31日 月曜日、先負

+ UPDATE: HPSBST02968 rev.2 - HP StoreOnce, Remote Unauthorized Access
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04126368-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ SYM14-005 セキュリティ アドバイザリー - Symantec LiveUpdate Administrator における、アカウントのアクセス権の不正な改ざんと不正な SQL インジェクションの問題
http://www.symantec.com/ja/jp/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00

+ HS14-008 DoS Vulnerability in Cosminexus
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-008/index.html

+ HS14-008 CosminexusにおけるDoS脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-008/index.html

+ Tomcat 8.0.5 (beta) Released
http://tomcat.apache.org/tomcat-8.0-doc/changelog.html

+ OpenSSH DNS SSH Fingerprint Record Check Can Be Bypassed By Remote Users
http://www.securitytracker.com/id/1029971
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2653

+ SA57540 Linux Kernel "inet_frag_intern()" Race Condition Vulnerability
http://secunia.com/advisories/57540/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0100

+ Linux Kernel 3.13.6 ath_tx_aggr_sleep() Local DoS
http://cxsecurity.com/issue/WLB-2014030252

+ nginx 1.4.6/1.5.11 Heap-based buffer overflow in the SPDY
http://cxsecurity.com/issue/WLB-2014030250
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133

「セクシー動画」アプリに注意、アカウント情報を盗まれる
http://itpro.nikkeibp.co.jp/article/NEWS/20140328/546925/?ST=security

2013年の不正アクセス件数は過去最多、不正送金が1000件超に
http://itpro.nikkeibp.co.jp/article/NEWS/20140328/546848/?ST=security

米政府、既存の通話記録収集プログラムの終了を正式発表
http://itpro.nikkeibp.co.jp/article/NEWS/20140328/546822/?ST=security

JVNVU#90746870 ManageEngine OpStor に複数の脆弱性
http://jvn.jp/vu/JVNVU90746870/index.html

LOCAL: AudioCoder 0.8.29 - Memory Corruption (SEH)
http://www.exploit-db.com/exploits/32585

28日 金曜日、大安

+ CESA-2014:0330 Moderate CentOS 6 samba Update
http://lwn.net/Alerts/592253/

+ phpMyAdmin 4.1.12 is released
http://sourceforge.net/p/phpmyadmin/news/2014/03/phpmyadmin-4112-is-released/

+ SYM14-005 Security Advisories Relating to Symantec Products - Symantec LiveUpdate Administrator Unauthenticated/Unauthorized Account Access Modification and SQL injections
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140327_00

+ MySQL 5.6.17, 5.5.37 released
http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-17.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html

+ SonicWALL Email Security Input Validation Flaw in 'License Management’ and ‘Advanced' Pages Permits Cross-Site Scripting Attacks
http://www.securitytracker.com/id/1029965

+ Mozilla Firefox "BumpChunk" Object Processing Use-After-Free
http://cxsecurity.com/issue/WLB-2014030228

+ Google Chrome Blink "locationAttributeSetter" Use-After-Free
http://cxsecurity.com/issue/WLB-2014030227

+ Firefox For Android Information Leak
http://cxsecurity.com/issue/WLB-2014030226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1484
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1515
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1506

+ SA57468 Linux Kernel ath9k "ath_tx_aggr_sleep()" Race Condition Vulnerability
http://secunia.com/advisories/57468/

+ SA57436 Linux Kernel PowerPC Fork/Clone Denial of Service Vulnerability
http://secunia.com/advisories/57436/

+ Linux Kernel 'arch_dup_task_struct()' Function Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/66477

+ Symantec LiveUpdate Administrator CVE-2014-1645 SQL Injection Vulnerability
http://www.securityfocus.com/bid/66400
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1645

+ Symantec LiveUpdate Administrator CVE-2014-1644 Unauthorized Access Vulnerability
http://www.securityfocus.com/bid/66399
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1644

スマートスキャンパターンが更新されていない事象について
http://app.trendmicro.co.jp/support/news.asp?id=2102

10カ国語で「ビットコイン払え」、新たな“脅迫ウイルス”出現
http://itpro.nikkeibp.co.jp/article/NEWS/20140327/546704/?ST=security

BlackBerryのChen暫定CEO、「リークに対して法的措置を講じる」
http://itpro.nikkeibp.co.jp/article/NEWS/20140327/546485/?ST=security

VU#140886 ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities
http://www.kb.cert.org/vuls/id/140886

27日 木曜日、仏滅

+ CESA-2014:0328 Important CentOS 6 kernel Update
http://lwn.net/Alerts/592021/

+ Cisco IOS Software SSL VPN Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ios-sslvpn
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2112

+ Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2106

+ Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-RSP72010GE
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2107

+ Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ikev2
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2108

+ Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ipv6
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2113

+ Cisco IOS Software Network Address Translation Vulnerabilities
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-nat
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2111
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2109

+ HPSBST02968 rev.1 - HP StoreOnce, Remote Unauthorized Access
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04126368-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6211

+ Linux kernel 3.12.15 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15

+ CVE-2013-6462 Buffer Errors vulnerability in X.Org
https://blogs.oracle.com/sunsecurity/entry/cve_2013_6462_buffer_errors
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6462

+ Apache httpd 2.2.27 Released
http://www.apache.org/dist/httpd/CHANGES_2.2.27
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438

+ RSA Authentication Manager Flaw in Self-Service Console Permits Cross-Frame Scripting Attacks
http://www.securitytracker.com/id/1029963
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0623

+ REMOTE: Katello (Red Hat Satellite) users/update_roles Missing Authorization
http://www.exploit-db.com/exploits/32515

+ SA57434 libcURL Connection Re-use and Certificate Verification Security Issues
http://secunia.com/advisories/57434/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2522

+ Linux Kernel 'get_rx_bufs()' Function Denial of Service Vulnerability
http://www.securityfocus.com/bid/66441
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0055

+ cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/66458
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139

+ cURL/libcURL CVE-2014-0138 Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/66457
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138

Trend Micro Deep Security 8.0 Service Pack 2 Patch 2 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2099

自衛隊の「サイバー防衛隊」発足、防衛大臣直轄で脅威に対処
http://itpro.nikkeibp.co.jp/article/NEWS/20140326/546344/?ST=security

Obama大統領、通話記録収集活動を終了する方針を明らかに---米メディアの報道
http://itpro.nikkeibp.co.jp/article/NEWS/20140326/545942/?ST=security

UPDATE: JVNVU#96176042 NTP が DDoS 攻撃の踏み台として使用される問題
http://jvn.jp/vu/JVNVU96176042/

JVNVU#94951842 Virtual Access GW6110A に権限昇格の脆弱性
http://jvn.jp/vu/JVNVU94951842/

DoS/PoC: Couchdb 1.5.0 - uuids DoS Exploit
http://www.exploit-db.com/exploits/32519

DoS/PoC: VirusChaser 8.0 - Stack Buffer Overflow
http://www.exploit-db.com/exploits/32522

26日 水曜日、先負

+ RHSA-2014:0328 Important: kernel security and bug fix update
http://rhn.redhat.com/errata/RHSA-2014-0328.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1860
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0055
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0069
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0101

+ RHSA-2014:0330 Moderate: samba and samba3x security update
http://rhn.redhat.com/errata/RHSA-2014-0330.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6150
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4496

+ CESA-2014:0330 Moderate CentOS 5 samba3x Update
http://lwn.net/Alerts/591872/

+ CESA-2014:0322 Moderate CentOS 5 net-snmp Update
http://lwn.net/Alerts/591870/

+ CESA-2014:0321 Moderate CentOS 6 net-snmp Update
http://lwn.net/Alerts/591871/

+ CVE-2013-0900 Race Conditions vulnerability in ICU
https://blogs.oracle.com/sunsecurity/entry/cve_2013_0900_race_conditions
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0900

+ CVE-2013-5745 Input Validation vulnerability in Vino
https://blogs.oracle.com/sunsecurity/entry/cve_2013_5745_input_validation
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5745

+ CVE-2008-0386 Improper Input Validation vulnerability in Xdg-utils
https://blogs.oracle.com/sunsecurity/entry/cve_2008_0386_improper_input
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0386

+ CVE-2014-0591 Buffer Errors vulnerability in Bind
https://blogs.oracle.com/sunsecurity/entry/cve_2014_0591_buffer_errors
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591

