8日 水曜日、大安

+ CESA-2014:1359 Important CentOS 7 polkit-qt Security Update
http://lwn.net/Alerts/615199/

+ UPDATE: GNU Bash Environment Variable Command Injection Vulnerabilit
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

+ HPSBGN03108 rev.1 - HP Records Manager, Remote Cross-Site Scripting (XSS)
https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04441391-1%257CdocLocale%253Dja_JP%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4661

+ Multiple vulnerabilities in Bash
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_bash
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

+ Apahce Tomcat 7.0.56 Released
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html

+ Apache mod_cgi Remote Command Execution (python)
http://cxsecurity.com/issue/WLB-2014100038

+ Postfix SMTP Shellshock
http://cxsecurity.com/issue/WLB-2014100037
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271

+ SA61679 McAfee Multiple Products GNU Bash Multiple Vulnerabilities
http://secunia.com/advisories/61679/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

+ Google Chrome For iOS CVE-2014-3187 Unspecified Security Vulnerability
http://www.securityfocus.com/bid/70272
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3187

+ Google Chrome CVE-2014-3188 Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/70262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3188

+ Linux Kernel 'xfs_da_btree.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/70261
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7283

「ソーシャル新人類」の不夜城?10代は何を考えているのか
テレビよりも動画配信サイトを好む中高生、著作権軽視ゆえのリスクも
http://itpro.nikkeibp.co.jp/atcl/column/14/537662/100100011/?ST=security

日立システムズ、セキュアブレインを完全子会社化
http://itpro.nikkeibp.co.jp/atcl/news/14/100701242/?ST=security

JVNVU#95507011 Rejetto HFS (HTTP File Server) に null バイトの取扱いに関する脆弱性
http://jvn.jp/vu/JVNVU95507011/index.html

JVNVU#93498805 NetComm NB604N に格納型クロスサイトスクリプティングの脆弱性
http://jvn.jp/vu/JVNVU93498805/index.html

VU#121036 BMC Track-It! contains multiple vulnerabilities
http://www.kb.cert.org/vuls/id/121036

VU#280844 Cryoserver Security Appliance vulnerable to privilege escalation
http://www.kb.cert.org/vuls/id/280844

LOCAL: Asx to Mp3 2.7.5 - Stack Overflow
http://www.exploit-db.com/exploits/34921