7日 水曜日、友引

+ RHSA-2012:1426 Moderate: kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2012-1426.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1568
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3511

+ Google Chrome 23.0.1271.64 released
http://googlechromereleases.blogspot.jp/2012/11/stable-channel-release-and-beta-channel.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5127
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5118
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5121
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5117
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5122
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5123
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5124
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5125
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5126
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5128

+ Opera 12.10 released
http://www.opera.com/docs/changelogs/unified/1210/

+ APSB12-24 Security updates available for Adobe Flash Player
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5275
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5279
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5280

+ UPDATE: HPSBHF02699 SSRT100592 rev.2 - HP ProLiant SL Advanced Power Manager (SL-APM), Remote User Validation Failure
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c02950841-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ UPDATE: Microsoft Security Advisory (2755801) Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10
http://technet.microsoft.com/en-us/security/advisory/2755801

+ CA ARCserveに関するセキュリティ問題
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-024/index.html

+ lm-sensors 3.3.3 released
http://www.lm-sensors.org/browser/lm-sensors/tags/V3-3-3/CHANGES

+ Linux Kernel KVM CVE-2012-4461 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/56414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4461

+ Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
http://www.securityfocus.com/bid/56403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3439

Multiple vulnerabilities in WebUI of UTM-1 Edge, Safe@Office and ZoneAlarm appliances
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk65460&src=securityAlerts

InterScan Web Security Virtual Appliance 5.6 公開のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1857

Advisory: Tavis Ormandy finds vulnerabilities in Sophos Anti-Virus products
http://www.sophos.com/en-us/support/knowledgebase/118424.aspx

Advisory: Upgrade to Sophos Anti-Virus for Mac, version 8
http://www.sophos.com/en-us/support/knowledgebase/116709.aspx

ラインアップ充実する標的型攻撃対策、新タイプが登場し競争激化へ
http://itpro.nikkeibp.co.jp/article/COLUMN/20121022/431681/?ST=security

シマンテックの法人向け「SEP11」に遠隔操作の恐れある脆弱性、現時点で対策方法なし
http://itpro.nikkeibp.co.jp/article/NEWS/20121106/435336/?ST=security

セキュリティ専任のエンジニアは300人、グーグルがセキュリティの取り組みを解説
http://itpro.nikkeibp.co.jp/article/NEWS/20121106/435334/?ST=security

Vulnerable, superfluous/outdated/deprecated/superseded 3rd party OCXs and DLLs distributed by and in
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-11/msg00031.html

[security bulletin] HPSBHF02699 SSRT100592 rev.2 - HP ProLiant SL Advanced Power Manager (SL-
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-11/msg00030.html

SQL Injection Vulnerability in OrangeHRM
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-11/msg00027.html

Multiple Vulnerabilities in LibreOffice
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-11/msg00026.html

Wisecracker 1.0 - A high performance distributed cryptanalysis framework
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-11/msg00029.html

multiple critical vulnerabilities in sophos products
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2012-11/msg00028.html

JVNVU#662243 Sophos Antivirus に複数の脆弱性
http://jvn.jp/cert/JVNVU662243/index.html

JVNVU#985625 複数の Symantec 製品に脆弱性
http://jvn.jp/cert/JVNVU985625/index.html

What to watch out For on Election Day
http://isc.sans.edu/diary.html?storyid=14461

Apple Safari Denial of Service Remote Attackers Vulnerability
http://www.securiteam.com/securitynews/6C02W1P60W.html

VU#180091 VeriCentre web application SQL injection vulnerability
http://www.kb.cert.org/vuls/id/180091

Apache Tomcat Header Processing Bug Lets Remote Users Deny Service
http://www.securitytracker.com/id/1027729

Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
http://www.securitytracker.com/id/1027728

LibreOffice Null Pointer Dereferences Let Remote Users Deny Service
http://www.securitytracker.com/id/1027727

Symantec Endpoint Protection CAB File Processing Flaw Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1027726