+ CVE-2013-6462 Buffer Errors vulnerability in X.Org
https://blogs.oracle.com/sunsecurity/entry/cve_2013_6462_buffer_errors
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6462

+ CVE-2013-2561 Link Following vulnerability in OpenFabrics ibutils
https://blogs.oracle.com/sunsecurity/entry/cve_2013_2561_link_following
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2561

+ Multiple vulnerabilities in Wireshark
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark9
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7112
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7114

+ CVE-2014-0397 Buffer Errors vulnerability in libXtsol
https://blogs.oracle.com/sunsecurity/entry/cve_2014_0397_buffer_errors
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0397

+ CVE-2013-4408 Buffer Errors vulnerability in Samba
https://blogs.oracle.com/sunsecurity/entry/cve_2013_4408_buffer_errors
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4408

+ CVE-2012-6150 Input Validation vulnerability in Samba
https://blogs.oracle.com/sunsecurity/entry/cve_2012_6150_input_validation
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6150

+ CVE-2006-4810 Buffer overflow vulnerability in Texinfo
https://blogs.oracle.com/sunsecurity/entry/cve_2006_4810_buffer_overflow
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4810

+ Microsoft Security Advisory (2953095) Vulnerability in Microsoft Word Could Allow Remote Code Execution
http://technet.microsoft.com/en-us/security/advisory/2953095
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1761

+ マイクロソフト セキュリティ アドバイザリ (2953095) Microsoft Word の脆弱性により、リモートでコードが実行される
http://technet.microsoft.com/ja-jp/security/advisory/2953095
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1761

+ OpenSSL 1.0.0l cache side-channel attack
http://cxsecurity.com/issue/WLB-2014030197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076

+ Linux kernel 3.13.6 DCCP arbitrary code execution
http://cxsecurity.com/issue/WLB-2014030194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2523

+ Windows Media Player 11.0.5721.5230 Memory Corruption PoC
http://cxsecurity.com/issue/WLB-2014030192

+ SA57564 PHP Fileinfo libmagic AWK File Processing Denial of Service Vulnerability
http://secunia.com/advisories/57564/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345

+ SA53612 Linux Kernel xen-netback NAPI Packet Handling Denial of Service Vulnerability
http://secunia.com/advisories/53612/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2580

+ SA57577 Microsoft Word RTF Memory Corruption Vulnerability
http://secunia.com/advisories/57577/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1761

+ PHP Fileinfo Component Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/66406
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345

Deep Discovery Inspector 3.5 Patch 1 (Build 1442) 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2093

“スマホ版仮想デスクトップ”で強固なセキュリティを、トレンドマイクロ
http://itpro.nikkeibp.co.jp/article/NEWS/20140325/545826/?ST=security

Wordに危険な脆弱性が発覚、悪用した標的型攻撃も
http://itpro.nikkeibp.co.jp/article/NEWS/20140325/545727/?ST=security

日本ベリサイン、「シマンテック・ウェブサイトセキュリティ」に社名変更
http://itpro.nikkeibp.co.jp/article/NEWS/20140325/545687/?ST=security

NSAのHuaweiサーバー侵入について中国が米国に説明を要求---海外メディアの報道
http://itpro.nikkeibp.co.jp/article/NEWS/20140325/545643/?ST=security

VU#213046 Virtual Access GW6110A router privilege escalation vulnerability
http://www.kb.cert.org/vuls/id/213046

REMOTE: FreePBX config.php Remote Code Execution
http://www.exploit-db.com/exploits/32512

DoS/PoC: Haihaisoft HUPlayer 1.0.4.8 (.m3u, .pls, .asx) - Buffer Overflow (SEH)
http://www.exploit-db.com/exploits/32513

DoS/PoC: Haihaisoft Universal Player 1.5.8 (.m3u, .pls, .asx) - Buffer Overflow (SEH)
http://www.exploit-db.com/exploits/32514

25日 火曜日、友引

+ RHSA-2014:0321 Moderate: net-snmp security and bug fix update
http://rhn.redhat.com/errata/RHSA-2014-0321.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2284

+ Mozilla Firefox 28.0.1 released
http://www.mozilla.org/en-US/firefox/28.0/releasenotes/

+ MFSA 2014-33 File: protocol links downloaded to SD card by default
http://www.mozilla.org/security/announce/2014/mfsa2014-33.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1515

+ iTunes 11.1.5 released
http://www.apple.com/itunes/download/

+ CESA-2014:0316 Important CentOS 5 thunderbird Update
http://lwn.net/Alerts/591184/

+ CESA-2014:0316 Important CentOS 6 thunderbird Update
http://lwn.net/Alerts/591183/

+ phpMyAdmin 4.1.11 is released
http://sourceforge.net/p/phpmyadmin/news/2014/03/phpmyadmin-4111-is-released/

+ Linux kernel 3.13.7, 3.10.34, 3.4.84 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.34
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.84

+ RHSA-2014:0322 Moderate: net-snmp security update
http://rhn.redhat.com/errata/RHSA-2014-0322.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6151
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2285

+ PostgreSQL updates 9.3.4, 9.2.8, 9.1.13, 9.0.17, and 8.4.21 released
http://www.postgresql.org/about/news/1511/
http://www.postgresql.org/docs/9.3/static/release-9-3-4.html
http://www.postgresql.org/docs/9.2/static/release-9-2-8.html
http://www.postgresql.org/docs/9.1/static/release-9-1-13.html
http://www.postgresql.org/docs/9.0/static/release-9-0-17.html
http://www.postgresql.org/docs/8.4/static/release-8-4-21.html

+ Microsoft Word RTF File Processing Flaw Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1029948
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1761

+ PHP Null Pointer Dereference in libgd gdImageCreateFromXpm() Lets Remote Users Deny Service
http://www.securitytracker.com/id/1029947
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2497

+ Linux Kernel Netfilter DCCP Processing Flaw Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1029945
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2523

+ Google Chrome Bugs Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1029940
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1715

+ REMOTE: MS14-012 Internet Explorer TextRange Use-After-Free
http://www.exploit-db.com/exploits/32438

+ DoS/PoC: Windows Media Player 11.0.5721.5230 - Memory Corruption PoC
http://www.exploit-db.com/exploits/32477

+ SA57541 Linux Kernel SCTP Handshake NULL Pointer Dereference Vulnerability
http://secunia.com/advisories/57541/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0101

+ SA57542 Linux Kernel "keyring_detect_cycle_iterator()" Denial of Service Vulnerability
http://secunia.com/advisories/57542/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0102

+ SA57284 Linux Kernel "rds_ib_laddr_check()" NULL Pointer Dereference Vulnerability
http://secunia.com/advisories/57284/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7339

+ SA57488 OpenSSH "child_set_env()" Security Bypass Security Issue
http://secunia.com/advisories/57488/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2532

+ SA57091 OpenSSL ECDSA Nonces Recovery Weakness
http://secunia.com/advisories/57091/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076

+ Linux Kernel potential information leak when ubuf backed skbs are skb_zerocopy()
http://cxsecurity.com/issue/WLB-2014030180
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2568

+ Microsoft Internet Explorer TextRange Use-After-Free (MS14-012) Exploit
http://cxsecurity.com/issue/WLB-2014030176
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0307

+ Linux Kernel rds prevent dereference of a NULL device
http://cxsecurity.com/issue/WLB-2014030169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7339

+ Microsoft Word CVE-2014-1761 Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/66385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1761

+ OpenSSH 'child_set_env()' Function Security Bypass Vulnerability
http://www.securityfocus.com/bid/66355
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2532

+ Linux Kernel CVE-2014-2568 Information Disclosure Vulnerability
http://www.securityfocus.com/bid/66348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2568

+ Linux Kernel CVE-2013-7339 NULL Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/66351
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7339

ウイルスバスタービジネスセキュリティサービス 5.3 Service Pack 1公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2098

JVNDB-2014-000033 ES File Explorer におけるディレクトリトラバーサルの脆弱性
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000033.html

JVNDB-2014-000032 Silex におけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000032.html

JIAA、インターネット広告のプライバシーポリシーガイドラインを9年ぶりに改定
http://itpro.nikkeibp.co.jp/article/NEWS/20140325/545622/?ST=security

「攻撃者は必ず痕跡を消そうとする」、トレンドマイクロが実際の攻撃から解析
http://itpro.nikkeibp.co.jp/article/NEWS/20140324/545582/?ST=security

