5日 金曜日、友引

PUBLIC ADVISORY: 03.04.10: Autonomy KeyView OLE Document Integer Overflow Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=858

JVN#06874657 OpenPNE におけるアクセス制限回避の脆弱性
http://jvn.jp/jp/JVN06874657/index.html

JVNDB-2010-000006 OpenPNE におけるアクセス制限回避の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000006.html

JVNDB-2010-001125 OpenOffice.org の filter/ww8/ww8par2.cxx におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001125.html

JVNDB-2010-001124 OpenOffice.org の filter/ww8/ww8par2.cxx における整数アンダーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001124.html

JVNDB-2010-001123 OpenOffice.org の GIFLZWDecompressor::GIFLZWDecompressor 関数におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001123.html

JVNDB-2010-001122 OpenOffice.org の XPMReader::ReadXPM 関数における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001122.html

JVNDB-2010-001121 Adobe BlazeDS における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001121.html

JVNDB-2010-001120 Adobe Flash Player および Adobe AIR におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001120.html

JVNDB-2010-001119 複数の Adobe 製品 におけるクロスドメインの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001119.html

OpenSSL Missing Check in kssl_keytab_is_available() Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023688.html

Symantec Data Loss Prevention Integer Overflow in KeyView Filter in Processing OLE Documents Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023686.html

Symantec Brightmail Integer Overflow in KeyView Filter in Processing OLE Documents Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023685.html

Symantec Mail Security Integer Overflow in KeyView Filter in Processing OLE Documents Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023684.html




+ PHP 5.3.2 Released
http://www.php.net/archive/2010.php#id-1
http://www.php.net/ChangeLog-5.php#5.3.2

+ Suhosin Patch 0.9.9.1 released
http://www.hardened-php.net/suhosin/download.html#suhosin_patch_0.9.9.1
http://www.hardened-php.net/suhosin/changelog.html#pversion_0.9.9.1

+ SA38807: OpenSSL Kerberos "kssk_keytab_is_available()" Denial of Service
http://secunia.com/advisories/38807/

+- OpenSSL 'ChangeCipherSpec' DTLS Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/35174

-+ Integer Overflow Security Vulnerability in AES and RC4 Decryption in the Solaris Kerberos Crypto Library May Lead to Execution of Arbitrary Code or a Denial of Service (DoS)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275530-1

- Multiple Security Vulnerabilities in BIND DNSSEC Software Shipped With Solaris May Cause Bogus NXDOMAIN Responses
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275890-1

FreeBSD 7.3-RC2 Available
http://lists.freebsd.org/pipermail/freebsd-stable/2010-March/055596.html

RHBA-2010:0132-1: openmotif bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0132.html

SYM10-006: Security Advisories Relating to Symantec Products - Multi-Vendor Autonomy KeyView Filter Module OLE Document Processing Overflow
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100304_00

Independent Researcher : fcrontab Information Disclosure Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31920

Independent Researcher : Open redirection vulnerability in the Drupal API function drupal_goto (Drupal 6.15 and 5.21)
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31923

VMware : ESX Service Console and vMA third party updates
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31921

Cisco : Multiple Vulnerabilities in Cisco Digital Media Manager
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31915

Cisco : Cisco Digital Media Player Remote Display Unauthorized Content Injection Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31916

Core Security Technologies : Luxology Modo 401 .LXO Integer Overflow
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31918

Debian : New cups packages fix arbitrary code execution
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31912

Gentoo Linux : sudo: Privilege escalation
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31917

「ガンブラー」の“再攻撃”が相次ぐ、原因は管理用PCのウイルス
「Webページの復旧やパスワード変更だけでは不十分」、IPAが警告
http://itpro.nikkeibp.co.jp/article/NEWS/20100305/345392/?ST=security

CA20100304-01: Security Notice for CA SiteMinder
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00047.html

Apple Airport Wireless Products: Promiscuous FTP PORT Allowed in FTP Proxy Provides Security Bypass
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00043.html

[ MDVSA-2010:054 ] pam_krb5
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00049.html

Unspecified EMC Documentum Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00044.html

NSOADV-2010-006: Authentium Command Free Scan ActiveX Control buffer overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00039.html

Open redirection vulnerability in the Drupal API function drupal_goto (Drupal 6.15 and 5.21)
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00046.html

IETF effort: Security Assesment of the Internet Protocol
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00040.html

VMSA-2010-0004 ESX Service Console and vMA third party updates
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00041.html

[xss] a xss on "ThreadID" parameter in BBSXP 2008 from china
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00048.html

fcrontab Information Disclosure Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00045.html

[SECURITY] [DSA 2007-1] New cups packages fix arbitrary code execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00038.html

[USN-906-1] CUPS vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00037.html

JVNVU#576029 libpng における圧縮された補助チャンクの処理に脆弱性
http://jvn.jp/cert/JVNVU576029/index.html

Dosya Yukle Script Arbitrary File Upload Security Issue
http://secunia.com/advisories/38822/

Fedora update for argyllcms
http://secunia.com/advisories/38828/

Debian update for cups
http://secunia.com/advisories/38798/

Joomla MyBlog Component "task" File Inclusion Vulnerability
http://secunia.com/advisories/38777/

Drupal Multiple Vulnerabilities
http://secunia.com/advisories/38835/

Comptel Provisioning and Activation "error_msg_parameter" Cross-Site Scripting
http://secunia.com/advisories/38801/

Cisco Digital Media Manager Multiple Vulnerabilities
http://secunia.com/advisories/38800/

OpenSSL Kerberos "kssk_keytab_is_available()" Denial of Service
http://secunia.com/advisories/38807/

Fcron "fcrontab" Insecure File Access Security Issues
http://secunia.com/advisories/38796/

Red Hat update for cups
http://secunia.com/advisories/38785/

Opera "Content-Length" Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/38820/

Fedora update for automake
http://secunia.com/advisories/38827/

Ubuntu update for cups
http://secunia.com/advisories/38786/

RCA DCM425 Cable Modem Denial of Service
http://secunia.com/advisories/38778/

CUPS "lppasswd" Privilege Escalation Vulnerability
http://secunia.com/advisories/38789/

VMware ESX Server 4 Multiple Vulnerabilities
http://secunia.com/advisories/38834/

VMware ESX Server 4 update for newt, nfs-utils, and glib2
http://secunia.com/advisories/38833/

VMware ESX Server Multiple Vulnerabilities
http://secunia.com/advisories/38832/

Drupal Internationalization Module Arbitrary Code Execution Vulnerability
http://secunia.com/advisories/38831/

