22日 火曜日、大安

　

　

　

　

　

　

　

+ HS09-019: Cosminexus, Processing Kit for XML, Hitachi Developer's Kit for Javaにおけるバッファオーバーフローの脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS09-019/index.html

PostgreSQL 8.5alpha3 Now Available
http://www.postgresql.org/about/news.1172

PostgreSQL PHP Generator 9.12 released
http://www.postgresql.org/about/news.1171

[Announce] GnuPG 2.0.14 released
http://lists.gnupg.org/pipermail/gnupg-announce/2009q4/000296.html

ServerProtect for Windows 5.8 公開とサポート開始のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1314

Trend Micro Security (for Mac) 1.5 公開およびサポートサービス開始のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1345

HS09-018: The StartTLS function is not enabled in Hitachi Storage Command Suite products
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS09-018/index.html

JVNDB-2009-002351 Sun Java SE および OpenJDK における権限を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002351.html

JVNDB-2009-002350 Sun Java SE および OpenJDK の Abstract Window Toolkit (AWT) における情報漏えいの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002350.html

JVNDB-2009-002349 Sun Java SE および OpenJDK の X11 および Win32GraphicsDevice サブシステムにおける getConfigurations 関数による配列の複製に関する脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002349.html

JVNDB-2009-002348 Sun Java SE の TrueType フォント解析機能におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002348.html

JVNDB-2009-002347 Sun Java SE および OpenJDK の Java Runtime Environment (JRE) における ディレクトリトラバーサルの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002347.html

JVNDB-2009-002200 Samba の smbd におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002200.html

JVNDB-2009-002199 Samba の mount.cifs における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002199.html




+ [Announce] GnuPG 2.0.14 released
http://www.gnupg.org/download/

+ MySQL Community Server 5.0.89 has been released
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-89.html

+ HPSBUX02498 SSRT090264 rev.1 - HP-UX Running Apache, Remote Unauthorized Data Injection, Denial of Service (DoS)
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01963123

- PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability
http://www.securityfocus.com/bid/37032
http://www.exploit-db.com/exploits/10557

redteam : TLS Renegotiation Vulnerability: Proof of Concept Code (Python)
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31304

Gentoo Linux : Ruby on Rails: Multiple vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31306

Debian : New ganeti packages fix arbitrary command execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31307

Debian : New acpid packages fix weak file permissions
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31308

Slackware Linux : seamonkey
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31305

ISecAuditors : PHP-Calendar <= v1.1 'configfile' Remote and Local File Inclusion vulnerability http://www.criticalwatch.com/support/security-advisories.aspx?AID=31302

ISecAuditors : Simple PHP Blog <= 0.5.1 Local File Include vulnerability http://www.criticalwatch.com/support/security-advisories.aspx?AID=31303

「USBウイルス対策してますか？」ブラウザーで確認できるツール
USBメモリーの自動実行機能をチェック、IPAが公開
http://itpro.nikkeibp.co.jp/article/NEWS/20091222/342540/?ST=security

JVN#75368899 IPv6 を実装した複数の製品にサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/jp/JVN75368899/index.html

RHBA-2009:1686-1: ksh bug fix update
http://rhn.redhat.com/errata/RHBA-2009-1686.html

SQL-Ledger =?utf-8?Q?=E2=80=93_severa?= =?utf-8?Q?l?= vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00280.html

TLS Renegotiation Vulnerability: Proof of Concept Code (Python)
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00279.html

pragmaMx CMS Blind SQL/XPath Injection vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00278.html

phpPollScript - 1.3 Remote File Include
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00277.html

[ GLSA 200912-02 ] Ruby on Rails: Multiple vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00276.html

[SECURITY] [DSA 1960-1] New acpid packages fix weak file permissions
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00274.html

[SECURITY] [DSA-1959-1] New ganeti packages fix arbitrary command execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00275.html

[USN-874-1] Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00273.html

[USN-873-1] Firefox 3.0 and Xulrunner 1.9 vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00272.html

SMF (Simple Machine Forum) 1.1.11 XSS - Discovered by : Khashayar Fereidani
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00271.html

[USN-875-1] Red Hat Cluster Suite vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00269.html

[ISecAuditors Security Advisories] PHP-Calendar <= v1.1 configfile Remote and Local File Inclusi http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00270.html

[ISecAuditors Security Advisories] Simple PHP Blog <= 0.5.1 Local File Include vulnerability http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00268.html

[ MDVSA-2009:336 ] koffice
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00266.html

TPTI-09-15: HP OpenView Data Protector Cell Manager Heap Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00265.html

ZDI-09-099: Hewlett-Packard OpenView Data Protector Backup Client Service Buffer Overflo
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2009-12/msg00264.html

iPhone Botnet Analysis
http://isc.sans.org/diary.html?storyid=7786

There is no such thing as a free lunch .
http://isc.sans.org/diary.html?storyid=7789

Adobe Flash Media Server Bugs Let Remote Users Execute Arbitrary Code and Deny Service
http://securitytracker.com/alerts/2009/Dec/1023377.html