［続報］KADOKAWAへの不正アクセス、大手銀行を装うフィッシングが目的
http://itpro.nikkeibp.co.jp/article/NEWS/20140324/545503/?ST=security

「KADOKAWA」のサーバーに再び不正アクセス、フィッシングの踏み台に
http://itpro.nikkeibp.co.jp/article/NEWS/20140324/545282/?ST=security

トルコ政府のTwitter遮断は成果無し、いっそう高まる批判---海外メディアの報道
http://itpro.nikkeibp.co.jp/article/NEWS/20140324/545262/?ST=security

REMOTE: Horde Framework Unserialize PHP Code Execution
http://www.exploit-db.com/exploits/32439

REMOTE: Array Networks vAPV and vxAG Private Key Privelege Escalation Code Execution
http://www.exploit-db.com/exploits/32440

DoS/PoC: jetVideo 8.1.1 - Basic (.wav) Local Crash PoC
http://www.exploit-db.com/exploits/32478

DoS/PoC: Light Audio Player 1.0.14 - Memory Corruption PoC
http://www.exploit-db.com/exploits/32481

DoS/PoC: GOM Media Player (GOMMP) 2.2.56.5183 - Memory Corruption PoC
http://www.exploit-db.com/exploits/32482

DoS/PoC: GOM Video Converter 1.1.0.60 - Memory Corruption PoC
http://www.exploit-db.com/exploits/32483

20日 木曜日、先負

+ RHSA-2014:0316 Important: thunderbird security update
http://rhn.redhat.com/errata/RHSA-2014-0316.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1493
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1505
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1508
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1509
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1511
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1512
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1514

+ CESA-2014:0310 Critical CentOS 6 firefox Update
http://lwn.net/Alerts/591067/

+ CESA-2014:0311 Critical CentOS 5 php Update
http://lwn.net/Alerts/591068/

+ Cisco AsyncOS Software Code Execution Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2119

+ McAfee Asset Manager Input Validation Flaws Let Remote Authenticated Users Inject SQL Commands and Download Files
http://www.securitytracker.com/id/1029927

+ Apache HTTP Server Two Denial of Service Vulnerabilities
http://secunia.com/advisories/57399/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098

+ Apache HTTP Server 2.4.7 mod_log_config denial of service
http://cxsecurity.com/issue/WLB-2014030150

+ Apache HTTP Server 2.4.7 dav_xml_get_cdata DoS
http://cxsecurity.com/issue/WLB-2014030149

+ OpenSSH 6.5 wildcards on AcceptEnv remote bypass environment restrictions
http://cxsecurity.com/issue/WLB-2014030148
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2532

サーバメンテナンスのお知らせ（2014/3/31）
http://app.trendmicro.co.jp/support/news.asp?id=2096

モバイルアプリの9割には攻撃可能な脆弱性、HPの調査で明らかに
http://itpro.nikkeibp.co.jp/article/NEWS/20140319/544723/?ST=security

「Suicaポイントクラブ」に不正アクセス、約92万件のログイン失敗
http://itpro.nikkeibp.co.jp/article/NEWS/20140319/544694/?ST=security

REMOTE: Quantum vmPRO - Backdoor Command
http://www.exploit-db.com/exploits/32367

REMOTE: SePortal 2.5 - SQL Injection Vulnerabilty
http://www.exploit-db.com/exploits/32359

REMOTE: Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key
http://www.exploit-db.com/exploits/32371

REMOTE: Quantum DXi V1000 2.2.1 - Static SSH Key
http://www.exploit-db.com/exploits/32372

LOCAL: MP3Info 0.8.5a - SEH Buffer Overflow Exploit
http://www.exploit-db.com/exploits/32358

LOCAL: Quantum vmPRO 3.1.2 - Privilege Escalation
http://www.exploit-db.com/exploits/32370

19日 水曜日、友引

+ RHSA-2014:0310 Critical: firefox security update
http://rhn.redhat.com/errata/RHSA-2014-0310.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1493
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1505
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1508
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1509
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1511
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1512
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1514

+ Mozilla Firefox 28 released
http://www.mozilla.jp/firefox/28.0/releasenotes/

+ Mozilla Thunderbird 24.3.0 released
http://www.mozilla.jp/thunderbird/24.4.0/releasenotes/

+ MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering
http://www.mozilla.org/security/announce/2014/mfsa2014-32.html

+ MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects
http://www.mozilla.org/security/announce/2014/mfsa2014-31.html

+ MFSA 2014-30 Use-after-free in TypeObject
http://www.mozilla.org/security/announce/2014/mfsa2014-30.html

+ MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs
http://www.mozilla.org/security/announce/2014/mfsa2014-29.html

+ MFSA 2014-28 SVG filters information disclosure through feDisplacementMap
http://www.mozilla.org/security/announce/2014/mfsa2014-28.html

+ MFSA 2014-27 Memory corruption in Cairo during PDF font rendering
http://www.mozilla.org/security/announce/2014/mfsa2014-27.html

+ MFSA 2014-26 Information disclosure through polygon rendering in MathML
http://www.mozilla.org/security/announce/2014/mfsa2014-26.html

+ MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape
http://www.mozilla.org/security/announce/2014/mfsa2014-25.html

+ MFSA 2014-24 Android Crash Reporter open to manipulation
http://www.mozilla.org/security/announce/2014/mfsa2014-24.html

+ MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore
http://www.mozilla.org/security/announce/2014/mfsa2014-23.html

+ MFSA 2014-22 WebGL content injection from one domain to rendering in another
http://www.mozilla.org/security/announce/2014/mfsa2014-22.html

+ MFSA 2014-21 Local file access via Open Link in new tab
http://www.mozilla.org/security/announce/2014/mfsa2014-21.html

+ MFSA 2014-20 onbeforeunload and Javascript navigation DOS
http://www.mozilla.org/security/announce/2014/mfsa2014-20.html

+ MFSA 2014-19 Spoofing attack on WebRTC permission prompt
http://www.mozilla.org/security/announce/2014/mfsa2014-19.html

+ MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key
http://www.mozilla.org/security/announce/2014/mfsa2014-18.html

+ MFSA 2014-17 Out of bounds read during WAV file decoding
http://www.mozilla.org/security/announce/2014/mfsa2014-17.html

+ MFSA 2014-16 Files extracted during updates are not always read only
http://www.mozilla.org/security/announce/2014/mfsa2014-16.html

+ MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)
http://www.mozilla.org/security/announce/2014/mfsa2014-15.html

+ CESA-2014:0304 Important CentOS 6 mutt Update
http://lwn.net/Alerts/590965/

+ CESA-2014:0306 Moderate ruby193-rubygem-actionpack SCL Security Update
http://lwn.net/Alerts/590966/

+ CESA-2014:0305 Moderate CentOS 5 samba Update
http://lwn.net/Alerts/590967/

+ UPDATE: HPSBNS02969 rev.2 - HP NonStop Servers running Java 7, Multiple Remote Vulnerabilities affecting Confidentiality, Integrity and Availability
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04126444-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ RHSA-2014:0311 Critical: php security update
http://rhn.redhat.com/errata/RHSA-2014-0311.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7243
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0689

+ Apache HTTPD 2.2.27 released
http://www.apache.org/dist/httpd/CHANGES_2.2.27

+ Java SE 8 Released
http://www.oracle.com/technetwork/java/javase/8train-relnotes-latest-2153846.html

+ Apache mod_dav and mod_log_config Bugs Let Remote Users Deny Service
http://www.securitytracker.com/id/1029926
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098

+ OpenSSH AcceptEnv Wildcard Processing Flaw May Let Remote Authenticated Users Bypass Environment Restrictions
http://www.securitytracker.com/id/1029925
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2532

+ Samba smbcacls Command Error May Let Remote Users Bypass Access Controls
http://www.securitytracker.com/id/1029922
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442

+ SA57446 Linux Kernel DCCP Packets Handling Memory Corruption Vulnerabilities
http://secunia.com/advisories/57446/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2523

+ SA57349 PHP "gdImageCreateFromXpm()" NULL Pointer Dereference Vulnerability
http://secunia.com/advisories/57349/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2497

+ Linux Kernel Multiple Function Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/66279
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2523

Check Point response to "Bypassing Application Control"
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98851&src=securityAlerts

InterScan Web Security Suite 5.6 Linux版 Service Pack 1 (Build 1062) 一時公開停止のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2097