Wt Two Vulnerabilities
http://secunia.com/advisories/38759/

VMware vMA Update for Multiple Packages
http://secunia.com/advisories/38794/

Drupal eTracker Module Script Insertion Vulnerability
http://secunia.com/advisories/38826/

Drupal Workflow Module Script Insertion Vulnerability
http://secunia.com/advisories/38825/

Fedora update for wireshark
http://secunia.com/advisories/38829/

Cisco Digital Media Player Content Injection Vulnerability
http://secunia.com/advisories/38799/

Drupal AddThis Button Module Script Insertion Vulnerability
http://secunia.com/advisories/38818/

Gentoo update for sudo
http://secunia.com/advisories/38803/

Red Hat update for java-1.5.0-ibm
http://secunia.com/advisories/38781/

Cisco Unified Communications Manager 5 Denial of Service Vulnerabilities
http://secunia.com/advisories/38824/

Cisco Unified Communications Manager Denial of Service Vulnerabilities
http://secunia.com/advisories/38754/

CA SiteMinder Input Validation Flaw in WebWorks Help Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023683.html

McAfee LinuxShield Discloses Whether Usernames Are Valid
http://securitytracker.com/alerts/2010/Mar/1023681.html

McAfee LinuxShield Lets Remote Authenticated Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023680.html

Fcron 'fcrontab' Symlink Flaw Lets Local Users View Files
http://securitytracker.com/alerts/2010/Mar/1023677.html

libpng Decompression Process May Let Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023674.html

Mozilla Firefox XPCOM Utility Chrome Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36857

Mozilla Firefox and SeaMonkey Proxy Auto-Configuration File Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/36856

Mozilla Firefox 'document.getSelect' Cross Domain Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36858

Mozilla Firefox Download Manager World Writable File Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36852

Opera Web Browser 'Content-Length' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38519

Mozilla Firefox and SeaMonkey 'libpr0n' GIF Parser Heap Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/36855

Mozilla Firefox CVE-2009-3382 Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/36866

Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/35888

Sun Java SE November 2009 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/36881

Mozilla Firefox and Seamonkey Regular Expression Parsing Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35891

Mozilla Firefox Form History Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36853

Mozilla Firefox CVE-2009-3380 Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/36871

Mozilla Firefox and SeaMonkey Download Filename Spoofing Vulnerability
http://www.securityfocus.com/bid/36867

Mozilla Firefox Floating Point Conversion Heap Overflow Vulnerability
http://www.securityfocus.com/bid/36851

ISC BIND 9 DNSSEC Query Response Additional Section Remote Cache Poisoning Vulnerability
http://www.securityfocus.com/bid/37118

GNOME glib Base64 Encoding and Decoding Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/34100

Linux Kernel 2.4 and 2.6 Multiple Local Information Disclosure Vulnerabilities
http://www.securityfocus.com/bid/36304

OpenSSL 'ChangeCipherSpec' DTLS Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/35174

Linux Kernel with SELinux 'mmap_min_addr' Low Memory NULL Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/36051

GNU ed File Processing 'strip_escapes()' Heap Overflow Vulnerability
http://www.securityfocus.com/bid/30815

Linux Kernel 'nfs4_proc_lock()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36936

OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/35001

OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/35138

D-Bus 'dbus_signature_validate()' Type Signature Denial of Service Vulnerability
http://www.securityfocus.com/bid/31602

Linux Kernel eCryptfs Lower Dentry Null Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36639

Linux Kernel 'pipe.c' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36901

Wireshark Dissector LWRES Multiple Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/37985

Newt Text Box Content Processing Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/36515

OpenSSL Multiple Vulnerabilities
http://www.securityfocus.com/bid/34256

'nfs-utils' Package 'hosts_ctl()' Security Bypass Vulnerability
http://www.securityfocus.com/bid/31823

Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/36552

Expat Unspecified XML Parsing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37203

Linux Kernel 'unix_stream_connect()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36723

Linux Kernel 2.4 and 2.6 Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36827

GNU Automake Insecure Directory Permissions Vulnerability
http://www.securityfocus.com/bid/37378

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37255

Linux Kernel r128 Driver CCE Initialization NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/36824

Linux Kernel '/drivers/net/r8169.c' Out-of-IOMMU Error Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36706

MiNBank 'minsoft_path' Parameter Multiple Remote File Include Vulnerabilities
http://www.securityfocus.com/bid/31492

Argyll CMS '55-Argyll.rules' Security Bypass Vulnerability
http://www.securityfocus.com/bid/38532

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities
http://www.securityfocus.com/bid/38531

4日 木曜日、先勝

[courier-announce] Cone 0.81 released
http://www.courier-mta.org/download.php#cone

OSC 2010 Tokyo/Springのセミナー資料を公開しました。
http://wiki.samba.gr.jp/mediawiki/index.php?title=%E3%82%A4%E3%83%99%E3%83%B3%E3%83%88#.E3.82.AA.E3.83.BC.E3.83.97.E3.83.B3.E3.82.BD.E3.83.BC.E3.82.B9.E3.82.AB.E3.83.B3.E3.83.95.E3.82.A1.E3.83.AC.E3.83.B3.E3.82.B92010_Tokyo.2FSpring

Timekeeping best practices for Linux guests
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1006427&sliceId=1&docTypeID=DT_KB_1_1

JVNVU#576029 libpng における圧縮された補助チャンクの処理に脆弱性
http://jvn.jp/cert/JVNVU576029/index.html

JVNDB-2010-001118 KVM の pit_ioport_read 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001118.html

JVNDB-2010-001117 KVM の x86 エミュレータにおける権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001117.html

JVNDB-2010-001116 KVM の x86 エミュレータにおける権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001116.html

JVNDB-2010-001115 QEMU の usb_host_handle_control 関数におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001115.html

JVNDB-2010-001114 RealNetworks HelixPlayer および RealPlayer におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001114.html

JVNDB-2010-001113 RealNetworks HelixPlayer および RealPlayer の Unescape 関数におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001113.html

salefale-dot-com is bad
http://isc.sans.org/diary.html?storyid=8350

CUPS lppasswd Format String Bug Lets Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Mar/1023678.html

Oracle Siebel Customer Relationship Management Input Validation Hole Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023676.html

MiNBank 'minsoft_path' Parameter Multiple Remote File Include Vulnerabilities
http://www.securityfocus.com/bid/31492

Microsoft Office Web Components ActiveX Control Stack Buffer Overflow Code Execution Vulnerability
http://www.securityfocus.com/bid/35992

+ RHSA-2010:0129-1: Moderate: cups security update
http://rhn.redhat.com/errata/RHSA-2010-0129.html
http://www.securityfocus.com/bid/38510

