:: IT Security Neophyte Investigator's MEMO ::: 3月 2010

2010年3月31日水曜日

31日水曜日、大安

Firefox 3.5.9 and 3.0.19 security updates now available
http://developer.mozilla.org/devnews/index.php/2010/03/30/firefox-3-5-9-and-3-0-19-security-updates-now-available/
http://www.mozilla.com/firefox/3.5.9/releasenotes/
http://www.mozilla.com/firefox/3.0.19/releasenotes/

Thunderbird 3.0.4 update is now available for free download
http://developer.mozilla.org/devnews/index.php/2010/03/30/thunderbird-3-0-4-update-is-now-available-for-free-download/
http://www.mozillamessaging.com/en-US/about/press/archive/2010-03-30-01
http://www.mozillamessaging.com/en-US/thunderbird/3.0.4/releasenotes/

MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy
http://www.mozilla.org/security/announce/2010/mfsa2010-24.html

MFSA 2010-23 Image src redirect to mailto: URL opens email editor
http://www.mozilla.org/security/announce/2010/mfsa2010-23.html

MFSA 2010-22 Update NSS to support TLS renegotiation indication
http://www.mozilla.org/security/announce/2010/mfsa2010-22.html

MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy
http://www.mozilla.org/security/announce/2010/mfsa2010-21.html

MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop
http://www.mozilla.org/security/announce/2010/mfsa2010-20.html

MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray
http://www.mozilla.org/security/announce/2010/mfsa2010-19.html

MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView
http://www.mozilla.org/security/announce/2010/mfsa2010-18.html

MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection
http://www.mozilla.org/security/announce/2010/mfsa2010-17.html

MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)
http://www.mozilla.org/security/announce/2010/mfsa2010-16.html

Trend Micro ServerProtect for NetApp 5.8 公開とサポート開始のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1390

Trend Micro ServerProtect for EMC Celerra 5.8 公開とサポート開始のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1391

HS10-003: EUR Form 製品におけるセキュリティ問題
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-003/index.html

US-CERT Technical Cyber Security Alert TA10-089A -- Microsoft Internet Explorer Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/Cert/2010-03/msg00002.html

JVNVU#512705 Broadcom NetXtreme 管理用ファームウェアにバッファオーバーフローの脆弱性
http://jvn.jp/cert/JVNVU512705/index.html

JVNTA10-089A Internet Explorer に複数の脆弱性
http://jvn.jp/cert/JVNTA10-089A/index.html

JVNVU#744549 Microsoft Internet Explorer における解放済みメモリを使用する脆弱性
http://jvn.jp/cert/JVNVU744549/index.html

PUBLIC ADVISORY: 03.30.10: Oracle Java Runtime Environment Image FIle Buffer Overflow Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=865

Mozilla Firefox Chrome Privilege Escalation Exposed via Firebug XMLHttpRequestSpy Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023783.html

Mozilla Thunderbird nsTreeSelection and nsTreeContentView Bugs Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023782.html

Mozilla Thunderbird Browser Engine Bugs Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023781.html

Mozilla Firefox Use-After-Free Error in nsTreeSelection Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023780.html

Mozilla Firefox Image Tag Processing Lets Remote Users Launch the Target User's Mail Handler Application
http://securitytracker.com/alerts/2010/Mar/1023779.html

Mozilla Firefox nsTreeContentView and nsPluginArray Dangling Pointers and Forced URL Drag and Drop Flaws Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023776.html

Mozilla Firefox Browser Engine Bugs Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023775.html

Oracle Java SE Multiple Flaws Let Remote Users Access and Modify Data and Deny Service
http://securitytracker.com/alerts/2010/Mar/1023774.html

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Linux Kernel 'net/mac80211/' Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/37170

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38162

GNU Automake Insecure Directory Permissions Vulnerability
http://www.securityfocus.com/bid/37378

QEMU Virtio Networking Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37201

pam_krb5 Existing/Non-Existing Username Enumeration Weakness
http://www.securityfocus.com/bid/35112

Red Hat Sendmail Localhost.Localdomain Email Spoofing Vulnerability
http://www.securityfocus.com/bid/23742

Squid Header-Only Packets Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37522

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36091

OpenLDAP X.509 Certificate NULL Character Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36844

Apple Mac OS X QuickDraw Manager Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/36985

Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/39020

+ マイクロソフトセキュリティ情報 MS10-018 - 緊急: Internet Explorer 用の累積的なセキュリティ更新プログラム (980182)
http://www.microsoft.com/japan/technet/security/bulletin/ms10-018.mspx
http://www.microsoft.com/technet/security/bulletin/MS10-018.mspx

+ マイクロソフトセキュリティアドバイザリ (981374): Internet Explorer の脆弱性により、リモートでコードが実行される
http://www.microsoft.com/japan/technet/security/advisory/981374.mspx
http://www.microsoft.com/technet/security/advisory/981374.mspx

+ J2SE JDK/JRE 1.6.0.19, 1.3.1_28 released
http://java.sun.com/j2se/1.3/ReleaseNotes.html#131_28
http://java.sun.com/javase/6/webnotes/6u19.html

+- RHSA-2010:0178-4: Important: Red Hat Enterprise Linux 5.5 kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0178.html

+ RHSA-2010:0198-4: Moderate: openldap security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0198.html

+ RHSA-2010:0221-4: Low: squid security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0221.html

+ RHSA-2010:0237-5: Low: sendmail security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0237.html

+ RHSA-2010:0258-4: Low: pam_krb5 security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0258.html

+ RHSA-2010:0273-5: Moderate: curl security, bug fix and enhancement update
http://rhn.redhat.com/errata/RHSA-2010-0273.html

+ RHSA-2010:0321-4: Low: automake security update
http://rhn.redhat.com/errata/RHSA-2010-0321.html

+ RHSA-2010:0329-1: Moderate: curl security update
http://rhn.redhat.com/errata/RHSA-2010-0329.html

++ RHSA-2010:0332-1: Critical: firefox security update
http://rhn.redhat.com/errata/RHSA-2010-0332.html

+ Oracle Java SE and Java for Business Critical Patch Update Advisory - March 2010
http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html

[ANNOUNCE] PostgreSQL PHP Generator 10.3 released
http://www.sqlmaestro.com/products/postgresql/phpgenerator/

Linux Kernel release: 2.6.33.2-rc1
http://www.linux.org/news/2010/03/30/0005.html

Linux Kernel release: 2.6.32.11-rc1
http://www.linux.org/news/2010/03/30/0004.html