Network VirusWall Enforcer バージョン 2.0/3.x 用 ネットワークウイルス検索エンジン 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2092

JVNDB-2014-000029 spモードメールにおいて Java メソッドが実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000029.html

JVNDB-2014-000028 spモードメールで作成中のメールへのアクセスに関する問題
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000028.html

JVNDB-2014-000027 spモードメールにおける受信メールの添付ファイルへのアクセスに関する問題
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000027.html

2014年版 情報セキュリティ10大脅威
http://www.ipa.go.jp/security/vuln/10threats2014.html

スパイウエア入りスマートフォン、米企業が堂々発売
http://itpro.nikkeibp.co.jp/article/NEWS/20140318/544444/?ST=security

政府がサイバー攻撃の大規模訓練、全府省庁100人が参加
http://itpro.nikkeibp.co.jp/article/NEWS/20140318/544422/?ST=security

18日 火曜日、先勝

+ RHSA-2014:0304 Important: mutt security update
http://rhn.redhat.com/errata/RHSA-2014-0304.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467

+ HPSBNS02969 rev.1 - HP NonStop Servers running Java 7, Multiple Remote Vulnerabilities affecting Confidentiality, Integrity and Availability
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04126444-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3563
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5035
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0498
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0499
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1531
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1724
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5081
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5083
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1537
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1571
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2424
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2457
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5823
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5830

+ RHSA-2014:0305 Moderate: samba security update
http://rhn.redhat.com/errata/RHSA-2014-0305.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0213
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0214
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4124

+ Sudo 1.8.10p2 released
http://www.sudo.ws/sudo/stable.html#1.8.10p2

+ iOS 7 - Kernel Mode Memory Corruption
http://www.exploit-db.com/exploits/32333/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1287

+ SA57440 Google Chrome for Android Multiple Vulnerabilities
http://secunia.com/advisories/57440/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1713

+ SA57439 Google Chrome Blink Bindings Use-After-Free and V8 Memory Corruption Vulnerabilities
http://secunia.com/advisories/57439/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1713

InterScan Messaging Security Virtual Appliance 8.5 Critical Patch build 12770 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2094

JVNDB-2014-000030 Android 版アプリ「出前館」における SSL サーバ証明書の検証不備の脆弱性
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000030.html

JVNDB-2014-000031 R-Company 製 Unzipper におけるディレクトリトラバーサルの脆弱性
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000031.html

NSAがFacebook偽装の報道を否定、海外メディアが声明文に注目
http://itpro.nikkeibp.co.jp/article/NEWS/20140317/543982/?ST=security

DoS/PoC: Free Download Manager - Stack-based Buffer Overflow
http://www.exploit-db.com/exploits/32332

DoS/PoC: Gold MP4 Player 3.3 - Universal SEH Exploit (MSF)
http://www.exploit-db.com/exploits/32329

17日 月曜日、赤口

+ Google Chrome 33.0.1750.152 released
http://googlechromereleases.blogspot.jp/2014/03/stable-channel-update_14.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1715

+ CESA-2014:0292 Important CentOS 6 389-ds-base Update
http://lwn.net/Alerts/590718/

+ CESA-2014:0285 Important CentOS 5 kernel Update
http://lwn.net/Alerts/590719/

+ CESA-2014:0293 Important CentOS 6 udisks Update
http://lwn.net/Alerts/590720/

+ Apache HTTP Server 2.4.9 Released
http://www.apache.org/dist/httpd/Announcement2.4.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438

+ libpng 1.6.10, 1.2.51 released
http://www.libpng.org/pub/png/src/libpng-1.6.10-README.txt
http://www.libpng.org/pub/png/src/libpng-1.2.51-README.txt

+ OpenSSH 6.6 released
http://www.openssh.com/txt/release-6.6

+ MacOSX Safari Firefox Kaspersky RegExp Remote/Local Denial of Service
http://cxsecurity.com/issue/WLB-2014030108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3336

+ iOS 7 Arbitrary Code Execution
http://cxsecurity.com/issue/WLB-2014030126
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1287

+ SA57366 Samba smbcacls Access Control Lists Handling Security Issue
http://secunia.com/advisories/57366/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442

+ Google Chrome Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/66239

+ Apple iOS PRNG Entropy Weakness
http://www.securityfocus.com/bid/66236

+ Samba 'smbcacls' Command Security Bypass Vulnerability
http://www.securityfocus.com/bid/66232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442

ウイルスバスター ビジネスセキュリティ 7.0 Service Pack 1 Windows 8.1 / Server 2012 R2 対応パッチ 一時公開停止のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2084

不正送金被害が過去最悪ペース、2014年2月までに6億円の被害
http://itpro.nikkeibp.co.jp/article/NEWS/20140314/543828/?ST=security

Zuckerberg CEOが当局の監視活動に関して大統領に電話、「政府に失望」
http://itpro.nikkeibp.co.jp/article/NEWS/20140314/543502/?ST=security

JVNVU#93903343 WatchGuard Fireware XTM にクロスサイトスクリプティングの脆弱性
http://jvn.jp/vu/JVNVU93903343/

VU#381692 Webmin contains a cross-site scripting vulnerability
http://www.kb.cert.org/vuls/id/381692

Kaspersky 14.0.0.4651 Remote Denial of Service PoC *youtube
http://cxsecurity.com/issue/WLB-2014030106

14日 金曜日、先負

+ RHSA-2014:0292 Important: 389-ds-base security update
http://rhn.redhat.com/errata/RHSA-2014-0292.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0132

+ RHSA-2014:0293 Important: udisks security update
http://rhn.redhat.com/errata/RHSA-2014-0293.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0004

+ APSB14-10 Security update available for Adobe Shockwave Player
http://helpx.adobe.com/security/products/shockwave/apsb14-10.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0505

+ UPDATE: Cisco Prime Infrastructure Command Execution Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140226-pi
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0679

+ HPSBMU02975 rev.1 - HP Smart Update Manager for Linux, Elevation of Privileges
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04000397-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6208

+ HPSBMU02967 rev.1 - HP Unified Functional Testing Running on Windows, Remote Execution of Arbitrary Code
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04122007-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6210

+ RHSA-2014:0285 Important: kernel security, bug fix, and enhancement update
http://rhn.redhat.com/errata/RHSA-2014-0285.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2929
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4554
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6381
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6383
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6885
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7263

+ Sudo 1.8.10p1 released
http://www.sudo.ws/sudo/stable.html#1.8.10p1

+ Cisco Cloud Portal Discloses Cryptographic Material That Lets Remote Users Decrypt Data
http://www.securitytracker.com/id/1029915
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0694

+ Google Chrome Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks
http://www.securitytracker.com/id/1029914
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1700
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1703
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1704

+ Squid Flaw in SSL-Bump Lets Remote Users Deny Service
http://www.securitytracker.com/id/1029908
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0128

+ Wireshark NFS/M3UA/RLC Dissector Bugs Let Remote Users Deny Service and MPEG Buffer Overflow Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1029907
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2281
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2283
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2299

+ MacOSX Safari Firefox Kaspersky RegExp Remote/Local Denial of Service
http://cxsecurity.com/issue/WLB-2014030108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3336

+ Firefox 27.0.1 and Safari 7.0.2 (9537.74.9) Remote Denial of Service
http://cxsecurity.com/issue/WLB-2014030107

+ Kaspersky 14.0.0.4651 Remote Denial of Service PoC
http://cxsecurity.com/issue/WLB-2014030106

+ SA57372 McAfee Email Gateway / McAfee Email and Web Security Appliance Multiple SQL Injection Vulnerabilities
http://secunia.com/advisories/57372/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7092

学校でのIT利用には「子供たちのプライバシー保護」が重要
米国のNPO法人代表が訴える
http://itpro.nikkeibp.co.jp/article/NEWS/20140313/543394/?ST=security

標的型攻撃サイトをDNSでアクセス制御する機能を提供開始
http://itpro.nikkeibp.co.jp/article/NEWS/20140313/543403/?ST=security

NSA、Facebookを装う手口などで盗聴活動を拡大---米サイトの報道
http://itpro.nikkeibp.co.jp/article/NEWS/20140313/543282/?ST=security

VU#807134 WatchGuard Fireware XTM devices contain a cross-site scripting vulnerability
http://www.kb.cert.org/vuls/id/807134

