2012年7月11日水曜日

11日 水曜日、友引

+ 2012 年 7 月のセキュリティ情報
http://technet.microsoft.com/ja-jp/security/bulletin/ms12-jul

+ MS12-043 - Critical Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2722479)
http://technet.microsoft.com/en-us/security/bulletin/ms12-043
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1889

+ MS12-044 - 緊急 Internet Explorer 用の累積的なセキュリティ更新プログラム (2719177)
http://technet.microsoft.com/ja-jp/security/bulletin/ms12-044
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1522
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1524

+ MS12-045 - 緊急 Microsoft Data Access Components の脆弱性により、リモートでコードが実行される (2698365)
http://technet.microsoft.com/ja-jp/security/bulletin/ms12-045
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1891

+ MS12-046 - Important Vulnerability in Visual Basic for Applications Could Allow Remote Code Execution (2707960)
http://technet.microsoft.com/en-us/security/bulletin/ms12-046
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1854

+ MS12-047 - Important Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2718523)
http://technet.microsoft.com/en-us/security/bulletin/ms12-047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1890
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1893

+ MS12-048 - Important Vulnerability in Windows Shell Could Allow Remote Code Execution (2691442)
http://technet.microsoft.com/en-us/security/bulletin/ms12-048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0175

+ MS12-049 - Important Vulnerability in TLS Could Allow Information Disclosure (2655992)
http://technet.microsoft.com/en-us/security/bulletin/ms12-049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1870

+ MS12-050 - 重要 SharePoint の脆弱性により、特権が昇格される (2695502)
http://technet.microsoft.com/ja-jp/security/bulletin/ms12-050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1858
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1859
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1860
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1861
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1862
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1863

+ MS12-051 - 重要 Microsoft Office for Mac の脆弱性により、特権が昇格される (2721015)
http://technet.microsoft.com/ja-jp/security/bulletin/ms12-051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1894

+ RHSA-2012:1064 Important: kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2012-1064.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2744
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2745

+ nginx-1.3.3 development version released
http://nginx.org/en/download.html

+ CentOS alert CESA-2012:1061 (kernel)
http://lwn.net/Alerts/506223/

+ CentOS alert CESA-2012:0841 (abrt)
http://lwn.net/Alerts/506225/

+ CentOS alert CESA-2012:0748 (libvirt)
http://lwn.net/Alerts/506226/

+ CentOS alert CESA-2012:0774 (libguestfs)
http://lwn.net/Alerts/506227/

+ CentOS alert CESA-2012:0796 (rsyslog)
http://lwn.net/Alerts/506228/

+ CentOS alert CESA-2012:0810 (busybox)
http://lwn.net/Alerts/506229/

+ CentOS alert CESA-2012:0811 (php-pecl-apc)
http://lwn.net/Alerts/506231/

+ CentOS alert CESA-2012:0813 (389-ds-base)
http://lwn.net/Alerts/506232/

+ CentOS alert CESA-2012:0862 (kernel)
http://lwn.net/Alerts/506233/

+ CentOS alert CESA-2012:0874 (mysql)
http://lwn.net/Alerts/506234/

+ CentOS alert CESA-2012:0876 (net-snmp)
http://lwn.net/Alerts/506235/

+ CentOS alert CESA-2012:0880 (qt)
http://lwn.net/Alerts/506236/

+ HPSBMU02796 SSRT100594 rev.1 - HP Operations Agent for AIX, HP-UX, Linux, Solaris and Windows, Remote Execution of Arbitrary Code
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?javax.portlet.tpst=ba847bafb2a2d782fcbb0710b053ce01&javax.portlet.prp_ba847bafb2a2d782fcbb0710b053ce01=wsrp-navigationalState%3DdocId%25253Demr_na-c03397769%25257CdocLocale%25253Dja_JP&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2019
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2020

+ Improper Input Validation vulnerability in Perl
https://blogs.oracle.com/sunsecurity/entry/cve_2011_3597_improper_input
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3597

+ Multiple Denial of Service vulnerabilities in Ghostscript
https://blogs.oracle.com/sunsecurity/entry/multiple_denial_of_service_vulnerabilities7
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4517

+ Numeric Errors vulnerability in LibTIFF
https://blogs.oracle.com/sunsecurity/entry/cve_2012_1173_numeric_errors
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1173

