Alerts and Updates (Archives) for 2006



NZCERT uses the following colour codings to classify these alerts and updates:

Critical
Important
Moderate
Low
Unassigned or classification not available

Note: Where Vendors use the Common Vulnerability Scoring System (CVSS), NZCERT uses the CVSS Temporal Score to classify the vulnerability using the above categories. If multiple CVSS scores are provided under the same security alert, this classification is based on the highest CVSS Temporal Score. More information on CVSS can be found here.

Adobe
Adobe: Update for buffer overflow in Adobe Download Manager	05Dec06
Adobe: Update for potential vulnerabilities in Reader and Acrobat7	05Dec06

Apple
Apple: Mac OS X 10.4.8 Security Update 2006-008	19Dec06
Apple: Mac OS X 10.3.9, Mac OS X 10.4.8 Security Update 2006-007	28Nov06
Apple: Apple Remote Desktop 3.1	16Nov06
Apple: Xcode Tools 2.4.1 Mac OS X 10.4 or later	31Sep06
Apple: Mac OS X 10.4.8 and Security Update 2006-006	29Sep06
Apple: AirPort Update 2006-001 and Security Update 2006-005	21Sep06
Apple: QuickTime 7.1.3	12Sep06

Borderware
Borderware: Security Patch fs73s02 (requires support contract)	20Oct06
Borderware: Security Patch fs73s01 (requires support contract)	13Sep06

Cisco Systems
Cisco: Multiple Vulnerabilities in Cisco Secure Desktop	08Nov06
Cisco: CSA Management Center LDAP Administrator Authentication Bypass	01Nov06
Cisco: CSA for Linux Port Scan Denial of Service	25Oct06
Cisco: Default Password in Wireless Location Appliance	12Oct06
Cisco: Limitations in Cisco Secure Desktop	06Oct06
Cisco: Access Point Web-browser Interface Vulnerability Updated	20Sep06
Cisco: DOCSIS RW Community String Enabled in Non-DOCSIS Platforms	20Sep06

GnuPG
GnuPG: remotely controllable function pointer	06Dec06

Microsoft
Microsoft: Security Bulletin for December 2006 (3 updates Critical)	12Dec06
Microsoft: Vulnerability in MS Word Could Allow Remote Code Execution	06Dec06
Microsoft: Exploit Code Affecting the Workstation Service on Win2K	16Nov06
Microsoft: Security Bulletin for November 2006 (5 updates Critical)	14Nov06
Microsoft: Security Bulletin for October 2006 (6 updates Critical)	11Oct06

Mozilla
Mozilla: XSS using outer window's Function object	19Dec06
Mozilla: RSS Feed-preview referrer leak	19Dec06
Mozilla: Mail header processing heap overflows	19Dec06
Mozilla: Mozilla SVG Processing Remote Code Execution	19Dec06
Mozilla: XSS by setting img.src to javascript: URI	19Dec06
Mozilla: LiveConnect crash finalizing JS objects	19Dec06
Mozilla: Privilege escallation using watch point	19Dec06
Mozilla: CSS cursor image buffer overflow (Windows only)	19Dec06
Mozilla: Crashes with evidence of memory corruption (rv:1.8.0.9/1.8.1.1)	19Dec06
Mozilla: Running Script can be recompiled	07Nov06
Mozilla: RSA Signature Forgery	07Nov06
Mozilla: Crashes with evidence of memory corruption	07Nov06

OpenOffice

Opera Software

PGP Corporation

Redhat
Red Hat: tar security update	19Dec06
Red Hat: firefox security update	19Dec06
Red Hat: seamonkey security update	19Dec06
Red Hat: thunderbird security update	19Dec06
Red Hat: mod_auth_kerb security update	06Dec06
Red Hat: gnupg security update	06Dec06
Red Hat: nss_ldap security update	15Nov06
Red Hat: openssh security update	15Nov06
Red Hat: elinks security update	15Nov06
Red Hat: wireshark security update	09Nov06
Red Hat: texinfo security update	08Nov06
Red Hat: ruby security update	08Nov06
Red Hat: firefox security update	08Nov06
Red Hat: seamonkey security update	08Nov06
Red Hat: thunderbird security update	08Nov06
Red Hat: php security update	06Nov06
Red Hat: qt security update	01Nov06

Snort

Sun
Java Runtime Environment Untrusted Applets Privilege Elevation	19Dec07

Wireshark
Wireshark: Multiple problems in Wireshark versions 0.9.8 to 0.99.3	31Oct06

IPS / IDS Signature Updates (Archives)

Cisco: IDS Update Bulletin 19 Dec 2006 (S263) (requires support contract)	19Dec06
Cisco: IDS Update Bulletin 15 Dec 2006 (S262) (requires support contract)	15Dec06
Cisco: IDS Update Bulletin 13 Dec 2006 (S261) (requires support contract)	13Dec06
Cisco: IDS Update Bulletin 30 Nov 2006 (S260) (requires support contract)	30Nov06

Snort
Snort: VRT Rule new rules category for "specific threats"	15Dec06
Snort: VRT Rule for MS06-073, 074, 076, 077 and 078	12Dec06
Snort: VRT Rule for MS06-068, MS03-026 and 3COM TFTP CVE-2006-6183	07Dec06
Snort: VRT Rule for MS06-066 and WinZip ActiveX CVE-2006-5198	16Nov06