13日 木曜日、友引

+ UPDATE: Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp

+ VMSA-2014-0002 VMware vSphere updates to third party libraries
http://www.vmware.com/security/advisories/VMSA-2014-0002.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332

+ Google Chrome 33.0.1750.149 released
http://googlechromereleases.blogspot.jp/2014/03/stable-channel-update_11.html

+ DoS/PoC: Oracle VirtualBox 3D Acceleration - Multiple Vulnerabilities
http://www.exploit-db.com/exploits/32208

+ Apple Facetime Information Disclosure
http://cxsecurity.com/issue/WLB-2014030091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6835

+ Oracle VirtualBox 3D Acceleration Memory Corruption
http://cxsecurity.com/issue/WLB-2014030090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0983
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0981
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0982

BatteryAID バージョン3.0.0.1105リリースのお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2095

Trend Micro Deep Discovery Advisor 3.0 Service Pack 1 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2091

「商品が破損していた！」クレームに見せかけたウイルスメールに注意
http://itpro.nikkeibp.co.jp/article/NEWS/20140312/543123/?ST=security

IEのゼロデイ脆弱性を修正するパッチが公開、すぐに適用を
http://itpro.nikkeibp.co.jp/article/NEWS/20140312/543092/?ST=security

JVNVU#98181377 CENTUM CS 3000 操作監視機能に複数のバッファオーバーフローの脆弱性
http://jvn.jp/vu/JVNVU98181377/index.html

JVNVU#96727848 Internet Explorer に解放済みメモリ使用 (use-after-free) の脆弱性
http://jvn.jp/vu/JVNVU96727848/index.html

REMOTE: Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow
http://www.exploit-db.com/exploits/32209

REMOTE: Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow
http://www.exploit-db.com/exploits/32210

LOCAL: Huawei Technologies eSpace Meeting Service 1.0.0.23 - Local Privilege Escalation
http://www.exploit-db.com/exploits/32205

12日 水曜日、先勝

+ 2014 年 3 月のセキュリティ情報
http://technet.microsoft.com/ja-jp/security/bulletin/ms14-mar

+ MS14-012 - 緊急 Internet Explorer 用の累積的なセキュリティ更新プログラム (2925418)
https://technet.microsoft.com/ja-jp/security/bulletin/ms14-012
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0298
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0299
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0302
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0303
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0304
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0305
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0306
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0307
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0309
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0311
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0312
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0313
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0322
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0324

+ MS14-013 - 緊急 Microsoft DirectShow の脆弱性により、リモートでコードが実行される (2929961)
https://technet.microsoft.com/ja-jp/security/bulletin/ms14-013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0301

+ MS14-014 - 重要 Silverlight の脆弱性により、セキュリティ機能のバイパスが起こる (2932677)
https://technet.microsoft.com/ja-jp/security/bulletin/ms14-014
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0319

+ MS14-015 - 重要 Windows カーネルモード ドライバーの脆弱性により、特権が昇格される (2930275)
https://technet.microsoft.com/ja-jp/security/bulletin/ms14-015
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0323

+ MS14-016 - 重要 Security Account Manager Remote (SAMR) プロトコルの脆弱性により、セキュリティ機能のバイパスが起こる (2934418)
https://technet.microsoft.com/ja-jp/security/bulletin/ms14-016
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0317

+ UPDATE: マイクロソフト セキュリティ アドバイザリ (2934088) Internet Explorer の脆弱性により、リモートでコードが実行される
http://technet.microsoft.com/ja-jp/security/advisory/2934088

+ UPDATE: マイクロソフト セキュリティ アドバイザリ (2755801) Internet Explorer 上の Adobe Flash Player の脆弱性に対応する更新プログラム
http://technet.microsoft.com/ja-jp/security/advisory/2755801

+ APSB14-08 Security updates available for Adobe Flash Player
http://helpx.adobe.com/security/products/flash-player/apsb14-08.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0503
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0504

+ CESA-2014:0266 Moderate CentOS 5 sudo Update
http://lwn.net/Alerts/590251/

+ Linux kernel 3.4.83 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.83

+ JK 1.2.39 released
http://tomcat.apache.org/connectors-doc/news/20140201.html#11%20March%20-%20JK-1.2.39%20released
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html

+ Samba 4.1.6, 4.0.16 and 3.6.23 Security Releases Available for Download
http://www.samba.org/samba/history/samba-4.1.6.html
http://www.samba.org/samba/history/samba-4.0.16.html
http://www.samba.org/samba/history/samba-3.6.23.html

+ Linux Kernel IPv6 Router Advertisement Processing Flaw Lets Remote Users Deny Service
http://www.securitytracker.com/id/1029894
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2309

+ Squid SSL-Bump HTTPS Requests Processing Denial of Service Vulnerability
http://secunia.com/advisories/57288/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0128

+ Squid CVE-2014-0128 Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/66112
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0128

Trend Micro Deep Discovery Advisor 3.0 Service Pack 1 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2091

「Intel Security」になっても戦略は変わらない、マカフィー社長
http://itpro.nikkeibp.co.jp/article/NEWS/20140311/542782/?ST=security

JR大阪駅ビルの「顔識別」実証実験、プライバシー侵害の懸念から延期
http://itpro.nikkeibp.co.jp/article/NEWS/20140311/542723/?ST=security

SSOソフトに端末認証を追加、セッション乗っ取りを防止
http://itpro.nikkeibp.co.jp/article/NEWS/20140311/542715/?ST=security

ANAマイレージクラブへの不正ログインで112万マイルが詐取、住所なども閲覧可能に
http://itpro.nikkeibp.co.jp/article/NEWS/20140311/542563/?ST=security

Snowden容疑者がSXSWカンファレンスにビデオで出席、米メディアが報道
http://itpro.nikkeibp.co.jp/article/NEWS/20140311/542562/?ST=security

JVNTA14-069A Microsoft Windows XP および Office 2003 のサポート終了について
http://jvn.jp/ta/JVNTA14-069A/

JVNVU#90170014 Apple TV における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU90170014/

JVNVU#94229445 Apple iOS における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU94229445/

REMOTE: SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
http://www.exploit-db.com/exploits/32163

iOS 7.1 のセキュリティアップデート

About the security content of iOS 7.1

http://support.apple.com/kb/HT6162

上記 URL の iOS のセキュリティアップデートの翻訳

1) Backup

　バックアップにあるシンボリックリンクを復元するとき、ファイルシステムの残りに書き込みする復元処理の間、後続の操作を許可することが原因で、悪意のあるバックアップがファイルシステムを改ざんできる脆弱性。(CVE-2013-5133)

2) Certificate Trust Policy

　いくつかの証明書がシステムルートのリストに加えられたり、削除されたりすることが原因で、ルート証明書が更新される脆弱性。

3) Configuration Profiles

　モバイル設定プロファイルの有効期限を正しく評価していないことが原因で、プロファイルの有効期限が評価されない脆弱性。(CVE-2014-1267)

4) CoreCapture

　IOKit API コールの CoreCapture の処理に到達可能なアサーションが存在することが原因で、悪意のあるアプリケーションが予期しないシステム停止を引き起こす脆弱性。(CVE-2014-1271)

5) Crash Reporting

　CrashHouseKeeping がファイルのパーミッションを変更している間シンボリックリンクを追随することが原因で、ローカルユーザが任意のファイルのパーミッションを変更できる脆弱性。(CVE-2014-1272)

6) dyld

　ダイナミック・ライブラリにあるテキスト再配置命令がコード署名の検証なしに dyld によってロードされることが原因で、コード署名要求を回避される脆弱性。(CVE-2014-1273)

7) FaceTime

　ロックされた装置上の FaceTime の契約がロック画面からの FaceTime 呼び出しの失敗により暴露されることが原因で、装置へ物履的にアクセスできる人がロック画面から FaceTime 契約にアクセスできる脆弱性。CVE-2014-1274)

8) ImageIO

　PDF ファイルの JPEG2000 画像の処理にバッファオーバーフローが存在することが原因で、細工されたPDFファイルを参照することでアプリケーションを異常終了させたり、任意のコードを実行されたりする脆弱性。(CVE-2014-1275)

9) ImageIO

　libtiff の TIFF 画像の処理にバッファオーバーフローが存在することが原因で、細工されたTIFFファイルを参照することでアプリケーションを異常終了させたり、任意のコードを実行されたりする脆弱性。(CVE-2012-2088)

