Fraudulent DigiNotar SSL Certificate

US-CERT is aware of public reports of the existence of fraudulent SSL certificates issued by DigiNotar. These fraudulent SSL certificates could be used by an attacker to masquerade as legitimate sites. Mozilla has released Firefox 3.6.22 and Firefox 6.0.2 to address this issue. Additional...

Potential Hurricane Irene Phishing Scams

In the past, US-CERT has received reports of phishing scams and malware campaigns related to topics that are of high-interest to the U.S. Government or news media, such as Hurricane Irene. Users' systems have been compromised by receiving and accessing phishing emails with subject lines that seem...

Cisco Releases Security Advisories

Cisco has released three security advisories to address vulnerabilities affecting the Cisco Unified Communications Manager, the Cisco Unified Presence Server, and the Cisco Intercompany Media Engine. These vulnerabilities may allow an attacker to disclose sensitive information or cause a...

Google Releases Chrome 13.0.782.215

Google has released Chrome 13.0.782.215 for Linux, Mac, Windows, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Releases blog entry and update to...

Mozilla Releases Firefox 6 and 3.6.20

The Mozilla Foundation has released Firefox 6 and Firefox 3.6.20 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, operate with escalated privileges, or obtain sensitive information. US-CERT encourages users and administrators to review th...

Adobe Releases Security Bulletins for Multiple Products

Adobe has released security bulletins to alert users of critical and important vulnerabilities in multiple products. The following products are affected: Adobe Shockwave Player 11.6.0.626 and earlier versions on the Windows and Macintosh operating systems Adobe Flash Player 10.3.181.36 and earlie...

RIM Releases Security Advisory for BlackBerry Enterprise Server

RIM has released a security advisory to address a vulnerability in the BlackBerry MDS Connection Service and BlackBerry Messaging Agent for the BlackBerry Enterprise Server. The vulnerability may allow an attacker to execute arbitrary code or gain unauthorized access to the BlackBerry Enterprise...

Microsoft Releases August Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, Microsoft Office, Microsoft .NET Framework, and Microsoft Developer Tools as part of the Microsoft Security Bulletin Summary for August 2011. These vulnerabilities may allow an attacker to execute...

Apple Releases QuickTime 7.7

Apple has released QuickTime 7.7 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review Apple Support Article HT4826 and apply any necessary updates to...

WordPress Themes Vulnerability

TimThumb, a PHP script that is reused in many popular themes for the WordPress blog software, contains a vulnerability that allows a remote attacker to upload arbitrary PHP code to an affected site. US-CERT encourages users and administrators to: determine if any hosted blogs use TimThumb by...

Google Releases Chrome 13.0.782.107

Google has released Chrome 13.0.782.107 for Windows, Mac, Linux, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to perform a cross-site scripting attack, or to execute arbitrary code. US-CERT encourages users and administrators to review the Goog...

Cisco Releases Security Advisory and Applied Mitigation Bulletin

Cisco has released a security advisory and an applied mitigation bulletin to address vulnerabilities in Cisco TelePresence Recording Server Software Release 1.7.2.0. Successful exploitation of these vulnerabilities may allow an attacker to bypass security restrictions or take control of the...

Apple Releases iOS 4.3.5 and iOS 4.2.10

Apple has released iOS 4.3.5 for the iPhone GSM model, iPod touch, and iPad, and iOS 4.2.10 for the iPhone CDMA model to address a vulnerability. This vulnerability may allow an attacker with a privileged network position to capture or modify data in SSL/TLS sessions. US-CERT encourages users and...

Foxit Releases Foxit Reader 5.0.2

The Foxit Corporation has released Foxit Reader 5.0.2 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the security release notes for Foxit Reader 5.0.2 and apply any necessary updates...

Apple Releases Safari 5.1 and 5.0.6

Apple has released Safari 5.1 and 5.0.6 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, perform a cross-site scripting attack, or disclose sensitive information. US-CERT encourages users and administrators to review Apple Support Article...

Apple Releases iOS 4.3.4 and iOS 4.2.9

Apple has released iOS 4.3.4 for the iPhone GSM model, iPod touch, and iPad, and iOS 4.2.9 for the iPhone CDMA model to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or operate with escalated privileges. US-CERT encourages users and...

RIM Releases Security Advisory for BlackBerry Enterprise Server

RIM has released a security advisory to address a vulnerability in the BlackBerry Administration API included in the BlackBerry Enterprise Server. The vulnerability may allow an attacker with user permissions granted to the BlackBerry Administration API to disclose sensitive information or cause ...

