Apple Releases Multiple Security Updates

Apple has released security updates for Apple iOS, Apple TV, and iTunes to address multiple vulnerabilities for the following products. Apple TV 2nd generation iPhone 3GS iPhone 4 and 4S iPod Touch 3rd generation and later iPad and iPad 2 iTunes for Windows 7, Vista, and XP service pack 2 or late...

Microsoft Releases March Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Visual Studio, and Express Design as part of the Microsoft Security Bulletin Summary for March 2012. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or opera...

Adobe Releases Update for Adobe Flash Player

Adobe has released a security bulletin for Adobe Flash Player to address multiple vulnerabilities affecting the following software versions: Adobe Flash Player 11.1.102.62 and earlier versions from Windows, Linux, and Solaris operating systems Adobe Flash Player 11.1.115.6 and earlier versions fo...

Google Releases Chrome 17.0.963.65

Google has released Chrome 17.0.963.65 for Linux, Macintosh, Windows, and Google Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review th...

RuggedCom Weak Cryptography for Password Vulnerability

Overview --------- Begin Update A Part 1 of 2 -------- This is an update to the original advisory titled ICSA-12-146-01—RuggedCom Weak Cryptography for Password Vulnerability that was published May 25, 2012, on the ICS-CERT Web page. Independent researcher Justin W. Clarke identified a default...

xArrow Multiple Vulnerabilities

Overview This advisory is a follow-up to ICS-ALERT-12-065-01 xArrow Vulnerabilities that was published March 05, 2012. Independent security researcher Luigi Auriemma identified and released four security vulnerabilities, along with proof-of-concept code, in the xArrow software application without...

DNSChanger Malware

UPDATE: On March 5, 2012, a federal judge agreed to allow more time for organizations and individuals to clean systems of the DNSChanger malware and extended the deadline for shutting off servers that had been keeping infected computers connected to the internet. Although the new deadline is July...

Emerson DeltaV Multiple Vulnerabilities

Overview ICS-CERT originally released Advisory ICSA-12-138-01P to the US-CERT secure portal on May 17, 2012, and released Update A on May 21, 2012. This web page release including Update A was delayed to allow users time to download and install the update. Researcher Kuang-Chun Hung of the Securi...

Google Releases Chrome 17.0.963.56

Google has released Chrome 17.0.963.56 for Linux, Macintosh, Windows, and Google Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review th...

Adobe Releases Security Bulletins for Adobe Shockwave Player and RoboHelp

Adobe has released a security bulletins for Adobe Shockwave Player and RoboHelp to address multiple vulnerabilities affecting the following software versions: Adobe Shockwave Player 11.6.3.633 and earlier versions for Windows and Macintosh Adobe RoboHelp 9 or 8 for Word on Windows Exploitation of...

Oracle Releases Critical Patch Update for February 2012

Oracle released its February Critical Patch Update CPU containing 14 security fixes for the following products: JDK and JRE 7 Update 2 and earlier JDK and JRE 5 Update 30 and earlier JDK and JRE 5.0 Update 33 and earlier SDK and JRE 1.4.235 and earlier JavaFX 2.0.2 and earlier US-CERT encourages...

Mozilla Releases Firefox 10.0.1

The Mozilla Foundation has released Firefox 10.0.1 to address a vulnerability. This vulnerability may cause a denial-of-service condition or potentially allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Mozilla Foundation Advisory for Firefox...

Progea Movicon Memory Corruption Vulnerability

Overview Security researcher Dillon Beresford of IXIAhttp://www.ixiacom.com/, website last accessed May 10, 2012. has identified a memory corruption vulnerability in the Progea Movicon application. This vulnerability can be exploited by a remote attacker; however, no public exploits are currently...

WellinTech KingSCADA Insecure Password Encryption

Overview This advisory is a follow-up to the alert titled “ICS-ALERT-12-020-06 - WellinTech KingSCADA Insecure Password Encryption Vulnerability” that was published January 20, 2012, on the ICS-CERT web page. Independent researchers Alexandr Polyakov and Alexey Sintsov from DSecRG identified an...

Microsoft Releases February Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, .Net Framework, Silverlight, Office, and Server Software as part of the Microsoft Security Bulletin Summary for February 2012. These vulnerabilities may allow an attacker to execute arbitrary code o...

Apple Releases Multiple Security Updates

Apple has released security updates for Apple OS X Lion 10.7 to 10.7.2, OS X Lion Server 10.7 to 10.7.2, Mac OS 10.6.8, and Mac OS X Server v 10.6.8 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition,...

Apple Mac OS X ATS data-font memory corruption vulnerability

Overview Apple Mac OS X ATS contains a memory corruption vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Apple Mac OS X ATS Apple Type Services fails to properly handle malformed data-font .dfont files, resulting in...

ruby: hash table collisions CPU usage DoS (oCERT-2011-003)

Ruby aka CRuby before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table...

Symantec pcAnywhere Hotfix

Symantec has released an update for pcAnywhere to address multiple vulnerabilities for the following software versions running on Windows: pcAnywhere 12.5 SP3 pcAnywhere Solutions 7.1 GA, SP 1, and SP 2 US-CERT encourages users and administrators to review the Symantec pcAnywhere hot fix and appl...

Google Releases Chrome 16.0.912.77

Google has released Chrome 16.0.912.77 for Linux, Mac, Windows, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review the Google Chro...