Linux Kernel release: 2.6.31.13-rc1
http://www.linux.org/news/2010/03/30/0003.html

Linux Kernel release: 2.6.27.46-rc1
http://www.linux.org/news/2010/03/30/0002.html

Linux Kernel release: 2.6.34-rc3
http://www.linux.org/news/2010/03/30/0001.html

Microsoft Security Advisory (981374): Vulnerability in Internet Explorer Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/981374.mspx

Document ID: 347979: Cluster shared disk available check failed error when installing Microsoft SQL Server 2008 to an MSCS cluster configured with Storage Foundation for Windows
http://seer.entsupport.symantec.com/docs/347979.htm

Document ID: 347670: After a successful user logon to Windows, SFWConfigPanel.exe faults.
http://seer.entsupport.symantec.com/docs/347670.htm

Microsoft : Cumulative Security Update for Internet Explorer
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32141

Secunia : ViewVC Regular Expression Search Cross-Site Scripting
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32131

SuSE : Linux kernel
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32125

SuSE : security-announce SUSE Security Summary Report
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32126

VMware : VMware products address vulnerabilities in WebAccess
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32130

Apple : Security Update 2010-002 / Mac OS X v10.6.3
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32124

Independent Researcher : Advisory: Weak RNG in PHP session ID generation leads to session hijacking
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32128

Independent Researcher : Medium security hole in Varnish reverse proxy
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32137

MustLive : Vulnerabilities in MiniManager for Project MANGOS
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32129

Protek Research Lab : {PRL} Novell Netware FTP Remote Stack Overflow
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32133

Securitylab.ir : Joomla Component com_weblinks Sql Injection Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32135

Securitylab.ir : XSS vulnerability in easy page cms
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32136

Securitylab.ir : Joomla Component com_xmap Sql Injection Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32139

Ubuntu Security Notice : Emacs vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32123

IEのパッチが3月31日に緊急リリース、ゼロデイ攻撃に対応
10件の脆弱性を解消、すべてのWindowsユーザーが適用を
http://itpro.nikkeibp.co.jp/article/NEWS/20100331/346414/?ST=security

iDefense Security Advisory 03.30.10: Microsoft Internet Explorer onreadystatechange Use After Free V
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00250.html

CVE-2010-0684: Apache ActiveMQ Persistent Cross-Site Scripting (XSS) Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00251.html

[security bulletin] HPSBOV02506 SSRT090244 rev.1 - HP Secure Web Server for OpenVMS (based on Ap
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00249.html

[security bulletin] HPSBMA02490 SSRT090222 rev.1 - HP SOA Registry Foundation, Remote Unauthoriz
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00245.html

[security bulletin] HPSBMA02513 SSRT090110 rev.1 - Insight Control for Linux (IC-Linux) Remo
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00243.html

Secunia Research: ViewVC Regular Expression Search Cross-Site Scripting
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00246.html

OXID eShop Enterprise: Session Fixation and XSS Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00247.html

VMSA-2010-0005 VMware products address vulnerabilities in WebAccess
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00248.html

[security bulletin] HPSBUX02514 SSRT100010 rev.1 - HP-UX running AudFilter rules enabled, Lo
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00242.html

[USN-919-1] Emacs vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00244.html

JVNDB-2010-001196 GNU tar および GNU cpio の rmt_read__ 関数におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001196.html

JVNDB-2010-001195 Pango の hb_ot_layout_build_glyph_classes 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001195.html

PUBLIC ADVISORY: 03.30.10: Microsoft Internet Explorer 'onreadystatechange' Use After Free Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=864

IBM WebSphere Application Server Two Vulnerabilities
http://secunia.com/advisories/39140/

HP SOA Registry Foundation Multiple Vulnerabilities
http://secunia.com/advisories/39187/

OneCMS Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/39170/

Aircrack-ng EAPOL Parsing Buffer Overflow Vulnerability
http://secunia.com/advisories/39150/

Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
http://secunia.com/advisories/39158/

ViewVC Regular Expression Search Cross-Site Scripting Vulnerability
http://secunia.com/advisories/38918/

Fedora update for trac
http://secunia.com/advisories/39181/

Trac Workflow Security Bypass
http://secunia.com/advisories/39123/

Novell NetWare FTP Server Buffer Overflow Vulnerability
http://secunia.com/advisories/39151/

Intel Active Management Technology SDK Redirection Buffer Overflow
http://secunia.com/advisories/39159/

VMware Server 2 WebAccess Two Vulnerabilities
http://secunia.com/advisories/39189/

VMware ESX / VirtualCenter WebAccess Forwarding Security Issue
http://secunia.com/advisories/39197/

VMware Server Console Script Insertion Vulnerability
http://secunia.com/advisories/39172/

VMware ESX WebAccess Two Vulnerabilities
http://secunia.com/advisories/39171/

Ubuntu update for emacs22 and emacs23
http://secunia.com/advisories/39155/

Fedora update for maniadrive
http://secunia.com/advisories/39179/

Fedora update for openssh
http://secunia.com/advisories/39182/

RHSA-2010:0181-5: Low: brltty security and bug fix update
http://rhn.redhat.com/errata/RHSA-2010-0181.html

RHSA-2010:0333-1: Critical: seamonkey security update
http://rhn.redhat.com/errata/RHSA-2010-0333.html

Microsoft Internet Explorer Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information
http://securitytracker.com/alerts/2010/Mar/1023773.html

HP-UX AudFilter Rules Let Local Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023772.html

HP Insight Control for Linux Lets Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Mar/1023771.html

VMware ESX Server Input Validation Flaws in WebAccess Permit Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023770.html

VMware Server Input Validation Flaws in WebAccess Permit Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023769.html

NetWare FTP Server Buffer Overflow Lets Remote Authenticated Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023768.html

Clam AntiVirus on OS X May Fail to Update Virus Definitions
http://securitytracker.com/alerts/2010/Mar/1023767.html

HP SOA Registry Foundation Lets Remote Users Access Data and Conduct Cross-Site Scripting Attacks and Lets Remote Authenticated Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Mar/1023765.html

VMWare Security Advisories Out
http://isc.sans.org/diary.html?storyid=8536

Zigbee Analysis Tools
http://isc.sans.org/diary.html?storyid=8539

Sharing the Tools
http://isc.sans.org/diary.html?storyid=8542

OOB Update for Internet Explorer MS10-018
http://isc.sans.org/diary.html?storyid=8533

HP OpenView NNM OvWebHelp.exe CGI Topic overflow
http://www.exploit-db.com/exploits/11974

