:: IT Security Neophyte Investigator's MEMO ::

2010年4月6日火曜日

6日火曜日、大安

Adobe Reader および Acrobat の脆弱性(APSB10-02)について
http://www.ipa.go.jp/security/ciadr/vul/20100113-adobe.html

uTorrent HTTP Basic Authentication Processing Flaw in WebUI Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Apr/1023818.html

Oracle Java SE and Java for Business Sound Component MIDI Stream Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39084

+ Linux Kernel "cifs_create()" NULL Pointer Dereference
http://secunia.com/advisories/39344/

+- Linux Kernel r128 NULL Pointer Dereference Vulnerability
http://secunia.com/advisories/39297/

+ Linux Kernel GFS/GFS2 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/39101

定期サーバメンテナンスのお知らせ（2010年4月16日）
http://www.trendmicro.co.jp/support/news.asp?id=1393

MustLive : Vulnerabilities in GunCMS and PhoenixCMS PHP Edition
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32219

Corelan Security Team : ZipScan 2.2c .zip file Stack BoF
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32217

Corelan Security Team : Zip Unzip v6 (.zip) 0day stack buffer overflow vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32218

Debian : New xulrunner packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32195

Debian : New netpbm-free packages fix denial of service
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32195

JVNVU#817433 複数の XML ライブラリの実装に脆弱性
http://jvn.jp/cert/JVNVU817433/index.html

JVN#87272440 Apache Tomcat におけるサービス運用妨害（DoS）の脆弱性
http://jvn.jp/jp/JVN87272440/index.html

JVN#63832775 Apache Tomcat における情報漏えいの脆弱性
http://jvn.jp/jp/JVN63832775/index.html

JVNVU#196617 Xpdf および poppler の JBIG2 データの処理における複数の脆弱性
http://jvn.jp/cert/JVNVU196617/index.html

[security bulletin] HPSBMA02490 SSRT090222 rev.2 - HP SOA Registry Foundation, Remote Unauthoriz
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00027.html

ZDI-10-061: Sun Java Runtime CMM readMabCurveData Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00038.html

ZDI-10-060: Sun Java Runtime Environment MixerSequencer Invalid Array Index Remote Code Exec
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00037.html

ZDI-10-059: Sun Java Runtime Environment JPEGImageEncoderImpl Remote Code Execution Vulnerab
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00047.html

ZDI-10-058: Apple Mac OS X ImageIO Framework JPEG2000 Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00041.html

ZDI-10-057: Sun Java Runtime Environment JPEGImageDecoderImpl Remote Code Execution Vulnerab
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00048.html

ZDI-10-056: Sun Java Runtime Environment Trusted Methods Chaining Remote Code Execution Vuln
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00031.html

ZDI-10-055: Sun Java Runtime Environment Mutable InetAddress Socket Policy Violation Vulnera
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00046.html

ZDI-10-054: Sun Java Runtime Environment JPEGImageReader stepX Remote Code Execution Vulnera
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00033.html

[SECURITY] [DSA 2028-1] New xpdf packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00044.html

ZDI-10-053: Sun Java Runtime Environment MIDI File metaEvent Remote Code Execution Vulnerabi
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00030.html

ZDI-10-052: Sun Java Runtime Environment XNewPtr Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00043.html

ZDI-10-051: Sun Java Runtime RMIConnectionImpl Privileged Context Remote Code Execution Vuln
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00040.html

Apple Safari <= Tag (heap spray) Remote Buffer Overflow Exploit (osX) http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00029.html

[SECURITY] [DSA 2027-1] New xulrunner packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00028.html

ZDI-10-050: Mozilla Firefox nsTreeSelection EventListener Remote Code Execution Vulnerabilit
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00042.html

ZDI-10-049: Mozilla Firefox PluginArray nsMimeType Dangling Pointer Remote Code Execution Vu
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00039.html

Vulnerabilities in HoloCMS
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00036.html

ZDI-10-047: Mozilla Firefox libpr0n imgContainer Bits-Per-Pixel Change Remote Code E
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00035.html

ZDI-10-046: Mozilla Firefox Web Worker Array Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00034.html

ZDI-10-045: Apple QuickTime MPEG-1 genl Atom Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00032.html

ZDI-10-044: Apple QuickTime FLI LinePacket Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00026.html

ZDI-10-043: Apple QuickTime FlashPix NumberOfTiles Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00025.html

ZDI-10-042: Apple QuickTime MediaVideo Compressor Name Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00024.html

ZDI-10-041: Apple QuickTime QDM2/QDCA Atom Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00023.html

ZDI-10-040: Apple QuickTime RLE Bit Depth Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00022.html

ZDI-10-039: Apple OS X Internet Enabled Disk Image Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00021.html

ZDI-10-038: Apple QuickTime QDMC/QDM2 Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00020.html

ZDI-10-037: Apple QuickTime MJPEG Sample Dimensions Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00019.html

ZDI-10-036: Apple QuickTime H.263 PictureHeader Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00018.html

ZDI-10-035: Apple QuickTime genl Atom Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00017.html

ZDI-10-034: Microsoft Internet Explorer Tabular Data Control ActiveX Remote Code Execution V
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00016.html

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00015.html

[SECURITY] [DSA 2026-1] New netpbm-free packages fix denial of service
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00014.html

Vulnerability Centreon IT & Network Monitoring v2.1.5
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00013.html

Joomla! SVMap Component "controller" Local File Inclusion Vulnerability
http://secunia.com/advisories/39350/

Advenced Management For Services Sites Security Bypass
http://secunia.com/advisories/39252/

Slackware update for mozilla-thunderbird
http://secunia.com/advisories/39336/

Joomla! LoginBox Pro Component "view" Local File Inclusion Vulnerability
http://secunia.com/advisories/39349/

uTorrent Web UI Basic Authorization Header Parsing Denial of Service
http://secunia.com/advisories/39192/

Joomla! Magic Updater Component "controller" Local File Inclusion Vulnerability
http://secunia.com/advisories/39348/

Linux Kernel "cifs_create()" NULL Pointer Dereference
http://secunia.com/advisories/39344/

Fedora update for seamonkey
http://secunia.com/advisories/39302/

Linux Kernel r128 NULL Pointer Dereference Vulnerability
http://secunia.com/advisories/39297/

Fedora update for hamlib
http://secunia.com/advisories/39347/

Ham Radio Control Libraries libtool Search Path Security Issue
http://secunia.com/advisories/39299/

Zip Unzip Archive Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/39280/

ZipScan Archive Processing Buffer Overflow Vulnerability
http://secunia.com/advisories/39281/

Munkyscripts Simple Gallery "cid" SQL Injection Vulnerability
http://secunia.com/advisories/39309/

Solutive CMS Multiple SQL Injection Vulnerabilities
http://secunia.com/advisories/39319/

Joomla redTWITTER Component "view" File Inclusion Vulnerability
http://secunia.com/advisories/39342/

MassMirror Uploader "MM_ROOT_DIRECTORY" File Inclusion Vulnerabilities
http://secunia.com/advisories/39314/

Uiga Proxy "content" File Inclusion Vulnerability
http://secunia.com/advisories/39313/

eZip Wizard Archive Unpacking Buffer Overflow Vulnerability
http://secunia.com/advisories/39169/

PolicyKit "pkexec" File Existence Disclosure Weakness
http://secunia.com/advisories/39149/

Profi Einzelgebots Auktions System "id_auk" SQL Injection Vulnerability
http://secunia.com/advisories/39196/

