29日 金曜日、先勝

+ RHSA-2016:0082 Important: qemu-kvm security update
https://rhn.redhat.com/errata/RHSA-2016-0082.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1714

+ RHSA-2016:0083 Important: qemu-kvm security and bug fix update
https://rhn.redhat.com/errata/RHSA-2016-0083.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1714

+ Selenium Standalone Server 2.50.0 released
http://docs.seleniumhq.org/download/

+ Selenium Client & WebDriver 2.50.0 released
https://raw.githubusercontent.com/SeleniumHQ/selenium/master/java/CHANGELOG

+ Selenium IE Driver Server 2.49.0 released
https://raw.githubusercontent.com/SeleniumHQ/selenium/master/cpp/iedriverserver/CHANGELOG

+ phpMyAdmin 4.5.4, 4.4.15.3, 4.0.10.13 released
https://www.phpmyadmin.net/files/4.5.4/
https://www.phpmyadmin.net/files/4.4.15.3/
https://www.phpmyadmin.net/files/4.0.10.13/

+ PMASA-2016-9 XSS vulnerability in SQL editor.
https://www.phpmyadmin.net/security/PMASA-2016-9/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2045

+ PMASA-2016-8 Full path disclosure vulnerability in SQL parser.
https://www.phpmyadmin.net/security/PMASA-2016-8/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2044

+ PMASA-2016-7 XSS vulnerability in normalization page.
https://www.phpmyadmin.net/security/PMASA-2016-7/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2043

+ PMASA-2016-6 Multiple full path disclosure vulnerabilities.
https://www.phpmyadmin.net/security/PMASA-2016-6/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2042

+ PMASA-2016-5 Unsafe comparison of XSRF/CSRF token.
https://www.phpmyadmin.net/security/PMASA-2016-5/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2041

+ PMASA-2016-4 Insecure password generation in JavaScript.
https://www.phpmyadmin.net/security/PMASA-2016-4/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1927

+ PMASA-2016-3 Multiple XSS vulnerabilities.
https://www.phpmyadmin.net/security/PMASA-2016-3/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2040

+ PMASA-2016-2 Unsafe generation of XSRF/CSRF token.
https://www.phpmyadmin.net/security/PMASA-2016-2/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2039

+ PMASA-2016-1 Multiple full path disclosure vulnerabilities.
https://www.phpmyadmin.net/security/PMASA-2016-1/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2038

+ Cisco Unity Connection User Search Cross-Site Scripting Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-uc
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1304

+ Cisco Small Business 500 Series Switches Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-sbs
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1303

+ VU#257823 OpenSSL re-uses unsafe prime numbers in Diffie-Hellman protocol
https://www.kb.cert.org/vuls/id/257823
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3197

+ OpenSSL 1.0.2f, 1.0.1r released
https://www.openssl.org/news/changelog.html#x1
https://www.openssl.org/news/cl101.txt

+ OpenSSL Security Advisory [28th Jan 2016]
https://www.openssl.org/news/secadv/20160128.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3197

+ OpenSSL Flaws Let Remote Users Recover DH Keys in Certain Cases and Let Remote Users Negotiate Disabled Ciphers
http://www.securitytracker.com/id/1034849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0701

News ＆ Trend
トヨタやソニーら異業種43社がセキュリティ人材育成を共同推進
http://itpro.nikkeibp.co.jp/atcl/column/14/346926/012700425/?ST=security

セールスフォースが「Heroku」に新機能、企業専用環境でセキュリティ向上
http://itpro.nikkeibp.co.jp/atcl/news/16/012800294/?ST=security