CompleteFTP Server Directory Traversal
http://www.exploit-db.com/exploits/11973

Shadow Stream Recorder 3.0.1.7 (.asx) Local Buffer Overflow
http://www.exploit-db.com/exploits/11957

ASX to MP3 Converter Version 3.0.0.100 => Local stack overflow exploit
http://www.exploit-db.com/exploits/11958

RM Downloader 3.0.2.1 (.asx) Local Buffer Overflow (SEH)
http://www.exploit-db.com/exploits/11953

Microsoft Internet Explorer Code Execution Vulnerabilities (MS10-018)
http://www.vupen.com/english/advisories/2010/0744

ViewVC Regular Expression Search Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0743

Novell NetWare FTP Server Command Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0742

Intel Active Management Technology SDK Stack Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0741

Apple Mac OS X Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0740

VMware WebAccess Cross Site Scripting and URL Forwarding Issues
http://www.vupen.com/english/advisories/2010/0739

Fedora Security Update Fixes PHP and ManiaDrive Vulnerabilities
http://www.vupen.com/english/advisories/2010/0738

Fedora Security Update Fixes Trac Ticket Status Manipulation Issue
http://www.vupen.com/english/advisories/2010/0737

Trac Security Update Fixes Ticket Status and Resolution Manipulation
http://www.vupen.com/english/advisories/2010/0736

Fedora Security Update Fixes OpenSSH Privilege Escalation Vulnerability
http://www.vupen.com/english/advisories/2010/0735

Ubuntu Security Update Fixes Emacs File Permission Vulnerability
http://www.vupen.com/english/advisories/2010/0734

Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
http://www.securityfocus.com/bid/27703

Apache Tomcat WebDav Remote Information Disclosure Vulnerability
http://www.securityfocus.com/bid/26070

Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
http://www.securityfocus.com/bid/27706

Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/30496

Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
http://www.securityfocus.com/bid/27006

Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/30494

Apache Tomcat Host Manager Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/29502

Apache Tomcat XML Parser Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35416

Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
http://www.securityfocus.com/bid/35196

Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
http://www.securityfocus.com/bid/35193

Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35263

Python Multiple Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/30491

Python 'expandtabs' Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/33187

Microsoft Internet Explorer 'iepeers.dll' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38615

Python 'Imageop' Module Argument Validation Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/31932

Python PyLocale_strxfrm Function Remote Information Leak Vulnerability
http://www.securityfocus.com/bid/23887

Python 'stringobject.c' Multiple Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/28749

Python zlib Module Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/28715

Python ImageOP Module Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/25696

Cisco IOS HTTP Service HTML Injection Vulnerability
http://www.securityfocus.com/bid/15602

NTP 'ntpq' Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34481

Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability
http://www.securityfocus.com/bid/35464

NTP 'ntpd' Autokey Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35017

ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
http://www.securityfocus.com/bid/35848

libxml2 Multiple Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/36010

Cisco IOS SIP Message (CVE-2010-0581) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38933

Cisco IOS SIP Message (CVE-2010-0580) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38929

Cisco IOS SIP Message (CVE-2010-0579) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38935

Novell Netware FTP Server Multiple Commands Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/39041

ViewVC 'lib/viewvc.py' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38650

CUPS 'lppasswd' Tool Localized Message String Security Weakness
http://www.securityfocus.com/bid/38524

CUPS File Descriptors Handling Use-After-Free Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38510

Samba Symlink Directory Traversal Vulnerability
http://www.securityfocus.com/bid/38111

Wireshark Dissector LWRES Multiple Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/37985

CUPS File Descriptors Handling Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/37048

Wireshark 1.2.0 Multiple Vulnerabilities
http://www.securityfocus.com/bid/35748

Samba 'client/mount.cifs.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38326

cronie 'crontab' Symbolic Link Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38391

PulseAudio Insecure Temporary File Creation Vulnerability
http://www.securityfocus.com/bid/38768

MIT Kerberos 'gss_accept_sec_context()' Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38904

Squid Header-Only Packets Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37522

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36091

Compiz Fusion 'Expo' Plugin Security Bypass Vulnerability
http://www.securityfocus.com/bid/32712

Wireshark 0.9.0 through 1.2.4 Multiple Vulnerabilities
http://www.securityfocus.com/bid/37407

MySQL 'sql/sql_table.cc' CREATE TABLE Security Bypass Vulnerability
http://www.securityfocus.com/bid/38043

MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37943

MySQL Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37297

MySQL MyISAM Table Symbolic Link Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37075

MySQL 5.0.51a Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/37640

MySQL OpenSSL Server Certificate yaSSL Security Bypass Vulnerability
http://www.securityfocus.com/bid/37076

Linux Kernel 'drivers/connector/connector.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38058

Linux Kernel 'dvb_net_ule()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38479

Red Hat Linux Kernel 'qla2xxx' DriverSecurity Bypass Vulnerability
http://www.securityfocus.com/bid/37876

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37255

Sun Java SE November 2009 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/36881

Sun Java SE Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/35922

Sun Java Runtime Environment and Java Development Kit Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/34240

Sun Java Runtime Environment Proxy Mechanism Implementation Privilege Escalation Vulnerabilities
http://www.securityfocus.com/bid/35943

Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow Vulnerability
http://www.securityfocus.com/bid/35944

Sun Java Runtime Environment XML Parsing Denial of Service Vulnerability
http://www.securityfocus.com/bid/35958

Sun Java Runtime Environment Audio System Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/35939

JNLPAppletLauncher Arbitrary File Creation Vulnerability
http://www.securityfocus.com/bid/35946

Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36552

WeBAM Denial of Service Vulnerability and CAPTCHA Bypass Vulnerability
http://www.securityfocus.com/bid/38967

PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38182

PHP LCG Entropy Security Vulnerability
http://www.securityfocus.com/bid/38430

PHP 'tempnam()' 'safe_mode' Validation Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38431

Oracle Java SE and Java for Business CVE-2010-0837 Remote Vulnerability
http://www.securityfocus.com/bid/39072

Oracle Java SE and Java for Business CVE-2010-0847 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39071

Oracle Java SE and Java for Business CVE-2010-0839 Remote Sound Vulnerability
http://www.securityfocus.com/bid/39070

Oracle Java SE and Java for Business CVE-2010-0087 Remote Vulnerability
http://www.securityfocus.com/bid/39068

Oracle Java SE and Java for Business CVE-2010-0840 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39065

Oracle Java SE and Java for Business CVE-2010-0846 Remote ImageIO Vulnerability
http://www.securityfocus.com/bid/39062