Sophos Anti-Virus Bugs Let Remote Users Execute Arbitrary Code with Root Privileges and Conduct Cross-Site Scripting Attacks and Let Local Users Gain Elevated Privileges
http://www.securitytracker.com/id/1027725

VeriCentre Web Console Multiple SQL Injection Vulnerabilities
http://secunia.com/advisories/51122/

ZPanel Cross-Site Request Forgery and SQL Injection Vulnerabilities
http://secunia.com/advisories/51172/

Python tweepy Module SSL Certificate Verification Security Issue
http://secunia.com/advisories/51223/

Opera Multiple Vulnerabilities
http://secunia.com/advisories/51183/

Apache Axis SSL Certificate Verification Security Issue
http://secunia.com/advisories/51219/

GEGL PPM Image Processing Integer Overflow Vulnerability
http://secunia.com/advisories/51114/

Ubuntu update for mesa
http://secunia.com/advisories/51215/

Ubuntu update for munin
http://secunia.com/advisories/51218/

Apache Tomcat Security Bypass and Denial of Service Vulnerabilities
http://secunia.com/advisories/51138/

Sysax FTP Automation Task Scheduling Privilege Escalation Security Issue
http://secunia.com/advisories/51173/

Sophos Products Multiple Vulnerabilities *youtube
http://cxsecurity.com/issue/WLB-2012110022

Solucionweb (default.php) SQL Injection Vulnerability
http://cxsecurity.com/issue/WLB-2012110030

Apache Tomcat 6.x / 7.x Denial Of Service
http://cxsecurity.com/issue/WLB-2012110029

Apache Tomcat 5.x / 6.x / 7.x DIGEST Authentication Weaknesses
http://cxsecurity.com/issue/WLB-2012110028

EmpireCMS 6.6 PHP Code Execution
http://cxsecurity.com/issue/WLB-2012110027

WinRM VBS Remote Code Execution
http://cxsecurity.com/issue/WLB-2012110026

KMPlayer 3.3.0.33 Buffer Overflow / DLL Hijack
http://cxsecurity.com/issue/WLB-2012110025

Zoom Graphics Cross Site Scripting
http://cxsecurity.com/issue/WLB-2012110024

Rakintech SQL Injection
http://cxsecurity.com/issue/WLB-2012110023

Linux Kernel SFC Driver CVE-2012-3412 Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/54763

Linux Kernel 'madvise_remove()' Function Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/55151

Linux Kernel ASLR Security Bypass Weakness
http://www.securityfocus.com/bid/52687

Linux Kernel UDF Filesystem Local Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/54279

Linux Kernel Hugepages CVE-2012-2133 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/53233

Claws Mail 'strchr()' Function NULL Pointer Denial of Service Vulnerability
http://www.securityfocus.com/bid/55837

Linux Kernel 'tcp_illinois_info()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/56346

Oracle MySQL Server CVE-2012-3160 Local Security Vulnerability
http://www.securityfocus.com/bid/56027

Linux Kernel 'uname()' System Call Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/55855

Linux Kernel 'ext4_convert_unwritten_exten()' Function Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/56238

xlockmore 'dclock' Mode Security Bypass Vulnerability
http://www.securityfocus.com/bid/56169

ViewVC CVE-2012-4533 HTML Injection Vulnerability
http://www.securityfocus.com/bid/56161

EMC NetWorker 'nsrd' RPC Service Format String Vulnerability
http://www.securityfocus.com/bid/55330

Linux Kernel KVM CVE-2012-4461 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/56414

Google Chrome Prior to 23.0.1271.64 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/56413

Performance Co-Pilot Multiple Information Disclosure Vulnerabilities
http://www.securityfocus.com/bid/56411

Python tweepy Library SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/56410

VeriCentre Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/56409

Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/56408

Opera Web Browser Prior to 12.10 Multiple Vulnerabilities
http://www.securityfocus.com/bid/56407

GEGL CVE-2012-4433 Integer Overflow Vulnerability
http://www.securityfocus.com/bid/56404

Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
http://www.securityfocus.com/bid/56403