Oracle Releases Critical Patch Update for July 2011

Oracle has released its Critical Patch Update for July 2011 to address 78 vulnerabilities across multiple products. This update contains the following security fixes: 13 for Oracle Database Server 3 for Oracle Secure Backup 7 for Oracle Fusion Middleware 18 for Oracle Enterprise Manager 1 for...

VideoLAN Releases VLC Media Player Security Advisories

VideoLAN has released Security Advisory 1105 and Security Advisory 1106 for VLC Media Player 1.1.10 and older to address two vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to do the following to help mitigate the...

Mozilla Releases Firefox 5.0.1

The Mozilla Foundation has released Firefox 5.0.1 to address an issue with Mac OS X 10.7 and Java for Mac OS X 10.6 Update 5. These issues could cause Firefox to crash. US-CERT encourages users and administrators to review the Mozilla Foundation Firefox 5.0.1 Release Notes and apply any necessary...

Microsoft Releases July Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows and Microsoft Office as part of the Microsoft Security Bulletin Summary for July 2011. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevated privileges. US-CERT encourages users...

Internet System Consortium releases BIND Patches

The Internet System Consortium has released updates for BIND to address multiple vulnerabilities. CVE-2011-2464 affects the following versions: 9.6.3; 9.6-ESV-R4 and later; 9.7.0 and later; 9.7.1 and later; 9.7.2 and later; 9.7.3 and later; 9.7.4b1; 9.8.0 and later; and 9.8.1b1. CVE-2011-2465...

WordPress Releases Version 3.1.4

WordPress has released WordPress 3.1.4 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to operate with elevated privileges. US-CERT encourages users and administrators to review the WordPress Codex document for version 3.1.4 and apply any necessary...

Apple Releases Java Updates for Mac OS X 10.5 and OS X 10.6

Apple has released Java for Mac OS X 10.5 Update 10 and Java for Mac OS X 10.6 Update 5 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review Apple articles HT4739 and HT4738 and apply any...

Google Releases Chrome 12.0.742.112

Google released Chrome 12.0.742.112 for Windows, Mac, Linux, and Chrome Frame to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code. This update also contains an updated version of Adobe Flash. US-CERT encourages users and...

Apple Releases Security Updates to Address Multiple Vulnerabilities

Apple has released Mac OS X 10.6.8 and Security Update 2011-004 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, disclose sensitive information, or cause a denial-of-service condition. US-CERT encourages users and administrators to review...

Mozilla Releases Firefox 5 and 3.6.18

The Mozilla Foundation has released Firefox 5 and Firefox 3.6.18 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, violate the same origin policy, or perform a cross-site scripting attack. US-CERT encourages users and administrators to...

RIM Releases Security Advisory for BlackBerry PlayBook

RIM has released a security advisory to address vulnerabilities in the Adobe Flash Player version included with the BlackBerry PlayBook tablet software. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial of service condition. US-CERT encourages users and...

Adobe Releases Security Bulletin for Critical Vulnerability in Flash Player

Adobe has released security bulletin APSB11-18 to alert users of a critical vulnerability in Adobe Flash Player. The following versions are affected: 10.3.181.23 and earlier for Windows, Macintosh, Linux, and Solaris 10.3.185.23 and earlier for Android Adobe indicates that it has received reports...

Google Releases Chrome 12.0.742.100

Google released Chrome 12.0.742.100 for Windows, Mac, Linux, and Chrome Frame to address a critical vulnerability in the Flash player plug-in. This vulnerability could allow an attacker to take control of the affected system. US-CERT encourages users and administrators to review the Google Chrome...

Adobe Releases Security Bulletin for Critical Vulnerabilities in Shockwave Player

Adobe has released security bulletin APSB11-17 to alert users of critical vulnerabilities in Adobe Shockwave Player 11.5.9.620 and earlier versions on the Windows and Macintosh operating systems. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code. US-CERT...

Microsoft Releases June Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Microsoft Office, Microsoft SQL Server, Microsoft Visual Studio, Microsoft .NET framework, Microsoft Silverlight, Microsoft Forefront Threat Management Gateway, and Internet Explorer as part of the Microsoft Security...

Adobe Releases Security Bulletin for Adobe Reader and Acrobat

Adobe has released a security bulletin to address multiple vulnerabilities in Adobe Reader 10.0.1 and earlier versions for Windows, Adobe Reader 10.0.3 and earlier versions of Macintosh, and Adobe Acrobat 10.0.3 and earlier versions for Windows and Macintosh. Exploitation of these vulnerabilities...

Google Chrome Releases 12.0.742.91

Google has released Chrome 12.0.742.91 for Windows, Mac, Linux, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Releases blog entry and update to...

