27日 金曜日、赤口

+ CESA-2014:0790 Moderate CentOS 6 dovecot Update
http://lwn.net/Alerts/603595/

+ CESA-2014:0788 Important CentOS 6 mod_wsgi Update
http://lwn.net/Alerts/603596/

+ phpMyAdmin 4.2.5 is released
http://sourceforge.net/p/phpmyadmin/news/2014/06/phpmyadmin-425-is-released/

+ Squid 3.4.5 released
http://www.squid-cache.org/Versions/v3/3.4/RELEASENOTES.html

+ HPSBMU03058 rev.1 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Information
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04351097-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224

+ Linux kernel 3.14.9, 3.10.45, 3.4.95 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.45
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.95

+ Tomcat 8.0.9 Released
http://tomcat.apache.org/tomcat-8.0-doc/changelog.html

+ Eclipse Luna (4.4) released
http://eclipse.org/org/press-release/20140625_luna_release_train.php

+ PHP 5.4.30 released
http://www.php.net/archive/2014.php#id2014-06-26-1

+ PgBackMan 1.0.0 released
http://www.postgresql.org/about/news/1530/

+ Cisco IOS IPSec Processing Flaw Lets Remote Authenticated Users Deny Service
http://www.securitytracker.com/id/1030473
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3299

+ Symantec Data Insight Input Validation Flaw in Management Console Permits Cross-Site Scripting and HTML Injection Attacks
http://www.securitytracker.com/id/1030472
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3432
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3433

+ Sophos Antivirus 9.5.1 Cross Site Scripting
http://cxsecurity.com/issue/WLB-2014060143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2385

+ SA59278 Linux Kernel "aio_read_events_ring()" Information Disclosure Vulnerability
http://secunia.com/advisories/59278/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0206

+ Linux Kernel 'control.c' File Use After Free Memory Corruption Vulnerability
http://www.securityfocus.com/bid/68164

+ Linux Kernel Multiple Local Security Bypass Vulnerabilities
http://www.securityfocus.com/bid/68162

+ Linux Kernel LZO Implementation 'lzo1x_decompress_safe.c' Memory Corruption Vulnerability
http://www.securityfocus.com/bid/68214
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4608

世界のセキュリティ・ラボから日経コミュニケーション
Apple IDハッキング、iPhoneが人質に
http://itpro.nikkeibp.co.jp/article/COLUMN/20140626/566925/?ST=security

管理者が指定した不審ファイルを自動的に削除、DTIが新ソフト
http://itpro.nikkeibp.co.jp/article/NEWS/20140626/566977/?ST=security

UPDATE: JVN#61247051 OpenSSL における Change Cipher Spec メッセージの処理に脆弱性
http://jvn.jp/jp/JVN61247051/