+ SA38776: Apache HTTP Server Multiple Vulnerabilities
http://secunia.com/advisories/38776/
http://www.vupen.com/english/advisories/2010/0511

- DBI 1.611 released
http://search.cpan.org/~timb/DBI/Changes

- Multiple Security Vulnerabilities in the Common Unix Printing System (CUPS) Web Interface in OpenSolaris May Lead to Cross-Site Scripting (XSS) and HTTP Response Splitting Attacks
http://sunsolve.sun.com/search/document.do?assetkey=1-66-271169-1

PSN-2010-02-661: 2010-03 Security Bulletin: NS-Remote SafeNet Security Fixes
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-02-661&viewMode=view

PSN-2010-02-660: 2010-03 Security Bulletin: Secure Access (SA) product ? Cross site scripting issue on end user edit bookmarks page
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-02-660&viewMode=view

PSN-2010-02-659: 2010-03 Security Bulletin: Secure Access (SA) and Unified Access Control (UAC) products - OpenSSL
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-02-659&viewMode=view

Sun Storage 7000 2009.Q3 Software Release May Result in an Incorrect Diagnosis of CPU Correctable Error
http://sunsolve.sun.com/search/document.do?assetkey=1-66-278130-1

Mozilla Developer Preview Now Available With Out-of-Process Plugins
http://developer.mozilla.org/devnews/index.php/2010/03/03/mozilla-developer-preview-now-available-with-out-of-process-plugins/

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20100303-cucm.shtml

Multiple Vulnerabilities in Cisco Digital Media Manager
http://www.cisco.com/warp/public/707/cisco-sa-20100303-dmm.shtml

Cisco Security Advisory: Cisco Digital Media Player Remote Display Unauthorized Content Injection Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20100303-dmp.shtml

Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco Unified Communications Manager Denial of Service Vulnerabilities
http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080b1b926.html

ウイルスパターンファイル 6.891.80の緊急配信のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1379

Document ID: 346617: After rebooting the first starting node of a Microsoft Cluster using dynamic disk(s) for quorum, the Cluster Service fails or is delayed due to a quorum online time-out.
http://seer.entsupport.symantec.com/docs/346617.htm

Document ID: 340500: Diskgroup import and deport may take an extensively long amount of time, and VxVDS.exe consumes 100% CPU
http://seer.entsupport.symantec.com/docs/340500.htm

Independent Researcher : plenitude String Crash(0day) Exploit
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31906

Independent Researcher : (plenitude String )Denial of Service Exploit
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31907

SuSE : security-announce SUSE Security Announcement: Linux kernel
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31901

AmnPardaz Security Research Team : Blind SQL Injection Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31908

Core Security Technologies : Luxology Modo 401 .LXO Integer Overflow
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31903

Debian : New sudo packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31902

「スクリプトを無効にしても防げない」、新たな「ガンブラー」出現
正規サイトに不正な設定ファイルをアップ、ユーザーを悪質サイトに誘導
http://itpro.nikkeibp.co.jp/article/NEWS/20100304/345314/?ST=security

イーディーコントライブ、ウイルス対策ソフトを搭載したUSBメモリー
http://itpro.nikkeibp.co.jp/article/NEWS/20100304/345313/?ST=security

Cisco Security Advisory: Cisco Digital Media Player Remote Display Unauthorized Content Injection Vu
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00034.html

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Digital Media Manager
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00033.html

CORRECTION: CORE-2009-0913 - Luxology Modo 401 .LXO Integer Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00036.html

[ GLSA 201003-01 ] sudo: Privilege escalation
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00032.html

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00027.html

MS10-015 re-released
http://isc.sans.org/diary.html?storyid=8341

Reports about large number of fake Amazon order confirmations
http://isc.sans.org/diary.html?storyid=8344

What is your firewall log telling you - Part #2
http://isc.sans.org/diary.html?storyid=8347

Cisco Digital Media Player Lets Remote Users Inject Arbitrary Video and Data Content
http://securitytracker.com/alerts/2010/Mar/1023672.html

Cisco Digital Media Manager Lets Remote Users Access the System and Remote Authenticated Users Modify the Configuration and View Passwords
http://securitytracker.com/alerts/2010/Mar/1023671.html

Cisco Unified Communications Manager SIP/SCCP/CTI Processing Bugs Let Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023670.html

Slackware update for openssl
http://secunia.com/advisories/38761/

DFD Cart Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities
http://secunia.com/advisories/38635/

SUSE update for kernel
http://secunia.com/advisories/38779/

Apache HTTP Server Multiple Vulnerabilities
http://secunia.com/advisories/38776/

ARISg "errmsg" Cross-Site Scripting Vulnerability
http://secunia.com/advisories/38793/

Modo 401 LXO Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/38784/

TYPO3 Calendar Base Extension SQL Injection Vulnerability
http://secunia.com/advisories/38745/

Oracle Siebel CRM Cross-Site Scripting Vulnerability
http://secunia.com/advisories/38806/

McAfee LinuxShield "nailsd" Authentication Security Issue
http://secunia.com/advisories/38782/

libpng Ancillary Chunks "Decompression Bomb" Denial of Service
http://secunia.com/advisories/38774/

Debian update for sudo
http://secunia.com/advisories/38762/

McAfee LinuxShield Statistics Server Authentication Bypass Vulnerability
http://www.vupen.com/english/advisories/2010/0518

Libpng PNG Compressed Ancillary Chunks Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0517

Oracle Siebel CRM "start.swe" Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0516

Apache "mod_proxy_ajp" Request Handling Denial of Service Issue
http://www.vupen.com/english/advisories/2010/0511

SLAED CMS Remote File Upload Vulnerability
http://www.securityfocus.com/bid/38450

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

CUPS File Descriptors Handling Use-After-Free Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38510

Apple Safari 'background' attribute Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38447

SystemTap '__get_argv()' and '__get_compat_argv()' Local Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/38120

Luxology Modo 401 'valet4.dll' Integer Overflow Vulnerability
http://www.securityfocus.com/bid/38460

Todd Miller Sudo 'runas_default' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38432

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38362

Linux Kernel 'do_pages_move()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38144

Linux Kernel 'drivers/connector/connector.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38058

Linux Kernel 64bit Personality Handling Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38027

Linux Kernel 'ebtables' Security Bypass Vulnerability
http://www.securityfocus.com/bid/37762

Linux Kernel 'print_fatal_signal()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/37724

Linux e1000e Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37523

Cisco Unified Communications Manager SCCP (CVE-2010-0587) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38496

Linux e1000 Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37519

Linux Kernel PI Futex Invalid Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38165

Linux Kernel 'megaraid_sas' Driver Insecure File Permission Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37019

