* Patches from Apple, Mozilla, rPath, others * Top 10 viruses in February, as reported by Sophos * Massachusetts vehicle registry warns of spoof site, and other interesting reading
Today’s bug patches and security alerts:
Multiple flaws have been found in QuickTime’s handling of certain file types. The flaws could be exploited by an attacker to run malicious code on an affected machine. Users should upgrade to Version 7.1.5.
3Com Zero-Day Initiative advisory
**********
Citrix client lays open security hole
The U.S. Department of Homeland Security (DHS) has warned of an easily exploitable security bug in Citrix’s Presentation Server Client that could leave users open to attack by malicious Web sites. Citrix Presentation Server allows companies to make applications available for use from central servers. The problem is with a feature allowing the Citrix client to connect to the server via a proxy server using the Independent Computing Architecture (ICA) protocol, according to an advisory from US-CERT, part of the DHS. Users should upgrade to version 10 to fix the problem. TechWorld, 03/07/07.
**********
Mozilla issues fix for Firefox, SeaMonkey flaw
The Mozilla Foundation has published a fix for a “critical” JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite. The fix, released Monday, targets Firefox Versions 2.0.0.2 and 1.5.0.10, as well as SeaMonkey Versions 1.1.1 and 1.0.8. An earlier fix for a JavaScript problem allowed scripts from Web content to execute arbitrary code, the Mozilla Foundation said in a security update. IDG News Service, 03/06/07.
**********
Three patches from rPath:
mod_python (memory leak, information disclosure)
kdelibs (cross-scripting attack)
**********
Four updates from Ubuntu:
tcpdump (buffer overflow, denial of service)
mod_python (memory leak, information disclosure)
**********
Two new fixes from Debian:
GnomeMeeting (format string, code execution)
**********
Two new updates from Mandriva:
util-linux (information disclosure)
**********
Two new patches from Gentoo:
STLport (buffer overflows, code execution)
AMD64 x86 emulation Qt library (code execution)
**********
Top 10 viruses in February, as reported by Sophos:
4. Zafi (4.8%)
7. Bagle (2.4%)
9. Nyxem (1.1%)
10. StraDl (1.0%)
**********
From the interesting reading department:
Massachusetts vehicle registry warns of spoof site
The Massachusetts Registry of Motor Vehicles is warning customers about an online scam intended to trick them out of their credit card information and their money. Computerworld, 03/06/07.
Security expert cracks RFID chip in U.K. passport
A security expert has cracked one of the U.K.’s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration. IDG News Service, 03/06/07.