Nodesforum Multiple File Inclusion Vulnerabilities
http://secunia.com/advisories/39311/

AjaXplorer Multiple Unspecified Vulnerabilities
http://secunia.com/advisories/39331/

Tcpdf HTML "tcpdf" Tag Processing Vulnerability
http://secunia.com/advisories/39277/

Joomla! JP Jobs Component "id" SQL Injection Vulnerability
http://secunia.com/advisories/39325/

Foxit Reader Embedded Program Execution Vulnerability
http://secunia.com/advisories/39291/

Joomla! Picasa Component "controller" Local File Inclusion Vulnerability
http://secunia.com/advisories/39338/

Vor und Ruckwarts Auktions System "id_auk" SQL Injection Vulnerability
http://secunia.com/advisories/39273/

Joomla! redSHOP Component "view" Local File Inclusion Vulnerability
http://secunia.com/advisories/39343/

VMware ESX Server 4 Update for samba and acpid
http://secunia.com/advisories/39147/

VMware vMA Samba and acpid Multiple Vulnerabilities
http://secunia.com/advisories/39162/

VMware ESX Server Samba Multiple Vulnerabilities
http://secunia.com/advisories/39218/

Debian update for netpbm-free
http://secunia.com/advisories/39268/

Debian update for xulrunner
http://secunia.com/advisories/39308/

Fedora update for viewvc
http://secunia.com/advisories/39301/

VMware Security Update Fixes Samba and acpid Vulnerabilities
http://www.vupen.com/english/advisories/2010/0801

Foxit Reader Embedded Executable Code Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0800

Zabbix "user" Parameter Handling Remote SQL Injection Vulnerability
http://www.vupen.com/english/advisories/2010/0799

Fedora Security Update Fixes Hamlib Libtool Untrusted Path Issue
http://www.vupen.com/english/advisories/2010/0798

Fedora Security Update Fixes ViewVC Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0797

Fedora Security Update Fixes SeaMonkey Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0796

Fedora Security Update Fixes krb5 Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0795

Fedora Security Update Fixes Fcron File Disclosure Vulnerability
http://www.vupen.com/english/advisories/2010/0794

Fedora Security Update Fixes Trac Ticket Status Manipulation Issue
http://www.vupen.com/english/advisories/2010/0793

Fedora Security Update Fixes Moodle phpCAS Cross Site Scripting
http://www.vupen.com/english/advisories/2010/0792

Fedora Security Update Fixes Libnids and Dsniff DoS Vulnerability
http://www.vupen.com/english/advisories/2010/0791

Fedora Security Update Fixes Thunderbird and Sunbird Vulnerabilities
http://www.vupen.com/english/advisories/2010/0790

Fedora Security Update Fixes ikiwiki Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0789

Fedora Security Update Fixes IMP Cross Site Scripting Vulnerabilities
http://www.vupen.com/english/advisories/2010/0788

Fedora Security Update Fixes Firefox and Xulrunner Vulnerabilities
http://www.vupen.com/english/advisories/2010/0787

Fedora Security Update Fixes Horde Cross Site Scripting Vulnerabilities
http://www.vupen.com/english/advisories/2010/0786

Fedora Security Update Fixes Asterisk Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0785

Slackware Security Update Fixes SeaMonkey Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0784

Slackware Security Update Fixes Firefox Code Execution Vulnerability
http://www.vupen.com/english/advisories/2010/0783

Slackware Security Update Fixes Thunderbird Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0782

Debian Security Update Fixes Xulrunner Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0781

Debian Security Update Fixes NetPBM Buffer Overflow Vulnerability
http://www.vupen.com/english/advisories/2010/0780

Xpdf JBIG2 Processing Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/34568

Xpdf Multiple Integer Overflow Vulnerabilities
http://www.securityfocus.com/bid/36703

GNU Libtool 'libltdl' Library Search Path Local Privilege Escalation Vulnerability
http://www.securityfocus.com/bid/37128

Open Handset Alliance Android Screen Lock Security Bypass Vulnerability
http://www.securityfocus.com/bid/37723

iSCSI Enterprise Target and tgt Multiple Format String Vulnerabilities
http://www.securityfocus.com/bid/39127

Oracle Java SE and Java for Business ImageIO 'JPEGImageReader' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39067

Snipe Gallery Arbitrary File Upload Vulnerability
http://www.securityfocus.com/bid/39099

Oracle Java SE and Java for Business 'readMabCurveData()' Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39069

Linux Kernel GFS/GFS2 Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/39101

Novell Netware FTP Server Multiple Commands Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/39041

Oracle Java SE and Java for Business 'MixerSequencer' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39077

DynPG CMS Multiple Remote File Include Vulnerabilities
http://www.securityfocus.com/bid/39168

Apple Safari BMP Image Uninitialized Memory Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38676

Apple Mac OS X ImageIO Component JP2 File Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39171

Oracle Java SE and Java for Business 'XNewPtr()' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39083

Oracle Java Runtime Environment 'JPEGImageEncoderImpl' Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39062

FeedDemon 'outline' Tag Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/33630

Oracle Java SE and Java for Business CVE-2010-0849 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39073

Oracle Java SE and Java for Business JRE Trusted Method Chaining Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39065

Oracle Java SE and Java for Business CVE-2010-0095 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39086

Microsoft Windows SMB Pathname Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38049

Oracle Java SE and Java for Business CVE-2010-0094 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39075

Linux Kernel 'sock_sendpage()' NULL Pointer Dereference Vulnerability
http://www.securityfocus.com/bid/36038

ISC BIND 9 Remote Dynamic Update Message Denial of Service Vulnerability
http://www.securityfocus.com/bid/35848

Mozilla Firefox WOFF Decoder Integer Overflow Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38298

VariCAD 2010 'DWB' File Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38815

Multiple Vendors Email Clients DNS prefetching Domain Name Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38046

ViewVC Regular Expression Search Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/39053

Microsoft Internet Explorer 'Tabular Data Control' ActiveX Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39025

ZipCentral ZIP File Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/18160

eZip Wizard Zip File Stack Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34044

Sun Java System Web Server WebDAV Unspecified Remote Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37874

Libnids 'ip_fragment.c' Null Pointer Deference Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/39142

Oracle Java SE and Java for Business CVE-2010-0847 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39071

Joomla! Picasa Component Local File Include Vulnerability
http://www.securityfocus.com/bid/39200

PolicyKit 'pkexec' File Existence Information Disclosure Weakness
http://www.securityfocus.com/bid/39198

Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39191

Cache::Cache Perl Module '/tmp' Insecure File Permissions Vulnerabilities
http://www.securityfocus.com/bid/39189

HoloCMS Denial of Service Vulnerability and CAPTCHA Bypass Vulnerability
http://www.securityfocus.com/bid/39188

Joomla! 'com_menu' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39184

2010年4月5日月曜日

5日月曜日、仏滅

++ jetty 6.1.23 released
http://jetty.codehaus.org/jetty/
http://svn.codehaus.org/jetty/jetty/branches/jetty-6.1/VERSION.txt

+? jetty 7.0.2 released
http://www.eclipse.org/projects/project-plan.php?projectid=rt.jetty
http://svn.codehaus.org/jetty/jetty/branches/jetty-7/VERSION.txt

コンピュータウイルス・不正アクセスの届出状況[3月分および第1四半期]について
http://www.ipa.go.jp/security/txt/2010/04outline.html

JVNDB-2010-001208 複数の Mozilla 製品におけるにおけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001208.html

JVNDB-2010-001207 Mozilla Firefox における同一生成元ポリシーを回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001207.html

