24日 木曜日、先負

+ RHSA-2014:0429 Moderate: tomcat6 security update
http://rhn.redhat.com/errata/RHSA-2014-0429.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4322
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050

+ CESA-2014:0420 Moderate CentOS 6 qemu-kvm Update
http://lwn.net/Alerts/595767/

+ Squid 3.4.4.2 released
http://www.squid-cache.org/Versions/v3/3.4/RELEASENOTES.html

+ AirPort Base Station Firmware Update 7.7.3
http://support.apple.com/kb/HT6203

+ About the security content of Apple TV 6.1.1
http://support.apple.com/kb/HT6209

+ About the security content of iOS 7.1.1
http://support.apple.com/kb/HT6208

+ Security Update 2014-002
http://support.apple.com/kb/HT6207

+ UPDATE: OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

+ UPDATE: Undocumented Test Interface in Cisco Small Business Devices
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140110-sbd

+ HPSBGN03011 rev.1 - HP IceWall MCRP running OpenSSL on Red Hat Enterprise Linux 6 (RHEL6), Remote Disclosure of Information
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04259321-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160

+ UPDATE: HPSBMU02997 rev.2 - HP Smart Update Manager (SUM) running OpenSSL, Remote Disclosure of Information
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04239375-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ UPDATE: HPSBMU02995 rev.5 - HP Software HP Service Manager, Asset Manager, UCMDB Browser, UCMDB Configuration Manager, Executive Scorecard, Server Automation, Diagnostics, LoadRunner, and Performance Center, running OpenSSL, Remote Disclosure of Information
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04236102-5%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ HPSBMU02895 SSRT101253 rev.1 - HP データプロテクタ、権限のリモート強化、サービス拒否 (DoS)、任意コードの実行
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04083772-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2344
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2345
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2346
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2347
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2349
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2350
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6195

+ UPDATE: HPSBST03015 rev.2 - HP 3PAR OS running OpenSSL, Remote Disclosure of Information
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04261644-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160

+ Linux kernel 3.13.11 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.11

+ SYM14-007 Security Advisories Relating to Symantec Products - Symantec Encryption Desktop Memory Access Violations
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140423_00

+ Symantec Messaging Gateway Input Validation Flaw in 'displayTab' Parameter Permits Cross-Site Scripting Attacks
http://www.securitytracker.com/id/1030136
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1648

+ Apple OS X Multiple Bugs Let Remote Users Execute Arbitrary Code and Deny Service and Local Users Gain Elevated Privileges
http://www.securitytracker.com/id/1030133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5170
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1296
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1314
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1315
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1316
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1318
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1319
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1320
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1322

+ AirPort Extreme and AirPort Time Capsule OpenSSL TLS Heartbeat Buffer Overread Lets Remote Users Obtain Potentially Sensitive Information
http://www.securitytracker.com/id/1030132
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160

+ SA58217 Wireshark RTP Dissector Denial of Service Vulnerability
http://secunia.com/advisories/58217/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2907

+ Symantec Messaging Gateway 10.5.1 Cross Site Scripting
http://cxsecurity.com/issue/WLB-2014040148

+ Symantec Encryption Desktop Memory Block Data Read Access Violation Denial of Service Vulnerability
http://www.securityfocus.com/bid/67020
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1647

+ Symantec Encryption Desktop Memory Copy Read Access Violation Denial of Service Vulnerability
http://www.securityfocus.com/bid/67016
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1646

脆弱性対策情報データベースJVN iPediaの登録状況 [2014年第1四半期（1月～3月）]
http://www.ipa.go.jp/security/vuln/report/JVNiPedia2014q1.html

パナソニックの会員サイトで情報漏洩のおそれ、不正ログイン試行460万件超
http://itpro.nikkeibp.co.jp/article/NEWS/20140423/552845/?ST=security

ワコール、不正アクセス受け閉鎖中だったWebサイトを一部再開
http://itpro.nikkeibp.co.jp/article/NEWS/20140423/552827/?ST=security

JVNVU#95860341 複数の Apple 製品の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU95860341/

JVNVU#98935174 IBM Notes および IBM Domino に問題
http://jvn.jp/vu/JVNVU98935174/