28日 月曜日、友引

+ CESA-2014:0926 Moderate CentOS 5 kernel Update
http://lwn.net/Alerts/606673/

+ CESA-2014:0924 Important CentOS 6 kernel Update
http://lwn.net/Alerts/606674/

+ CESA-2014:0923 Important CentOS 7 kernel Security Update
http://lwn.net/Alerts/606675/

+ CESA-2014:0927 Moderate CentOS 7 qemu-kvm Security Update
http://lwn.net/Alerts/606676/

+ UPDATE: HPSBGN02936 rev.2 - HP and H3C VPN Firewall Module Products, Remote Denial of Service (DoS)
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03993467-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ HPSBMU03071 rev.1 - HP Autonomy IDOL, Running OpenSSL, Remote Unauthorized Access, Disclosure of Information
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04370307-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224

+ HPSBMU03073 rev.1 - HP Network Virtualization, Remote Execution of Code, Disclosure of Information
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04374202-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2626

+ HPSBMU03076 rev.1 - HP Systems Insight Manager (SIM) on Linux and Windows running OpenSSL, Multiple Vulnerabilities
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04379485-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470

+ HPSBMU03074 rev.1 - HP Insight Control server migration on Linux and Windows running OpenSSL, Remote Denial of Service (DoS), Code Execution, Unauthorized Access, Disclosure of Information
https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04378799-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470

+ HS14-019 Multiple Vulnerabilities in Cosminexus
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-019/index.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4265
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4268

+ HS14-019 Cosminexusにおける複数の脆弱性
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-019/index.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2490
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4219
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4221
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4265
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4266
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4268

+ PHP 5.4.31 Released
http://php.net/archive/2014.php#id2014-07-24-2
http://www.php.net/ChangeLog-5.php#5.4.31

+ HP VPN Firewall Module Unspecified Flaw Lets Remote Users Deny Service
http://www.securitytracker.com/id/1030649
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4840

+ Bugzilla Input Validation Flaw in JSONP Endpoint Permits Cross-Site Request Forgery Attacks
http://www.securitytracker.com/id/1030648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1546

+ Apple QuickTime 'mvhd' Atom Memory Corruption Error Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1030638
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4979

+ Apache mod_cache Null Pointer Dereference Lets Remote Users Deny Service
http://www.securitytracker.com/id/1030625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4352

+ Bugzilla 3.x / 4.x Cross Site Request Forgery
http://cxsecurity.com/issue/WLB-2014070148

JVNDB-2013-002240 TrendLink の ActiveX コントロールにおける任意のプログラムが実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002240.html

JVNVU#97798872 Omron NS シリーズ HMI に複数の脆弱性
http://jvn.jp/vu/JVNVU97798872/

JVNVU#90219433 BulletProof FTP Client 2010 にスタックバッファオーバーフローの脆弱性
http://jvn.jp/vu/JVNVU90219433/

JVNVU#99829464 TestRail にクロスサイトスクリプティングの脆弱性
http://jvn.jp/vu/JVNVU99829464/

NTTドコモ利用者狙う偽サイトが出現、見た目もドメイン名も偽装
http://itpro.nikkeibp.co.jp/atcl/news/14/072700226/?ST=security

チェックしておきたい脆弱性情報＜2014.07.28＞
http://itpro.nikkeibp.co.jp/atcl/column/14/268561/072300008/?ST=security

【セキュリティレガシー～崩壊するデータ安全保障】
［総論］負の遺産を一掃せよ
http://itpro.nikkeibp.co.jp/article/COLUMN/20140718/571204/?ST=security

【個人情報保護法改正、データ活用はもう怖くない】
［個人情報保護法改正1］プライバシー保護のための機関が誕生、日本の制度を国際水準に
http://itpro.nikkeibp.co.jp/article/COLUMN/20140722/571224/?ST=security

【セキュリティレガシー～崩壊するデータ安全保障】
http://itpro.nikkeibp.co.jp/article/COLUMN/20140718/571203/?ST=security

ロックインターナショナル、「スマホ経由の情報漏洩」に対応したソフト
http://itpro.nikkeibp.co.jp/atcl/news/14/072500224/?ST=security

DNSサーバーを狙ったDDoS攻撃、オープンリゾルバーを踏み台に
http://itpro.nikkeibp.co.jp/atcl/news/14/072500214/?ST=security

VU#394540 Sabre AirCentre Crew solutions contain a SQL injection vulnerability
http://www.kb.cert.org/vuls/id/394540