JVNDB-2010-001206 Mozilla Thunderbird/SeaMonkey における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001206.html

Oracle Java SE and Java for Business CVE-2010-0847 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39071

+ Linux kernel 2.6.33.2, 2.6.32.11, 2.6.31.13, 2.6.27.46 released
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33.2
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.11
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.13
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.46

[ANN] Apache Vysper 0.5 released
http://mina.apache.org/vysper/apache-vysper-05-release.html

MySQL Workbench 5.2.17 Beta 7 Available
http://wb.mysql.com/

[ANNOUNCEMENT] HttpComponents HttpCore 4.1-beta1 Released
http://www.apache.org/dist/httpcomponents/httpcore/RELEASE_NOTES.txt

[ANNOUNCE] Apache Tika 0.7 released
http://www.apache.org/dist/lucene/tika/CHANGES-0.7.txt

[ANNOUNCEMENT] Apache Commons Math 2.1 Released
http://commons.apache.org/math/

ALERT WEEKLY SUMMARY REPORT
http://sunsolve.sun.com/search/document.do?assetkey=1-66-275470-1

HPSBMA02490 SSRT090222 rev.2 - HP SOA Registry Foundation, Remote Unauthorized Access to Data, Cross Site Scripting (XSS), Privilege Escalation
http://www11.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02037890

Document ID: 348286: Upgrading to Storage Foundation HA (SFW-HA) 5.1 SP1 returns error to uninstall or upgrade previous conflicting products
http://seer.entsupport.symantec.com/docs/348286.htm

Document ID: 347698: "An error occurred while executing the test. The given key was not present in the dictionary" is reported by the cluster validation tool in Microsoft Windows Failover Cluster when a Volume Manager Disk Group resource is present - Vertas Storage Foundation for Windows
http://seer.entsupport.symantec.com/docs/347698.htm

Independent Researcher : Vulnerability Centreon IT & Network Monitoring v2.1.5
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32179

RHBA-2010:0340-1: net-snmp bug fix update
http://rhn.redhat.com/errata/RHBA-2010-0340.html

Nmap 5.30BETA1 Released With 37 New Scripts, Nping, and New Apple Vulnerability
http://seclists.org/nmap-hackers/2010/3

Financial Management of Cyber Risk
http://isc.sans.org/diary.html?storyid=8575

Apple QuickTime and iTunes Security Update
http://isc.sans.org/diary.html?storyid=8566

Foxit Reader Security Update
http://isc.sans.org/diary.html?storyid=8569

Oracle Java SE and Java for Business Critical Patch Update Advisory
http://isc.sans.org/diary.html?storyid=8572

Mozilla Firefox Memory Re-use Error Lets Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Apr/1023817.html

IBM WEBi Input Validation Flaw Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023802.html

Vulnerability Note VU#570177: Foxit Reader vulnerable to arbitrary command execution
http://www.kb.cert.org/vuls/id/570177

Vulnerability Note VU#507652: Oracle Sun Java fails to properly validate Java applet signatures
http://www.kb.cert.org/vuls/id/507652

Mozilla Firefox DOM Node Moving Use-After-Free Vulnerability
http://secunia.com/advisories/39175/

Slackware update for seamonkey
http://secunia.com/advisories/39241/

Slackware update for openssl
http://secunia.com/advisories/39239/

Zabbix PHP Frontend "user" SQL Injection Vulnerability
http://secunia.com/advisories/39119/

Mozilla Firefox Node Scope Confusion Use-after-free Vulnerability
http://www.vupen.com/english/advisories/2010/0779

Apple AirPort Utility MAC Address ACLs Bypass Weakness
http://www.vupen.com/english/advisories/2010/0778

Libnids "ip_fragment.c" Remote Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0777

Ubuntu Security Update Fixes Libnss-db Information Disclosure Issue
http://www.vupen.com/english/advisories/2010/0776

Turbolinux Security Update Fixes Thunderbird Multiple Vulnerabilities
http://www.vupen.com/english/advisories/2010/0775

Turbolinux Security Update Fixes Squid Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0774

Slackware Security Update Fixes SeaMonkey Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0773

Slackware Security Update Fixes Firefox Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0772

Slackware Security Update Fixes OpenSSL Denial of Service Issues
http://www.vupen.com/english/advisories/2010/0771

SuSE Security Update Fixes Code Execution and Security Bypass Issues
http://www.vupen.com/english/advisories/2010/0770

SuSE Security Update Fixes Kernel Code Execution and DoS Issues
http://www.vupen.com/english/advisories/2010/0769

PHP 6.0 Dev str_transliterate() 0Day Buffer Overflow Exploit
http://www.exploit-db.com/exploits/12051

Easy Ftp Server v1.7.0.2 MKD Remote Post-Authentication BoF Exploit
http://www.exploit-db.com/exploits/12044

eZip Wizard 3.0 (.zip) SEH
http://www.exploit-db.com/exploits/12059

ZipCentral (.zip) 0day SEH Exploit
http://www.exploit-db.com/exploits/12053

Apple Safari ImageIO TIFF Image Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38673

Apple Safari TIFF Image Uninitialized Memory Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38677

Apple Safari Prior to 4.0.5 Integer Overflow Vulnerability
http://www.securityfocus.com/bid/38674

Apple Safari BMP Image Uninitialized Memory Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38676

LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability
http://www.securityfocus.com/bid/35451

Sendmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/37543

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Foxit Reader Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39109

Netpbm XPM File Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38164

Oracle Java SE and Java for Business CVE-2010-0087 Remote Vulnerability
http://www.securityfocus.com/bid/39068

Mozilla Firefox 'multipart/x-mixed-replace' Image Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38921

Mozilla Firefox and SeaMonkey Web Workers Array Data Type Remote Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38285

Apple QuickTime FLC Encoded '.fli' Movie File Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39152

Apple QuickTime QDM2 and QDCA Encoded Audio Content (CVE-2010-0059) Memory Corruption Vulnerability
http://www.securityfocus.com/bid/39160

Apple QuickTime FlashPix Encoded File 'NumberOfTiles' Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/39155

Apple QuickTime M-JPEG Data '.mov' File Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39154

Apple QuickTime MPEG Movie File 'genl' Atom Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39166

Apple QuickTime RLE Encoded '.mov' File Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39165

Apple QuickTime CoreMedia H.263 Encoded '.3g2' Movie Files Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39167

Microsoft Internet Explorer CTimeAction Object Memory Corruption Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39030

Microsoft Internet Explorer 'Tabular Data Control' ActiveX Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39025

Mozilla Firefox Use-After-Free Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38952

Jabber Studio JabberD Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/17155

eDisplay Personal FTP server Multiple Commands Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/38860

PHP xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38708

Google Chrome Invalid FTP Server Response Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/39183

2010年4月2日金曜日

2日金曜日、先勝

++ Security Vulnerability in BIND DNS Software Shipped With Solaris May Allow DNS Cache Poisoning
http://sunsolve.sun.com/search/document.do?assetkey=1-66-273169-1

+ Linux kernel 2.6.33.2, 2.6.32.11, 2.6.31.13, 2.6.27.46 released
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33.2
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.11
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.13
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.46

Linux Kernel release: 2.6.33.2
http://www.linux.org/news/2010/04/02/0004.html

Linux Kernel release: 2.6.32.11
http://www.linux.org/news/2010/04/02/0003.html

Linux Kernel release: 2.6.31.13
http://www.linux.org/news/2010/04/02/0002.html

Linux Kernel release: 2.6.27.46
http://www.linux.org/news/2010/04/02/0001.html

JVNTA10-089A Internet Explorer に複数の脆弱性
http://jvn.jp/cert/JVNTA10-089A/index.html

