3日 水曜日、赤口

+ RHSA-2013:0696 Critical: firefox security update
http://rhn.redhat.com/errata/RHSA-2013-0696.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0795
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0796
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0800

+ RHSA-2013:0697 Important: thunderbird security update
http://rhn.redhat.com/errata/RHSA-2013-0697.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0795
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0796
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0800

+ Mozilla Firefox 20.0 released
http://www.mozilla.org/en-US/firefox/20.0/releasenotes/

+ Mozilla Thunderbird 17.0.5 released
http://www.mozilla.org/en-US/thunderbird/17.0.5/releasenotes/

+ MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage
http://www.mozilla.org/security/announce/2013/mfsa2013-40.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0791

+ MFSA 2013-39 Memory corruption while rendering grayscale PNG images
http://www.mozilla.org/security/announce/2013/mfsa2013-39.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0792

+ MFSA 2013-38 Cross-site scripting (XSS) using timed history navigations
http://www.mozilla.org/security/announce/2013/mfsa2013-38.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0793

+ MFSA 2013-37 Bypass of tab-modal dialog origin disclosure
http://www.mozilla.org/security/announce/2013/mfsa2013-37.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0794

+ MFSA 2013-36 Bypass of SOW protections allows cloning of protected nodes
http://www.mozilla.org/security/announce/2013/mfsa2013-35.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0795

+ MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux
http://www.mozilla.org/security/announce/2013/mfsa2013-35.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0796

+ MFSA 2013-34 Privilege escalation through Mozilla Updater
http://www.mozilla.org/security/announce/2013/mfsa2013-34.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0797

+ MFSA 2013-33 World read and write access to app_tmp directory on Android
http://www.mozilla.org/security/announce/2013/mfsa2013-33.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0798

+ MFSA 2013-32 Privilege escalation through Mozilla Maintenance Service
http://www.mozilla.org/security/announce/2013/mfsa2013-32.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0799

+ MFSA 2013-31 Out-of-bounds write in Cairo library
http://www.mozilla.org/security/announce/2013/mfsa2013-31.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0800

+ MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 / rv:17.0.5)
http://www.mozilla.org/security/announce/2013/mfsa2013-30.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0789
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0790

+ nginx-1.2.8 stable version released
http://nginx.org/en/download.html

+ UPDATE: HPSBNS02843 SSRT101001 rev.2 - HP NonStop Servers running OSS Remote Operations, Unauthorized Disclosure of Information, Unauthorized Modification, Unauthorized Access to Files
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03654586-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ CVE-2013-0255 Array Index error vulnerability in PostgreSQL
https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0255

+ FreeBSD-SA-13:04.bind BIND remote denial of service
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:04.bind.asc

+ FreeBSD-SA-13:03.openssl OpenSSL multiple vulnerabilities
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:03.openssl.asc

+ s3:smbd:smb2: fix an assignment-instead-of-check bug conn_snum_used()
http://ftp.samba.org/pub/samba/patches/security/samba-3.6-CVE-2013-0454.patch
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0454

+ Sudo 1.8.6p7 released
http://www.sudo.ws/sudo/devel.html#1.8.7b1

+ VU#704916 The TigerText Free Consumer Private Texting App (iOS) sends unencrypted user information in support requests
http://www.kb.cert.org/vuls/id/704916
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0128

+ SA52867 Skype Unspecified Vulnerabilities
http://secunia.com/advisories/52867/

PostgreSQL Conference Europe 2013 - date and location
http://www.postgresql.org/about/news/1455/

チェックしておきたい脆弱性情報＜2013.04.03＞
http://itpro.nikkeibp.co.jp/article/COLUMN/20130401/467643/?ST=security

スマホ最大のセキュリティリスクはウイルスではない
http://itpro.nikkeibp.co.jp/article/Watcher/20130401/467542/?ST=security

IIJ、運用管理込みのファイアウォールレンタルにパロアルト製品を追加
http://itpro.nikkeibp.co.jp/article/NEWS/20130402/468108/?ST=security

マカフィー、10月以降実行型サンドボックス「ValidEdge」をIPS製品などに搭載
http://itpro.nikkeibp.co.jp/article/NEWS/20130402/467981/?ST=security