Ubuntu update for Firefox and Xulrunner
http://secunia.com/advisories/37893/

Ubuntu update for redhat-cluster
http://secunia.com/advisories/37892/

Adobe Flash Media Server Two Vulnerabilities
http://secunia.com/advisories/37891/

Ubuntu update for Firefox and Xulrunner
http://secunia.com/advisories/37890/

Debian update for acpid
http://secunia.com/advisories/37885/

Debian update for ganeti
http://secunia.com/advisories/37884/

Gentoo update for rails
http://secunia.com/advisories/37876/

IBM SDK for Java TLS Session Renegotiation Plaintext Injection
http://secunia.com/advisories/37875/

t-prot Unspecified Denial of Service Vulnerability
http://secunia.com/advisories/37874/

Nortel CS1000 NTP Mode 7 Request Denial of Service
http://secunia.com/advisories/37871/

Ampache Unspecified Security Bypass Vulnerabilities
http://secunia.com/advisories/37867/

8pixel.net Blog Database Disclosure Security Issue
http://secunia.com/advisories/37846/

PacketFence "username" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/37844/

Pandora FMS "id_agente" SQL Injection Vulnerability
http://secunia.com/advisories/37837/

Ignition "blog" Local File Inclusion Vulnerabilities
http://secunia.com/advisories/37836/

Saurus CMS File Inclusion Vulnerabilities
http://secunia.com/advisories/37828/

cPanel "fileop" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/37826/

Joomla DigiStore Component "pid[]" and "cid[]" SQL Injection Vulnerabilities
http://secunia.com/advisories/37756/

angelo-emlak Information Disclosure Security Issue
http://secunia.com/advisories/37724/

Joomla Event Manager Compoment "id" SQL Injection Vulnerability
http://secunia.com/advisories/37687/

IBM SDK for Java TLS Session Renegotiation Plaintext Injection Issue
http://www.vupen.com/english/advisories/2009/3609

cPanel "fileop" Parameter Handling Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2009/3608

Nortel CS1000 NTP Mode 7 Remote Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2009/3607

Adobe Flash Media Server Directory Traversal and DoS Vulnerabilities
http://www.vupen.com/english/advisories/2009/3606

TLS Renegotiation Vulnerability PoC Exploit
http://www.exploit-db.com/exploits/10579

PlayMeNow Malformed M3U Playlist Buffer Overflow(SEH
http://www.exploit-db.com/exploits/10577

Intel Indeo Codec Media Content Multiple Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/37251

Adobe Illustrator Encapsulated Postscript File Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37192

HP Operations Manager Remote Unauthorized Access Vulnerability
http://www.securityfocus.com/bid/37086

HP OpenView Network Node Manager 'ovalarm.exe' Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37347

Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/37331

IBM Access Support ActiveX Control 'GetXMLValue()' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34228

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability
http://www.securityfocus.com/bid/37032

IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/36916

IBM Tivoli Storage Manager Multiple Vulnerabilities
http://www.securityfocus.com/bid/34803

Ruby on Rails 'strip_tags()' Non-Printable Character Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/37142

Ruby on Rails Session Fixation Vulnerability
http://www.securityfocus.com/bid/26598

Ruby on Rails Multiple Vulnerabilities
http://www.securityfocus.com/bid/26096

Ruby on Rails ':offset' And ':limit' Parameters SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/31176

Ruby on Rails Form Helpers Unicode String Handling Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/36278

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35579

Mozilla Firefox and Sea Monkey Content Injection Spoofing Vulnerability
http://www.securityfocus.com/bid/37370

Mozilla Firefox and SeaMonkey 'liboggplay' Media Library Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/37369

Mozilla Firefox 'window.opener' Property Chrome Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37365

Mozilla Firefox CVE-2009-3982 JavaScript Engine Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/37364

Mozilla Firefox and SeaMonkey Theora Video Library Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/37368

Mozilla Firefox and SeaMonkey NTLM Credential Reflection Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/37366

Mozilla Firefox and Sea Monkey Insecure Protocol Location Bar Spoofing Vulnerability
http://www.securityfocus.com/bid/37367

Mozilla Firefox CVE-2009-3981 Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/37363

Mozilla Firefox CVE-2009-3979 Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/37361

Mozilla Firefox/SeaMonkey GeckoActiveXObject Exception Message COM Object Enumeration Vulnerability
http://www.securityfocus.com/bid/37360

Mozilla Firefox CVE-2009-3980 Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/37362

Joomla! JCal Pro Component 'mosConfig_absolute_path' Parameter Remote File Include Vulnerability
http://www.securityfocus.com/bid/37438

PHPPhotoalbum 'upload.php' Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/37436

Kasseler CMS Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/37435

Simple PHP Blog 'blog_language1' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/37434

Joomla! DigiStore Component Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/37433

SQL-Ledger Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/37431

Intel BIOS SINIT Authenticated Code Module Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37430

4homepages 4images 'search_user' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/37429

Joomla Event Manager Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/37426

Simplicity oF Upload 'upload.php' Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/37424

JBC Explorer 'arbre.php' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/37423