+ IBM Lotus Expeditor のセキュリティアドバイザリおよびセキュリティアップデートパック
http://www-01.ibm.com/support/docview.wss?uid=swg21599432
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4647
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0187

+ Microsoft Security Advisory (2728973) Unauthorized Digital Certificates Could Allow Spoofing
http://technet.microsoft.com/en-us/security/advisory/2728973

+ マイクロソフト セキュリティ アドバイザリ (2728973)承認されていないデジタル証明書により、なりすましが行われる
http://technet.microsoft.com/ja-jp/security/advisory/2728973

+ Microsoft Security Advisory (2719662) Vulnerabilities in Gadgets Could Allow Remote Code Execution
http://technet.microsoft.com/en-us/security/advisory/2719662

+ マイクロソフト セキュリティ アドバイザリ (2719662) ガジェットの脆弱性により、リモートでコードが実行される
http://technet.microsoft.com/ja-jp/security/advisory/2719662

+ Microsoft Security Advisory (2719615) Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
http://technet.microsoft.com/en-us/security/advisory/2719615

+ マイクロソフト セキュリティ アドバイザリ (2719615) XML コアサービスの脆弱性により、リモートでコードが実行される
http://technet.microsoft.com/ja-jp/security/advisory/2719615

+ Microsoft Security Advisory (2269637) Insecure Library Loading Could Allow Remote Code Execution
http://technet.microsoft.com/en-us/security/advisory/2269637

+ RHSA-2012:1061 Moderate: kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2012-1061.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3375

+ Linux Kernel IPv6 'nf_ct_frag6_reasm()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/54367
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2744

+ Linux Kernel Key Management CVE-2012-2745 Denial Of Service Vulnerability
http://www.securityfocus.com/bid/54365
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2745

Check Point response to "Check Point GO Vulnerabilities report"   (10-7-2012)
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsecurityalerts=

Trend Micro Power Managementオプション 公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1806

Trend Micro Security (for Mac) 1.5 Service Pack 4 (ビルド 6024) 公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1808

国内にも「脅迫ウイルス」が出現、ファイルを暗号化して人質に
http://itpro.nikkeibp.co.jp/article/NEWS/20120711/408381/?ST=security

DNS Changer感染PC用の代替サーバー停止、チェック方法が変更に
http://itpro.nikkeibp.co.jp/article/NEWS/20120710/408236/?ST=security

JVNVU#763795 Netsweeper に複数の脆弱性
http://jvn.jp/cert/JVNVU763795/index.html

JVNVU#154307 Synel SY-780/A にサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/cert/JVNVU154307/index.html

JVNDB-2012-001003 Apache Tomcat におけるサービス運用妨害 (CPU 資源の消費) の脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-001003.html

JVNDB-2011-004139 Asterisk Open Source の ast_uri_encode 関数におけるスタックベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004139.html

JVNDB-2012-003028 複数の Asterisk 製品におけるサービス運用妨害 (RTP ポートの枯渇) の脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003028.html

JVNDB-2012-003027 Pidgin の libpurple の MXit プロトコルプラグインにおけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003027.html

JVNDB-2012-003026 PHP の phar 拡張機能における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003026.html

[security bulletin] HPSBMU02796 SSRT100594 rev.1 - HP Operations Agent for AIX, HP-UX, Linux
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-07/msg00054.html

Microsoft July 2012 Black Tuesday Update - Overview
http://isc.sans.edu/diary.html?storyid=13642

Today at SANSFIRE (09 July 2012) - ISC Panel Discussion on the State of the Internet
http://isc.sans.edu/diary.html?storyid=13645

Microsoft revoking trust in Microsoft certificates - SA 2728973
http://isc.sans.edu/diary.html?storyid=13648

Microsoft fix-it to disable gadgets - SA 2719662
http://isc.sans.edu/diary.html?storyid=13651

Microsoft Office for Mac Folder Permission Flaw Lets Local Users Gain Elevated Privileges
http://www.securitytracker.com/id/1027234

Windows Schannel Lets Remote Users Decrypt TLS Traffic
http://www.securitytracker.com/id/1027233

Microsoft SharePoint Input Validation Flaws Permit Cross-Site Scripting, Information Disclosure, and URL Redirection Attacks
http://www.securitytracker.com/id/1027232

