28日 月曜日、赤口

+ HTTP authentication leak in redirects
https://curl.haxx.se/docs/adv_2018-b3bf.html
CVE-2018-1000007

+ HTTP/2 trailer out-of-bounds read
https://curl.haxx.se/docs/adv_2018-824a.html
VE-2018-1000005

+ MantisBT 2.10.0 and 2.9.1 released
https://mantisbt.org/blog/?p=564

+ CESA-2018:0163 Important CentOS 7 389-ds-base Security Update
https://lwn.net/Articles/745451/

+ CESA-2018:0223 Moderate CentOS 7 nautilus Security Update
https://lwn.net/Articles/745454/

+ CESA-2018:0151 Important CentOS 7 kernel Security Update
https://lwn.net/Articles/745453/

+ CESA-2018:0158 Moderate CentOS 7 dhcp Security Update
https://lwn.net/Articles/745452/

+ Mozilla Foundation Security Advisory 2018-04 Security vulnerabilities fixed in Thunderbird 52.6
https://www.mozilla.org/en-US/security/advisories/mfsa2018-04/
CVE-2018-5095
CVE-2018-5096
CVE-2018-5097
CVE-2018-5098
CVE-2018-5099
CVE-2018-5102
CVE-2018-5103
CVE-2018-5104
CVE-2018-5117
CVE-2018-5089

+ UPDATE: CPU Side-Channel Information Disclosure Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel

+ Apache Tomcat 8.0.49, 7.0.84 Released
http://tomcat.apache.org/tomcat-8.0-doc/changelog.html#Tomcat_8.0.49_(violetagg)
http://tomcat.apache.org/tomcat-7.0-doc/changelog.html#Tomcat_7.0.84_(violetagg)

+ Postfix 3.2.5, 3.1.8, 3.0.12, 2.11.11 released
http://mirror.postfix.jp/postfix-release/official/postfix-3.2.5.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-3.1.8.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-3.0.12.HISTORY
http://mirror.postfix.jp/postfix-release/official/postfix-2.11.11.HISTORY

ユニシスメインフレームからAWSへの5ステップでの移行
https://aws.amazon.com/jp/blogs/news/migrating-unisys-mainframe-to-aws-in-5-steps/

UPDATE: JVN#89379547 Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性
http://jvn.jp/jp/JVN89379547/

仮想通貨流出問題、コインチェックが自己資金での返金を決定
http://itpro.nikkeibp.co.jp/atcl/news/17/012803041/?ST=security&itp_list_theme

580億円分の仮想通貨が流出、大手取引所への不正アクセスで
http://itpro.nikkeibp.co.jp/atcl/news/17/012703040/?ST=security&itp_list_theme

「サイバー攻撃者がもうけ方をビジネスメール詐欺に変えてくる」、パロアルトが脅威予測
http://itpro.nikkeibp.co.jp/atcl/news/17/012603037/?ST=security&itp_list_theme

GMOペパボで不正アクセス、最大7万7385件の個人情報流出
http://itpro.nikkeibp.co.jp/atcl/news/17/012603031/?ST=security&itp_list_theme