24日 水曜日、先勝

+ About OS X NTP Security Update
https://support.apple.com/en-us/HT6601
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9295

+ nginx 1.7.9 released
http://nginx.org/en/CHANGES

+ CESA-2014:2024 Important CentOS 7 ntp Security Update
http://lwn.net/Alerts/627246/

+ CESA-2014:2024 Important CentOS 6 ntp Security Update
http://lwn.net/Alerts/627248/

+ CESA-2014:2025 Important CentOS 5 ntp Security Update
http://lwn.net/Alerts/627247

+ UPDATE: Multiple Vulnerabilities in ntpd Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd

+ Apache POI 3.11 released
http://www.apache.org/dyn/closer.cgi/poi/release/RELEASE-NOTES.txt

+ Advisory: Vulnerability NTP CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296
http://www.sophos.com/en-us/support/knowledgebase/121788.aspx
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9296

+ FreeBSD-SA-14:31.ntp Multiple vulnerabilities in NTP suite
https://www.freebsd.org/security/advisories/FreeBSD-SA-14:31.ntp.asc
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9296

+ FreeBSD-EN-14:13.freebsd-update freebsd-update attempts to remove the root directory
https://www.freebsd.org/security/advisories/FreeBSD-EN-14:13.freebsd-update.asc

+ UnZip Buffer Overflows in '-t' Command Line Option Let Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1031433
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8141

+ REMOTE: Lotus Mail Encryption Server (Protector for Mail) LFI to RCE
http://www.exploit-db.com/exploits/35588

+ libpng 1.6.15 Heap Overflow
http://cxsecurity.com/issue/WLB-2014120165

+ Microsoft SDKs vulnerable
http://cxsecurity.com/issue/WLB-2014120164

+ Lotus Mail Encryption Server (Protector for Mail) Local File Inclusion
http://cxsecurity.com/issue/WLB-2014120161

+ PHP 5.6.3 unserialize() execute arbitrary code
http://cxsecurity.com/issue/WLB-2014120160
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8142

Help the FSF stay strong for 30 more years
https://www.fsf.org/appeal/

MicroOLAP Database Designer meets PostgreSQL 9.4
http://www.postgresql.org/about/news/1560/

Bucardo 5.3.0 released
http://www.postgresql.org/about/news/1559/

チェックしておきたい脆弱性情報＜2014.12.24＞
http://itpro.nikkeibp.co.jp/atcl/column/14/268561/121800036/?ST=security

だまされる、脅される、盗まれる　あなたの「お金」が危ない
［事件ファイル］口座から金を盗む「ネットバンキング詐欺事件」
http://itpro.nikkeibp.co.jp/atcl/column/14/120900123/120900002/?ST=security

パソコンとの違いで見る、スマートフォンのセキュリティ対策
［OSの脆弱性］スマホは更新不可のケースも
http://itpro.nikkeibp.co.jp/atcl/column/14/120900122/121700002/?ST=security

時刻同期サービス「ntpd」に重大脆弱性、細工パケット一撃でサーバー乗っ取りも
http://itpro.nikkeibp.co.jp/atcl/news/14/122202355/?ST=security

米大統領がサイバー攻撃への北関与を断定、テロ支援国家再指定を検討
http://itpro.nikkeibp.co.jp/atcl/news/14/122202344/?ST=security

JVNVU#96446762 複数のブロードバンドルータに、脆弱性が存在するバージョンの Allegro RomPager を使用している問題
http://jvn.jp/vu/JVNVU96446762/

UPDATE: JVNVU#96605606 Network Time Protocol daemon (ntpd) に複数の脆弱性
http://jvn.jp/vu/JVNVU96605606/

JVNVU#95399358 AppsGeyser で作成される Android アプリケーションに SSL 証明書の検証不備の脆弱性が作り込まれる問題
http://jvn.jp/vu/JVNVU95399358/

LOCAL: BitRaider Streaming Client 1.3.3.4098 Local Privilege Escalation Vulnerability
http://www.exploit-db.com/exploits/35590

LOCAL: GParted 0.14.1 - OS Command Execution
http://www.exploit-db.com/exploits/35595

DoS/PoC: jetAudio 8.1.3 Basic (mp3) - Crash POC
http://www.exploit-db.com/exploits/35592