24日 火曜日、赤口

+ RHSA-2015:0715 Moderate: openssl security update
https://rhn.redhat.com/errata/RHSA-2015-0715.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0287
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0288
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0289
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0292
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0293

+ RHSA-2015:0716 Moderate: openssl security and bug fix update
https://rhn.redhat.com/errata/RHSA-2015-0716.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0287
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0288
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0289
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0292
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0293

+ Mozilla Firefox 36.0.4 released
https://www.mozilla.org/en-US/firefox/36.0.4/releasenotes/

+ MFSA-2015-28 Privilege escalation through SVG navigation
https://www.mozilla.org/en-US/security/advisories/mfsa2015-28/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818

+ MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination
https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817

+ PDFCreator 2.1 and PDF Architect 3 released
http://www.pdfforge.org/blog/pdfcreator-21-and-pdf-architect-3-released

+ UPDATE: Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150320-openssl

+ UPDATE: GNU glibc gethostbyname Function Buffer Overflow Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghost

+ PHP 5.6.7, 5.5.23, 5.4.39 released
http://php.net/ChangeLog-5.php#5.6.7
http://php.net/ChangeLog-5.php#5.5.23
http://php.net/ChangeLog-5.php#5.4.39

+ Sudo 1.8.13 released
http://www.sudo.ws/sudo/stable.html#1.8.13

+ JVNVU#95877131 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU95877131/

+ Mozilla Firefox SVG Processing Flaw Lets Remote Users Bypass Same-Origin Policy and Execute Arbitrary Scripts with Elevated Privileges
http://www.securitytracker.com/id/1031959
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818

+ Mozilla Firefox Heap Overflow in JIT Implementation Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1031958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817

+ OpenSSL DoS tester now available (CVE-2015-0291)
http://cxsecurity.com/issue/WLB-2015030160
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0291

+ PHP SoapClient's __call() type confusion through unserialize()
http://cxsecurity.com/issue/WLB-2015030159

+ Mozilla Firefox / Firefox ESR / SeaMonkey Two Vulnerabilities
http://secunia.com/advisories/62437/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818

JVNDB-2015-000040 LINE における意図しないアプリ内関数が呼び出される脆弱性
http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000040.html

JVNDB-2015-000041 MP Form Mail CGI eCommerce版 におけるコードインジェクションの脆弱性
http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000041.html

Active Directoryが危ない！標的型攻撃から守れ
第2回　ドメイン管理者の認証情報が狙われる
http://itpro.nikkeibp.co.jp/atcl/column/15/031700048/031700002/?ST=security

Active Directoryが危ない！標的型攻撃から守れ
第1回　メールやWeb経由で侵入、端末の乗っ取りを図る
http://itpro.nikkeibp.co.jp/atcl/column/15/031700048/031700001/?ST=security

テコラスがDB向けセキュリティソフト、アクセス中の様子を動画で確認
http://itpro.nikkeibp.co.jp/atcl/news/15/032001033/?ST=security

JVNVU#94580091 複数の BIOS 実装において SMRAM の領域外を参照する SMM 関数呼び出しが可能な問題
http://jvn.jp/vu/JVNVU94580091/

JVNVU#93435107 NSIS Inetc プラグインに SSL サーバ証明書の検証不備の脆弱性
http://jvn.jp/vu/JVNVU93435107/

JVN#41281927 LINE における意図しないアプリ内関数が呼び出される脆弱性
http://jvn.jp/jp/JVN41281927/

JVNVU#93102213 Apple OS X における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU93102213/

JVNVU#99221748 Apple Safari における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU99221748/index.html

JVN#39175666 MP Form Mail CGI eCommerce版 におけるコードインジェクションの脆弱性
http://jvn.jp/jp/JVN39175666/index.html

VU#631788 Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM
http://www.kb.cert.org/vuls/id/631788

VU#894897 NSIS Inetc plug-in fails to validate SSL certificates
http://www.kb.cert.org/vuls/id/894897