Adobe Releases Security Update for Flash Player

Adobe has released security bulletin APSB11-13 to address a vulnerability in Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux, and Solaris, and 10.3.185.22 and earlier versions for Android. Exploitation of this vulnerability may allow an attacker to conduct a cross-site...

VideoLAN Releases VLC Media Player 1.1.10

VideoLAN has released VLC Media Player 1.1.10 to address an integer overflow vulnerability in the xspf demuxer. Exploitation of this vulnerability may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the release notes for VLC Media Player 1.1.10 a...

VMware Releases Security Advisory

VMware has released security advisory VMSA-2011-0009 to address multiple vulnerabilities in the following products: VMware Workstation 7.1.3 and earlier VMware Player 3.1.3 and earlier VMware Fusion 3.1.2 and earlier ESXi 4.1 without patch ESXi410-201104402-BG ESXi 4.0 without patch...

Oracle Releases Critical Patch Update for June 2011

Oracle released its June Critical Patch Update CPU containing 17 security fixes for the following products: JDK and JRE 6 Update 25 and earlier for Windows, Solaris, and Linux JDK and JRE 5.0 Update 29 and earlier for Windows, Solaris, and Linux SDK and JRE 1.4.231 and earlier for Windows, Solari...

Cisco Releases Security Advisories for Multiple Products

Cisco has released security advisories for four products to address multiple vulnerabilities. These products include Cisco Unified IP phones, Cisco Network Registrar, Cisco AnyConnect Secure Mobility Client, and Cisco Media Experience. Exploitation of the vulnerabilities may allow an attacker to...

Gmail Phishing Attack

US-CERT is aware of public reports of a phishing attack that specifically targets US government and military officials' Gmail accounts. The attack arrives via an email sent from a spoofed address of an individual or agency known to the targeted user. The email contains a "view download" link that...

Apple Releases Malware Detection Tool

Apple has released Security Update 2011-003 for Mac OS X in response to the recent Mac fake anti-virus software. This update: adds a malware definition to the File Quarantine application causes the File Quarantine application to automatically update its malware definition list daily removes...

Internet System Consortium releases BIND patches

The Internet System Consortium has released updates for BIND to address a vulnerability in BIND versions 9.4-ESV-R3 and later, 9.6-ESV-R2 and later, 9.6.3, 9.7.1 and later, and 9.8.0 and later. Exploitation of this vulnerability may allow an attacker to cause a denial-of-service condition...

Cisco Releases Security Advisory for Cisco Internet Streamer

Cisco has released a security advisory to address a vulnerability in the web server component of the Cisco Internet Streamer application, which is part of the Cisco Content Delivery System. This vulnerability may allow an attacker to cause a denial-of-service condition. US-CERT encourages users a...

WordPress Releases Version 3.1.3

WordPress has released WordPress 3.1.3 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the WordPress Codex document for version 3.1.3 and apply any necessary updates t...

Google Chrome Releases 11.0.696.71

Google has released Chrome 11.0.696.71 for Windows, Mac, Linux, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Releases blog entry and update to...

Apple Mac Defender, MacProtector, and MacSecurity Fake Anti-Virus Software

Apple has released a security advisory related to the recent Mac fake anti-virus software. The most common names for this fake anti-virus software are MacDefender, MacProtector, and MacSecurity. This fake anti-virus software is the result of a phishing scam targeting Mac users that redirects them...

Microsoft Releases New Version of EMET

Microsoft has released a new, fully supported version of the Enhanced Mitigation Experience Toolkit EMET designed to mitigate exploitation attempts. EMET allows users to manage security mitigation technologies to make it more difficult for an attacker to exploit software vulnerabilities. US-CERT...

Mississippi Flooding Disaster Email Scams, Fake Antivirus, and Phishing Attack Warning

Users should be aware of potential email scams, fake antivirus, and phishing attacks regarding the Mississippi flooding disaster. Email scams may contain links or attachments that may direct users to phishing or malicious websites. Fake antivirus attacks may come in the form of pop-ups that flash...

Adobe Releases Flash Player and Flash Media Server Updates

Adobe has released updates for Flash Player and Flash Media Server to address multiple vulnerabilities. These vulnerabilities affect Adobe Flash Player 10.2.159.1 and earlier versions for Windows, Macintosh, Linux, and Solaris; Adobe Flash Player 10.2.157.51 and earlier versions for Android; Adob...

Google Releases Chrome 11.0.696.68

Google released Chrome 11.0.696.68 for Windows, Mac, Linux, and Chrome Frame to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Releases blog entry and update to Chrome...