11日 金曜日、友引

　

- マイクロソフト セキュリティ アドバイザリ (2219475): Windows のヘルプとサポート センターの脆弱性により、リモートでコードが実行される
http://www.microsoft.com/japan/technet/security/advisory/2219475.mspx

Adobe Flash Player の脆弱性について
http://www.ipa.go.jp/security/ciadr/vul/20100611-adobe.html

企業のセキュリティ支出、主目的は「IDとアクセス権の管理」
http://itpro.nikkeibp.co.jp/article/Research/20100611/349093/?ST=security

SymantecとHP、消費者向けPCへのセキュリティ対策ソフトのバンドルで契約延長
http://itpro.nikkeibp.co.jp/article/NEWS/20100611/349091/?ST=security

Facebook、子供の安全なネット利用で全米PTAと協力
http://itpro.nikkeibp.co.jp/article/NEWS/20100611/349106/?ST=security

Adobe Flash Player および Adobe Acrobat/Reader の脆弱性に関する注意喚起
http://www.jpcert.or.jp/at/2010/at100015.txt

JVNVU#578319 Microsoft Windows Help and Support Center に脆弱性
http://jvn.jp/cert/JVNVU578319/index.html

UPDATE: JVNTA10-159A Adobe Reader、Acrobat および Flash Player に脆弱性
http://jvn.jp/cert/JVNTA10-159A/index.html

UPDATE: JVNVU#486225 Adobe Flash ActionScript AVM2 newfunction 命令に脆弱性
http://jvn.jp/cert/JVNVU486225/index.html

Adobe AIR Multiple Flaws Let Remote Users Execute Arbitary Code, Conduct Cross-Site Scripting Attacks, and Deny Service
http://securitytracker.com/alerts/2010/Jun/1024086.html

Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitary Code, Conduct Cross-Site Scripting Attacks, and Deny Service
http://securitytracker.com/alerts/2010/Jun/1024085.html

WebKit ':visited' CSS Pseudo-class Information Disclosure Vulnerability
http://www.securityfocus.com/bid/40756

Adobe Flash Player 10.0.45.2 and AIR 1.5.3.9130 Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/40759

nginx 0.8.36 Source Disclosure and DoS Vulnerabilities
http://www.exploit-db.com/exploits/13818/

Adobe Flash and AIR Multiple Remote Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/1421






+ マイクロソフト セキュリティ アドバイザリ (980088): Internet Explorer の脆弱性により、情報漏えいが起こる
http://www.microsoft.com/japan/technet/security/advisory/980088.mspx

+ Microsoft Security Advisory (2219475): Vulnerability in Windows Help and Support Center Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/2219475.mspx
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32854
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00119.html
http://isc.sans.edu/diary.html?storyid=8953
http://isc.sans.edu/diary.html?storyid=8956
http://secunia.com/advisories/40076/
http://www.kb.cert.org/vuls/id/578319
http://www.securitytracker.com/id?1024084
http://www.exploit-db.com/exploits/13808
http://www.vupen.com/english/advisories/2010/1417
http://www.securityfocus.com/bid/40725
http://www.securityfocus.com/bid/40721

- Microsoft Help and Support Center 'sysinfo/sysinfomain.htm' Cross Site Scripting Weakness
http://www.securityfocus.com/bid/40721

APSB10-14: Security update available for Adobe Flash Player
http://www.adobe.com/support/security/bulletins/apsb10-14.html

UPDATE: APSA10-01: Security Advisory for Flash Player, Adobe Reader and Acrobat
http://www.adobe.com/support/security/advisories/apsa10-01.html

HPSBMA02537 SSRT010027 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02217439&admit=109447626+1276223412800+28353475

Postfix 2.8 Snapshot 20100610
http://mirror.postfix.jp/postfix-release/experimental/postfix-2.8-20100610.HISTORY

Greatly Enhanced LINQ Capabilities in Devart ADO.NET Data Providers
http://www.postgresql.org/about/news.1211

Devel-NYTProf-4.00 released
http://search.cpan.org/~timb/Devel-NYTProf-4.00/

InterScan Web Security Suite Linux版/Solaris版におけるウイルス検索エンジン VSAPI 9.130緊急公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1427

Debian : New glibc packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32847

ProCheckUp : Juniper Secure Access seriers (Juniper IVE) authenticated XSS & REDIRECTION
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32855

Cisco : Vulnerabilities in Cisco Unified Contact Center Express
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32848

Cisco : Cisco Application Extension Platform Privilege Escalation Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32849

Computer Associates : Security Notice for CA PSFormX and WebScan ActiveX Controls
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32851

Independent Researcher : Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32854

MajorSecurity : Plume CMS - change Admin Password via Cross-site Request Forgery
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32866

