VMware Patches Bugs in Player, Fusion

VMware has issued an update for a number of its more popular products, fixing several vulnerabilities. Some of the flaws could lead to arbitrary code execution. The patches resolve security issues in the following VMware products: VMware Workstation 7.1.3 and earlier, VMware Player 3.1.3 and...

VideoLAN Releases VLC Media Player 1.1.10

VideoLAN has released VLC Media Player 1.1.10 to address an integer overflow vulnerability in the xspf demuxer. Exploitation of this vulnerability may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the release notes for VLC Media Player 1.1.10 a...

Adobe Releases Security Update for Flash Player

Adobe has released security bulletin APSB11-13 to address a vulnerability in Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux, and Solaris, and 10.3.185.22 and earlier versions for Android. Exploitation of this vulnerability may allow an attacker to conduct a cross-site...

Siemens WinCC Flexible Runtime Heap Overflow

Overview ICS-CERT originally released Advisory ICSA-11-244-01P on the US-CERT secure Portal on September 01, 2011. This web page release was delayed to allow users sufficient time to download and install the update. Independent security researchers Billy Rios and Terry McCorkle have reported a...

GE Intelligent Platforms Proficy Plant Applications Buffer Overflow

Overview ICS CERT originally released Advisory ICSA-11-243-01P on the US-CERT secure Portal on August 31, 2011. This web page release was delayed to allow users time to download and install the update. ICS-CERT has received a report from GE concerning a stack-based buffer overflow vulnerability i...

GE Proficy Historian Web Administrator XSS

Overview ICS-CERT originally released Advisory ICSA-11-243-02P on the US-CERT secure Portal on August 31, 2011. ICS-CERT has received a report from independent security researchers Billy Rios and Terry McCorkle concerning multiple cross-site scripting XSS vulnerabilities in the GE Intelligent...

GE Intelligent Platforms Proficy Historian Data Archiver Buffer Overflow Vulnerability

Overview ICS-CERT originally released Advisory ICSA-11-243-03P on the US-CERT secure Portal on August 31, 2011. This web page release was delayed to allow users time to download and install the update. ICS-CERT received a report from GE Intelligent Platforms and the Zero Day Initiative concerning...

Nmap NSE net: ssl-cert

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple Releases Malware Detection Tool

Apple has released Security Update 2011-003 for Mac OS X in response to the recent Mac fake anti-virus software. This update: adds a malware definition to the File Quarantine application causes the File Quarantine application to automatically update its malware definition list daily removes...

postfix security update

CentOS Errata and Security Advisory CESA-2011:0843 Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CV...

Moderate: Red Hat Security Advisory: postfix security update

Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Anymacro Mail System G4X email server web interface directory traversal vulnerability

Overview Anymacro Mail System G4X email server web interface contains a directory traversal vulnerability. Description According to Anymacro's website: Anymacro Mail System is a professional e-mail and unified messaging product solution. Anymacro Mail System can be used for an e-mail platform for...

Internet System Consortium releases BIND patches

The Internet System Consortium has released updates for BIND to address a vulnerability in BIND versions 9.4-ESV-R3 and later, 9.6-ESV-R2 and later, 9.6.3, 9.7.1 and later, and 9.8.0 and later. Exploitation of this vulnerability may allow an attacker to cause a denial-of-service condition...

Cisco Releases Security Advisory for Cisco Internet Streamer

Cisco has released a security advisory to address a vulnerability in the web server component of the Cisco Internet Streamer application, which is part of the Cisco Content Delivery System. This vulnerability may allow an attacker to cause a denial-of-service condition. US-CERT encourages users a...

WordPress Releases Version 3.1.3

WordPress has released WordPress 3.1.3 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the WordPress Codex document for version 3.1.3 and apply any necessary updates t...

Siemens Working On Fix For 'Security Gaps' In Logic Controllers

Siemens AG said on Tuesday that it was talking to its customers about what it acknowledged were “security gaps” in its Programmable Logic Controllers PLCs, after an NSS Labs researcher disclosed the discovery of what he described as serious security holes in the company’s industrial control...

Apple Mac Defender, MacProtector, and MacSecurity Fake Anti-Virus Software

Apple has released a security advisory related to the recent Mac fake anti-virus software. The most common names for this fake anti-virus software are MacDefender, MacProtector, and MacSecurity. This fake anti-virus software is the result of a phishing scam targeting Mac users that redirects them...

Erlang -- ssh library uses a weak random number generator

US-CERT reports: The Erlang/OTP ssh library implements a number of cryptographic operations that depend on cryptographically strong random numbers. Unfortunately the RNG used by the library is not cryptographically strong, and is further weakened by the use of predictable seed material. The RNG...

Microsoft Releases New Version of EMET

Microsoft has released a new, fully supported version of the Enhanced Mitigation Experience Toolkit EMET designed to mitigate exploitation attempts. EMET allows users to manage security mitigation technologies to make it more difficult for an attacker to exploit software vulnerabilities. US-CERT...

Mississippi Flooding Disaster Email Scams, Fake Antivirus, and Phishing Attack Warning

Users should be aware of potential email scams, fake antivirus, and phishing attacks regarding the Mississippi flooding disaster. Email scams may contain links or attachments that may direct users to phishing or malicious websites. Fake antivirus attacks may come in the form of pop-ups that flash...