12日 火曜日、友引

+ HPSBMU02790 SSRT100872 rev.1 - HP Server Automation, Remote Execution of Arbitrary Code
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?javax.portlet.tpst=ba847bafb2a2d782fcbb0710b053ce01&javax.portlet.prp_ba847bafb2a2d782fcbb0710b053ce01=wsrp-navigationalState%3DdocId%25253Demr_na-c03366886%25257CdocLocale%25253Dja_JP&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1182

+ Dovecot 2.0.21 released
http://www.dovecot.org/list/dovecot-news/2012-June/000227.html

+ Linux kernel 3.2.20 released
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.20

+ LOCAL: MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability
http://www.exploit-db.com/exploits/19037

+ SA49409 MySQL User Login Security Bypass and Unspecified Vulnerability
http://secunia.com/advisories/49409/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122

+ SA49339 Linux Kernel mmap_sem Denial of Service Vulnerability
http://secunia.com/advisories/49339/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2373

+ SA49503 Chrome Flash Player Multiple Vulnerabilities
http://secunia.com/advisories/49503/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2034
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2035
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2036
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2037
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2038
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2039
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2040

Check Point response to "libcrypt 'crypt()' Password Encryption Weakness" (CVE-2012-2143)
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk75640&src=securityAlerts

IBM Lotus Quickr 8.2 for Domino の ActiveX コントロールにおけるバッファーオーバーフローに関する脆弱性の問題 (CVE-2012-2176)
http://www-304.ibm.com/support/docview.wss?uid=swg21596548

IBM Lotus iNotes ActiveX Attachment_Times におけるバッファーオーバーフローに関する脆弱性の問題 (CVE-2012-2175)
http://www-304.ibm.com/support/docview.wss?uid=swg21597148

Advisory: Considerations for customers running Endpoint Security and Control 10 in advance of May maintenance release
http://www.sophos.com/en-us/support/knowledgebase/117226.aspx

Linkedinが大量パスワード流出対策を報告、「アカウント侵害の報告は受けていない」
http://itpro.nikkeibp.co.jp/article/NEWS/20120611/401281/?ST=security

JVN#38163638 Flash Player における同一生成元ポリシー実装不備の脆弱性
http://jvn.jp/jp/JVN38163638/index.html

JVNVU#815532 ForeScout CounterACT にクロスサイトスクリプティングの脆弱性
http://jvn.jp/cert/JVNVU815532/index.html

JVNDB-2012-002652 ForeScout CounterACT にクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002652.html

JVNDB-2012-002651 Oracle Java SE の Java Runtime Environment (JRE) における脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002651.html

JVNDB-2012-002650 Ubuntu で使用されるアップデートマネージャにおけるリポジトリ認証情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002650.html

JVNDB-2012-002649 Globus Toolkit の GridFTP における権限を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002649.html

JVNDB-2012-002648 OpenConnect におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002648.html

JVNDB-2012-002647 複数の製品の Chromebook プラットフォーム上で稼働する Google Chrome における脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002647.html

JVNDB-2012-002646 Serendipity の include/functions_trackbacks.inc.php における SQL インジェクションの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002646.html

JVNDB-2012-002645 SensioLabs Symfony における Web セッションをハイジャックされる脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002645.html

JVNDB-2012-002644 Openstack Compute (Nova) におけるサービス運用妨害 (CPU およびハードドライブの消費) の脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002644.html

JVNDB-2012-002643 MIT Kerberos の kadmind のcheck_1_6_dummy 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002643.html

JVNDB-2012-002642 MIT Kerberos の kadmin プロトコルの実装における文字列属性を変更される脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002642.html

JVNDB-2012-002641 複数の Sony 製品の Wireless Manager ActiveX コントロールにおけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002641.html

JVNDB-2012-002640 libmodplug の CSoundFile::ReadAMS2 関数における一つずれエラーの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002640.html

JVNDB-2012-002639 libmodplug の CSoundFile::ReadDSM 関数における一つずれエラーの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002639.html

JVNDB-2012-002638 libmodplug の CSoundFile::ReadAMS 関数における一つずれエラーの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002638.html

JVNDB-2012-002637 libmodplug の CSoundFile::ReadS3M 関数におけるスタックベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002637.html