MajorSecurity : Anantasoft Gazelle CMS - change admin password via Cross-site Request Forgery
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32867

MajorSecurity : Invision Power Board - stored Cross site Scripting
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32868

NGENUITY : McAfee UTM Firewall Help Reflected Cross-Site Scripting
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32852

TippingPoint Security Research Team : Sophos Anti-Virus SAVOnAccessFilter Local Privilege Escalation Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32853

Ubuntu Security Notice : MySQL vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32846

マカフィー、仮想環境向けセキュリティプラットフォームを発表
http://itpro.nikkeibp.co.jp/article/NEWS/20100610/349069/?ST=security

JVNTA10-159A Adobe Reader、Acrobat および Flash Player に脆弱性
http://jvn.jp/cert/JVNTA10-159A/index.html

JVNTA10-159B Microsoft 製品における複数の脆弱性に対するアップデート
http://jvn.jp/cert/JVNTA10-159B/index.html

JVNDB-2010-001514 MySQL におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001514.html

JVNDB-2010-001513 MySQL の my_net_skip_rest 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001513.html

JVNDB-2010-001512 MySQL におけるディレクトリトラバーサルの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001512.html

JVNDB-2010-001329 複数の Oracle 製品の Java 2D コンポーネントにおける脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001329.html

iDefense Security Advisory 06.07.10: Multiple Vendor WebKit HTML Caption Use After Free Vulnerabilit
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00134.html

[MajorSecurity SA-071]phpFaber CMS - Multiple stored Cross-site Scripting issues
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00131.html

[SECURITY] [DSA 2059-1] New pcsc-lite packages fix privilege escalation
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00133.html

Vulnerabilities in Belavir for WordPress
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00130.html

[ MDVSA-2010:113 ] wireshark
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00122.html

PR09-17: Juniper Secure Access seriers (Juniper IVE) authenticated XSS & REDIRECTION
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00120.html

[SECURITY] [DSA 2058-1] New glibc packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00124.html

Awcm Cms Local File Inclusion Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00123.html

Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00119.html

TPTI-10-03: Sophos Anti-Virus SAVOnAccessFilter Local Privilege Escalation Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-06/msg00121.html

PUBLIC ADVISORY: 06.10.10: Adobe Flash Player Out of Bounds Memory Indexing Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=871

PUBLIC ADVISORY: 06.10.10: Adobe Flash Player Use-After-Free Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=872

PUBLIC ADVISORY: 06.07.10: Multiple Vendor WebKit HTML Caption Use After Free Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=870

iPad Owners Exposed
http://isc.sans.edu/diary.html?storyid=8941

Another Morning of Fun
http://isc.sans.edu/diary.html?storyid=8944

Top 5 Social Networking Media Risks
http://isc.sans.edu/diary.html?storyid=8947

Wireshark 1.2.9 Now Available
http://isc.sans.edu/diary.html?storyid=8950

Microsoft Help Centre Handling of Escape Sequences May Lead to Exploit
http://isc.sans.edu/diary.html?storyid=8953

Microsoft Security Advisory 2219475
http://isc.sans.edu/diary.html?storyid=8956

Nuggetz CMS Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/40137/

Webmedia Explorer Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/40139/

FlatnuX CMS Cross-Site Request Forgery and Script Insertion Vulnerabilities
http://secunia.com/advisories/40136/

Debian update for glibc and eglibc
http://secunia.com/advisories/40121/

Plume CMS Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/40133/

Linksys WAP54G Undocumented Debug Interface Vulnerability
http://secunia.com/advisories/40103/

Cisco Unified Contact Center Express Two Vulnerabilities
http://secunia.com/advisories/40098/

Cisco Application Extension Platform Privilege Escalation Vulnerability
http://secunia.com/advisories/40093/

Sophos Anti-Virus "NtQueryAttributesFile()" Privilege Escalation Vulnerability
http://secunia.com/advisories/40085/

Microsoft Windows helpctr.exe Invalid URL Processing Vulnerability
http://secunia.com/advisories/40076/

Juniper IVE OS Redirection Weakness
http://secunia.com/advisories/40117/

McAfee UTM Firewall "page" Cross-Site-Scripting Vulnerability
http://secunia.com/advisories/40138/

McAfee UTM Firewall "page" Cross-Site-Scripting Vulnerability
http://secunia.com/advisories/40089/

CA WebScan ActiveX Control Multiple Vulnerabilities
http://secunia.com/advisories/40118/

CA PSFormX ActiveX Control Multiple Vulnerabilities
http://secunia.com/advisories/40092/

Wireshark Multiple Vulnerabilities
http://secunia.com/advisories/40112/

Ubuntu update for mysql-server
http://secunia.com/advisories/40100/

Vulnerability Note VU#578319: Microsoft Windows Help and Support Center URI processing vulnerability
http://www.kb.cert.org/vuls/id/578319