CUPS 'kerberos' Parameter Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/36958

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34789

CUPS 'lppasswd' Tool Localized Message String Security Weakness
http://www.securityfocus.com/bid/38524

Drupal Workflow Module Comment Field HTML Injection Vulnerability
http://www.securityfocus.com/bid/38520

Opera Web Browser 'Content-Length' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38519

Adobe Flash Player Local File Access Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38517

HazelPress 'login.php' Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38516

Drupal eTracker Module URI Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38514

Drupal AddThis Button Module HTML Injection Vulnerability
http://www.securityfocus.com/bid/38513

Drupal Internationalization Module PHP Filter PHP Code Execution Vulnerability
http://www.securityfocus.com/bid/38512

Project Man 'login.php' Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38511

ProMan Multiple Remote and Local File Include Vulnerabilities
http://www.securityfocus.com/bid/38509

PhpCDB 'lang_global' Parameter Multiple Local File Include Vulnerabilities
http://www.securityfocus.com/bid/38507

Uiga Church Portal 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38506

DFD Cart Multiple Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38505

Cisco Digital Media Player Video or Data Content Injection Vulnerability
http://www.securityfocus.com/bid/38504

Cisco Digital Media Manager Default Credentials Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/38503

Cisco Digital Media Manager Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38502

Cisco Unified Communications Manager SCCP (CVE-2010-0588) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38501

Cisco Digital Media Manager (CVE-2010-0571) Remote Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38500

Cisco Unified Communications Manager SIP Message (CVE-2010-0591) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38498

Cisco Unified Communications Manager CTI Manager Service Denial of Service Vulnerability
http://www.securityfocus.com/bid/38497

Cisco Unified Communications Manager SIP Message (CVE-2010-0590) Denial of Service Vulnerability
http://www.securityfocus.com/bid/38495

3日 水曜日、赤口

+ DBI 1.611 released
http://search.cpan.org/~timb/DBI/Changes

InterScan Messaging Hosted SecurityにおけるMTA(Mail Transfer Agent)不具合のご報告
http://www.trendmicro.co.jp/support/news.asp?id=1378

Microsoft、プライバシ保護技術「U-Prove」のプレビュー版を公開
http://itpro.nikkeibp.co.jp/article/NEWS/20100303/345278/?ST=security

JPCERT/CC WEEKLY REPORT 2010-03-03
http://www.jpcert.or.jp/wr/2010/wr100801.html

JVNDB-2010-001112 Microsoft Windows の Microsoft Paint における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001112.html

JVNDB-2010-001111 Microsoft Windows の kernel における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001111.html

JVNDB-2010-001110 Microsoft Windows の KDC におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001110.html

JVNDB-2010-001109 Microsoft Windows の SMB 実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001109.html

JVNDB-2010-001108 Microsoft Windows の SMB 実装におけるアクセス権を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001108.html

JVNDB-2010-001107 Microsoft Windows の SMB 実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001107.html

JVNDB-2010-001106 Microsoft Windows の SMB 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001106.html

JVNDB-2010-001105 Microsoft Windows の Client/Server Run-time Subsystem における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001105.html

JVNDB-2010-001104 Microsoft Windows の Hyper-V サーバ実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001104.html

JVNDB-2008-001801 IPv6 NDP 実装における Neighbor Discovery メッセージの送信元検証処理に関する脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001801.html

コンピュータウイルス・不正アクセスの届出状況[2月分]について
http://www.ipa.go.jp/security/txt/2010/03outline.html

IBM Informix Dynamic Server Buffer Overflows in 'librpc.dll' Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023669.html

BaoFeng Storm ActiveX Control 'OnBeforeVideoDownload()' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34789

Symantec AntiVirus Scan Evasion Vulnerability
http://www.securityfocus.com/bid/38219

+ BIND 9.6.2 released
https://www.isc.org/files/release-notes/962.html

+ Vulnerability Note VU#576029: libpng stalls on highly compressed ancillary chunks
http://www.kb.cert.org/vuls/id/576029
http://www.securityfocus.com/bid/38478

+ Linux Kernel 'dvb_net_ule()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38479

MySQL Connector/Net 6.3 Alpha 2 has been released
http://dev.mysql.com/downloads/connector/net/6.3.html

- DBI-1.610_90 Development release
http://search.cpan.org/~timb/DBI-1.610_90/

- IBM Lotus Domino 'readme.nsf' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38481

MicroOLAP Database Designer for PostgreSQL with enhanced WineHQ support released
http://www.postgresql.org/about/news.1184

Samba 3.3.11 対応の日本語マニュアル ver 0.5.5 を公開しました。
http://sourceforge.jp/forum/forum.php?forum_id=22264

定期サーバメンテナンスのお知らせ（2010年3月12日）
http://www.trendmicro.co.jp/support/news.asp?id=1377

iDEFENSE : IBM Lotus Domino Web Access ActiveX Stack Buffer Overflow Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31897

Slackware Linux : gzip
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31886

Slackware Linux : openssl
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31887

Slackware Linux : seamonkey
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31888

「架空の引き落としでだます」、セゾンカードをかたるフィッシング
偽メールに「取り消しはこちらまで」のURL、アクセスすると偽サイト
http://itpro.nikkeibp.co.jp/article/NEWS/20100302/345264/?ST=security

ガンブラー対策でセキュリティ企業などがコミュニティ設立
http://itpro.nikkeibp.co.jp/article/NEWS/20100302/345254/?ST=security

JVNVU#612021 Internet Explorer において VBScript および Windows Help を使用する際に任意のコードが実行される脆弱性
http://jvn.jp/cert/JVNVU612021/index.html

CPNI-957037 SSH 通信において一部データが漏えいする可能性
http://jvn.jp/niscc/CPNI-957037/index.html

NSOADV-2010-004: McAfee LinuxShield remote/local code execution
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00025.html

ZDI-10-024: Novell eDirectory SOAP Request Parsing Denial of Service Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00024.html

[SECURITY] [DSA 2006-1] New sudo packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00023.html

[ MDVSA-2010:053 ] apache
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00026.html

Luxology Modo 401 .LXO Integer Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00022.html

Sparta Systems TrackWise TeamAccess module Multiple Cross Site Scripting Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00016.html

1024CMS Blind SQL Injection Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00012.html

iDefense Security Advisory 03.02.10: IBM Lotus Domino Web Access ActiveX Stack Buffer Overflow Vulne
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00017.html

[xss] i found a Cross Site Scripting Vulnerability about Discuz! uid Parameter
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00018.html

Eshbel Priority MarketGate module Cross Site Scripting Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00015.html

Todd Miller Sudo local root exploit discovered by Slouching
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00020.html