JVNDB-2012-002636 libmodplug の CSoundFile::ReadWav 関数における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002636.html

JVNDB-2012-002635 libmodplug の abc_new_macro および abc_new_umacro 関数におけるスタックベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002635.html

JVNDB-2012-000046 Flash Player における同一生成元ポリシー実装不備の脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000046.html

Microsoft Update Security
http://isc.sans.edu/diary.html?storyid=13429

Exploit Available for Trivial MySQL Password Bypass
http://isc.sans.edu/diary.html?storyid=13432

Astaro Security Gateway Input Validation Flaw in Comment Field Permits Cross-Site Scripting Attacks
http://www.securitytracker.com/id/1027140

VU#221180 BMC Identity Management Suite cross-site request forgery vulnerability
http://www.kb.cert.org/vuls/id/221180

次期ウイルスバスターの評価プログラムを開始
Windows 8 リリースプレビュー版に対応する
ベータ版とMac用ベータ版を公開
～参加者から抽選でiPadやAmazonギフト券をプレゼント～
http://jp.trendmicro.com/jp/about/news/pr/article/20120608011600.html

Et-chat Remote File Uploader (RFU)
http://cxsecurity.com/issue/WLB-2012060122

voipswitch SQL Injection Vulnerability
http://cxsecurity.com/issue/WLB-2012060121

Tom Sawyer Software GET Extension Factory Remote Code Execution
http://cxsecurity.com/issue/WLB-2012060120

Astaro Security Gateway <= v8.304 Persistent Cross-Site Scripting Vulnerability
http://cxsecurity.com/issue/WLB-2012060119

REMOTE: F5 BIG-IP Remote Root Authentication Bypass Vulnerability
http://www.exploit-db.com/exploits/19064

REMOTE: Tom Sawyer Software GET Extension Factory Remote Code Execution
http://www.exploit-db.com/exploits/19030

DoS/PoC: PEamp (.mp3) Memory Corruption PoC
http://www.exploit-db.com/exploits/19034

WordPress PICA Photo Gallery Plugin Arbitrary File Disclosure and File Upload Vulnerabilities
http://secunia.com/advisories/49467/

WordPress SFBrowser Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49466/

SUSE update for php5
http://secunia.com/advisories/49471/

Wordpress Mac Photo Gallery Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49468/

WordPress Front File Manager Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49428/

WordPress PDW File Browser Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49444/

WordPress Hungred Post Thumbnail Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49447/

WordPress Tinymce Thumbnail Gallery Plugin Arbitrary File Disclosure Vulnerability
http://secunia.com/advisories/49460/

WordPress Simple Download Button Shortcode Plugin Arbitrary File Disclosure Vulnerability
http://secunia.com/advisories/49462/

WordPress RBX Gallery Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49463/

WordPress Top Quark Architecture Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49465/

ForeScout CounterACT "username" and "loginname" Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/49481/

Agora Project "dossierup" Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49452/

Check Point Endpoint Connect Insecure Library Loading Vulnerability
http://secunia.com/advisories/49432/

HP Onboard Administrator Multiple Vulnerabilities
http://secunia.com/advisories/49402/

SUSE update for pidgin-otr
http://secunia.com/advisories/49508/

MariaDB User Login Security Bypass Security Issue
http://secunia.com/advisories/49417/

MySQL User Login Security Bypass and Unspecified Vulnerability
http://secunia.com/advisories/49409/

Debian update for php5
http://secunia.com/advisories/49416/

Debian update for postgresql-8.4
http://secunia.com/advisories/49423/

Linux Kernel mmap_sem Denial of Service Vulnerability
http://secunia.com/advisories/49339/

HP Web Jetadmin Unspecified Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/49424/

MantisBT SOAP API Bugnotes Security Bypass Security Issue
http://secunia.com/advisories/49414/

WordPress Easy Contact Forms Export Plugin File Disclosure Vulnerability
http://secunia.com/advisories/49450/

Chrome Flash Player Multiple Vulnerabilities
http://secunia.com/advisories/49503/

WordPress wpStoreCart Plugin Arbitrary File Upload Vulnerability
http://secunia.com/advisories/49459/

WordPress Plugin Newsletter Plugin Arbitrary File Disclosure Vulnerability
http://secunia.com/advisories/49464/