10) ImageIO

　libjpeg の　JPEG マーカーの処理に初期化されていないメモリへのアクセスが存在することが原因で、細工された JPEG ファイルを参照することでメモリの中身の暴露を導く脆弱性。(CVE-2013-6629)

11) IOKit HID Event

　IOKit フレームワークのインターフェースが悪意のあるアプリに他のアプリのユーザ操作を監視することを許可していることが原因で、悪意のあるアプリケーションが他のアプリのユーザ操作を監視できる脆弱性。(CVE-2014-1276)

12) iTunes Store

　ネットワークに係る特権を持つ攻撃者がユーザに悪意のあるアプリをダウンロードすることに誘発するためにネットワーク通信をだますことができることが原因で、企業向けアプリのダウンロードを介して悪意のあるアプリをユーザがダウンロードすることを誘発する介入者攻撃ができる脆弱性。(CVE-2014-1277)

13) Kernel

　ARM ptmx_get_ioctl 関数に領域外メモリアクセス問題が存在することが原因で、ローカルユーザがシステムの異常終了やカーネル上で任意のコードを実行できる脆弱性。(CVE-2014-1278)

14) Office Viewer

　Microsoft Word 文書の処理においてメモリの二重解放が存在することが原因で、悪意のある Microsoft Word 文書を開くことでアプリケーションが異常終了したり、任意のコードを実行できる脆弱性。(CVE-2014-1252)

15) Photos Backend

　有用なライブラリから画像を削除するときに、画像のキャッシュされたバージョンを削除できないことが原因で、トランスペアレント画像に下の写真アプリにて削除された画像が残る脆弱性。(CVE-2014-1281)

16) Profiles

　長い名前の設定プロファイルが装置にロードされるが、プロファイル内に表示されないことが原因で、設定プロファイルがユーザから隠されてしまう脆弱性。(CVE-2014-1282)

17) Safari

  Safari がメインフレームより異なるドメインからサブフレーム上にあるユーザの名前及びパスワードを自動的に埋めてしまうしまう脆弱性。(CVE-5227)

18) Settings - Accounts

　Find My iPhone 状態の処理に状態管理の問題が存在することが原因で、装置に物理的にアクセスできる人が iCloud のパスワードの入力なしに Find My iPhone を無効にできる脆弱性。(CVE-2014-1284)

19) Springboard

　アクティベーション中の意味不明のアプリケーションの異常終了が電話がホーム画面を表示することが原因で、装置に物理的にアクセスできる人が装置がアクティベートされていなくても装置のホーム画面を見ることができる脆弱性。(CVE-2014-1285)

20) SpringBoard Lock System

　ロック画面に状態管理の問題が存在することが原因で、リモートのユーザがロック画面を無反応にできる脆弱性。(CVE-2014-1286)

21) TelephonyUI Framework

　Safari が facetime-audio:// URL を開く前にユーザに尋ねないことが原因で、Webページがユーザ操作なしに FaceTime 音声通話を起動できる脆弱性。(CVE-2013-6835)

22) USB Host

　USB メッセージの処理にメモリ破壊の問題が存在することが原因で、装置に物理的にアクセスできる人がカーネルモードで任意のコードを実行できる脆弱性。(CVE-2014-1287)

23) Video Driver

　MPEG-4 エンコードファイルの処理に NULL ポインタ逆参照問題が存在することが原因で、細工されたビデオを再生することで装置を無反応にする脆弱性。(CVE-2014-1280)

24) WebKit

　WebKit に複数のメモリ破壊が存在することが原因で、悪意のあるWebサイトを閲覧することで、アプリケーションが異常終了したり、任意のコードを実行したりする脆弱性。(CVE-2013-2909,CVE-2013-2926,CVE-2013-2928,CVE-2013-5196,CVE-2013-5197,CVE-2013-5198,CVE-2013-5199,CVE-2013-5225,CVE-2013-5228,CVE-2013-6625,CVE-2013-6635,CVE-2014-1269,CVE-2014-1270,CVE-2014-1289,CVE-2014-1290,CVE-2014-1291,CVE-2014-1292,CVE-2014-1293,CVE-2014-1294)

11日 火曜日、赤口

+ About the security content of Apple TV 6.1
http://support.apple.com/kb/HT6163
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1279
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1267
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1272
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1273
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1275
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2088
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1287
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2909
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2926
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2928
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5225
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6635
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1289
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1290
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1291
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1292
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1294
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1280

+ About the security content of iOS 7.1
http://support.apple.com/kb/HT6162
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1267
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1272
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1273
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1275
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2088
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1281
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1284
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6835
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1287
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1280
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2909
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2926
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2928
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5225
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6635
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1289
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1290
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1291
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1292
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1294

+ HPSBGN02970 rev.1 - HP Rapid Deployment Pack (RDP) or HP Insight Control Server Deployment, Multiple Remote Vulnerabilities affecting Confidentiality, Integrity and Availability
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04135307-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4008
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2182
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2213
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2492
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2518
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2689
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2723
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4077
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4110
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0058
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1088
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1179
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2137
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2313
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2372
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2383
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6206

+ HPSBMU02948 rev.1 - HP Systems Insight Manager (SIM) Running on Linux and Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS), Disclosure of Information
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04039150-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1535
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4163
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4164
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4165
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4167
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0650
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1371
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1378
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1379
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2555

+ HPSBMU02947 rev.1 - HP System Management Homepage (SMH) Running on Linux and Windows, Remote Disclosure of Information and Cross-Site Request Forgery (CSRF)
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04039138-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4846
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6188

+ UPDATE: HPSBST02937 rev.2 - HP StoreVirtual 4000 and StoreVirtual VSA Software dbd_manager, Remote Execution of Arbitrary Code
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03995204-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ HPSBUX02976 SSRT101236 rev.1 - HP-UX Running NFS rpc.lockd, Remote Denial of Service (DoS)
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04174142-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6209

+ Linux kernel 3.12.14 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.14

+ RHSA-2014:0266 Moderate: sudo security update
http://rhn.redhat.com/errata/RHSA-2014-0266.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106

+ Sudo 1.8.10 released
http://www.sudo.ws/sudo/stable.html#1.8.10

+ Sudo validate_env_vars() Bug Lets Local Users Gain Elevated Privileges
http://www.securitytracker.com/id/1029886
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106

+ REMOTE: HP Data Protector Backup Client Service Remote Code Execution
http://www.exploit-db.com/exploits/32164

+ Linux Kernel IPv6 Router Advertisement Packets Processing Denial of Service Vulnerability
http://secunia.com/advisories/57250/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2309

+ Wireshark Multiple Vulnerabilities
http://secunia.com/advisories/57265/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2281
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2283
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2299

+ Apple TV CVE-2014-1279 Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/66090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1279

+ Apple iOS and TV Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/66089
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1267
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1273
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1272
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1275
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1280
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1282
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1287

Some protections may not work for specific HTTP evasions in R77.10 / R77 / R76
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98814&src=securityAlerts

PostgreSQL Database Appliance from Fujitsu
http://www.postgresql.org/about/news/1510/

「偽メールにだまされないで！」三菱東京UFJ銀行をかたるフィッシング
http://itpro.nikkeibp.co.jp/article/NEWS/20140310/542484/?ST=security

Bitcoin考案者特定を報じたNewsweek、疑問の声に対して「記事を支持する」と声明
http://itpro.nikkeibp.co.jp/article/NEWS/20140310/542262/?ST=security

［CD 2014］「スマホの問題は心の問題。子供たちの相談に乗ってあげてほしい」---兵庫県立大学の竹内准教授
http://itpro.nikkeibp.co.jp/article/NEWS/20140310/542242/?ST=security

REMOTE: SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
http://www.exploit-db.com/exploits/32163

REMOTE: GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution
http://www.exploit-db.com/exploits/32132

LOCAL: KMPlayer 3.8.0.117 - Buffer Overflow
http://www.exploit-db.com/exploits/32152

LOCAL: QNX 6.4.x/6.5.x ifwatchd - Local root Exploit
http://www.exploit-db.com/exploits/32153

LOCAL: QNX 6.5.0 x86 io-graphics - Local root Exploit
http://www.exploit-db.com/exploits/32154

LOCAL: QNX 6.5.0 x86 phfont - Local root Exploit
http://www.exploit-db.com/exploits/32155