HP SOA Registry Foundation Unspecified Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/39061

HP SOA Registry Foundation Unspecified Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/39060

HP SOA Registry Foundation Unspecified Information Disclosure Vulnerability
http://www.securityfocus.com/bid/39059

Joomla! 'com_actions' Component 'actionid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39057

IBM WebSphere Application Server Orb Client Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/39056

Joomla! 'com_guide' Component 'season' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39055

ViewVC Regular Expression Search Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/39053

HP Insight Control for Linux Unspecified Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/39052

IBM WebSphere Application Server Administration Console Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/39051

Joomla! 'com_spec' Component 'pro_id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39050

PhotoPost vBGallery 'profile.php' Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/39048

Microsoft Internet Explorer (CVE-2010-0494) Cross Domain Information Disclosure Vulnerability
http://www.securityfocus.com/bid/39047

HP-UX AudFilter Rule Local Denial Of Service Vulnerability
http://www.securityfocus.com/bid/39046

Trac Ticket Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/39040

Microsoft Internet Explorer Uninitialized Memory (CVE-2010-0490) Memory Corruption Vulnerability
http://www.securityfocus.com/bid/39031

Microsoft Internet Explorer (CVE-2010-0492) Memory Corruption Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39030

Microsoft Internet Explorer Post Encoding Information Disclosure Vulnerability
http://www.securityfocus.com/bid/39028

Microsoft Internet Explorer (CVE-2010-0491) Memory Corruption Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39027

Microsoft Internet Explorer (CVE-2010-0805) Uninitialized Memory Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39025

Microsoft Internet Explorer HTML Rendering Uninitialized Memory Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39024

Microsoft Internet Explorer Uninitialized Memory (CVE-2010-0267) Memory Corruption Vulnerability
http://www.securityfocus.com/bid/39023

2010年3月30日火曜日

30日火曜日、仏滅

- マイクロソフトセキュリティ情報の事前通知 - 2010 年 3 月 (定例外)
http://www.microsoft.com/japan/technet/security/bulletin/ms10-mar-ans.mspx

「Windows 7」の脆弱性対策、管理者権限の制限が効果的
http://itpro.nikkeibp.co.jp/article/NEWS/20100330/346398/?ST=security

VMWare Security Advisories Out
http://isc.sans.org/diary.html?storyid=8536

Mac OS X Bugs Let Remote Users Access Data and Execute Arbitrary Code and Local Users Gain System Privileges
http://securitytracker.com/alerts/2010/Mar/1023766.html

Apple File Protocol Server Has Directory Traversal and Guest Access Control Flaws That Let Remote Users Access Files on the Target System
http://securitytracker.com/alerts/2010/Mar/1023764.html

Apple Mail May Use the Wrong Encryption Key or Fail to Delete User Filter Rules
http://securitytracker.com/alerts/2010/Mar/1023763.html

Apple iChat Server Stack Overflow and Use-After-Free Bugs Let Remote Authenticated Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023762.html

+ OpenSSL 1.0.0 released
http://www.openssl.org/news/

+? Microsoft Security Bulletin Advance Notification for March 2010
http://www.microsoft.com/technet/security/bulletin/ms10-mar.mspx

- HPSBUX02514 SSRT100010 rev.1 - HP-UX running AudFilter rules enabled, Local Denial of Service (DoS)
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02063258

[ANNOUNCE] Apache CouchDB 0.11.0 has been released
http://couchdb.apache.org/downloads.html

HPSBMA02513 SSRT090110 rev.1 - Insight Control for Linux (IC-Linux) Remote Execution of Arbitrary Code, Local Unauthorized Elevation of Privilege
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02062621

HPSBMA02490 SSRT090222 rev.1 - HP SOA Registry Foundation, Remote Unauthorized Access to Data, Cross Site Scripting (XSS), Privilege Escalation
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02037890

UPDATE: Cisco Security Advisory: IOS HTTP Server Command Injection Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml

Debian : New curl packages fix arbitrary code execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32118

MustLive : Vulnerabilities in ArcManager
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32121

Mandriva : Security Announce php
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32117

「ボットネットが15ドル、初心者向け情報が満載」――闇サイトの実態
英ソフォスが報告、「スキルがなくてもサイバー犯罪が可能な状況に」
http://itpro.nikkeibp.co.jp/article/NEWS/20100329/346378/?ST=security

Vulnerabilities in MiniManager for Project MANGOS
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00238.html

XSS vulnerability in easy page cms
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00236.html

Joomla Component com_xmap Sql Injection Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00239.html

Joomla Component com_weblinks Sql Injection Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00237.html

{PRL} Novell Netware FTP Remote Stack Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00228.html

London DEFCON March meet - DC4420 - Wednesday March 31st 2010
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00230.html

Medium security hole in Varnish reverse proxy
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00231.html

Remote buffer overflow in aircrack-ng causes DOS and possible code execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00235.html

Exploiting nano
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00232.html

Vulnerabilities in ArcManager
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00225.html

SQL Injection Vulnerabilitie in PhotoPost vBGallery 2.5
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00234.html

[SECURITY] [DSA 2023-1] New curl packages fix arbitrary code execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00224.html

[ MDVSA-2010:068 ] php
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00227.html

[ MDVSA-2010:068 ] php
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00233.html

[ MDVSA-2010:068 ] php
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00229.html

[security bulletin] HPSBOV02497 SSRT090245 rev.2 - HP TCP/IP Services for OpenVMS Running NTP, Remote Execution of Arbitrary Code, Denial of Service (DoS)
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00226.html

APPLE-SA--1 Security Update 2010-002 / Mac OS X v10.6.3
http://isc.sans.org/diary.html?storyid=8521

OpenSSL V 1.0.0 released!
http://isc.sans.org/diary.html?storyid=8527

Nmap 5.30BETA1 released
http://isc.sans.org/diary.html?storyid=8530

QuickTime Buffer Overflows and Memory Corruption Errors in Playing Movie Files Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023761.html

SAP GUI Insecure Method in SAPBExCommonResources Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023760.html

Moodle Input Validation Flaw in phpCAS Library Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023759.html

Microsoft Excel MDXTUPLE Record Heap Overflow Vulnerability
http://www.securiteam.com/windowsntfocus/5BP3G0U0UU.html

NOS Microsystems getPlus Downloader Input Validation Vulnerability
http://www.securiteam.com/securitynews/5CP3H0U0UK.html

Microsoft Excel FNGROUPNAME Record Uninitialized Memory Vulnerability
http://www.securiteam.com/windowsntfocus/5GP3L0U0UA.html