ZDI-10-023: Multiple Vendor librpc.dll Signedness Error Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00013.html

ZDI-10-022: IBM Informix librpc.dll Multiple Remote Code Execution Vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00011.html

[ MDVSA-2010:052 ] sudo
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00014.html

PUBLIC ADVISORY: 03.01.10: IBM Lotus Domino Web Access ActiveX Stack Buffer Overflow Vulnerability
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=857

Updates for your consumption this morning (Bind, Opera)
http://isc.sans.org/diary.html?storyid=8335

Panda Cloud Antivirus 1.0.1リリース
http://pandajapanblogs.blogspot.com/2010/03/panda-cloud-antivirus-101.html

Uploadify Arbitrary File Upload Security Issue
http://secunia.com/advisories/38773/

TrendNet TV-IP110W Missing Authentication Check Security Issue
http://secunia.com/advisories/38479/

1024 CMS "id" SQL Injection Vulnerability
http://secunia.com/advisories/38775/

IBM AIX NTP Mode 7 Request Denial of Service
http://secunia.com/advisories/38764/

PHP Trouble Ticket "id" SQL Injection Vulnerability
http://secunia.com/advisories/38763/

IBM Informix Dynamic Server RPC Implementation Vulnerabilities
http://secunia.com/advisories/38731/

Fedora update for sunbird
http://secunia.com/advisories/38770/

Fedora update for thunderbird
http://secunia.com/advisories/38772/

Red Hat update for systemtap
http://secunia.com/advisories/38817/

Red Hat update for systemtap
http://secunia.com/advisories/38765/

Fedora update for openldap
http://secunia.com/advisories/38769/

Fedora update for puppet
http://secunia.com/advisories/38766/

IBM AIX Security Update Fixes NTP Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0510

EMC Legato Networker RPC Library Code Execution Vulnerability
http://www.vupen.com/english/advisories/2010/0509

IBM Informix Dynamic Server Remote Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0508

ProSSHD v1.2 20090726 Buffer Overflow Exploit
http://www.exploit-db.com/exploits/11618

Internet Explorer 'winhlp32.exe' 'MsgBox()' Remote Code Execution Vulnerability
http://www.exploit-db.com/exploits/11615

Novell eDirectory eMBox SOAP Request Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38157

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38362

Todd Miller Sudo 'runas_default' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38432

Microsoft Windows Double Free Memory Corruption Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38044

Microsoft Windows #GP Trap Handler Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37864

Microsoft Windows Client/Server Run-time Subsystem Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38098

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability
http://www.securityfocus.com/bid/35138

OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/35001

OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/31692

GNU gzip LZW Compression Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/37886

PHP Advanced Transfer Manager Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/15074

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37255

Mozilla Firefox CVE-2010-0159 Multiple Remote Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/38286

Mozilla Firefox and SeaMonkey Web Workers Array Data Type Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38285

Mozilla Firefox and SeaMonkey SVG Document Cross Domain Scripting Vulnerability
http://www.securityfocus.com/bid/38288

Mozilla Firefox and SeaMonkey 'showModalDialog' method Cross Domain Scripting Vulnerability
http://www.securityfocus.com/bid/38289

Mozilla Firefox/Thunderbird/SeaMonkey HTML Parser Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38287

OpenLDAP X.509 Certificate NULL Character Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36844

Domino Web Access ActiveX Control URL Handling Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38457

McAfee LinuxShield 'nailsd' Daemon Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38489

ProSSHD 'scp_get()' Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38487

Phptroubleticket 'vedi_faq.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38486

My Little Forum 'contact.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38485

Discuz! 'uid' Parameter Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38484

Sparta Systems TrackWise EQMS Multiple Cross-Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/38483

TrendNet TV-IP110W Missing Authentication Check Security Bypass Vulnerability
http://www.securityfocus.com/bid/38482

IBM Lotus Domino 'readme.nsf' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38481

MarketGate Package for Eshbel Priority ERP 'Referer' Parameter Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38480

Linux Kernel 'dvb_net_ule()' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38479

Libpng 'png_decompress_chunk()' Function Denial of Service Vulnerability
http://www.securityfocus.com/bid/38478

1024 CMS 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38476

Luxology Modo 401 'valet4.dll' Integer Overflow Vulnerability
http://www.securityfocus.com/bid/38460

2日 火曜日、大安

+ BIND 9.6.2 released
https://www.isc.org/files/release-notes/962.html

Linux kernel 2.6.33-git7
http://www.kernel.org/diff/diffview.cgi?file=/pub/linux/kernel//v2.6/snapshots/patch-2.6.33-git7.bz2

Trend Micro Web Security for Yamaha サポート開始のお知らせ
http://www.trendmicro.co.jp/support/news.asp?id=1376

乱数生成器に関する説明会
http://www.ipa.go.jp/security/event/2009/jcmvp/rng_session.html

［F1］キーを押さないで！---Windowsに新たな脆弱性
VBScriptとヘルプの処理に問題、「実証コード」が既に出回る
http://itpro.nikkeibp.co.jp/article/NEWS/20100302/345226/?ST=security

JVNVU#612021 Internet Explorer において VBScript および Windows Help を使用する際に任意のコードが実行される脆弱性
http://jvn.jp/cert/JVNVU612021/index.html

JVNDB-2010-001103 Microsoft Office PowerPoint におけるスタックベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001103.html

JVNDB-2010-001102 Microsoft Office PowerPoint におけるスタックベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001102.html

JVNDB-2010-001101 Microsoft Office PowerPoint における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001101.html

JVNDB-2010-001100 Microsoft Office PowerPoint における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001100.html

JVNDB-2010-001099 Microsoft Office PowerPoint におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001099.html

JVNDB-2010-001098 Microsoft Office PowerPoint におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001098.html

Windows VBScript Script Engine Flaw in Processing Windows Help Files Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023668.html

- マイクロソフト セキュリティ アドバイザリ (981169): VBScript の脆弱性により、リモートでコードが実行される
http://www.microsoft.com/japan/technet/security/advisory/981169.mspx

Microsoft Internet Explorer 'winhlp32.exe' 'MsgBox()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38463




+ Apache Tomcat Connectors 1.2.30 released
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html
http://tomcat.apache.org/connectors-doc/news/20100101.html#1%20March%20-%20JK-1.2.30%20released

+- BIND 9.6.2 released
http://ftp.isc.org/isc/bind9/9.6.2/9.6.2

+ iptables 1.4.7 released
http://www.iptables.org/projects/iptables/downloads.html#iptables-1.4.7
http://www.iptables.org/projects/iptables/files/changes-iptables-1.4.7.txt