Windows Kernel-Mode Driver Bugs Lets Local Users Gain Elevated Privileges
http://www.securitytracker.com/id/1027231

Windows Shell Command Injection Flaw Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027230

Microsoft Office DLL Loading Error Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027229

Microsoft Visual Basic for Applications DLL Loading Error Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027228

Microsoft Data Access Components (MDAC) ADO Cachesize Buffer Overflow Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027227

Microsoft Internet Explorer Deleted Object Access Bugs Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027226

HP Operations Agent Bugs Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027225

Microsoft SharePoint Multiple Vulnerabilities
http://secunia.com/advisories/49875/

Microsoft Windows TLS Protocol Information Disclosure Weakness
http://secunia.com/advisories/49874/

Microsoft InfoPath and Groove Server Cross-Site Scripting Vulnerability
http://secunia.com/advisories/49877/

Visual Basic for Applications Insecure Library Loading Vulnerability
http://secunia.com/advisories/49800/

Microsoft Windows Shell Command Injection Vulnerability
http://secunia.com/advisories/49873/

Microsoft Office for Mac Insecure Filesystem Permissions Security Issue
http://secunia.com/advisories/49876/

Microsoft Windows Data Access Components Vulnerability
http://secunia.com/advisories/49873/

Internet Explorer Two Vulnerabilities
http://secunia.com/advisories/45690/

Red Hat update for kernel
http://secunia.com/advisories/49778/

Red Hat update for kernel
http://secunia.com/advisories/49741/

WordPress WP Symposium Plugin Multiple SQL Injection Vulnerabilities
http://secunia.com/advisories/49534/

WordPress A Page Flip Book Plugin "pageflipbook_language" File Inclusion Vulnerability
http://secunia.com/advisories/49505/

WordPress Sendit Newsletter Plugin "id" SQL Injection Vulnerability
http://secunia.com/advisories/49506/

WordPress The Guardian News Feed Plugin Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/49865/

Wangkongbao CNS-1000 and CNS-1100 File Download Vulnerability
http://secunia.com/advisories/49776/

HP Operations Agent Two Vulnerabilities
http://secunia.com/advisories/49872/

Gentoo update for keepalived
http://secunia.com/advisories/49844/

OpenVZ update for kernel
http://secunia.com/advisories/49861/

Gentoo update for sudo
http://secunia.com/advisories/49860/

Gentoo update for libxml2
http://secunia.com/advisories/49859/

Gentoo update for gnash
http://secunia.com/advisories/49841/

Gentoo update for pidgin-otr
http://secunia.com/advisories/49834/

Gentoo update for mod_fcgid
http://secunia.com/advisories/49846/

Gentoo update for chasen
http://secunia.com/advisories/49832/

Gentoo update for jruby
http://secunia.com/advisories/49828/

Ubuntu update for pidgin
http://secunia.com/advisories/49862/

LimeSurvey 1.92 + build 120704 Remote File Inclusion Vulnerability
http://cxsecurity.com/issue/WLB-2012070061

phpmoneybooks 1.0.4 Remote File Inclusion Vulnerability
http://cxsecurity.com/issue/WLB-2012070060

phpList 2.10.18 Cross Site Scripting
http://cxsecurity.com/issue/WLB-2012070059

Flogr 1.7 Cross Site Scripting
http://cxsecurity.com/issue/WLB-2012070058

Digiport SQL Injection
http://cxsecurity.com/issue/WLB-2012070057

Apache Hadoop HDFS Information Disclosure
http://cxsecurity.com/issue/WLB-2012070056

Check Point Abra Bypass / Command Execution
http://cxsecurity.com/issue/WLB-2012070055

BookNux 0.2 Cross Site Scripting / SQL Injection
http://cxsecurity.com/issue/WLB-2012070054

digiGALLERY SQL Injection
http://cxsecurity.com/issue/WLB-2012070053

Checkpoint Abra Multiple Vulnerabilities
http://www.exploit-db.com/exploits/19716

RETIRED: Microsoft Visual Basic for Applications DLL Loading Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/53830

Microsoft Visual Basic for Applications DLL Loading Arbitrary Code Execution Vulnerability
http://www.securityfocus.com/bid/54303

Microsoft Internet Explorer And Microsoft Lync HTML Sanitizing Information Disclosure Vulnerability
http://www.securityfocus.com/bid/53842

Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/53934

Oracle Java SE CVE-2012-1723 Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/53960