RHBA-2010:0177-1: pidgin bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0177.html

IBM Web Interface WEBi Unspecified Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0733

Cisco TFTP Server Packets Processing Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0732

HP-UX NFS/ONCplus Inadvertently Enabled NFS Weakness
http://www.vupen.com/english/advisories/2010/0731

Fedora Security Update Fixes Fcron File Disclosure Vulnerability
http://www.vupen.com/english/advisories/2010/0730

Fedora Security Update Fixes Tar Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0729

Fedora Security Update Fixes Cpio Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0728

Fedora Security Update Fixes krb5 Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0727

Fedora Security Update Fixes Moodle phpCAS Cross Site Scripting Issue
http://www.vupen.com/english/advisories/2010/0726

Debian Security Update Fixes cURL Data Callback Excessive Length
http://www.vupen.com/english/advisories/2010/0725

Mandriva Security Update Fixes PHP XML-RPC Denial of Service Issue
http://www.vupen.com/english/advisories/2010/0724

Devana "id" SQL Injection Vulnerability
http://secunia.com/advisories/39121/

Open Web Analytics "IP" File Inclusion Vulnerability
http://secunia.com/advisories/39153/

TSOKA CMS "id" SQL Injection Vulnerability
http://secunia.com/advisories/39120/

SiteX CMS Local File Inclusion and SQL Injection Vulnerabilities
http://secunia.com/advisories/39173/

Post Card "catid" SQL Injection Vulnerability
http://secunia.com/advisories/39183/

Deliver File Handling Multiple Security Issues
http://secunia.com/advisories/39039/

IBM WEBi Unspecified Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/39186/

CF Image Hosting Script "img" File Disclosure Vulnerability
http://secunia.com/advisories/39145/

N-13 News "default_login_language" Local File Inclusion Vulnerability
http://secunia.com/advisories/39144/

Fedora update for krb5
http://secunia.com/advisories/39180/

Joomla! dcsFlashGames Component "catid" SQL Injection Vulnerability
http://secunia.com/advisories/39161/

Fedora update for moodle
http://secunia.com/advisories/39137/

Moodle phpCAS Cross-Site Scripting Vulnerability
http://secunia.com/advisories/39129/

Stud_PE Function Name Parsing Buffer Overflow Vulnerability
http://secunia.com/advisories/39130/

Fedora update for fcron
http://secunia.com/advisories/39195/

Date & Sex Vor und Ruckwarts Auktions System "id_auk" SQL Injection
http://secunia.com/advisories/39114/

Flirt Matching SMS System "id" SQL Injection Vulnerability
http://secunia.com/advisories/39163/

Debian update for curl
http://secunia.com/advisories/39087/

ID Software Quake II Server Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/11551

MySQL MyISAM Table Symbolic Link Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37075

Samba Oplock Break Notification Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36573

MySQL Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37297

Perl 'rmdir()' Local Race Condition Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/12767

Ruby BigDecimal Library Denial Of Service Vulnerability
http://www.securityfocus.com/bid/35278

MySQL 'sql_parse.cc' Multiple Format String Vulnerabilities
http://www.securityfocus.com/bid/35609

Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35263

Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
http://www.securityfocus.com/bid/35196

Apache Tomcat XML Parser Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35416

Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
http://www.securityfocus.com/bid/35193

Vim Vim Script Multiple Command Execution Vulnerabilities
http://www.securityfocus.com/bid/29715

Info-ZIP UnZip 'inflate_dynamic()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/28288

MySQL 'sql/sql_table.cc' CREATE TABLE Security Bypass Vulnerability
http://www.securityfocus.com/bid/38043

Ruby on Rails Form Helpers Unicode String Handling Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/36278

MySQL Command Line Client HTML Special Characters HTML Injection Vulnerability
http://www.securityfocus.com/bid/31486

PHP Versions Prior to 5.3.1 Multiple Vulnerabilities
http://www.securityfocus.com/bid/37079

PHP 'tempnam()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/36555

PHP 'posix_mkfifo()' 'open_basedir' Restriction Bypass Vulnerability
http://www.securityfocus.com/bid/36554

Apache Tomcat WAR File Directory Traversal Vulnerability
http://www.securityfocus.com/bid/37944

Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/37942

Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
http://www.securityfocus.com/bid/37945

Mailman 'list templates' and 'list info' Multiple HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/27630

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35579

XTerm Window Title Reporting Escape Sequence Command Execution Vulnerability
http://www.securityfocus.com/bid/6940

Libpng 1-bit Interlaced Images Information Disclosure Vulnerability
http://www.securityfocus.com/bid/35233

Vim 'PySys_SetArgv' Remote Command Execution Vulnerability
http://www.securityfocus.com/bid/33447

Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability
http://www.securityfocus.com/bid/35510

Apache mod_proxy_ftp Remote Command Injection Vulnerability
http://www.securityfocus.com/bid/36254

Cyrus SASL 'sasl_encode64()' Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34961

Ruby on Rails 'strip_tags()' Non-Printable Character Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/37142

Apple Safari ImageIO TIFF Image Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38673

Apple Safari BMP Image Uninitialized Memory Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38676

Apple Safari TIFF Image Uninitialized Memory Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38677

Cyrus IMAP Server SIEVE Script Local Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/36296

cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability
http://www.securityfocus.com/bid/33962

CUPS 'lppasswd' Tool Localized Message String Security Weakness
http://www.securityfocus.com/bid/38524

cURL / libcURL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36032

Jabber Studio JabberD Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/17155

PHP 'session.save_path()' Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/37390

PHP 'htmlspecialcharacters()' Malformed Multibyte Character Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/37389

QEMU Virtio Networking Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37201

phpCAS Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38883

Microsoft Windows Media Player AVI File Colorspace Conversion Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38790

GNU Tar and GNU Cpio Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38628

SAP MaxDB 'serv.exe' Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38769

eDisplay Personal FTP server Multiple Commands Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/38860

Mini-stream Software RM-MP3 Converter '.pls' File Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34514

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38162

PHP xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38708

MIT Kerberos 'gss_accept_sec_context()' Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38904

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities
http://www.securityfocus.com/bid/38531

Joomla! 'com_weblinks' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39032

Microsoft Internet Explorer MS10-018 Advanced Notification
http://www.securityfocus.com/bid/39021

Apple Mac OS X APPLE-SA--1 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/39020

N-13 News 'default_login_language' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/39012

Joomla! 'com_radio' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39010

Joomla! 'com_business' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39009

Joomla! 'com_departments' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39008