JVN#60969543 HL-SiteManager における SQL インジェクションの脆弱性
http://jvn.jp/jp/JVN60969543/index.html

JVNDB-2010-000010 HL-SiteManager における SQL インジェクションの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000010.html

JVNDB-2010-001205 Mozilla Firefox の Web Open Fonts Format デコーダにおける整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001205.html

JVNDB-2010-001204 Accela BizSearch のローカル収集におけるアクセス権限に関する脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001204.html

JVNDB-2010-001174 Apache HTTP Server の ap_read_request 関数における重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001174.html

JVNDB-2010-001173 Apache HTTP Server の ap_proxy_ajp_request 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001173.html

JVNDB-2010-001057 Linux kernel における SCSI ホストの属性に任意の変更を加えられる脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001057.html

JVNDB-2010-001006 Linux kernel の e1000e ドライバにおけるイーサネットフレームの処理に関する脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001006.html

JVNDB-2010-001005 Linux kernel の r8169 ドライバにおけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001005.html

JVNDB-2010-001004 Linux kernel の e1000 ドライバにおけるパケットフィルタの制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001004.html

JVNDB-2010-001002 sendmail における X.509 証明書の処理に関する任意の SSL-based SMTP サーバになりすまされる脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001002.html

JVNDB-2009-002502 Linux kernel の poll_mode_io ファイルにおけるドライバの I/O モードを変更される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002502.html

JVNDB-2009-002501 Linux kernel におけるドライバの動作およびログレベルを変更される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002501.html

JVNDB-2009-002500 Linux kernel の hfs サブシステムにおけるスタックベースのバッファオーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002500.html

JVNDB-2009-002499 Linux kernel の drivers/firewire/ohci.c におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002499.html

JVNDB-2009-002498 Linux kernel の fuse_direct_io 関数におけるサービス運用妨害 (DoS)の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002498.html

JVNDB-2009-002497 Linux kernel の gdth_read_event 関数における権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002497.html

JVNDB-2009-002471 Linux kernel の arch/x86/ia32/ia32entry.S におけるレジスタ値を読み取られる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002471.html

JVNDB-2009-002470 Linux kernel の NFSv4 クライアントの nfs4_proc_lock 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002470.html

JVNDB-2009-002469 Linux kernel の net/unix/af_unix.c におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002469.html

JVNDB-2009-002468 Linux kernel の ATI Rage 128 ドライバにおける権限昇格の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002468.html

JVNDB-2009-002423 Linux kernel の tcf_fill_node 関数におけるカーネルメモリから重要な情報を取得される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002423.html

JVNDB-2007-001202 Linux kernel の ipv6_hop_jumbo 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001202.html

Security Advisory for ESX Service Console
http://isc.sans.org/diary.html?storyid=8563

Jabber Studio JabberD Remote Denial Of Service Vulnerability
http://www.securityfocus.com/bid/17155

eDisplay Personal FTP server Multiple Commands Remote Buffer Overflow Vulnerabilities
http://www.securityfocus.com/bid/38860

PHP xmlrpc Extension Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38708

Firefox 3.6.3 security update now available
http://developer.mozilla.org/devnews/index.php/2010/04/01/firefox-3-6-3-security-update-now-available/

MFSA 2010-25: Re-use of freed object due to scope confusion
http://www.mozilla.org/security/announce/2010/mfsa2010-25.html

+ RHSA-2010:0339-1: Important: java-1.6.0-openjdk security update
http://rhn.redhat.com/errata/RHSA-2010-0339.html

MySQL 5.5.5 (Not yet released)
http://dev.mysql.com/doc/refman/5.5/en/news-5-5-5.html

Document ID: 346996: Mounting a formatted SFW dynamic volume to a empty NTFS Folder prompts for the volume to be formatted in Windows Server 2008.
http://seer.entsupport.symantec.com/docs/346996.htm

Document ID: 341277: The MOMhelper.exe process continually terminates after updating the Storage Foundation for Windows High Availability (SFW-HA) Management Pack for Microsoft System Center Operations Manager 2007
http://seer.entsupport.symantec.com/docs/341277.htm

VMware ESX and ESXi 3.5 Comparison
http://kb.vmware.com/selfservice/microsites/microsite.do?cmd=displayKC&docType=kc&externalId=1006543&sliceId=1&docTypeID=DT_KB_1_1

Dawid Golunski : Zabbix <= 1.8.1 SQL Injection http://www.criticalwatch.com/support/security-advisories.aspx?AID=32174

Independent Researcher : Advisory Optimal Archive 1.38
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32175

Red Hat : Critical: java-1.6.0-sun security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32169

Red Hat : Critical: java-1.5.0-sun security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32170

Red Hat : Important: java-1.6.0-openjdk security update
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32171

Apple : AirPort Base Station Update 2010-001
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32168

CONIX Security : Multiple XSS vulnerabilities in OSSIM 2.2.1
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32178

VMSA-2010-0006 ESX Service Console updates for samba and acpid
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00012.html

Juniper SRX Critical Denial of Service Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00010.html

DynPG CMS v4.1.0 Multiple Remote File Inclusion Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00005.html

CSRF Vulnerability in OSSIM 2.2.1
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00004.html

Zabbix <= 1.8.1 SQL Injection http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00007.html

VUPEN Security Research - Apple Quicktime FLC Encoded Movie Heap Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00006.html

VUPEN Security Research - Apple Quicktime PICT Handling Heap Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00011.html

VUPEN Security Research - Apple Quicktime PICT Processing Integer Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00002.html

VUPEN Security Research - Apple iTunes ColorSync Profile Integer Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00001.html

VUPEN Security Research - Sun Java JDK/JRE Unpack200 Buffer Overflow Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00003.html

VUPEN Security Research - Sun Java JDK/JRE AWT Library Invalid Index Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00009.html

VUPEN Security Research - Sun Java JDK/JRE AWT Library Invalid Pointer Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00008.html

[USN-922-1] libnss-db vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-04/msg00000.html

「ファイルを開くだけでプログラム実行の恐れ」、PDFの危険な仕様
脆弱性がなくても被害に遭う、閲覧ソフトによっては警告が出ない
http://itpro.nikkeibp.co.jp/article/NEWS/20100401/346544/?ST=security

Android携帯やiPhoneで使えるマルウエア対策技術、シマンテックが公開
http://itpro.nikkeibp.co.jp/article/NEWS/20100401/346529/?ST=security

JVNDB-2010-001203 x86_64 プラットフォーム上の Linux kernel の load_elf_binary 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001203.html

JVNDB-2010-001202 x86_64 および amd64 プラットフォーム上 Linux Kernel におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001202.html

JVNDB-2010-001201 Linux Kernel の The ip6_dst_lookup_tail 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001201.html

JVNDB-2010-001200 Linux Kernel の SCTP 実装におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001200.html

JVNDB-2010-001199 Linux Kernel の do_pages_move 関数におけるカーネルメモリの情報が漏えいする脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001199.html

JVNDB-2010-001198 Linux kernel の ebtables モジュールにおけるアクセス制限を回避される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001198.html

JVNDB-2010-001197 Linux kernel の print_fatal_signal 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001197.html

Alien Arena "SV_BeginDownload_f()" Denial of Service Vulnerabilities
http://secunia.com/advisories/39143/