+ Samba 3.5.0 Available for Download
http://news.samba.org/releases/3.5.0/
http://samba.org/samba/history/samba-3.5.0.html

+ Sudo version 1.7.2p5 was released
http://www.sudo.ws/sudo/news.html
http://www.sudo.ws/sudo/stable.html

+ Microsoft Security Advisory (981169): Vulnerability in VBScript Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/981169.mspx
http://isc.sans.org/diary.html?storyid=8332
http://secunia.com/advisories/38727/
http://www.kb.cert.org/vuls/id/612021
http://www.vupen.com/english/advisories/2010/0485

+ RHSA-2010:0124-1: Important: systemtap security update
http://rhn.redhat.com/errata/RHSA-2010-0124.html

+ RHSA-2010:0125-1: Moderate: systemtap security update
http://rhn.redhat.com/errata/RHSA-2010-0125.html
http://securitytracker.com/alerts/2010/Mar/1023664.html

Thunderbird 3.0.3 Now Available
http://www.mozillamessaging.com/en-US/about/press/archive/-01
http://www.mozillamessaging.com/en-US/thunderbird/3.0.3/releasenotes/

- Buffer Overflow Vulnerability in Lotus iNotes ActiveX Control
http://www-01.ibm.com/support/docview.wss?uid=swg21421808

RHBA-2010:0127-1: libXi bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0127.html

[ MDVSA-2010:051 ] mozilla-thunderbird
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00010.html

[SECURITY] [DSA 2004-1] New Linux 2.6.24 packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00008.html

[SECURITY] [DSA 2004-1] New samba packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00007.html

Oracle Siebel 7.x CRM Cross Site Scripting Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00006.html

CONFidence 2010 /25-26 May/, CfP
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00005.html

Month of PHP Security 2010 - CALL FOR PAPERS
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00001.html

[USN-905-1] sudo vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00000.html

ARISg5 (Version 5.0) Cross Site Scripting Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00002.html

「秘密情報を分割、複数のセンターに保存」――NRIセキュアが実証実験
「分割データからは元データを推測できない」、およそ30社が実験に参加
http://itpro.nikkeibp.co.jp/article/NEWS/20100302/345223/?ST=security

「APECと同等のプラバシ・ポリシーを全社採用」、米Microsoft最高プライバシ責任者が説明
http://itpro.nikkeibp.co.jp/article/NEWS/20100301/345201/?ST=security

Debian : New Linux 2.6.24 packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31883

Debian : New samba packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31882

IE 0-day using .hlp files
http://isc.sans.org/diary.html?storyid=8332

SystemTap Buffer Overflow in __get_argv() May Let Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Mar/1023664.html

- KVM x86 Emulator Flaw Lets Local Users Gain Elevated Privileges on the Guest Operating System
http://securitytracker.com/alerts/2010/Mar/1023663.html

IBM Lotus iNotes Buffer Overflow in ActiveX Control Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023662.html

DeDeCMS Authentication Security Bypass
http://secunia.com/advisories/38790/

IBM Lotus Domino Web Access Multiple Vulnerabilities
http://secunia.com/advisories/38755/

IBM Lotus Domino Web Access 6 ActiveX Control Buffer Overflow
http://secunia.com/advisories/38744/

IBM Lotus Domino Web Access / iNotes ActiveX Control Buffer Overflow
http://secunia.com/advisories/38681/

Joomla YaNC Component "listid" SQL Injection Vulnerability
http://secunia.com/advisories/38780/

FtpDisc FTP "GET" Buffer Overflow Vulnerability
http://secunia.com/advisories/38724/

Baykus Yemek Tarifleri Scripti SQL Injection Vulnerabilities
http://secunia.com/advisories/38760/

Blax Blog "kadi" SQL Injection Vulnerability
http://secunia.com/advisories/38758/

ScriptsFeed Business Directory Software "us" and "ps" SQL Injection Vulnerabilities
http://secunia.com/advisories/38771/

ScriptsFeed Dating Software "txtgender" and "txtlookgender" SQL Injection Vulnerabilities
http://secunia.com/advisories/38767/

Pre Classified Listings ASP Multiple Vulnerabilities
http://secunia.com/advisories/38768/

DZ EROTIK Auktionshaus "V4rgo" "id" SQL Injection Vulnerability
http://secunia.com/advisories/38792/

Debian update for linux-2.6.24
http://secunia.com/advisories/38810/

Uiga FanClub SQL Injection and Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/38756/

Uiga Personal Portal "id" SQL Injection Vulnerability
http://secunia.com/advisories/38757/

Microsoft Windows "MsgBox()" HLP File Execution Vulnerability
http://secunia.com/advisories/38727/

Article Friendly "filename" File Inclusion Vulnerability
http://secunia.com/advisories/38715/

Oracle Siebel Loyalty Management "start.swe" Cross-Site Scripting
http://secunia.com/advisories/38802/

Fedora update for httpd
http://secunia.com/advisories/38813/

Fedora update for squid
http://secunia.com/advisories/38812/

Debian update for samba
http://secunia.com/advisories/38811/

Docebo Cross-Site Request Forgery Vulnerability
http://secunia.com/advisories/38422/

Ubuntu update for sudo
http://secunia.com/advisories/38795/

Vulnerability Note VU#612021: Internet Explorer VBScript Windows Help arbitrary code execution
http://www.kb.cert.org/vuls/id/612021

IBM Lotus iNotes ActiveX Control and UltraLite Vulnerabilities
http://www.vupen.com/english/advisories/2010/0496

IBM Lotus iNotes ActiveX Control Remote Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0495

Scriptsfeed Business Directory Remote SQL Injection Vulnerabilities
http://www.vupen.com/english/advisories/2010/0494

Scriptsfeed Dating Software Remote SQL Injection Vulnerabilities
http://www.vupen.com/english/advisories/2010/0493

phpMySite Remote SQL Injection and Cross Site Scripting Vulnerabilities
http://www.vupen.com/english/advisories/2010/0492

Tracking Requirements and Use Cases Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0491

Blax Blog "kadi" and "sifre" Remote SQL Injection Vulnerabilities
http://www.vupen.com/english/advisories/2010/0490

Baykus Yemek Tarifleri Multiple Remote SQL Injection Vulnerabilities
http://www.vupen.com/english/advisories/2010/0489

Uiga Personal Portal "id" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0488

Uiga FanClub "id" Parameter Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0487

Oracle Siebel Loyalty Management "start.swe" Cross Site Scripting Issue
http://www.vupen.com/english/advisories/2010/0486

Microsoft Windows "MsgBox()" Help File Code Execution Vulnerability
http://www.vupen.com/english/advisories/2010/0485

