5日 月曜日、先勝

+ phpMyAdmin 4.3.4 is released
http://sourceforge.net/p/phpmyadmin/news/2014/12/phpmyadmin-434-is-released/

+ The Android-x86 4.4-r2 released
http://www.android-x86.org/releases/releasenote-4-4-r2

+ UPDATE: Multiple Vulnerabilities in ntpd Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd

+ Linux kernel 3.2.66 released
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.66

+ Multiple vulnerabilities in NTP
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_ntp
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9296

+ libpng 1.6.16, 1.2.52 released
http://www.libpng.org/pub/png/src/libpng-1.6.16-README.txt
http://www.libpng.org/pub/png/src/libpng-1.2.52-README.txt

+ LOCAL: Windows 8.1 (32/64 bit) - Privilege Escalation (ahcache.sys/NtApphelpCacheControl)
http://www.exploit-db.com/exploits/35661

+ SA61851 Linux Kernel "batadv_frag_merge_packets()" Denial of Service Vulnerability
http://secunia.com/advisories/61851/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9428

+ Windows 8.1 (32/64 bit) - Privilege Escalation (ahcache.sys/NtApphelpCacheControl)
http://cxsecurity.com/issue/WLB-2015010003

+ Facebook Insecure Direct Object Reference
http://cxsecurity.com/issue/WLB-2014120202

+ nginx 1.7.3 SMTP STARTTLS plaintext injection flaw
http://cxsecurity.com/issue/WLB-2014120201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3556

+ PHP 'apprentice.c' Denial of Service Vulnerability
http://www.securityfocus.com/bid/71811

+ PHP 'cgi_main.c' Out of Bounds Read Denial of Service Vulnerability
http://www.securityfocus.com/bid/71833

+ Linux Kernel 'fragmentation.c' Denial of Service Vulnerability
http://www.securityfocus.com/bid/71847
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9428

+ PHP CVE-2014-9425 Double Free Denial of Service Vulnerability
http://www.securityfocus.com/bid/71800
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9425

+ libpng 'png_combine_row()' Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/71820

だまされる、脅される、盗まれる　あなたの「お金」が危ない
「遠隔操作ウイルス」とは何なのか？
http://itpro.nikkeibp.co.jp/atcl/column/14/120900123/120900006/?ST=security

パソコンとの違いで見る、スマートフォンのセキュリティ対策
［紛失・盗難］誰にでも起こるから入念に対策を
http://itpro.nikkeibp.co.jp/atcl/column/14/120900122/121700005/?ST=security

セコム、ウォークスルー顔認証システムをパッケージ製品化
http://itpro.nikkeibp.co.jp/atcl/news/14/122602402/?ST=security

ソニーへのサイバー攻撃、北朝鮮関与に一部専門家が異論
http://itpro.nikkeibp.co.jp/atcl/news/14/122602401/?ST=security

2014年アクセスランキング発表！
［CIO、Computerworld］SSL 3.0、Bashの脆弱性は世界の脅威、アップルも共通の話題
http://itpro.nikkeibp.co.jp/atcl/column/14/121000124/121500008/?ST=security

Facebook、プライバシー法違反の集団訴訟に直面か
http://itpro.nikkeibp.co.jp/atcl/news/14/122602399/?ST=security

プレステとXboxのオンラインサービスに障害発生
http://itpro.nikkeibp.co.jp/atcl/news/14/122602398/?ST=security

REMOTE: ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution
http://www.exploit-db.com/exploits/35688

REMOTE: ProjectSend Arbitrary File Upload
http://www.exploit-db.com/exploits/35660

REMOTE: Liferay Portal 7.0.x <= 7.0.2 - Pre-Auth RCE
http://www.exploit-db.com/exploits/35652

REMOTE: WhatsApp <= 2.11.476 - Remote Reboot/Crash App Android
http://www.exploit-db.com/exploits/35637

LOCAL: i-FTP Schedule Buffer Overflow
http://www.exploit-db.com/exploits/35671

DoS/PoC: Wickr Desktop 2.2.1 Windows - Denial of Service Vulnerability
http://www.exploit-db.com/exploits/35622