| May 09, 2008 |
Mozilla Releases Thunderbird 2.0.0.14 Mozilla has released Thunderbird 2.0.0.14 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to escalate privileges or execute arbitrary code. US-CERT encourages users to review Mozilla Foundation Security Advisories 2008-14 and 2008-15 and to update to Thunderbird 2.0.0.14. |
| May 08, 2008 |
Microsoft Releases Advance Notification for May Security Bulletin Microsoft has issued a Security Bulletin Advance Notification indicating that its May release cycle will contain four bulletins, three of which will have a severity rating of Critical. The notification states that these Critical bulletins are for Microsoft Windows and Office. The notification also states that there will be one Important bulletin for Windows Live OneCare, Antigen, Defender, and Forefront Security. Release of these bulletins is scheduled for Tuesday, May 12. US-CERT will provide additional information as it becomes available. |
| May 07, 2008 |
Microsoft Releases Windows XP Service Pack 3 Microsoft has released Service Pack 3 for Windows XP. Service Pack 3 includes multiple Hotfixes and security updates and is available through Automatic Updates and Windows Update. Users should note that Windows XP SP3 does not include Internet Explorer 7, however it does include updates to both IE 6 and IE 7, and will update whichever version is currently installed. US-CERT encourages users to review the release notes for Service Pack 3 for Windows XP and apply any necessary updates. |
| May 06, 2008 |
PHP 5.2.6 Released PHP has released version 5.2.6 to address multiple vulnerabilities. These vulnerabilities include
US-CERT encourages users to review the PHP 5.2.6 Release Announcement and update to version 5.2.6. |
| May 05, 2008 |
Common Data Format Buffer Overflow Vulnerability NASA has issued an advisory regarding a vulnerability in Common Data Format (CDF) version 3.2 and earlier. This vulnerability is due to a buffer overflow condition in the handling of specially-crafted CDF files. Exploitation of this vulnerability may allow an attacker to execute arbitrary code. US-CERT encourages users to review the NASA advisory and update to CDF 3.2.1 to help mitigate the risk. US-CERT will provide additional information as it becomes available. |
| Apr 28, 2008 |
WordPress Vulnerabilities WordPress has released version 2.5.1 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to bypass security restrictions or conduct a cross-site scripting attack. US-CERT encourages users to review the WordPress 2.5.1 release notes and apply any necessary updates. |
| Apr 25, 2008 |
Compromised Websites Hosting Malicious JavaScript US-CERT is following reports of SQL injection attacks that have compromised a large number of legitimate websites. The compromised websites contain injected JavaScript that attempts to exploit multiple, known vulnerabilities. Users who visit a compromised website may unknowingly execute malicious code. US-CERT encourages users to do the following to help mitigate the risks of this and similar attacks:
US-CERT will provide more information as it becomes available. |
| Apr 25, 2008 |
HP Software Update Vulnerabilities US-CERT is aware of reports of multiple vulnerabilities affecting HP Software Update. These vulnerabilities are due to insecure methods in multiple ActiveX controls. Exploitation of these vulnerabilities may allow a remote attacker to execute arbitrary code or view or modify sensitive information. US-CERT encourages users to do the following to help mitigate the risks:
|
| Apr 24, 2008 |
IRS Rebate Phishing Scam US-CERT is aware of a public report indicating that a phishing scam is circulating. This scam is related to the U.S. Internal Revenue Service economic stimulus rebate and arrives via email messages that appear to be from the IRS. The messages include text that attempts to convince users to follow a link to a website before a deadline to expedite the rebate process. This website requests that the user provide bank account information. US-CERT encourages users to do the following to help mitigate the risks:
|
| Apr 23, 2008 |
Apple QuickTime Vulnerability US-CERT is aware of public reports of a vulnerability in Apple QuickTime. By convincing a user to open a specially crafted QuickTime file, an attacker may be able to execute arbitrary code. This vulnerability may have several attack vectors, such as visiting a malicious or compromised website. US-CERT encourages users to use caution when opening QuickTime files, and apply the best security practices described in the Securing Your Web Browser document, to help mitigate the risks. US-CERT will provide additional information as it becomes available. |