Symantec AntiVirus and Symantec Endpoint Protection Scan Evasion Vulnerability
http://www.securityfocus.com/bid/38219

Todd Miller Sudo 'runas_default' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38432

Linux Kernel KVM 'handle_dr()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/37221

Sun Java System Directory Server LDAP Search Request Denial of Service Vulnerability
http://www.securityfocus.com/bid/37899

Samba 'client/mount.cifs.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38326

Mozilla Firefox/Thunderbird/SeaMonkey HTML Parser Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38287

Microsoft PowerPoint Viewer TextBytesAtom Record Stack Overflow Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38107

Adobe Acrobat and Reader CVE-2010-0188 Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38195

PHP LCG Entropy Security Vulnerability
http://www.securityfocus.com/bid/38430

SystemTap 'stat-server' Remote Arbitrary Command Injection Vulnerability
http://www.securityfocus.com/bid/37842

SystemTap '__get_argv()' and '__get_compat_argv()' Local Memory Corruption Vulnerabilities
http://www.securityfocus.com/bid/38120

OpenOffice Prior to 3.2 Multiple Remote Code Execution Vulnerabilities
http://www.securityfocus.com/bid/38218

Gravity Board X Multiple SQL Injection Vulnerabilities and Remote Command Execution Vulnerability
http://www.securityfocus.com/bid/34370

Joomla! Pax Gallery 'gid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/33035

RETIRED: Drupal Realname User Reference Widget Module Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38255

RETIRED: Drupal Advanced Help Injection and Export Module HTML Injection Vulnerability
http://www.securityfocus.com/bid/38284

Joomla! LiveTicker 'tid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/33010

Samba 'mount.cifs' Utility Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37992

Linux Kernel 'megaraid_sas' Driver Insecure File Permission Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37019

Linux Kernel 'ebtables' Security Bypass Vulnerability
http://www.securityfocus.com/bid/37762

Linux Kernel CVE-2010-0291 'mmap()' and 'mremap()' Multiple Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/37906

Linux Kernel 'print_fatal_signal()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/37724

Linux Kernel 'drivers/connector/connector.c' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38058

Linux Kernel 'hfc_usb.c' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37036

Linux Kernel 'drivers/scsi/gdth.c' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37068

Linux Kernel 'drivers/firewire/ohci.c' NULL Pointer Dereference Denial of Service Vulnerability
http://www.securityfocus.com/bid/37339

Linux Kernel with SELinux 'mmap_min_addr' Low Memory NULL Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/36051

Linux e1000e Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37523

Linux e1000 Driver 'Jumbo Frame' Handling Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/37519

Linux Kernel 'do_pages_move()' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38144

Linux Kernel 'nfs4_proc_lock()' Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/36936

Linux Kernel 'fuse_direct_io()' Invalid Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/37069

Linux Kernel 'fs/proc/base.c' Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36019

Linux Kernel PI Futex Invalid Pointer Dereference Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38165

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Squid Web Proxy Cache HTCP Request Processing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38212

Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
http://www.securityfocus.com/bid/36260

Apache mod_proxy_ftp Remote Command Injection Vulnerability
http://www.securityfocus.com/bid/36254

Scriptsfeed Business Directory Software 'login.php' Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38470

DeDeCMS '_SESSION[dede_admin_id]' Parameter Authentication Bypass Vulnerability
http://www.securityfocus.com/bid/38469

Linux Kernel KVM Segment Selector Loading Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38467

Uiga Fan Club Login Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/38466

Blax Blog 'girisyap.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38465

Uiga Fan Club and Personal Portal 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38464

Article Friendly 'filename' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/38461

ExtCalendar 'upgrade.php' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38458

Domino Web Access ActiveX Control Unspecified Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38457

Oracle Siebel 'loyalty_enu/start.swe' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38456

Joomla! 'com_yanc' Component 'listid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/38454

1日 月曜日、仏滅

[ANNOUNCE] RunJasperReports version 1.1 released
http://www.agilebase.co.uk/opensource

[ANNOUNCE] access2pgsql 1.0.1 released
http://pgfoundry.org/projects/access2pgsql/

Sysstat 9.1.1 released (development version)
http://pagesperso-orange.fr/sebastien.godard/

AS/NZ "Online Offensive - Fight fraud online" week March 1-7
http://isc.sans.org/diary.html?storyid=8326

Orbital Viewer v1.04 (.orb) 0day Local Universal SEH Overflow Exploit
http://www.exploit-db.com/exploits/11581

JVNDB-2010-001097 Microsoft Office の MSO.DLL におけるバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001097.html

JVNDB-2010-001096 Microsoft DirectX の DirectShow におけるヒープベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001096.html

JVNDB-2010-001095 Microsoft Windows の TCP/IP 実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001095.html

JVNDB-2010-001094 Microsoft Windows の TCP/IP 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001094.html

JVNDB-2010-001093 Microsoft Windows の TCP/IP 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001093.html

JVNDB-2010-001092 Microsoft Windows の TCP/IP 実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001092.html

JVNDB-2010-001091 Microsoft Windows の Microsoft Data Analyzer ActiveX コントロール における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001091.html

JVNDB-2010-001090 Microsoft Windows の SMB クライアント実装における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001090.html

JVNDB-2010-001089 Microsoft Windows の SMB クライアント実装における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001089.html

JVNDB-2010-001005 Linux kernel の r8169 ドライバにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001005.html

JVNDB-2010-001004 Linux kernel の e1000 ドライバにおけるパケットフィルタの制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001004.html

JVNDB-2009-002399 MySQL における権限チェックを回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002399.html

JVNDB-2009-002398 MySQL における SSL サーバになりすまされる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002398.html

JVNDB-2009-002013 MySQL の dispatch_command 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002013.html

JVNDB-2008-002424 MySQL のコマンドラインクライアントにおけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002424.html

+- FreeBSD-EN-10:02.sched_ule: Deadlock in ULE scheduler
http://security.freebsd.org/advisories/FreeBSD-EN-10:02.sched_ule.asc

+ Multiple Security Vulnerabilities in the Solaris GNOME PDF Rendering Libraries May Lead to a Denial of Service (DoS) or Execution of Arbitrary Code
http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1

+ Samba 3.3.11 Available for Download
http://news.samba.org/releases/3.3.11/
http://samba.org/samba/history/samba-3.3.11.html

+ libpng 1.2.43, 1.4.1 released
http://www.libpng.org/pub/png/src/libpng-1.2.43-README.txt
http://www.libpng.org/pub/png/src/libpng-1.4.1-README.txt

+ JK-1.2.29 released
http://tomcat.apache.org/connectors-doc/news/20100101.html#26%20February%20-%20JK-1.2.29%20released
http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html

