7日 木曜日、赤口

+ RHSA-2014:1012 Moderate: php53 and php security update
https://rhn.redhat.com/errata/RHSA-2014-1012.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1571
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6712
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0238
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3479
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3480
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3515
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4721

+ RHSA-2014:1013 Moderate: php security update
https://access.redhat.com/errata/RHSA-2014:1013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0238
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3479
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3480
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3487
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3515
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4721

+ RHSA-2014:1011 Moderate: resteasy-base security update
https://access.redhat.com/errata/RHSA-2014:1011
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3490

+ RHSA-2014:1023 Important: kernel security and bug fix update
https://access.redhat.com/errata/RHSA-2014:1023
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0181
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2672
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2673
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3534
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667

+ CESA-2014:1013 Moderate CentOS 7 php Security Update
http://lwn.net/Alerts/607747/

+ CESA-2014:1012 Moderate CentOS 6 php Update
http://lwn.net/Alerts/607748/

+ CESA-2014:1011 Moderate CentOS 7 resteasy-base Security Update
http://lwn.net/Alerts/607749/

+ CESA-2014:1008 Important CentOS 7 samba Security Update
http://lwn.net/Alerts/607750/

+ CESA-2014:1009 Important CentOS 6 samba4 Update
http://lwn.net/Alerts/607751/

+ UPDATE: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl

+ Cisco IOS Software and Cisco IOS XE Software EnergyWise Crafted Packet Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140806-energywise
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3327

+ UPDATE: HPSBGN03050 rev.2 - HP IceWall SSO Dfw and HP IceWall MCRP running OpenSSL, Remote Denial of Service (DoS), Code Execution, Security Restriction Bypass, Disclosure of Information, or Unauthorized Access
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04343424-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ HPSBHF03084 rev.1 HP PCs with UEFI Firmware, Execution of Arbitrary Code
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04393276-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4859
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4860

+ UPDATE: HPSBMU03037 rev.2 - HP Multimedia Service Environment (MSE), (HP Network Interactive Voice Response (NIVR)), Remote Disclosure of Information
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04275280-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ HPSBMU03085 rev.1 - HP Application Lifecycle Management / Quality Center, Elevation of Privilege
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04394553-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2631

+ HPSBNS03082 rev.1 - HP NonStop Safeguard Security Software, Remote Program Access
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04391893-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2629

+ UPDATE: HPSBST02980 rev.2 - HP Array Configuration Utility, HP Array Diagnostics Utility, HP ProLiant Array Diagnostics and SmartSSD Wear Gauge Utility Running on Linux, Local Elevation of Privilege
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04187357-2%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

+ Linux kernel 3.2.62 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.62

+ Cisco IOS and IOS XE EnergyWise Processing Flaw Lets Remote Users Deny Service
http://www.securitytracker.com/id/1030682
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3327

+ Linux Kernel SCTP Null Pointer Dereference Lets Remote Users Deny Service
http://www.securitytracker.com/id/1030681
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077

+ McAfee Network Security Manager Input Validation Flaw in User Management Module Permits Cross-Site Request Forgery Attacks
http://www.securitytracker.com/id/1030674
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2390

+ OpenSSL 1.0.1i, 1.0.0n, 0.9.8zb released
http://www.openssl.org/source/

+ OpenSSL Security Advisory [6 Aug 2014]
http://www.openssl.org/news/secadv_20140806.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3508
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3509
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3505
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3506
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3511
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3512

+ SA59709 PHP Fileinfo libmagic AWK File Processing Denial of Service Vulnerability
http://secunia.com/advisories/59709/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3538

+ SA60430 Linux Kernel SCTP AUTH NULL Pointer Dereference Vulnerability
http://secunia.com/advisories/60430/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077

+ Symantec Endpoint Protection 11.x, 12.x - Kernel Pool Overflow
http://cxsecurity.com/issue/WLB-2014080026

JVNDB-2014-000085 GOM Player におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000085.html

【社長に説明できるセキュリティ】
社内営業で経営層の判断を促す（前編） 「危険である」では効果なし
http://itpro.nikkeibp.co.jp/atcl/column/14/511845/073000001/?ST=security

トレンドマイクロ、一般消費者向けの戦略と新サービス概要を発表
家庭内の複数の端末を一括して守る「セキュリティアットホーム」などを予定
http://itpro.nikkeibp.co.jp/atcl/news/14/080600388/?ST=security

日立システムズ、ホスト型ファイアウォールの運用代行サービスを開始
http://itpro.nikkeibp.co.jp/atcl/news/14/080600387/?ST=security

ソリトンがネット不正接続をブロックする機器の新版、一元管理を可能に
http://itpro.nikkeibp.co.jp/atcl/news/14/080600385/?ST=security