LOCAL: QNX 6.4.x/6.5.x pppoectl - Information Disclosure
http://www.exploit-db.com/exploits/32156

LOCAL: iCAM Workstation Control 4.8.0.0 - Authentication Bypass
http://www.exploit-db.com/exploits/32158

10日 月曜日、大安

+ Squid 3.4.4, 3.3.12 released
http://www.squid-cache.org/Versions/v3/3.4/RELEASENOTES.html
http://www.squid-cache.org/Versions/v3/3.3/RELEASENOTES.html

+ Wireshark 1.10.6 released
http://www.wireshark.org/docs/relnotes/wireshark-1.10.6.html

+ HPSBUX02963 SSRT101297 rev.1 - HP-UX m4(1), Local Unauthorized Access
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04103553-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6200

+ Linux kernel 3.13.6, 3.10.33 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.33

+ HS14-007 Vulnerability in JP1/File Transmission Server/FTP
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-007/index.html

+ HS14-006 Cross-site Scripting Vulnerability in JP1/Integrated Management - Service Support
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-006/index.html

+ HS14-007 JP1/File Transmission Server/FTPにおける脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-007/index.html

+ JP1/Integrated Management - Service Supportにおけるクロスサイトスクリプティングの脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-006/index.html

+ PHP 5.4.26 Released
http://www.php.net/ChangeLog-5.php#5.4.26

+ SonicWALL Network Security Appliance 2400 Input Validation Flaw in 'dashboard.jsp' Permits Cross-Site Scripting Attacks
http://www.securitytracker.com/id/1029884

+ IBM AIX Unspecified Workload Partition FTP Bug Lets Remote Authenticated Users Gain Elevated Privileges
http://www.securitytracker.com/id/1029883
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0899

+ HP-UX m4(1) Command Flaw Lets Local Users Gain Elevated Privileges
http://www.securitytracker.com/id/1029881
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6200

+ Citrix NetScaler Application Delivery Controller Multiple Flaws Let Users Gain Elevated Privileges and Deny Service
http://www.securitytracker.com/id/1029880
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6938
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6939
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6940
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6941
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6942
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6943
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6944

+ Linux kernel IPv6 crash due to router advertisement flooding
http://cxsecurity.com/issue/WLB-2014030061
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2309

+ Safari User-Assisted Download & Run Attack
http://cxsecurity.com/issue/WLB-2014030059

+ Google's YouTube Unrestricted File Upload Report
http://cxsecurity.com/issue/WLB-2014030040

+ Apache Struts 2 ClassLoader Manipulation / DoS
http://cxsecurity.com/issue/WLB-2014030056

+ SonicWall Dashboard Cross Site Scripting
http://cxsecurity.com/issue/WLB-2014030054

Check Point response to GnuTLS certificate verification vulnerability (CVE-2014-0092)
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98795&src=securityAlerts

パスワードマネージャー PC版プログラムアップデートのお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2090

未知ファイルの実行禁止ソフトがWin 8.1に対応
http://itpro.nikkeibp.co.jp/article/NEWS/20140307/542064/?ST=security

場所と時刻を自動判別し、MDMのセキュリティポリシーを切り替え
http://itpro.nikkeibp.co.jp/article/NEWS/20140307/542045/?ST=security

IEのゼロデイ脆弱性、修正するパッチが間もなく公開
http://itpro.nikkeibp.co.jp/article/NEWS/20140307/542009/?ST=security

JVN#14876762 Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/jp/JVN14876762/

JVNVU#91643393 Aker Secure Mail Gateway にクロスサイトスクリプティングの脆弱性
http://jvn.jp/vu/JVNVU91643393/

JVNVU#93584370 Huawei E355 に認証回避の脆弱性
http://jvn.jp/vu/JVNVU93584370/

LOCAL: GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution
http://www.exploit-db.com/exploits/32132

7日 金曜日、友引

+ CESA-2014:0255 Moderate CentOS 6 subversion Update
http://lwn.net/Alerts/589698/

+ CESA-2014:0255 Moderate CentOS 5 subversion Update
http://lwn.net/Alerts/589699/

+ phpMyAdmin 4.1.9 is released
http://sourceforge.net/p/phpmyadmin/news/2014/03/phpmyadmin-419-is-released/

+ Microsoft Security Bulletin Advance Notification for March 2014
http://technet.microsoft.com/en-us/security/bulletin/ms14-mar

+ Apache Struts 2.3.16.1 GA released
http://struts.apache.org/announce.html#a20140302
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094

+ PHP 5.5.10 released
http://www.php.net/archive/2014.php#id2014-03-06-1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7327

+ Sudo 1.7.10p8 released
http://www.sudo.ws/sudo/maintenance.html#1.7.10p8
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106

+ Linux Kernel SCTP Null Pointer Dereference Lets Remote Users Deny Service
http://www.securitytracker.com/id/1029872
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0101

+ SA57158 PHP Fileinfo libmagic Multiple Denial of Service Vulnerabilities
http://secunia.com/advisories/57158/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270

+ Microsoft March 2014 Notification Multiple Vulnerabilities
http://www.securityfocus.com/bid/66016

+ PHP Fileinfo Component Out of Bounds Memory Corruption Vulnerability
http://www.securityfocus.com/bid/66002
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270

+ Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability
http://www.securityfocus.com/bid/65999
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094

Advisory: 'License exceeded' warning after upgrading to SafeGuard Enterprise 6.1
http://www.sophos.com/en-us/support/knowledgebase/120710.aspx

サンディスク、読み取り最大260MB／秒・書き込み最大240MB／秒のUSB 3.0対応フラッシュメモリー
http://itpro.nikkeibp.co.jp/article/NEWS/20140307/541823/?ST=security

「セクシー画像」にコマンドを隠す、新たなウイルスが出現
http://itpro.nikkeibp.co.jp/article/NEWS/20140306/541765/?ST=security

FreedomPop、通信を暗号化する盗聴防止スマホ「Privacy Phone」を発表
http://itpro.nikkeibp.co.jp/article/NEWS/20140306/541566/?ST=security

JVNVU#95919136 Synology DiskStation Manager にアクセス制御不備の脆弱性
http://jvn.jp/vu/JVNVU95919136/

JVNVU#93289336 Serena Dimensions CM web client に複数の脆弱性
http://jvn.jp/vu/JVNVU93289336/

VU#687278 Aker Secure Mail Gateway reflected XSS vulnerability
http://www.kb.cert.org/vuls/id/687278

VU#341526 Huawei E355 contains a direct request vulnerability
http://www.kb.cert.org/vuls/id/341526

6日 木曜日、先勝

+ RHSA-2014:0255 Moderate: subversion security update
http://rhn.redhat.com/errata/RHSA-2014-0255.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1968
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032

+ CESA-2014:0247 Important CentOS 5 gnutls Update
http://lwn.net/Alerts/589447/

+ CESA-2014:0246 Important CentOS 6 gnutls Update
http://lwn.net/Alerts/589448/

+ CESA-2014:0249 Important CentOS 5 postgresql Update
http://lwn.net/Alerts/589449/

+ Cisco Small Business Router Password Disclosure Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-rpd

+ Multiple Vulnerabilities in Cisco Wireless LAN Controllers
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140305-wlc

+ HPSBHF02965 rev.1 - HP Security Management System, Remote Execution of Arbitrary Code
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04156626-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6201

+ UPDATE: HPSBMU02933 rev.2 - HP SiteScope, issueSiebelCmd and loadFileContents SOAP Requests, Remote Code Execution, Arbitrary File download, Denial of Service (DoS)
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03969435-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ UPDATE: HPSBST02955 rev.2 - HP XP P9000 Performance Advisor Software, 3rd party Software Security - Apache Tomcat and Oracle Updates, Multiple Vulnerabilities Affecting Confidentiality, Availability And Integrity
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04047415-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ HPSBUX02973 SSRT101455 rev.1 - HP-UX Running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04166778-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5888
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5889
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5898
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5899
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5902
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5905
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5906
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0410
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428

+ HPSBUX02972 SSRT101454 rev.1 - HP-UX Running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04166777-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5870
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5888
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5889
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5893
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5895
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5898
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5899
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5902
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5904
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5905
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5906
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0382
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0410
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428

+ SA57242 Opera Unspecified Vulnerabilities
http://secunia.com/advisories/57242/

+ CISCO RV110W RV215W CVR100W Bypass Login Page
http://cxsecurity.com/issue/WLB-2014030043
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0683