RHBA-2010:0462-1: procps bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0462.html

Microsoft Help and Support Center URL Escaping Flaw Lets Remote Users Execute Arbitrary Commands
http://securitytracker.com/alerts/2010/Jun/1024084.html

Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly
http://www.exploit-db.com/exploits/13808/

Juniper Networks IVE "homepage.cgi" URL Redirection Weakness
http://www.vupen.com/english/advisories/2010/1420

Linksys WAP54G Undocumented Debug Pages Code Execution
http://www.vupen.com/english/advisories/2010/1419

Wireshark Multiple Buffer Overflow and Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/1418

Microsoft Windows Help Whitelist Bypass and Cross Site Scripting Issues
http://www.vupen.com/english/advisories/2010/1417

Cisco Products Directory Traversal and Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/1416

Cisco Application Extension Platform Privilege Escalation Vulnerability
http://www.vupen.com/english/advisories/2010/1415

Adobe Flash Player, Acrobat Reader, and Acrobat 'authplay.dll' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40586

Adobe Flash Player SWF Version Null Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/31537

WebKit Caption Element Handling Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40658

Mozilla Firefox CVE-2009-3377 Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/36872

RETIRED: Apple Safari Prior to 5.0 and 4.1 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/40620

Microsoft Windows Help And Support Center Trusted Document Whitelist Bypass Vulnerability
http://www.securityfocus.com/bid/40725

JCE-Tech PHP Calendars Multiple Cross-Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/40391

emesene '/tmp/emsnpic' Insecure Temporary File Creation Vulnerability
http://www.securityfocus.com/bid/40455

Microsoft Help and Support Center 'sysinfo/sysinfomain.htm' Cross Site Scripting Weakness
http://www.securityfocus.com/bid/40721

Entry Level CMS 'index.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38422

Microsoft SharePoint Server 2007 '_layouts/help.aspx' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/39776

Microsoft SharePoint Help Page Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/40559

Internet Explorer and SharePoint 'toStaticHTML' Cross Domain Information Disclosure Vulnerability
http://www.securityfocus.com/bid/40409

Microsoft IIS Authentication Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40573

Microsoft Internet Explorer 'CStyleSheet' Uninitialized Memory Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40417

Microsoft Internet Explorer Developer Toolbar (CVE-2010-1261) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40416

Microsoft Internet Explorer Dynamic Object Tag Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38055

Microsoft Internet Explorer Developer Toolbar HTML Element Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40414

Microsoft Windows Media Decompression (CVE-2010-1880) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40464

Microsoft Windows OpenType Compact Font Format Driver Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/40572

Microsoft Internet Explorer URLMON Sniffing Cross Domain Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38056

IETF and W3C XML Digital Signature Specification HMAC Truncation Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/35671

Microsoft Windows Kernel 'Win32k.sys' Window Creation Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/40569

Microsoft Windows Kernel 'Win32k.sys' Data Validation Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/40508

Microsoft Windows Media Decompression (CVE-2010-1879) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40432

Microsoft Internet Explorer Uninitialized Memory (CVE-2010-1259) Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40410

Microsoft Windows Kernel 'Win32k.sys' TrueType Font Parsing Code Execution Vulnerability
http://www.securityfocus.com/bid/40570

WebKit Integer Truncation TCP Port Information Disclosure Vulnerability
http://www.securityfocus.com/bid/40697

RETIRED: Alibaba Clone Platinum Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/40206

GNU glibc 'ld.so' ELF Header Parsing Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/40063

GNU glibc 'strfmon()' Function Integer Overflow Weakness
http://www.securityfocus.com/bid/36443

RETIRED: phpGraphy 'mysql_cleanup.php' Remote File Include Vulnerability
http://www.securityfocus.com/bid/40506

RETIRED: Content Management System module for PHProjekt 'path_pre' Remote File Include Vulnerability
http://www.securityfocus.com/bid/40545

Wireshark 0.8.20 through 1.2.8 Multiple Vulnerabilities
http://www.securityfocus.com/bid/40728

Adobe Flash Player 10.0.45.2 and AIR 1.5.3.9130 Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/40759

PCSC-Lite 'PCSCD' Daemon Unspecified Local Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/40758

JCE-Tech PHP Calendars 'product_list.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/40757

MaraDNS Hostname Null Pointer Dereference Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/40745

Multiple Joobi Components for Joomla! 'task' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/40739

Flatnux 'head' Parameter HTML Injection Vulnerability
http://www.securityfocus.com/bid/40738

AWCM CMS 'notify.php' Local File Include Vulnerability
http://www.securityfocus.com/bid/40736

Arab Portal 'members.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/40735