10日 火曜日、友引

+ Dovecot 1.1.20, 1.2.7 released
http://www.dovecot.org/list/dovecot-news/2009-November/000141.html
http://www.dovecot.org/list/dovecot-news/2009-November/000142.html

+ Linux kernel 2.6.27.39, 2.6.31.6 released
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.39
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.6

Postfix 2.7 Snapshot 20091109
http://mirror.postfix.jp/postfix-release/experimental/postfix-2.7-20091109.HISTORY

2009年前半のWebセキュリティ，最も脆弱性が多かったWebブラウザは「Firefox」
http://itpro.nikkeibp.co.jp/article/NEWS/20091110/340264/?ST=security

JVNDB-2009-002201 Elinks の entity_cache におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002201.html

JVNDB-2007-001199 Elinks の add_filename_to_string 関数におけるフォーマットストリングの脆弱性
http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001199.html

JVNDB-2009-002200 Samba の smbd におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002200.html

JVNDB-2009-002199 Samba の mount.cifs における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002199.html

JVNDB-2009-002198 Squid の strListGetItem 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002198.html

JVNDB-2009-002197 Sun Solaris の IP モジュールにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002197.html

JVNDB-2009-002196 OpenSSH の ChrootDirectory 機能における権限を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002196.html

JVNDB-2009-001165 JDK および JRE の unpack200 におけるバッファオーバフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001165.html

JVNDB-2009-001164 JDK および JRE の unpack200 における整数オーバフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001164.html

JVNDB-2009-001160 JDK および JRE における Type1 フォントの処理に関する任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001160.html

JVNDB-2009-001159 JDK および JRE における GIF イメージの処理に関するバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001159.html

JVNDB-2009-001158 JDK および JRE における PNG イメージおよび GIF イメージの処理に関するバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001158.html

JVNDB-2009-001157 JDK および JRE における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001157.html

JVNDB-2009-001156 JDK および JRE におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001156.html

JVNDB-2008-002161 Java Runtime Environment (JRE) の ZIP ファイル処理における任意のメモリを読まれる脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002161.html

JVNDB-2008-002160 Java Runtime Environment (JRE) における任意のファイルを読まれる脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002160.html

JVNDB-2008-002146 Sun Java Web Start および Java Plug-in における HTTP セッションをハイジャックされる脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002146.html

Tomcat Windows Installer Creates Default Blank Administrative Password
http://securitytracker.com/alerts/2009/Nov/1023146.html

OpenSSL Protocol Flaw in SSL Renegotiation Lets Remote Users Conduct Man-in-the-Middle Attacks
http://securitytracker.com/alerts/2009/Nov/1023145.html

Citrix NetScaler Unspecified Flaw Lets Remote Users Deny Service
http://securitytracker.com/alerts/2009/Nov/1023144.html

Blender '.blend' File Validation Flaw Lets Remote Users Execute Arbitrary Commands
http://securitytracker.com/alerts/2009/Nov/1023143.html

Solaris SCTP and SDP Flaw Lets Local Users Deny Service
http://securitytracker.com/alerts/2009/Nov/1023142.html

Sun Virtual Desktop Infrastructure VirtualBox Web Service Grants Access to Remote Users
http://securitytracker.com/alerts/2009/Nov/1023141.html

Apple Mac OS X Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2009/3184

CUPS Web Interface Cross Site Scripting and Response Splitting Issues
http://www.vupen.com/english/advisories/2009/3177

+ HPSBUX02476 SSRT090250 rev.1 - HP-UX Running Java, Remote Increase in Privilege, Denial of Service and Other Vulnerabilities
http://www11.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=emr_na-c01925304-1

+ Apache Tomcat Windows Installer insecure default administrative password
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00061.html
http://www.securityfocus.com/bid/36954

- Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00065.html
http://archives.neohapsis.com/archives/bugtraq/current/0066.html
http://archives.neohapsis.com/archives/fulldisclosure/current/0119.html

+ RHSA-2009:1561-1: Important: libvorbis security update
http://rhn.redhat.com/errata/RHSA-2009-1561.html

+ Linux Kernel 2.4 Multiple Vulnerabilities
http://secunia.com/advisories/37296/
http://www.securityfocus.com/bid/36635
http://www.securityfocus.com/bid/36379
http://www.securityfocus.com/bid/36723

+ Linux Kernel 'fput()' NULL Pointer Dereference Local Denial of Service Vulnerabilty
http://www.securityfocus.com/bid/36953

+ Apache mod_ssl Session Renegotiation Plaintext Injection Vulnerability
http://www.vupen.com/english/advisories/2009/3166

Debian : New pidgin packages fix arbitrary code execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30842

Debian : New NSPR packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30843

Mandriva : apache
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30841

Debian : New drupal6 packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30844

FreeBSD : patch OpenSSL in base: fix CVE-2009-3555
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30839

Independent Researcher : Linux 2.6.x fs/pipe.c local root exploit (CVE-2009-3547)
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30838

Independent Researcher : CVE-2009-3555 - apache/mod_ssl vulnerability and mitigation
http://www.criticalwatch.com/support/security-advisories.aspx?AID=30840

Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00065.html

[SECURITY] [DSA 1930-1] New drupal6 packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00057.html

[SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative pas
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00061.html

[ MDVSA-2009:295 ] apache
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00060.html

[SECURITY] [DSA 1932-1] New pidgin packages fix arbitrary code execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00058.html

DoS vulnerability in Internet Explorer
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00064.html

[SECURITY] [DSA 1931-1] New NSPR packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00059.html