+ RHSA-2010:0122-1: Important: sudo security update
http://rhn.redhat.com/errata/RHSA-2010-0122.html
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31872
http://secunia.com/advisories/38746/

+ PHP 5.2.13 released
http://www.php.net/releases/5_2_13.php
http://www.php.net/ChangeLog-5.php#5.2.13

+ SA38708: PHP Two Security Bypass Vulnerabilities
http://secunia.com/advisories/38708/
http://securitytracker.com/alerts/2010/Feb/1023661.html
http://www.vupen.com/english/advisories/2010/0479
http://www.securityfocus.com/bid/38431

+ PHP LCG entropy Unspecified Security Vulnerability
http://www.securityfocus.com/bid/38430

+ PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38182

++ Multiple Integer Overflow Vulnerabilities in the FreeType 2 Font Engine May Lead to a Denial of Service (DoS) or Allow Execution of Arbitrary Code
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1

- Sysstat 9.0.6.1 released
http://pagesperso-orange.fr/sebastien.godard/

[ANN] Maven 2.0.11 Released
http://maven.apache.org/download.html

MySQL 5.5.2-m2 has been released
http://dev.mysql.com/doc/refman/5.5/en/mysql-nutshell.html

Samba 3.4.6 対応の日本語マニュアル ver 3.4.6-1 を公開しました。
http://sourceforge.jp/forum/forum.php?forum_id=22188

Document ID: 346516: Windows Cluster 2008 MSDTC resource fails to online when VMDG resource is used.
http://seer.entsupport.symantec.com/docs/346516.htm

RHBA-2010:0123-1: openssh bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0123.html

Enhanced VMotion Compatibility (EVC) processor support
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1003212&sliceId=1&docTypeID=DT_KB_1_1

Independent Researcher : insufficient domain name validation vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31874

Mandriva : Security Announce apache-mod_security
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31871

Red Hat : Important: sudo security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=31872

[ MDVSA-2010:050 ] apache-mod_security
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00230.html

getPlus insufficient domain name validation vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00231.html

ARISg5 (version 5.0) cross site scripting vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00233.html

AST-2010-003: Invalid parsing of ACL rules can compromise security
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00232.html

[ MDVSA-2010:049 ] sudo
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-02/msg00229.html

Disasters take practice
http://isc.sans.org/diary.html?storyid=8323

PHP 5.2.13 Security Update
http://isc.sans.org/diary.html?storyid=8314

Search Engine Poisoning: Chile Earthquake
http://isc.sans.org/diary.html?storyid=8317

PHP Bugs Let Local Users Bypass safe_mode and open_basedir Security Controls
http://securitytracker.com/alerts/2010/Feb/1023661.html

IBM WebSphere Portal Input Validation Hole in 'login.jsp' Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Feb/1023660.html

Sudo sudoedit and 'runas_default' Flaws Let Local Users Gain Elevated Privileges
http://securitytracker.com/alerts/2010/Feb/1023658.html

Blue Coat ProxySG Protocol Flaw in SSL Renegotiation Lets Remote Users Conduct Man-in-the-Middle Attacks
http://securitytracker.com/alerts/2010/Feb/1023655.html

Blue Coat PacketShaper Protocol Flaw in SSL Renegotiation Lets Remote Users Conduct Man-in-the-Middle Attacks
http://securitytracker.com/alerts/2010/Feb/1023654.html

Orbital Viewer ".orb" File Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/38720/

Red Hat update for sudo
http://secunia.com/advisories/38746/

PHP Two Security Bypass Vulnerabilities
http://secunia.com/advisories/38708/

WebAdministrator Lite CMS "s" SQL Injection Vulnerability
http://secunia.com/advisories/38667/

Website Baker Security Bypass Vulnerability
http://secunia.com/advisories/38747/

Hitachi JP1/Cm2/Network Node Manager Remote Console Insecure File Permissions
http://secunia.com/advisories/38740/

Hitachi Cosminexus Products uCosminexus Portal Framework Cross-Site Scripting
http://secunia.com/advisories/38737/

XMail Insecure Temporary Files Security Issue
http://secunia.com/advisories/38734/

Asterisk CIDR Host Access Rules Security Bypass
http://secunia.com/advisories/38752/

Fedora update for mingw32-libltdl
http://secunia.com/advisories/38705/

Windows XP Internet Explorer 8,7 .HLP vulnerability
http://www.isec.pl/vulnerabilities10.html

PHP Security Update Fixes Multiple Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0479

Orbital Viewer ORB File Processing Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0478

Hitachi JP1/Cm2/Network Node Manager Insecure File Permissions
http://www.vupen.com/english/advisories/2010/0477

Hitachi uCosminexus Portal Framework Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0476

Asterisk CIDR Host Access Rules Security Bypass Vulnerability
http://www.vupen.com/english/advisories/2010/0475

Datev VBSExeCall ActiveX "ExecuteExe()" Code Execution Vulnerability
http://www.vupen.com/english/advisories/2010/0474

Symantec Altiris Deployment Solution Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0473

IBM AIX LDAP Login Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/38444

Todd Miller Sudo 'runas_default' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38432

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/38362

Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
http://www.securityfocus.com/bid/32452

Microsoft Windows ICMPv6 Router Advertisement Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38061

NOS getPlus Downloader Domain Validation Arbitrary File Download Vulnerability
http://www.securityfocus.com/bid/38313

Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/34383

FreeType Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/34550

Squid Web Proxy Cache HTCP Request Processing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38212

ModSecurity Security Bypass And Denial Of Service Vulnerabilities
http://www.securityfocus.com/bid/38156

PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38182

GNU Libtool 'libltdl' Library Search Path Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37128

Nemo Multiple File Attachments Mail Form 'upload.php' Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/38443

ARISg 'wflogin.jsp' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/38441

Crawlability vBSEO 'vbseo.php' Local File Include Vulnerability
http://www.securityfocus.com/bid/38439

Orbital Viewer '.orb' File Stack-Based Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38436

Website Baker 'framework/class.wb.php' Security Bypass Vulnerability
http://www.securityfocus.com/bid/38434

FileExecutive Multiple Remote Vulnerabilities
http://www.securityfocus.com/bid/38433

PHP 'tempnam()' 'safe_mode' Validation Restriction-Bypass Vulnerability
http://www.securityfocus.com/bid/38431

PHP LCG entropy Unspecified Security Vulnerability
http://www.securityfocus.com/bid/38430

Hitachi Multiple Products Unspecified Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38429

Hitachi JP1/Cm2/Network Node Manager Insecure File Permissions Vulnerability
http://www.securityfocus.com/bid/38428