+ PHP date() is evil (XSS'able)
http://cxsecurity.com/issue/WLB-2014030046

+ libssh and stunnel PRNG flaws
http://cxsecurity.com/issue/WLB-2014030044
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0016
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0017

+ Windows Escalate UAC Protection Bypass (In Memory Injection)
http://cxsecurity.com/issue/WLB-2014030039

+ Google's YouTube Unrestricted File Upload Report
http://cxsecurity.com/issue/WLB-2014030040

+ Java OpenID Server 1.2.1 XSS / Session Fixation
http://cxsecurity.com/issue/WLB-2014030037

Trend Micro Mobile Security 9.0 Patch 1(build 1586)公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2062

Trend Micro SafeSync for Enterprise 2.1 Patch 1およびPatch 1.1 (build 1277) 公開のお知らせ
http://app.trendmicro.co.jp/support/news.asp?id=2078

誤警告情報：スマートスキャンパターンファイル：TROJ_MOSERAN.BMC
http://app.trendmicro.co.jp/support/news.asp?id=2089

Bitcoin銀行「Flexcoin」にもサイバー攻撃、6000万円相当を盗まれる
http://itpro.nikkeibp.co.jp/article/NEWS/20140305/541425/?ST=security

シスコ、買収したSourcefireの機能を統合した製品を発表
http://itpro.nikkeibp.co.jp/article/NEWS/20140305/541346/?ST=security

JVNVU#97152032 Synology DiskStation Manager に認証情報がハードコードされている問題
http://jvn.jp/vu/JVNVU97152032/index.html

JVNVU#95250773 ZTE 製ケーブルモデム F460/F660 にバックドアの問題
http://jvn.jp/vu/JVNVU95250773/index.html

VU#823452 Serena Dimensions CM 12.2 Build 7.199.0 web client vulnerabilities
http://www.kb.cert.org/vuls/id/823452

LOCAL: ALLPlayer M3U Buffer Overflow
http://www.exploit-db.com/exploits/32074

5日 水曜日、赤口

+ MantisBT 1.2.17 Released
http://www.mantisbt.org/blog/?p=288

+ Opera 20 released
http://www.opera.com/docs/changelogs/unified/2000/

+ RHSA-2014:0249 Important: postgresql security update
http://rhn.redhat.com/errata/RHSA-2014-0249.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0060
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0061
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0062
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0063
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0064
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0065
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0066

+ Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1029864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6663
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6666
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6667
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6668

+ Linux Kernel IPv4 Fragment Processing Flaw Lets Remote Users Deny Service
http://www.securitytracker.com/id/1029859
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0100

+ MantisBT 'adm_config_report.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/65903
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2238

誤警告情報：スマートスキャンパターンファイル：TROJ_MOSERAN.BMC
http://app.trendmicro.co.jp/support/news.asp?id=2089

アダルト動画と引き換えに別アプリをインストール、危険なアプリ出現
http://itpro.nikkeibp.co.jp/article/NEWS/20140304/541157/?ST=security

JVNVU#93348073 Foscam FI8910W に認証回避の脆弱性
http://jvn.jp/vu/JVNVU93348073/index.html

VU#600724 ZTE F460/F660 cable modems contain an unauthenticated backdoor
http://www.kb.cert.org/vuls/id/600724

LOCAL: Calavera UpLoader 3.5 - SEH Buffer Overflow
http://www.exploit-db.com/exploits/32050

4日 火曜日、大安

+ RHSA-2014:0246 Important: gnutls security update
http://rhn.redhat.com/errata/RHSA-2014-0246.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092

+ Google Chrome 33.0.1750.146 released
http://googlechromereleases.blogspot.jp/2014/03/stable-channel-update.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6663
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6666
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6667
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6668

+ UPDATE: マイクロソフト セキュリティ アドバイザリ (2862152) DirectAccess および IPSec の脆弱性により、セキュリティ機能のバイパスが起こる
http://technet.microsoft.com/ja-jp/security/advisory/2862152

+ RHSA-2014:0247 Important: gnutls security update
http://rhn.redhat.com/errata/RHSA-2014-0247.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092

+ SA57216 Linux Kernel "complete_emulated_mmio()" Memory Corruption Vulnerability
http://secunia.com/advisories/57216/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0049

+ Linux Kernel kvm mmio_fragments out-of-the-bounds access
http://cxsecurity.com/issue/WLB-2014030021
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0049

+ MantisBT Admin SQL Injection Arbitrary File Read
http://cxsecurity.com/issue/WLB-2014030019
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2238

+ OpenVPN (DSM) 4.3-3810 has a hardcoded root password of synopass
http://cxsecurity.com/issue/WLB-2014030016
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2264

+ MantisBT 1.2.16 SQL Injection
http://cxsecurity.com/issue/WLB-2014030014
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2238

+ Linux Kernel 'complete_emulated_mmio()' Function Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/65909
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0049

Bitcoin取引所は今後も狙われる、セキュリティ企業が指摘
http://itpro.nikkeibp.co.jp/article/NEWS/20140303/540691/?ST=security

mixiに不正ログイン、1万件以上のIDで身に覚えのない投稿
http://itpro.nikkeibp.co.jp/article/NEWS/20140303/540651/?ST=security

JVNVU#93097036 Blue Coat ProxySG に脆弱性
http://jvn.jp/vu/JVNVU93097036/

JVNVU#97434093 CMS Made Simple にクロスサイトスクリプティングの脆弱性
http://jvn.jp/vu/JVNVU97434093/

VU#525132 Foscam IP camera authentication bypass vulnerability
http://www.kb.cert.org/vuls/id/525132

LOCAL: ALLPlayer 5.8.1 - (.m3u file) Buffer Overflow (SEH)
http://www.exploit-db.com/exploits/32041

3日 月曜日、仏滅

+ CESA-2014:0223 Moderate CentOS 5 libtiff Update
http://lwn.net/Alerts/588836/

+ CESA-2014:0222 Moderate CentOS 6 libtiff Update
http://lwn.net/Alerts/588837/

+ CESA-2014:0221 Moderate postgresql92-postgresql SCL Security Update
http://lwn.net/Alerts/588838/

+ UPDATE: マイクロソフト セキュリティ アドバイザリ (2871690) 非準拠の UEFI モジュールを失効させる更新プログラム
http://technet.microsoft.com/ja-jp/security/advisory/2871690

Blocking NTP access on Gaia OS / IPSO OS (CVE-2013-5211)
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98758&src=securityAlerts

スマートスキャンサーバのサポート終了日について
http://app.trendmicro.co.jp/support/news.asp?id=2085

InterScan for Microsoft Exchange 11.0 にて確認された事象について
http://app.trendmicro.co.jp/support/news.asp?id=2086

Bitcoin取引所のMt.GOXが民事再生手続き、490億円相当のBitcoinがほぼ消失
http://itpro.nikkeibp.co.jp/article/NEWS/20140228/540326/?ST=security

「My SoftBank」で不正アクセス、344件の顧客情報が漏洩
http://itpro.nikkeibp.co.jp/article/NEWS/20140228/540325/?ST=security

警察共済組合、PC700台に日立の指静脈認証を導入
http://itpro.nikkeibp.co.jp/article/NEWS/20140228/540306/?ST=security

サーバー数無制限のSSL証明書、トレンドマイクロが一般販売を開始
http://itpro.nikkeibp.co.jp/article/NEWS/20140228/540171/?ST=security

社外ではVPN接続を強制、秘文のWi-Fi制御ソフトに新版
http://itpro.nikkeibp.co.jp/article/NEWS/20140228/540143/?ST=security

Apache Commons FileUpload および Apache Tomcat の脆弱性に関する注意喚起
http://www.jpcert.or.jp/at/2014/at140007.html

JVNVU#97152032 Synology DiskStation Manager に認証情報がハードコードされている問題
http://jvn.jp/vu/JVNVU97152032/

VU#526062 CMS Made Simple contains multiple cross-site scripting vulnerabilities
http://www.kb.cert.org/vuls/id/526062

REMOTE: GE Proficy CIMPLICITY gefebt.exe Remote Code Execution
http://www.exploit-db.com/exploits/31987

LOCAL: GoldMP4Player 3.3 - Buffer Overflow Exploit (SEH)
http://www.exploit-db.com/exploits/31972