June 05, 2007 - Current Activity

PHP Vulnerabilty

US-CERT is aware of a publicly reported vulnerability in PHP.  PHP version 5.2.3 may be vulnerable to an  integer overflow within the chunk_split() function.

More information can be found in the following PHP Security Blog.

US-CERT will provide additional information as it becomes available.

Microsoft Internet Explorer and Mozilla Firefox Vulnerabilities

US-CERT is aware of a public report of multiple vulnerabilities in Mozilla Firefox and Microsoft Internet Explorer.

More information can be found in Vulnerability Note VU#471361.

US-CERT encourages users to follow the steps in the Securing Your Web Browser document.

Apple Releases Update for Xserve Lights-Out Management Firmware

Apple releases Firmware Update 1.0 to address a vulnerability in Xserve Lights-Out Management Firmware.  The vulnerability lies in Apple's implementation of IPMI and may allow a remote, unprivileged ipmitool user to gain administrative privileges on a Xserve system.

US-CERT encourages users to apply Firmware Update 1.0 as soon as possible.

US-CERT will continue to investigate this vulnerability and provide additional details as they become available.

Mozilla Releases Security Advisories to Address Multiple Vulnerabilities

The Mozilla Foundation has released Security Advisories to address multiple vulnerabilities in Firefox, Thunderbird, and SeaMonkey.  The impacts of these vulnerabilities include arbitrary code execution, denial of service, memory corruption and cross-site scripting.

More information can be found in Technical Cyber Security Alert TA07-151A and the Vulnerability Notes Database.

US-CERT encourages users to apply the updates as described in the Security Advisories.

Apple Releases a Security Update for QuickTime 7.1.6 to Address Multiple Vulnerabilities

Apple has released a Security Update for QuickTime 7.1.6 to address multiple vulnerabilities in Apple QuickTime for Java. The impacts of these vulnerabilities include arbitrary code execution and information disclosure.

More information can be found in the following:

• Vulnerability Note VU#995836
• Vulnerability Note VU#434748

Apple Releases Security Update to Address Multiple Vulnerabilities in Various Products

Apple has released Security Update 2007-005 to address multiple vulnerabilities in various products.  The impacts of these vulnerabilities include denial of service, arbitrary code execution, information disclosure, and privilege escalation.

US-CERT encourages users to apply the appropriate updates as soon as possible.

More information about this vulnerability can be found in the following:

• Vulnerability Note VU#221876
• Vulnerability Note VU#116100

Microsoft Office ActiveX Control Vulnerability

US-CERT is aware of reports of a vulnerability in a Microsoft Office 2000 ActiveX control.  Excessive data passed to the OUACTRL ActiveX control may result in a buffer overflow allowing arbitrary code execution or causing a denial-of-service condition.