Ubuntu update for libnss-db
http://secunia.com/advisories/39165/

OSSIM Spoofing and Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/39141/

Optimal Desktop Archive Parsing Buffer Overflow Vulnerability
http://secunia.com/advisories/39157/

leaftec cms Cross-Site Scripting and SQL Injection
http://secunia.com/advisories/39166/

DynPG CMS "DefineRootToTool" File Inclusion Vulnerability
http://secunia.com/advisories/39185/

Optimal Archive Error Handling Buffer Overflow Vulnerability
http://secunia.com/advisories/39154/

Linux SCSI Target Framework (tgt) Format String Vulnerabilities
http://secunia.com/advisories/39142/

Drupal Taxonomy Breadcrumb Module Script Insertion Vulnerabilities
http://secunia.com/advisories/39138/

Compiere Cross-Site Scripting Vulnerabilities
http://secunia.com/advisories/39177/

Apple AirPort Base Station Network Access Restriction Bypass
http://secunia.com/advisories/39160/

Drupal Taxonomy Filter Module Multiple Script Insertion Vulnerabilities
http://secunia.com/advisories/39220/

Fedora update for thunderbird and sunbird
http://secunia.com/advisories/39204/

Fedora update for horde
http://secunia.com/advisories/39245/

Fedora update for imp
http://secunia.com/advisories/39247/

Red Hat update for java-1.6.0-openjdk
http://secunia.com/advisories/39210/

Fedora update for libnids
http://secunia.com/advisories/39249/

Libnids NULL Pointer Dereference Denial of Service
http://secunia.com/advisories/39225/

Red Hat update for java-1.6.0-sun
http://secunia.com/advisories/39216/

Fedora update for asterisk
http://secunia.com/advisories/39248/

Red Hat update for java-1.5.0-sun
http://secunia.com/advisories/39207/

Fedora update for ikiwiki
http://secunia.com/advisories/39244/

Fedora update for firefox and xulrunner
http://secunia.com/advisories/39246/

Red Hat Global File System gfs_lock() Lets Local Users Deny Service
http://securitytracker.com/alerts/2010/Apr/1023809.html

Debian Security Update Fixes Icedove Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0768

Debian Security Update Fixes Moin Cross Site Scripting Vulnerability
http://www.vupen.com/english/advisories/2010/0767

Redhat Security Update Fixes Java Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0766

Redhat Security Update Fixes SeaMonkey Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0765

Redhat Security Update Fixes Firefox Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0764

Redhat Security Update Fixes Automake Insecure Permissions Issue
http://www.vupen.com/english/advisories/2010/0763

Redhat Security Update Fixes GFS Local Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0762

Redhat Security Update Fixes cURL Data Callback Excessive Length
http://www.vupen.com/english/advisories/2010/0761

Redhat Security Update Fixes KVM Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0760

Redhat Security Update Fixes pam_krb5 Username Enumeration Issue
http://www.vupen.com/english/advisories/2010/0759

Redhat Security Update Fixes Sendmail Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0758

Redhat Security Update Fixes Squid Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/0757

Redhat Security Update Fixes OpenLDAP Certificate Spoofing Issue
http://www.vupen.com/english/advisories/2010/0756

Redhat Security Update Fixes brltty Untrusted Search Path Vulnerability
http://www.vupen.com/english/advisories/2010/0755

Redhat Security Update Fixes Kernel Denial of Service Vulnerabilities
http://www.vupen.com/english/advisories/2010/0754

Mozilla SeaMonkey Scriptable Plugin Content Security Bypass Vulnerability
http://www.securityfocus.com/bid/38830

VMware WebAccess URL Forwarding Vulnerability
http://www.securityfocus.com/bid/39103

Samba Oplock Break Notification Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36573

Samba setuid 'mount.cifs' Verbose Option Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36572

Samba Format String And Security Bypass Vulnerabilities
http://www.securityfocus.com/bid/35472

Samba Misconfigured '/etc/passwd' File Security Bypass Vulnerability
http://www.securityfocus.com/bid/36363

acpid Local Denial of Service Vulnerability
http://www.securityfocus.com/bid/34692

VMware WebAccess '/ui/vmDirect.do' Information Disclosure Vulnerability
http://www.securityfocus.com/bid/39106

Mozilla Firefox and Thunderbird Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/35769

Multiple Horde Products Cross-Site Scripting Vulnerabilities and File Overwrite Vulnerability
http://www.securityfocus.com/bid/36382

Horde Application Framework Administration Interface 'PHP_SELF' Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/37351

Horde Products Local File Include and Cross Site Scripting Vulnerabilities
http://www.securityfocus.com/bid/33491

Horde XSS Filter Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/33367

Horde MIME Attachment Filename Insufficient Filtering Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/31110

Horde Application Framework Forward Slash Insufficient Filtering Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/31107

Foxit Reader Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/39109

Libnids 'ip_fragment.c' Null Pointer Deference Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/39142

ikiwiki 'htmlscrubber' Plugin Remote Script Code Injection Vulnerability
http://www.securityfocus.com/bid/38844

MIT Kerberos 'gss_accept_sec_context()' Denial Of Service Vulnerability
http://www.securityfocus.com/bid/38904

Trac Ticket Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/39040

RETIRED: VMware WebAccess Multiple Vulnerabilities
http://www.securityfocus.com/bid/39037

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities
http://www.securityfocus.com/bid/38531

Apple Mac OS X QuickDraw Manager Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/36985

Linux Kernel USB interface Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/39042

WebKit CSS 'format()' Arguments Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38684

WebKit Cross-Origin Stylesheet Request Information Disclosure Vulnerability
http://www.securityfocus.com/bid/38692

Oracle Java SE and Java for Business CVE-2010-0085 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39094

Oracle Java SE and Java for Business CVE-2010-0091 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39096

Oracle Java SE and Java for Business CVE-2010-0084 Remote Vulnerability
http://www.securityfocus.com/bid/39093

Oracle Java SE and Java for Business CVE-2010-0093 Remote Vulnerability
http://www.securityfocus.com/bid/39088

Oracle Java SE and Java for Business CVE-2010-0092 Remote Vulnerability
http://www.securityfocus.com/bid/39090

Oracle Java SE and Java for Business CVE-2010-0845 Remote HotSpot Server Vulnerability
http://www.securityfocus.com/bid/39089

Oracle Java SE and Java for Business CVE-2010-0848 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39078

Oracle Java SE and Java for Business CVE-2010-0095 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39086

Oracle Java SE and Java for Business CVE-2010-0082 HotSpot Server Remote Vulnerability
http://www.securityfocus.com/bid/39085

Oracle Java SE and Java for Business CVE-2010-0088 Remote Java Runtime Environme Vulnerability
http://www.securityfocus.com/bid/39081

Oracle Java SE and Java for Business CVE-2010-0094 Remote Java Runtime Environment Vulnerablity
http://www.securityfocus.com/bid/39075

Oracle Java SE and Java for Business CVE-2010-0837 Remote Vulnerability
http://www.securityfocus.com/bid/39072

Oracle Java SE and Java for Business CVE-2010-0847 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39071

Oracle Java SE and Java for Business CVE-2010-0838 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39069

Oracle Java SE and Java for Business CVE-2010-0840 Remote Java Runtime Environment Vulnerability
http://www.securityfocus.com/bid/39065

HP-UX AudFilter Rule Local Denial Of Service Vulnerability
http://www.securityfocus.com/bid/39046

