* Patches from Apple, Gentoo, Mandriva, others * Top 10 viruses for the past 7 days, according to Trend Micro * Do-it-yourself phishing kit offered for sale, and other interesting reading
Today’s bug patches and security alerts:
‘Month of Apple Bugs’ turns up 10 flaws so far
A month-long campaign by two independent security researchers to disclose security flaws in Apple’s products has so far resulted in 10 vulnerabilities being publicly disclosed — and several more on the verge of being announced. Computerworld, 01/11/07.
Latest “Month of Apple Bugs”:
1/7 – OmniWeb Javascript alert() Format String Vulnerability
1/8 – Application Enhancer (APE) Local Privilege Escalation
1/9 – Apple Finder DMG Volume Name Memory Corruption
1/10 – Apple DMG UFS ffs_mountfs() Integer Overflow Vulnerability
1/11 – Apple DMG UFS byte_swap_sbin() Integer Overflow Vulnerability
1/12 – Apple DMG UFS ufs_lookup() Denial of Service Vulnerability
1/13 – Apple DMG HFS do_hfs_truncate() Denial of Service Vulnerability
1/14 – AppleTalk ATPsndrsp() Heap Buffer Overflow Vulnerability
1/15 – Multiple Mac OS X Local Privilege Escalation Vulnerabilities
**********
Five new updates from Gentoo:
OpenOffice.org (integer overflow, code execution)
w3m (format string flaw, code execution)
**********
Seven new patches from Mandriva:
NVIDIA Xorg driver (buffer overflow, code execution)
kerberos (denial of service, code execution)
kdenetwork (denial of service)
Mozilla Firefox (multiple flaws)
Mozilla Thunderbird (multiple flaws)
libneon0.26 (denial of service)
**********
Three new fixes from Debian:
**********
Six new updates from Ubuntu:
krb5 (denial of service, code execution)
libgtop2 (buffer overflow, code execution)
OpenOffice.org (integer overflow, code execution)
OpenOffice.org (integer overflow, code execution)
**********
Top 10 viruses for the past 7 days, according to Trend Micro:
1. Pe_Parite.A (8,187)
2. Troj_Generic (2,891)
3. Worm_Nyxem.E (1,275)
4. Html_Netsky.P (1,090)
5. Worm_Netsky.Dam (1,061)
6. Worm_Rontkbr.Gen (658)
7. Pak_Generic.001 (637)
8. Worm_Anig.A (489)
9. Worm_Rontokbro.B (393)
10. Worm_Sdbot.Bqt (377)
**********
From the interesting reading department:
Do-it-yourself phishing kit offered for sale
A software kit has been discovered for sale on the Internet that makes it possible for non-experts to set up and carry out sophisticated phishing attacks on large numbers of Web sites. TechWorld, 01/12/07.
CES – Hack this application!
Vendors can build a buzz around products by embracing the hacker community, according to technology company executives speaking at the International Consumer Electronics Show. IDG News Service, 01/12/07.