Linux Kernel 'fs/eventpoll.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/54283

ISC BIND CVE-2012-1033 Security Bypass Vulnerability
http://www.securityfocus.com/bid/51898

ISC BIND 9 DNS Resource Records Handling Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/53772

keepalived Insecure PID Files Insecure File Permissions Vulnerability
http://www.securityfocus.com/bid/47859

Novell ZENworks Configuration Management AdminStudio Remote Code Execution Vulnerabilities
http://www.securityfocus.com/bid/50274

JRuby Hash Collision Denial Of Service Vulnerability
http://www.securityfocus.com/bid/51233

pidgin-otr 'log_message_cb()' Function Format String Vulnerability
http://www.securityfocus.com/bid/53557

X.Org Input Device Format String Vulnerability
http://www.securityfocus.com/bid/53150

Netsweeper Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
http://www.securityfocus.com/bid/54355

GNU Gnash Cookie Files Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/50747

GNU Gnash 'GnashImage::size()' Integer Overflow Vulnerability
http://www.securityfocus.com/bid/52446

Apache 'mod_fcgid' Module Denial Of Service Vulnerability
http://www.securityfocus.com/bid/52565

Apache 'mod_fcgid' Module Unspecified Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/44900

ChaSen Unspecified Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/50588

Google Chrome Prior to 19 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/53540

Todd Miller Sudo Host_List Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/53569

CUPS 'texttops' Filter NULL-pointer Dereference Vulnerability
http://www.securityfocus.com/bid/40943

CUPS Web Interface Information Disclosure Vulnerability
http://www.securityfocus.com/bid/40897

CUPS 'cupsFileOpen' function Symlink Attack Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/41131

CUPS Web Interface Unspecified Cross Site Request Forgery Vulnerability
http://www.securityfocus.com/bid/40889

CUPS 'gif_read_lzw()' CVE-2011-3170 GIF File Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/49323

CUPS 'lppasswd' Tool Localized Message String Security Weakness
http://www.securityfocus.com/bid/38524

CUPS File Descriptors Handling Use-After-Free Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38510

CUPS File Descriptors Handling Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/37048

CUPS Server 'cups/ipp.c' Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/44530

CUPS 'cupsDoAuthentication()' Infinite Loop Denial of Service Vulnerability
http://www.securityfocus.com/bid/41126

Open Upload Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
http://www.securityfocus.com/bid/54372

WordPress WP-Predict Plugin 'PredictId' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/54370

WP Symposium Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/54369

WordPress PageflipBook Plugin 'pageflipbook_language' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/54368

Linux Kernel IPv6 'nf_ct_frag6_reasm()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/54367

Linux Kernel Key Management CVE-2012-2745 Denial Of Service Vulnerability
http://www.securityfocus.com/bid/54365

WordPress Sendit Newsletter plugin 'id' SQL Injection Vulnerability
http://www.securityfocus.com/bid/54364

WordPress The Guardian News Feed Plugin Cross Site Request Forgery Vulnerability
http://www.securityfocus.com/bid/54363

Microsoft Office for Mac Improper Folder Permissions Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/54361

Microsoft SharePoint CVE-2012-1863 Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/54316

Microsoft SharePoint CVE-2012-1862 URI Redirection Vulnerability
http://www.securityfocus.com/bid/54315

Microsoft SharePoint Search Scope Information Disclosure Vulnerability
http://www.securityfocus.com/bid/54314

Microsoft SharePoint CVE-2012-1861 HTML Injection Vulnerability
http://www.securityfocus.com/bid/54313

Microsoft SharePoint 'scriptresx.ashx' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/54312

Microsoft Data Access Components CVE-2012-1891 Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/54308

Microsoft Windows File/Directory Names Handling Arbitrary Command Injection Vulnerability
http://www.securityfocus.com/bid/54307

Microsoft Windows TLS Protocol CBC Mode Information Disclosure Vulnerability
http://www.securityfocus.com/bid/54304

Microsoft Windows CVE-2012-1893 Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/54302

Microsoft Internet Explorer CVE-2012-1524 Attribute Remove Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/54294

Microsoft Internet Explorer CVE-2012-1522 Cached Object Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/54293

Microsoft Windows CVE-2012-1890 Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/54285

ラベル:

0 件のコメント:

コメントを投稿

登録: コメントの投稿 (Atom)