ToutVirtual VirtualIQ Multiple Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00063.html

FRHACK01 DVDs
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-11/msg00062.html

世界初の「iPhoneウイルス」出現、“脱獄”ユーザーを狙う
保護機能を外したiPhoneだけが対象、壁紙をリック・アストリーに
http://itpro.nikkeibp.co.jp/article/NEWS/20091109/340281/?ST=security

RHBA-2009:1559-1: dbus-python bug fix available
http://rhn.redhat.com/errata/RHBA-2009-1559.html

RHSA-2009:1526-1: Low: Red Hat Enterprise Linux 3 - 1-Year End Of Life Notice
http://rhn.redhat.com/errata/RHSA-2009-1526.html

80's Flashback on Jailbroken iPhones
http://isc.sans.org/diary.html?storyid=7558

Apple Security Update 2009-006 for Mac OS X v10.6.2
http://isc.sans.org/diary.html?storyid=7561

Sun Solaris mod_perl Two Vulnerabilities
http://secunia.com/advisories/37303/

Linux Kernel 2.4 Multiple Vulnerabilities
http://secunia.com/advisories/37296/

Debian update for pidgin
http://secunia.com/advisories/37294/

Debian update for nspr
http://secunia.com/advisories/37275/

Debian update for drupal6
http://secunia.com/advisories/37260/

Debian update for linux-2.6
http://secunia.com/advisories/37230/

Transport Layer Security (TLS) handshake renegotiation weak security
http://www.iss.net/threats/352.html

Deliantra Server Multiple Buffer Overflow and Denial of Service Issues
http://www.vupen.com/english/advisories/2009/3176

Super Serious Stats "uid" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2009/3175

XOOPS Data Processing Unspecified Vulnerabilities
http://www.vupen.com/english/advisories/2009/3174

AjaXplorer "cross-repository-copy" Feature Security Bypass Vulnerability
http://www.vupen.com/english/advisories/2009/3173

eoCMS "id" and "page" Parameters SQL Injection Vulnerabilities
http://www.vupen.com/english/advisories/2009/3172

Sun Solaris Apache 2 Cross Site Scripting and Denial of Service Issues
http://www.vupen.com/english/advisories/2009/3171

Apache mod_ssl Session Renegotiation Plaintext Injection Vulnerability
http://www.vupen.com/english/advisories/2009/3166

PHP 5.2.10 and Prior Versions Multiple Vulnerabilities
http://www.securityfocus.com/bid/36449

OpenLDAP Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/26245

FreeRADIUS Zero-length Tunnel-Password Attributes Denial of Service Vulnerability
http://www.securityfocus.com/bid/36263

OpenLDAP MODRDN Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/27778

OpenSSH CBC Mode Information Disclosure Vulnerability
http://www.securityfocus.com/bid/32319

LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
http://www.securityfocus.com/bid/35451

Dovecot Sieve Plugin Multiple Unspecified Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/36377

Apple QuickTime Multiple Arbitrary Code Execution Vulnerabilities
http://www.securityfocus.com/bid/36328

Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
http://www.securityfocus.com/bid/35115

Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
http://www.securityfocus.com/bid/35253

Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/35888

Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/35951

Subversion Binary Delta Processing Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/35983

Apache 'mod_deflate' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35623

Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/35949

Apache 'mod_proxy' Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35565

Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/34663

Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
http://www.securityfocus.com/bid/35251

libxml2 Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/36010

IPsec-Tools Prior to 0.7.2 Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/34765

Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
http://www.securityfocus.com/bid/35221

Apache Tomcat XML Parser Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35416

Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35263

Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
http://www.securityfocus.com/bid/35196

Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
http://www.securityfocus.com/bid/35193

Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
http://www.securityfocus.com/bid/27706

Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/34383

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Linux Kernel 'fput()' NULL Pointer Dereference Local Denial of Service Vulnerabilty
http://www.securityfocus.com/bid/36953

Apache Tomcat Windows Installer Insecure Password Vulnerability
http://www.securityfocus.com/bid/36954

Mozilla Firefox CVE-2009-3379 Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/36875

Sun Java SE November 2009 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/36881

Linux Kernel 2.4 and 2.6 Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36827

Linux Kernel r128 Driver CCE Initialization NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/36824

Blender '.blend' file Remote Command Execution Vulnerability
http://www.securityfocus.com/bid/36838

Oracle Network Authentication CVE-2009-1979 Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/36747

Multiple Horde Products Cross-Site Scripting Vulnerabilities and File Overwrite Vulnerability
http://www.securityfocus.com/bid/36382

Adobe Reader and Acrobat U3D File Invalid Array Index Remote Vulnerability
http://www.securityfocus.com/bid/36665

PDFLib 'open_basedir' Restriction Bypass Vulnerability
http://www.securityfocus.com/bid/36951

Linux Kernel 'pipe.c' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36901

Linux Kernel 'net/ax25/af_ax25.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36635

Linux Kernel AppleTalk Driver IP Over DDP Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36379

Linux Kernel 'unix_stream_connect()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36723

Mozilla Firefox Floating Point Conversion Heap Overflow Vulnerability
http://www.securityfocus.com/bid/36851

Mozilla Firefox and Thunderbird Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/35769

Pidgin OSCAR Plugin Invalid Memory Access Denial Of Service Vulnerability
http://www.securityfocus.com/bid/36719

Drupal Cross-Site Scripting, Code Injection and Information Disclosure Vulnerabilities
http://www.securityfocus.com/bid/35548

Apple Mac OS X 2009-006 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/36956

XOOPS Versions Prior to 2.4.0 Multiple Unspecified Vulnerabilities
http://www.securityfocus.com/bid/36955