Joomla! 'com_units' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39006

Joomla! 'com_personal' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39005

Joomla! 'com_tariff' Component 'detail' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39004

Joomla! 'com_teacher' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39003

Joomla! 'com_science' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39002

Joomla! 'com_agency' Component 'aid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39001

Joomla! 'com_topmenu' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39000

Joomla! 'com_adds' Component 'catid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38999

Simple Machines Forum Avatar Upload Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/39007

AdaptCMS Lite 'admin.php' Security Bypass Vulnerability
http://www.securityfocus.com/bid/38998

2010年3月29日月曜日

29日月曜日、先負

[ANNOUNCE] Apache ZooKeeper 3.3.0
http://hadoop.apache.org/zookeeper/docs/r3.3.0/releasenotes.html

[ANNOUNCE] MyFaces Core v2.0.0-beta-3 Release
http://myfaces.apache.org/download.html

JVNVU#181737 IntelliCom NetBiter Config HICP におけるバッファオーバーフローの脆弱性
http://jvn.jp/cert/JVNVU181737/index.html

JVNDB-2010-001055 Linux kernel の fasync_helper 関数における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001055.html

JVNDB-2009-002409 libc における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002409.html

JVNDB-2009-002319 SSL および TLS プロトコルに脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002319.html

+ SA39080: Linux Kernel Bluetooth L2CAP Denial of Service
http://secunia.com/advisories/39080/

ALERT WEEKLY SUMMARY REPORT
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275470-1

HPSBOV02497 SSRT090245 rev.2 - HP TCP/IP Services for OpenVMS Running NTP, Remote Execution of Arbitrary Code, Denial of Service (DoS)
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01961959

MySQL 5.5.4 (Not yet released)
http://dev.mysql.com/doc/refman/5.5/en/news-5-5-4.html

Suhosin-Extension 0.9.31 released
http://www.hardened-php.net/suhosin/changelog.html#version_0.9.31

Cisco IOS Software H.323 Denial of Service Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20100324-h323.shtml

Cisco Security Advisory: Cisco IOS Software Multiprotocol Label Switching Packet Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ldp.shtml

Independent Researcher : Possible RDP vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32112

Mandriva : kernel
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32110

Hewlett-Packard : HP-UX Running sendmail with STARTTLS Enabled, Remote Unauthorized Access
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32113

Independent Researcher : Permanent-type Cross-Site Vulnerability in all version of Discuz!
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32115

Independent Researcher : Multiple Vulnerabilities in EASY Enterprise DMS
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32116

Vulnerabilities in TooFAST
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00223.html

[ MDVSA-2010:067 ] kernel
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00221.html

[security bulletin] HPSBUX02509 SSRT100032 rev.1 - HP-UX Running NFS/ONCplus, NFS Inadverten
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00222.html

偽の「アップルストア」メールに注意、ウイルスとスパムのダブル攻撃
リンクをクリックするだけで感染の恐れ、「iPad」人気に便乗か？
http://itpro.nikkeibp.co.jp/article/NEWS/20100329/346337/?ST=security

Direct News File Inclusion Vulnerabilities
http://secunia.com/advisories/39106/

eZ Publish Cross-Site Scripting and SQL Injection Vulnerabilities
http://secunia.com/advisories/39101/

HP-UX NFS/ONCplus Unintentional NFS Configuration Weakness
http://secunia.com/advisories/39111/

Linux Kernel Bluetooth L2CAP Denial of Service
http://secunia.com/advisories/39080/

Broadcom NetXtreme ASF Buffer Overflow Vulnerability
http://secunia.com/advisories/39107/

Unity Two Denial of Service Vulnerabilities
http://secunia.com/advisories/39097/

Website Baker Database Backup Authentication Bypass Vulnerability
http://secunia.com/advisories/39072/

freeSSHd String Processing Denial of Service Vulnerability
http://secunia.com/advisories/39021/

vBulletin Multiple Vulnerabilities
http://secunia.com/advisories/39113/

HP Secure Web Server for OpenVMS Two Vulnerabilities
http://secunia.com/advisories/39061/

Aris agXchange ESM Redirection Weakness and Cross-Site Scripting Vulnerability
http://secunia.com/advisories/39058/

RakNet "ProcessOfflineNetworkPacket()" Integer Underflow Vulnerability
http://secunia.com/advisories/39108/

Cisco TFTP Server Denial of Service Vulnerability
http://secunia.com/advisories/39116/

Fedora update for php
http://secunia.com/advisories/39132/

Fedora update for libpng
http://secunia.com/advisories/39131/

Red Hat update for httpd
http://secunia.com/advisories/39115/

HP-UX NFS/ONCplus Inadvertently Enables NFS
http://securitytracker.com/alerts/2010/Mar/1023758.html

GnuTLS Certificate Serial Number Processing Stack Overflow May Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023756.html

Interchange Lets Remote Users Conduct HTTP Response Splitting Attacks
http://securitytracker.com/alerts/2010/Mar/1023755.html

Honeynet Project: 2010 Forensic Challenge #3
http://isc.sans.org/diary.html?storyid=8518

HP-UX Running NFS/ONCplus, Inadvertently Enabled NFS
http://isc.sans.org/diary.html?storyid=8512

Create a Summary of IP Addresses from PCAP Files using Unix Tools
http://isc.sans.org/diary.html?storyid=8515

Getting the EXE out of the RTF again
http://isc.sans.org/diary.html?storyid=8506

SIFT2.0 SANS Investigative Forensics Toolkit released
http://isc.sans.org/diary.html?storyid=8509

SAP GUI "SAPBExCommonResources" Command Execution Vulnerability
http://www.vupen.com/english/advisories/2010/0723

Broadcom NetXtreme ASF Packets Handling Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0722

HP CSWS for OpenVMS Commmand Injection and DoS Issues
http://www.vupen.com/english/advisories/2010/0721

HP Project and Portfolio Management Center Cross Site Scripting Issue
http://www.vupen.com/english/advisories/2010/0720

HP-UX Security Update Fixes Sendmail Certificate Spoofing Vulnerability
http://www.vupen.com/english/advisories/2010/0719

Fedora Security Update Fixes Libpng Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0718

Fedora Security Update Fixes ManiaDrive PHP Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0717

Fedora Security Update Fixes PHP Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0716

Stud_PE <= v2.6.05 Stack Overflow PoC exploit http://www.exploit-db.com/exploits/11911

Mini-stream Ripper 3.1.0.8 => Local stack overflow exploit
http://www.exploit-db.com/exploits/11909