TikiWiki Versions Prior to 4.2 Multiple Vulnerabilities
http://www.securityfocus.com/bid/38608

ikiwiki 'teximg' Plugin Insecure TeX Commands Information Disclosure Vulnerability
http://www.securityfocus.com/bid/36181

Horde Turba Contact Manager '/imp/test.php' Cross Site Scripting Vulnerability
http://www.securityfocus.com/bid/31168

Horde IMP Webmail Client Cross Site Scripting And HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/33492

Asterisk T.38 'FaxMaxDatagram' Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/38047

Asterisk RTP Comfort Noise Processing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37153

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability
http://www.securityfocus.com/bid/39095

Oracle Java SE and Java for Business CVE-2010-0090 Remote Java Web Start Vulnerability
http://www.securityfocus.com/bid/39091

Oracle Java SE and Java for Business CVE-2010-0844 Remote Vulnerability
http://www.securityfocus.com/bid/39084

Oracle Java SE and Java for Business CVE-2010-0842 Remote Vulnerability
http://www.securityfocus.com/bid/39077

Oracle Java SE and Java for Business CVE-2010-0843 Remote Vulnerability
http://www.securityfocus.com/bid/39083

VMware WebAccess JSON Cross-site Scripting Vulnerabliity
http://www.securityfocus.com/bid/39105

VMware WebAccess Virtual Machine Name Cross-site Scripting Vulnerability
http://www.securityfocus.com/bid/39104

Oracle Java SE and Java for Business CVE-2010-0849 Remote Java 2D Vulnerability
http://www.securityfocus.com/bid/39073

Oracle Java SE and Java for Business CVE-2010-0839 Remote Sound Vulnerability
http://www.securityfocus.com/bid/39070

Oracle Java SE and Java for Business CVE-2010-0087 Remote Vulnerability
http://www.securityfocus.com/bid/39068

Oracle Java SE and Java for Business CVE-2010-0841 Remote ImageIO Vulnerability
http://www.securityfocus.com/bid/39067

Oracle Java SE and Java for Business CVE-2010-0846 Remote ImageIO Vulnerability
http://www.securityfocus.com/bid/39062

Microsoft Internet Explorer 'iepeers.dll' Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38615

HP OpenView Network Node Manager 'OvWebHelp.exe' Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37340

WeBAM Denial of Service Vulnerability and CAPTCHA Bypass Vulnerability
http://www.securityfocus.com/bid/38967

Easy-Clanpage 'id' Parameter Multiple SQL Injection Vulnerabilities
http://www.securityfocus.com/bid/28309

DynPG CMS Multiple Remote File Include Vulnerabilities
http://www.securityfocus.com/bid/39168

Apple QuickTime CoreMedia H.263 Encoded Movie Files Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39167

Apple Mac OS X PS Normalizer PostScript File Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39151

Moodle Prior to 1.9.8/1.8.12 Multiple Vulnerabilities
http://www.securityfocus.com/bid/39150

ZABBIX 'DBcondition' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39148

Joomla! 'com_network' Component 'cid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39147

Joomla! 'com_tour' Component 'cid' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39146

Joomla! 'com_trading' Component 'id' Parameter SQL Injection Vulnerability
http://www.securityfocus.com/bid/39143

2010年4月1日木曜日

About the security content of iTunes 9.1

http://support.apple.com/kb/HT4105
上記 URL の iTunes 9.1 のセキュリティアップデートの翻訳

1) ColorSync
　埋め込みカラープロファイルの画像を取り扱う際に整数バッファーフローが発生することが原因で、細工された画像を開くことでヒープオーバーフローが発生してアプリケーションを異常終了させたり、任意のコードを実行されたりする脆弱性。(CVE-2010-0040)

2) ImageIO
　TIFF 画像を取り扱う際にバッファオーバーフローが発生することが原因で、細工された TIFF 画像を表示することでアプリケーションを異常終了させたり、任意のコードを実行されたりする脆弱性。(CVE-2009-2285)

3) ImageIO
　BMP 画像を取り扱う際に初期化されていないメモリへアクセスすることが原因で、細工された Web サイトを閲覧することで Safari のメモリから Web サイトにデータを送信して情報漏洩する脆弱性。(CVE-2010-0041)

4) ImageIO
　TIFF 画像を取り扱う際に初期化されていないメモリへアクセスすることが原因で、細工された Web サイトを閲覧することで Safari のメモリから Web サイトにデータを送信して情報漏洩する脆弱性。(CVE-2010-0042)

5) ImageIO
　TIFF 画像を取り扱う際にメモリ破壊がが発生することが原因で、細工された TIFF 画像を表示することでアプリケーションを異常終了させたり、任意のコードを実行されたりする脆弱性。(CVE-2010-0043)

6) iTunes
　MP4 ファイルを取り扱い際に無限ループが発生することが原因で、細工された podcast が iTunes に無限ループを発生させて再起動したあとでも操作を妨害する脆弱性。(CVE-2010-0531)

7) iTunes
　Windows 版のインストールにおいて競合状態が発生することが原因で、ローカルでシステム権限で実行されるファイルを書き換えることを許す脆弱性。(CVE-2010-0532)

1日木曜日、赤口

+ RHSA-2010:0339-1: Important: java-1.6.0-openjdk security update
http://rhn.redhat.com/errata/RHSA-2010-0339.html

- Security Vulnerability in BIND DNS Software Shipped With Solaris May Allow DNS Cache Poisoning
http://sunsolve.sun.com/search/document.do?assetkey=1-66-273169-1

CHAR(10) - Clustering, HA and Replication Conference
http://www.postgresql.org/about/news.1191

PostgreSQL PHP Generator 10.3 released
http://www.postgresql.org/about/news.1190

VMSA-2010-0005: VMware products address vulnerabilities in WebAccess
http://www.vmware.com/security/advisories/VMSA-2010-0005.html

Google、ベトナム人ユーザー狙うサイバー攻撃を警告、既に数万台が感染
http://itpro.nikkeibp.co.jp/article/NEWS/20100401/346515/?ST=security

JVN#38687002 Compiere におけるクロスサイトスクリプティングの脆弱性
http://jvn.jp/jp/JVN38687002/index.html

JVN#57963254 Compiere におけるクロスサイトスクリプティングの脆弱性
http://jvn.jp/jp/JVN57963254/index.html

JVN#41842181 PrettyFormMail におけるクロスサイトスクリプティングの脆弱性
http://jvn.jp/jp/JVN41842181/index.html

JVNDB-2010-000009 Compiere におけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000009.html

JVNDB-2010-000008 Compiere におけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000008.html

JVNDB-2010-000007 PrettyFormMail におけるクロスサイトスクリプティングの脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000007.html

JVNDB-2010-001130 複数の Mozilla 製品の HTML パーサにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001130.html

JVNDB-2010-001128 複数の Mozilla 製品のブラウザエンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001128.html

JVNDB-2009-002454 複数の Mozilla 製品における任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002454.html

JVNDB-2009-002304 Mozilla Firefox におけるダウンロードファイルを置き換えられる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002304.html

JVNDB-2009-002303 Mozilla Firefox/SeaMonkey における意図しないファイルをダウンロードさせられる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002303.html

JVNDB-2009-002299 Mozilla Firefox のブラウザエンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002299.html

JVNDB-2009-002109 Mozilla Firefox の JavaScript エンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002109.html

JVNDB-2009-002106 Mozilla Firefox のブラウザエンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002106.html

JVNDB-2009-002101 Mozilla Firefox における任意の PKCS11 モジュールをインストール/削除させる脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002101.html

