22日 水曜日、赤口

+ RHSA-2015:0867 Important: qemu-kvm security and bug fix update
https://rhn.redhat.com/errata/RHSA-2015-0867.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8106

+ RHSA-2015:0864 Important: kernel security and bug fix update
https://rhn.redhat.com/errata/RHSA-2015-0864.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3215
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3690
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7825
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7826
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8171
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9529
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9584
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1421

+ RHSA-2015:0863 Moderate: glibc security and bug fix update
https://rhn.redhat.com/errata/RHSA-2015-0863.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7423
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1781

+ nginx 1.8.0 released
http://nginx.org/en/CHANGES-1.8

+ CESA-2015:0863 Moderate CentOS 6 glibc Security Update
http://lwn.net/Alerts/641229/

+ HPSBMU03321 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code
https://h20566.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c04636829&docLocale=ja_JP
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2116

+ Glibc Buffer Overflow in getanswer_r() Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1032178
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1781

+ Mozilla Firefox Bug in AsyncPaintWaitEvent() Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1032171
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2706

+ Apple OS X XPC Entitlement Validation Flaw Lets Local Users Gain Root Privileges
http://www.securitytracker.com/id/1032167
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1130

+ SA64249 Linux Kernel chown() Race Condition Privileges Escalation Vulnerability
http://secunia.com/advisories/64249/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3339

+ SA64146 Microsoft Windows Privilege Escalation Vulnerability
http://secunia.com/advisories/64146/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1701

+ SA64071 Mozilla Firefox "AsyncPaintWaitEvent::AsyncPaintWaitEvent()" Use-After-Free Vulnerability
http://secunia.com/advisories/64071/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2706

+ glibc 2.20 getanswer_r, gethostbyname_r DNS response arbitrary code execution
http://cxsecurity.com/issue/WLB-2015040126
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1781

+ Linux chown() was racy relative to execve()
http://cxsecurity.com/issue/WLB-2015040119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3339

News ＆ Trend
株主向けサイトから5社1万4667人の株主情報が漏洩か
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/042100233/?ST=security

CSIRTメモ
チェックしておきたい脆弱性情報＜2015.04.22＞
http://itpro.nikkeibp.co.jp/atcl/column/14/268561/041900054/?ST=security

センサーで捕まえろ、施設侵入者　アライドテレシスが新手法
http://itpro.nikkeibp.co.jp/atcl/news/15/042101381/?ST=security

JVNVU#90912447 Net Nanny が共有の秘密鍵とルート CA 証明書を使用している問題
http://jvn.jp/vu/JVNVU90912447/index.html