10日 火曜日、先負

+ UPDATE: GNU glibc gethostbyname Function Buffer Overflow Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghost

+ Apache Tomcat 7.0.59 Released
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html

+ Postfix 3.0.0, 2.11.4, 2.10.6, 2.9.12, 2.8.20 released
http://mirror.postfix.jp/postfix-release/official/postfix-3.0.0.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.11.4.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.10.6.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.9.12.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.8.20.HISTORY

+ Sudo 1.8.12 released
http://www.sudo.ws/sudo/stable.html#1.8.12

+ Sudo: Arbitrary file access via TZ environment variable
http://www.sudo.ws/sudo/alerts/tz.html

+ Gecko CMS 2.3 Multiple Vulnerabilities
http://cxsecurity.com/issue/WLB-2015010058
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1423
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1424

+ Trend Micro Multiple Products Arbitrary Write Privilege Escalation
http://cxsecurity.com/issue/WLB-2015020030
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9641

+ SA62768 Apache Tomcat Chunked Request Handling Vulnerability
http://secunia.com/advisories/62768/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0227

+ PHP 'exif_process_unicode()' Function Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/72541
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0232

+ PHP CVE-2015-0231 Incomplete Fix Use After Free Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/72539
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0231

+ PHP wdsl Extension CVE-2013-6501 Security Weakness
http://www.securityfocus.com/bid/72530
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6501

新人D太と先輩M子のITビジネス日誌
サイバー攻撃の被害を最小にする組織「CSIRT」はどうやってつくる？
http://itpro.nikkeibp.co.jp/atcl/column/14/493082/020400014/?ST=security

EMC、ガバナンス機能に注力したアイデンティティ管理ソフト
http://itpro.nikkeibp.co.jp/atcl/news/15/020900465/?ST=security

「UACを回避して管理者権限で実行」――不正送金ウイルスの新手口
http://itpro.nikkeibp.co.jp/atcl/news/15/020900463/?ST=security

米大手保険会社にサイバー攻撃、顧客・従業員8000万人の情報漏洩
http://itpro.nikkeibp.co.jp/atcl/news/15/020900461/?ST=security

DoS/PoC: MooPlayer 1.3.0 - 'm3u' SEH Buffer Overflow PoC
http://www.exploit-db.com/exploits/36022

DoS/PoC: Chemtool 1.6.14 - Memory Corruption Vulnerability
http://www.exploit-db.com/exploits/36024