JVNDB-2009-002100 Mozilla Firefox における XUL ツリー要素に関する任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002100.html

JVNDB-2009-001970 Mozilla Firefox におけるドメイン名の処理に関するサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001970.html

JVNDB-2009-001936 Mozilla Firefox/Thunderbird の JavaScript エンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001936.html

JVNDB-2009-001933 Mozilla Firefox/Thunderbird の base64 デコード関数における整数オーバーフローの脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001933.html

JVNDB-2009-001932 Mozilla Firefox/Thunderbird のブラウザエンジンにおける任意のコードを実行される脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001932.html

We are experiencing e-mail issues
http://isc.sans.org/diary.html?storyid=8551

Apple AirPort Base Station Lets Remote Users Access Restricted Networks
http://securitytracker.com/alerts/2010/Mar/1023801.html

【リアルタイム更新中】エイプリルフールに便乗しているサイトまとめ2010年版
http://gigazine.net/index.php?/news/comments/20100401_matome_april_fool/

Wireshark 1.2.7, 1.0.12, and 1.3.4 Released
http://www.wireshark.org/news/20100331.html

+ DeleGate 9.9.7 released
http://www.delegate.org/mail-lists/delegate-en/4780

+? Secunia Research: Sun Java JDK/JRE Soundbank Resource Name Buffer Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00260.html

+? Secunia Research: Sun Java JDK/JRE Soundbank Resource Parsing Buffer Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00253.html

「Red Hat Enterprise Linux 5.5」リリース、最新プロセッサをサポート
http://itpro.nikkeibp.co.jp/article/NEWS/20100331/346451/

[ANNOUNCE] Apache PDFBox 1.1.0 released
http://pdfbox.apache.org/download.html

Squid 3.1.1 released
http://www.squid-cache.org/Versions/v3/3.1/RELEASENOTES.html

Linux kernel 2.6.34-rc3 released
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.34-rc3

RHEA-2010:0336-1: tzdata enhancement update
http://rhn.redhat.com/errata/RHEA-2010-0336.html

Debian : New moin packages fix cross-site scripting
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32144

Debian : New icedove packages fix several vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32145

iDEFENSE : Oracle Java Runtime Environment Image FIle Buffer Overflow Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32154

Independent Researcher : Trustwave's SpiderLabs Security Advisory
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32153

Secunia : Sun Java JDK/JRE Soundbank Resource Parsing Buffer Overflow
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32155

Apple : QuickTime 7.6.6
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32142

Apple : iTunes 9.1
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32143

Hewlett-Packard : Insight Control for Linux (IC-Linux) Remote Execution of Arbitrary Code, Local Unauthorized Elevatio
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32159

Hewlett-Packard : HP SOA Registry Foundation, Remote Unauthorized Access to Data, Cross Site Scripting (XSS), Privileg
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32160

Hewlett-Packard : HP Secure Web Server for OpenVMS (based on Apache) CSWS, Remote Denial of Service (DoS), Unauthorize
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32163

iDEFENSE : Microsoft Internet Explorer 'onreadystatechange' Use After Free Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32152

Independent Researcher : Possible VT-x enabled Intel CPU Crash Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32156

Independent Researcher : Apache ActiveMQ Persistent Cross-Site Scripting (XSS) Vulnerability
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32157

Independent Researcher : OXID eShop Enterprise: Session Fixation and XSS Vulnerabilities
http://www.criticalwatch.com/support/security-advisories.aspx?AID=32161

Microsoft Internet Explorer の脆弱性 (MS10-018) に関する注意喚起
http://www.jpcert.or.jp/at/2010/at100007.txt

JPCERT/CC WEEKLY REPORT
http://www.jpcert.or.jp/wr/2010/wr101201.html

JVNDB-2009-002524 Linux kernel の ext4_decode_error 関数におけるサービス運用妨害 (DoS) の脆弱性
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002524.html

[Suspected Spam]Vulnerabilities in NoCMS
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00261.html

[SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00264.html

[SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00254.html

Elevation of Privilege Vulnerability in iTunes for Windows
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00252.html

Multiple XSS vulnerabilities in OSSIM 2.2.1
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00256.html

OpenDcHub 0.8.1 Remote Code Execution Exploit
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00255.html

BitComet <= 1.19 Remote DOS Exploit http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00262.html

Secunia Research: Sun Java JDK/JRE Soundbank Resource Name Buffer Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00260.html

Secunia Research: Sun Java JDK/JRE Soundbank Resource Parsing Buffer Overflow
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00253.html

[SECURITY] [DSA 2025-1] New icedove packages fix several vulnerabilities
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00258.html

[SECURITY] [DSA 2024-1] New moin packages fix cross-site scripting
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00259.html

iDefense Security Advisory 03.30.10: Oracle Java Runtime Environment Image FIle Buffer Overflow Vuln
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00263.html

Trustwaves SpiderLabs Security Advisory TWSL2010-002
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-03/msg00257.html

KVM virtio-net Driver TCP Processing Bug Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023798.html

QuickTime Movie/PICT/BMP File Processing Errors Let Remote Users Execute Arbitrary Code
http://securitytracker.com/alerts/2010/Mar/1023790.html

iTunes Installation Race Condition Lets Local Users Gain System Privileges
http://securitytracker.com/alerts/2010/Mar/1023787.html

iTunes MP4 Podcast Infinite Loop Lets Remote Users Deny Service
http://securitytracker.com/alerts/2010/Mar/1023786.html

Apache ActiveMQ Input Validation Flaw Permits Cross-Site Scripting Attacks
http://securitytracker.com/alerts/2010/Mar/1023778.html

PDF Arbitrary Code Execution - vulnerable by design.
http://isc.sans.org/diary.html?storyid=8545

Yamamah "calbums" SQL Injection Vulnerability
http://secunia.com/advisories/39205/

Joomla DW Graph Component "controller" File Inclusion Vulnerability
http://secunia.com/advisories/39200/

CompleteFTP Server Directory Traversal Vulnerability
http://secunia.com/advisories/39191/

Apache CouchDB Insecure Timing Vulnerability
http://secunia.com/advisories/39146/

Free MP3 CD Ripper Buffer Overflow Vulnerability
http://secunia.com/advisories/39193/

Centreon "host_id" SQL Injection Vulnerability
http://secunia.com/advisories/39236/

Red Hat update for brltty
http://secunia.com/advisories/39231/

Irmin CMS "_Root_Path" File Inclusion Vulnerability
http://secunia.com/advisories/39214/

Open DC Hub "myinfo()" Buffer Overflow Vulnerability
http://secunia.com/advisories/39199/

Red Hat update for firefox
http://secunia.com/advisories/38566/

OXID eShop Script Insertion and Session Fixation Vulnerabilities
http://secunia.com/advisories/39224/

BitComet Client DHT Processing Denial of Service Vulnerability
http://secunia.com/advisories/39213/

React Forum "action" File Inclusion Vulnerability
http://secunia.com/advisories/39211/

KimsQ Multiple Remote File Inclusion Vulnerabilities
http://secunia.com/advisories/39156/

Red Hat update for seamonkey
http://secunia.com/advisories/39117/

Apache ActiveMQ Script Insertion and Cross-Site Request Forgery
http://secunia.com/advisories/39223/

Peik CMS Information Disclosure Security Issue
http://secunia.com/advisories/39221/

