードに関連した任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001934.html

JVNDB-2009-001933 Mozilla Firefox/Thunderbird の base64 デコード関数における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001933.html

JVNDB-2009-001932 Mozilla Firefox/Thunderbird のブラウザエンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001932.html

CD-ROM等からアプリケーションをインストール中に再起動を要求された場合、CD-ROM等を抜いてからインストールウィザードで再起動を行うとシャットダウン時にフリーズする
http://esupport.trendmicro.co.jp/Pages/JP-2075689.aspx

+ OpenLDAP 2.4.19 Released
http://www.openldap.org/software/release/changes.html

Netgear RangeMax WNR3500L Wireless-N router runs Linux
http://www.linux.org/news/2009/10/06/0001.html

Linux Google Chrome Shines
http://www.linux.org/news/2009/10/05/0004.html

Security Advisories Relating to Symantec Products - Symantec SecurityExpressions Cross-site Scripting and HTML Injection Vulnerability
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091006_00

メッセージラボ，中小企業向けにセキュリティ・サービスを日本語化
http://itpro.nikkeibp.co.jp/article/NEWS/20091006/338473/?ST=security

JVNDB-2009-002047 Sun Solaris の Kernel におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002047.html

Cyber Security Awareness Month - Day 6 ports 67&68 udp - bootp and dhcp
http://isc.sans.org/diary.html?storyid=7279

Apache Solaris Support Code Bug Lets Remote Users Deny Service
http://securitytracker.com/alerts/2009/Oct/1022988.html

Palm webOS JavaScript Directory Traversal Flaw Lets Remote Users Access Files on the Target Device
http://securitytracker.com/alerts/2009/Oct/1022987.html

Google Android SMS and Dalvik API Bugs Let Remote Users Deny Service
http://securitytracker.com/alerts/2009/Oct/1022986.html

McAfee Email and Web Security Appliance TCP Implementation Denial of Service
http://secunia.com/advisories/36966/

Stonesoft Products TCP Implementation Denial of Service Vulnerability
http://secunia.com/advisories/36965/

Ubuntu update for glib
http://secunia.com/advisories/36959/

GNOME GLib "set_unix_mode()" Symlink Copy Insecure Permissions
http://secunia.com/advisories/36958/

Joomla CB Resume Builder Component "group_id" SQL Injection Vulnerability
http://secunia.com/advisories/36954/

Hyperic HQ Cross-Site Scripting and Script Insertion Vulnerabilities
http://secunia.com/advisories/36935/

Debian update for elinks
http://secunia.com/advisories/36933/

Linksys WRT54GC Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/36921/

FrontRange HEAT SQL Injection Vulnerabilities
http://secunia.com/advisories/36900/

HP LoadRunner XUpload ActiveX Control Insecure Method
http://secunia.com/advisories/36898/

CORE-2009-0922: Jetty Persistent XSS in Sample Cookies Application
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00037.html

Dopewars 1.5.12 Server Denial of Service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00036.html

[USN-843-1] BackupPC vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00034.html

[USN-842-1] Wget vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00035.html

[Advisory]PBBoard <=2.0.2 Full Path Disclosure http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00033.html

[Sec-Area Advisory]PBBoard <=2.0.2 - XSS in Topic http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00032.html

FRHACK01 Slides are online
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00028.html

AlleyCode SEH overflow POC‏‏
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00030.html

[USN-841-1] GLib vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-10/msg00027.html

Sun VirtualBox VBoxNetAdpCtl Configuration Tool Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36604

QEMU Multiple Local Vulnerabilities
http://www.securityfocus.com/bid/23731

D-Bus 'dbus_signature_validate()' Type Signature Denial of Service Vulnerability
http://www.securityfocus.com/bid/31602

Microsoft Windows SMB2 '_Smb2ValidateProviderCallback()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/36299

e107 eCaptcha Unspecified Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/36535

WebKit CSS 'Attr' Function Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/35318

WebKit DOM Event Handler Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35271

WebKit Numeric Character References Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35607

WebKit JavaScript Garbage Collector Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35309

Samba Oplock Break Notification Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36573

Samba setuid 'mount.cifs' Verbose Option Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36572

Samba Misconfigured '/etc/passwd' File Security Bypass Vulnerability
http://www.securityfocus.com/bid/36363

Symantec SecurityExpressions Audit and Compliance Server Error Message HTML Injection Vulnerability
http://www.securityfocus.com/bid/36571

Symantec SecurityExpressions Audit and Compliance Server Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/36570

Multiple Vendor Browser 'HTMLSelectElement' Denial of Service Vulnerability
http://www.securityfocus.com/bid/35446

KDE KSSL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36229

Wget NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36205

BackupPC 'ClientNameAlias()' Security Bypass Vulnerability
http://www.securityfocus.com/bid/36575

Linux Kernel AppleTalk Driver IP Over DDP Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36379

X-Cart Email Subscription 'email' Parameter Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/36601

EMC Captiva PixTools Distributed Imaging ActiveX Control Multiple Insecure Method Vulnerabilities
http://www.securityfocus.com/bid/36566

Linksys WRT54GC Router Cross-Site Request Forgery Vulnerability
http://www.securityfocus.com/bid/36599

TCP/IP Protocol Stack Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/31545

Joomla! CB Resume Builder 'group_id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/36598

Joomla! Soundset Component 'cat_id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/36597

ELinks 'entity_cache' HTML File Off By One Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/36574

GNOME GLib Symbolic Link Arbitrary File Access Vulnerability
http://www.securityfocus.com/bid/36313

Open Handset Alliance Malformed Application Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/36590

Adobe ColdFusion Double-Encoded NULL Character Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36096

Adobe JRun Multiple Unspecified Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/36050

Adobe JRun 'logviewer.jsp' Directory Traversal Vulnerability
http://www.securityfocus.com/bid/36047

Palm WebOS Email Arbitrary Script Injection Vulnerability
http://www.securityfocus.com/bid/36592

Apache HTTP Server Solaris Event Port Pollset Support Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/36596

Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
http://www.securityfocus.com/bid/36260

Apache mod_proxy_ftp Remote Command Injection Vulnerability
http://www.securityfocus.com/bid/36254

PhPepperShop Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/32690