2日 木曜日、赤口

+ RHSA-2017:0225 Moderate: libtiff security update
https://rhn.redhat.com/errata/RHSA-2017-0225.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8870
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5652
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9533
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9534
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9535
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9536
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9537
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9540

+ CESA-2017:0225 Moderate CentOS 6 libtiff Security Update
https://lwn.net/Alerts/713251/

+ CESA-2017:0225 Moderate CentOS 7 libtiff Security Update
https://lwn.net/Alerts/713252/

+ Cisco Industrial Ethernet 2000 Series Switches CIP Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-psc1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3812

+ Cisco Prime Service Catalog URL Redirect Attack Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-psc
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3810

+ Cisco Prime Home Authentication Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-prime-home
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3791

+ Cisco Firepower Device Manager Arbitrary Audit Log Entry Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw2
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3822

+ Cisco Firepower URL Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3814

+ Cisco Firepower 4100 Series NGFW and Firepower 9300 Security Appliance Command Shell Injection Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fpw
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3806

+ Cisco Firepower Management Center Incomplete Rule Set Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-fmc
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3809

+ Cisco Email Security Appliance Malformed MIME Header Filtering Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-esa1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3818

+ Cisco cBR Series Converged Broadband Routers List Headers Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-cbr
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3824

+ Cisco ASR 1000 Series Aggregation Services Routers SNMP High CPU Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-asrsnmp
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3820

+ Linux kernel 4.9.7, 4.4.46, 3.12.70 released
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.7
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.46
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.70

+ NTP 4.2.8p9 released
http://archive.ntp.org/ntp4/ChangeLog-stable

+ UPDATE: JVNVU#99304449 Apache HTTP Web Server 2.4 における複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU99304449/

+ UPDATE: JVNVU#97133859 Apache HTTP Web Server の HTTP/2 プロトコルの処理にサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/vu/JVNVU97133859/

+ UPDATE: JVNVU#92250735 Apache Tomcat の複数の脆弱性に対するアップデート
http://jvn.jp/vu/JVNVU92250735/

+ UPDATE: JVNVU#98667810 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU98667810/

+ UPDATE: JVNVU#93163809 OpenSSL に複数の脆弱性
http://jvn.jp/vu/JVNVU93163809/index.html

+ UPDATE: JVNVU#97236594 glibc にバッファオーバーフローの脆弱性
http://jvn.jp/vu/JVNVU97236594/index.html

+ Google Chrome HTMLKeygenElement::shadowSelect() Type Confusion
https://cxsecurity.com/issue/WLB-2017020009

+ Apple WebKit HTMLFormElement::reset() Use-After-Free
https://cxsecurity.com/issue/WLB-2017020008
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2362

+ Apple WebKit Renderbox Type Confusion
https://cxsecurity.com/issue/WLB-2017020007
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2373

+ Apple WebKit HTMLKeygenElement Type Confusion
https://cxsecurity.com/issue/WLB-2017020006
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2369

パートナーを探せ！イスラエルCyberTechで日本企業が現地企業に熱視線
http://itpro.nikkeibp.co.jp/atcl/news/17/020200342/?ST=security&itp_list_theme

オリゾンシステムズ、LAN上の振る舞いで脅威を検知・遮断する製品
http://itpro.nikkeibp.co.jp/atcl/news/17/020100339/?ST=security&itp_list_theme

イスラエルでCyberTech 2017開催、ネタニヤフ首相がサイバーテロ対抗で国際協力を宣言
http://itpro.nikkeibp.co.jp/atcl/news/17/020100314/?ST=security&itp_list_theme

UPDATE: JVN#89379547 Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/jp/JVN89379547/

JVNVU#95305501 SHDesigns Resident Download Manager がファームウエアを検証しない問題
http://jvn.jp/vu/JVNVU95305501/index.html