Red Hat update for kernel
http://secunia.com/advisories/39230/

Debian update for moin
http://secunia.com/advisories/39190/

P30vel Hosting Script Security Bypass
http://secunia.com/advisories/39168/

Mozilla SeaMonkey Multiple Vulnerabilities
http://secunia.com/advisories/39243/

Mozilla Thunderbird Multiple Vulnerabilities
http://secunia.com/advisories/39242/

Mozilla Firefox Multiple Vulnerabilities
http://secunia.com/advisories/39240/

Mozilla Firefox Multiple Vulnerabilities
http://secunia.com/advisories/39136/

MoinMoin Despam Script Insertion Vulnerability
http://secunia.com/advisories/39188/

Novell ZENworks Configuration Management Two Vulnerabilities
http://secunia.com/advisories/39212/

Debian update for icedove
http://secunia.com/advisories/39184/

huroncms Two SQL Injection Vulnerabilities
http://secunia.com/advisories/39148/

HP-UX AudFilter Denial of Service Vulnerability
http://secunia.com/advisories/39228/

HP Insight Control Suite For Linux Two Vulnerabilities
http://secunia.com/advisories/39227/

Avaya Products OpenSSL "bn_wexpand()" Vulnerability
http://secunia.com/advisories/39222/

eSSL eTimeTrack Information Disclosure Security Issue
http://secunia.com/advisories/39073/

Red Hat update for pam_krb5
http://secunia.com/advisories/39237/

Red Hat update for sendmail
http://secunia.com/advisories/39234/

Red Hat update for automake
http://secunia.com/advisories/39233/

Red Hat update for openldap
http://secunia.com/advisories/39232/

Red Hat update for squid
http://secunia.com/advisories/39229/

SUSE Update for Multiple Packages
http://secunia.com/advisories/39176/

Red Hat update for curl
http://secunia.com/advisories/39174/

Sun Java JDK / JRE Multiple Vulnerabilities
http://secunia.com/advisories/37255/

Apple iTunes Multiple Vulnerabilities
http://secunia.com/advisories/39135/

SUSE update for kernel
http://secunia.com/advisories/39178/

Apple QuickTime Multiple Vulnerabilities
http://secunia.com/advisories/39133/

Novell ZENworks Configuration Management Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0753

WebSphere Application Server Information Disclosure and DoS Issues
http://www.vupen.com/english/advisories/2010/0752

HP-UX AudFilter Rules Unspecified Local Denial of Service Vulnerability
http://www.vupen.com/english/advisories/2010/0751

HP Insight Control for Linux Code Execution and Privilege Escalation
http://www.vupen.com/english/advisories/2010/0750

HP SOA Registry Foundation Code Execution and Privilege Escalation
http://www.vupen.com/english/advisories/2010/0749

Mozilla Products Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0748

Sun Java JDK and JRE Code Execution and Security Bypass Vulnerabilities
http://www.vupen.com/english/advisories/2010/0747

Apple QuickTime File Handling Multiple Code Execution Vulnerabilities
http://www.vupen.com/english/advisories/2010/0746

Apple iTunes Code Execution and Privilege Escalation Vulnerabilities
http://www.vupen.com/english/advisories/2010/0745

OpenDcHub 0.8.1 Remote Code Execution Exploit
http://www.exploit-db.com/exploits/11986

WM Downloader 3.0.0.9 (.asx) Local Buffer Overflow
http://www.exploit-db.com/exploits/11981

RETIRED: Apple QuickTime Multiple Arbitrary Code Execution Vulnerabilities
http://www.securityfocus.com/bid/39087

Apache 'mod_isapi' Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38494

Apple iPhone Malformed Characters Denial of Service Vulnerability
http://www.securityfocus.com/bid/38758

iBoutique 'index.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/31159

SMEStorage 'com_smestorage' Component for Joomla! Local File Include Vulnerability
http://www.securityfocus.com/bid/38911

Apple iPhone Malformed VML Data Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38990

WebKit Right-to-Left Displayed Text Handling Memory Corruption Vulnerability
http://www.securityfocus.com/bid/38689

SuperNews 'index.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/38988

Jenkins Software RakNet Remote Integer Underflow Vulnerability
http://www.securityfocus.com/bid/38974

Retired: Microsoft Internet Explorer MS10-018 Advanced Notification
http://www.securityfocus.com/bid/39021

Mozilla Firefox Unspecified Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/38952

Astaro Security Linux 'index.fpl' Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/38893

RETIRED: VMware WebAccess Multiple Vulnerabilities
http://www.securityfocus.com/bid/39037

OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability
http://www.securityfocus.com/bid/38562

Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/35888

Mozilla Firefox and Thunderbird Remote Integer Overflow Vulnerability
http://www.securityfocus.com/bid/35769

Mozilla Firefox and Seamonkey Regular Expression Parsing Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/35891

Mozilla Firefox MFSA 2009-47, -48, -49, -50, -51 Multiple Vulnerabilities
http://www.securityfocus.com/bid/36343

Mozilla Thunderbird Multiple Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/38831

HP OpenView Network Node Manager 'OvWebHelp.exe' Remote Heap Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/37340

Multiple Mini-stream Software Products '.asx' File Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/34864

Multiple Vendor TLS Protocol Session Renegotiation Security Vulnerability
http://www.securityfocus.com/bid/36935

Linux Kernel 'net/mac80211/' Multiple Remote Denial of Service Vulnerabilities
http://www.securityfocus.com/bid/37170

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/38162

GNU Automake Insecure Directory Permissions Vulnerability
http://www.securityfocus.com/bid/37378

QEMU Virtio Networking Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37201

pam_krb5 Existing/Non-Existing Username Enumeration Weakness
http://www.securityfocus.com/bid/35112

Red Hat Sendmail Localhost.Localdomain Email Spoofing Vulnerability
http://www.securityfocus.com/bid/23742

Squid Header-Only Packets Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/37522

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/36091

OpenLDAP X.509 Certificate NULL Character Certificate Validation Security Bypass Vulnerability
http://www.securityfocus.com/bid/36844

Apple Mac OS X QuickDraw Manager Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/36985

Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities
http://www.securityfocus.com/bid/39020

Apple QuickTime BMP File Memory Corruption Vulnerability
http://www.securityfocus.com/bid/39141

Apple AirPort Base Station MAC Address ACL Remote Security Bypass Vulnerability
http://www.securityfocus.com/bid/39134

GNU libnss_db Local Information Disclosure Vulnerability
http://www.securityfocus.com/bid/39132

Drupal Taxonomy Breadcrumb Module Multiple HTML Injection Vulnerabilities
http://www.securityfocus.com/bid/39130

Open DC Hub 'MyInfo' Message Remote Stack Buffer Overflow Vulnerability
http://www.securityfocus.com/bid/39129

iSCSI Enterprise Target and tgt Multiple Format String Vulnerabilities
http://www.securityfocus.com/bid/39127

Apache ActiveMQ 'createDestination.action' HTML Injection Vulnerability
http://www.securityfocus.com/bid/39119

Centreon 'main.php' SQL Injection Vulnerability
http://www.securityfocus.com/bid/39118

CouchDB Message Digest Verification Security Bypass Vulnerability
http://www.securityfocus.com/bid/39116

BitComet DHT Packet Remote Denial of Service Vulnerability
http://www.securityfocus.com/bid/39112

MoinMoin 'Despam' Action Cross-Site Scripting Vulnerability
http://www.securityfocus.com/bid/39110

Joomla! DW Graph Component 'controller' Parameter Local File Include Vulnerability
http://www.securityfocus.com/bid/39108

登録: 投稿 (Atom)

2010年4月6日火曜日

6日 火曜日、大安