CPIO File Size Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/16057

Broadcom NetXtreme ASF Packet Handling Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38759

GNU Tar and GNU Cpio Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38628

vBulletin Multiple Unspecified Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38977

Wazzum Dating Software Arbitrary File Upload Vulnerabilities
http://www.securityfocus.com/bid/38873

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38362

Oracle Java SE and Java For Business March 2010 Advanced Notification
http://www.securityfocus.com/bid/38973

httpdx Multiple Remote Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/38718

Invision Power Board Currency Module SQL Injection Vulnerability
http://www.securityfocus.com/bid/38717

Libpng 'png_decompress_chunk()' Function Denial of Service Vulnerability
http://www.securityfocus.com/bid/38478

Linux Kernel 64bit Personality Handling Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38027

Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
http://www.securityfocus.com/bid/36260

Apache mod_proxy_ftp Remote Command Injection Vulnerability
http://www.securityfocus.com/bid/36254

PHP LCG Entropy Security Vulnerability
http://www.securityfocus.com/bid/38430

PHP 'tempnam()' 'safe_mode' Validation Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38431

PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38182

Apple Safari iPhone/iPod touch Malformed Webpage Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38994

WebMaid CMS Multiple Remote and Local File Include Vulnerabilities
http://www.securityfocus.com/bid/38993

Apple Safari for iPhone/iPod touch Malformed 'Throw' Exception Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38992

Apple iPhone Malformed VML Data Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38990

Apple iPhone/iPod Touch Safari Malformed Image Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38989

SuperNews 'index.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38988

eZ Publish SQL Injection and HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/38985

Joomla! dcsFlashGames Component 'catid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38981

Flirt Matching SMS System 'index.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38980

2010年3月26日金曜日

26日金曜日、赤口

ウイルス検索エンジン VSAPI 9.120 公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1384

JVNDB-2010-001194 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001194.html

JVNDB-2010-001193 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001193.html

JVNDB-2010-001192 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001192.html

JVNDB-2010-001191 Apple Safari の WebKit における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001191.html

JVNDB-2010-001190 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001190.html

JVNDB-2010-001189 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001189.html

JVNDB-2010-001188 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001188.html

JVNDB-2010-001187 Apple Safari の WebKit における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001187.html

+ RHSA-2010:0162-1: Important: openssl security update
http://rhn.redhat.com/errata/RHSA-2010-0162.html

+ RHSA-2010:0163-1: Moderate: openssl security update
http://rhn.redhat.com/errata/RHSA-2010-0163.html

+ RHSA-2010:0165-1: Moderate: nss security update
http://rhn.redhat.com/errata/RHSA-2010-0165.html

+ RHSA-2010:0166-1: Moderate: gnutls security update
http://rhn.redhat.com/errata/RHSA-2010-0166.html

+ RHSA-2010:0167-1: Moderate: gnutls security update
http://rhn.redhat.com/errata/RHSA-2010-0167.html

+ RHSA-2010:0168-1: Moderate: httpd security and enhancement update
http://rhn.redhat.com/errata/RHSA-2010-0168.html

+ RHSA-2010:0173-2: Important: openssl096b security update
http://rhn.redhat.com/errata/RHSA-2010-0173.html

+ RHSA-2010:0175-1: Low: httpd security, bug fix, and enhancement update
http://rhn.redhat.com/errata/RHSA-2010-0175.html

+ OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability
http://www.securityfocus.com/bid/38562

- HPSBUX02509 SSRT100032 rev.1 - HP-UX Running NFS/ONCplus, NFS Inadvertently Enabled
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02026642

- RHSA-2010:0164-1: Moderate: openssl097a security update
http://rhn.redhat.com/errata/RHSA-2010-0164.html

- Microsoft Internet Explorer Unspecified Remote Code Execution Vulnerabilities
http://www.securityfocus.com/bid/38951

[Announce] Apache Qpid version 0.6 is released
http://www.apache.org/dist/qpid/0.6

HPSBMA02436 SSRT080064 rev.1 - HP Project and Portfolio Management Center (PPMC), Remote Cross Site Scripting (XSS)
http://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01762443&admit=109447627+1269566153893+28353475

Postgres participating in Google Summer of Code 2010
http://www.postgresql.org/about/news.1189

Suhosin-Extension 0.9.30 released
http://www.hardened-php.net/suhosin/changelog.html

Document ID: 347809: Disks from IBM XIV array appear as Symmetrix and IBM disks in Veritas Enterprise Administrator (VEA).
http://seer.entsupport.symantec.com/docs/347809.htm

RHBA-2010:0174-1: strace bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0174.html

Red Hat : Important: openssl security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32085

Red Hat : Moderate: openssl security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32086

Red Hat : Moderate: openssl097a security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32087

Red Hat : Moderate: nss security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32088

Red Hat : Moderate: gnutls security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32089

Red Hat : Moderate: gnutls security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32090

Red Hat : Moderate: httpd security and enhancement update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32091

Red Hat : Important: openssl096b security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32092

Cisco : Cisco Unified Communications Manager Express Denial of Service Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32093

Cisco : Cisco IOS Software H.323 Denial of Service Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32094

Cisco : Cisco IOS Software IPsec Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32095

Cisco : Cisco IOS Software Multiprotocol Label Switching Packet Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32096

Cisco : Cisco IOS Software NAT Skinny Call Control Protocol Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32097

Cisco : Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32098

Cisco : Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32099

Cisco : Pulse CMS Arbitrary File Writing Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32102

Compass Security : OpenCMS OAMP Comments Module XSS
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32105

フィンランドの人気サイトからパスワード流出、最多は「salasana」
12万7000件以上のユーザー情報が漏えい、安易なパスワードが多数
http://itpro.nikkeibp.co.jp/article/NEWS/20100326/346226/?ST=security

Gmailに「なりすまし検出機能」、怪しいログインを警告
IPアドレスからログイン元を特定、いつもと異なる場合はユーザーに通知
http://itpro.nikkeibp.co.jp/article/NEWS/20100326/346257/?ST=security

F5がゲートウエイ製品に本人認証システムとの連携機能を追加
http://itpro.nikkeibp.co.jp/article/NEWS/20100325/346203/?ST=security

Multiple Vulnerabilities in EASY Enterprise DMS
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00216.html

=?Windows-1252?Q?There_is_a?= =?Windows-1252?Q?_Permanent?= =?Windows-1252?Q?-type_C
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00220.html

Ruxcon 2010 Call For Papers
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00219.html

[security bulletin] HPSBUX02508 SSRT100007 rev.1 - HP-UX Running sendmail with STARTTLS Enab
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00215.html

[security bulletin] HPSBMA02436 SSRT080064 rev.1 - HP Project and Portfolio Management Center (P
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00214.html

Hackito Ergo Sum Conference (Paris 8-10 April 2010) : Schedule
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00218.html

[ MDVSA-2010:066 ] kernel
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00213.html

Vulnerabilities in WeBAM
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00212.html

"Copyright Lawsuit filed against you"
http://isc.sans.org/diary.html?storyid=8497

Responding to "Copyright Lawsuit filed against you"
http://isc.sans.org/diary.html?storyid=8500

Zeus wants to do your taxes
http://isc.sans.org/diary.html?storyid=8503

Vulnerability Note VU#512705: Broadcom NetXtreme managment firmware ASF buffer overflow
http://www.kb.cert.org/vuls/id/512705

HP-UX update for sendmail
http://secunia.com/advisories/39088/

Discuz! "Referer" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/39104/

Alkacon OpenCms Comments Module Script Insertion Vulnerability
http://secunia.com/advisories/39099/

INVOhost Multiple SQL Injection Vulnerabilities
http://secunia.com/advisories/39095/

justVisual CMS "p" Local File Inclusion Vulnerability
http://secunia.com/advisories/39093/

Red Hat update for gnutls
http://secunia.com/advisories/39127/

Red Hat update for gnutls
http://secunia.com/advisories/39084/

Red Hat update for openssl097a
http://secunia.com/advisories/39126/

Red Hat update for openssl
http://secunia.com/advisories/39125/

Red Hat update for openssl
http://secunia.com/advisories/39124/

Red Hat update for openssl096b
http://secunia.com/advisories/39092/

Red Hat update for httpd
http://secunia.com/advisories/39100/

Red Hat update for nss
http://secunia.com/advisories/39089/

Interchange HTTP Response Splitting Vulnerability
http://secunia.com/advisories/39103/

HP Project and Portfolio Management Center Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/39105/

Drupal Menu Block Module Script Insertion Vulnerability
http://secunia.com/advisories/39109/

Drupal Mime Mail Module Arbitrary Code Execution Vulnerability
http://secunia.com/advisories/39118/

Sandbox Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/39064/

Cisco IOS TCP Options Denial of Service Vulnerability
http://secunia.com/advisories/39078/

Cisco IOS H.323 Two Denial of Service Vulnerabilities
http://secunia.com/advisories/39067/

Cisco IOS SIP Implementation Multiple Vulnerabilities
http://secunia.com/advisories/39068/

Cisco IOS Label Distribution Protocol Denial of Service
http://secunia.com/advisories/39065/

Cisco IOS NAT SCCP Fragmentation Denial of Service
http://secunia.com/advisories/39062/

Cisco IOS IPsec IKE Packet Denial of Service
http://secunia.com/advisories/39057/

SAP GUI version 7.00 BExGlobal Active-X unsecure method
http://www.exploit-db.com/exploits/11879

eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF
http://www.exploit-db.com/exploits/11877

KenWard's Zipper v1.400 Buffer Overflow - Method 2
http://www.exploit-db.com/exploits/11872

Redhat Security Update Fixes httpd "mod_proxy_ajp" Vulnerabilities
http://www.vupen.com/english/advisories/2010/0715

Redhat Security Update Fixes GnuTLS Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0714

GnuTLS X.509 Certificate Serial Number Extraction Vulnerability
http://www.vupen.com/english/advisories/2010/0713

Redhat Security Update Fixes NSS TLS Plaintext Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0712

Redhat Security Update Fixes OpenSSL and OpenSSL097a Vulnerabilities
http://www.vupen.com/english/advisories/2010/0711

OpenSSL TLS Connection Record Handling Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0710

Cisco IOS IPsec Internet Key Exchange Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0709

Cisco IOS NAT SCCP Fragmentation Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0708

Cisco IOS Multiprotocol Label Switching Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0707

Cisco IOS H.323 Implementation Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/0706

Cisco IOS Session Initiation Protocol Code Execution and DoS Issues
http://www.vupen.com/english/advisories/2010/0705

Cisco IOS Unified Communications Manager Express Denial of Service
http://www.vupen.com/english/advisories/2010/0704

Cisco IOS TCP Packet Processing Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0703

Fedora Security Update Fixes Firefox and Xulrunner Vulnerabilities
http://www.vupen.com/english/advisories/2010/0702

Ubuntu Security Update Fixes Samba Directory Traversal Vulnerability
http://www.vupen.com/english/advisories/2010/0701

Ubuntu Security Update Fixes Puppet Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0700

Ubuntu Security Update Fixes krb5 Two Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/0699

Mandriva Security Update Fixes Kernel Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/0698

Apple Safari 4 Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38955

Joomla! CKForms Component 'fid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38785

Drupal Mime Mail Module PHP Code Execution Vulnerability
http://www.securityfocus.com/bid/38950

Intellicom 'NetBiterConfig.exe' 'Hostname' Data Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37325

GNU Tar and GNU Cpio Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38628

Apache Subrequest Handling Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38580

Sendmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/37543

GnuTLS X.509 Certificate Serial Number Decoding Remote Security Vulnerability
http://www.securityfocus.com/bid/38959

Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38491

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability
http://www.securityfocus.com/bid/38562

OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38533

OpenSSL Multiple Vulnerabilities
http://www.securityfocus.com/bid/34256

Easy-Clanpage User 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/28329

Microsoft Internet Explorer Unspecified Remote Code Execution Vulnerabilities
http://www.securityfocus.com/bid/38951

UltraISO CCD and IMG File Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34363

Crimson Editor '.cfg' File Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38900

Linux Kernel 64bit Personality Handling Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38027

Linux Kernel 'do_pages_move()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38144

Linux e1000e Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37523

Oracle Java SE and Java For Business March 2010 Advanced Notification
http://www.securityfocus.com/bid/38973

JINAIS IRC Message Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38972

New-CMS 'pg' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38971

justVisual 'p' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38970

Smart PC Recorder MP3 File Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38969

Cisco TFTP Server Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38968

WeBAM Denial of Service Vulnerability and CAPTCHA Bypass Vulnerability
http://www.securityfocus.com/bid/38967

EASY ENTERPRISE Multiple Vulnerabilities
http://www.securityfocus.com/bid/38966

INVOhost Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38962

登録: 投稿 (Atom)

2010年3月31日水曜日

31日 水曜日、大安