Security Updates | 2009-06-10

I track security updates for the following vendors: Apple, Cisco, FreeBSD, Microsoft, Red Hat, and Sun Microsystems. I chose these vendors based on my own needs for the networks and systems I manage. I’ve also found that updates from these vendors tend to catch the major updates necessary for common software applications. If you have other vendors you would like me to provide updates for, send me a message.

The FreeBSD Project

• Local information disclosure via direct pipe writes
• Missing permission check on SIOCSIFINFO_IN6 ioctl
• ntpd stack-based buffer-overflow vulnerability

Microsoft Corporation

• Update for DNS Devolution
• Vulnerability in Internet Information Services Could Allow Elevation of Privilege
• Update Rollup for ActiveX Kill Bits
• Vulnerability in Web Proxy Auto-Discovery (WPAD) Could Allow Information Disclosure
• Vulnerabilities in Active Directory Could Allow Remote Code Execution (971055)
• Vulnerabilities in Windows Print Spooler Could Allow Remote Code Execution (961501)
• Cumulative Security Update for Internet Explorer (969897)
• Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (969514)
• Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (969462)
• Vulnerability in Microsoft Works Converters Could Allow Remote Code Execution (957632)
• Vulnerability in RPC Could Allow Elevation of Privilege (970238)
• Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (968537)
• Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege (970483)
• Vulnerability in Windows Search Could Allow Information Disclosure (963093)

Red Hat, Inc.

• RHSA-2009:1087 Important: mod_jk security update

Sun Microsystems, Inc.

• Multiple Security Vulnerabilities in Common UNIX Printing System (CUPS) May Allow a Remote User to Execute Arbitrary Code
• A Security Vulnerability in the Solaris rpc.nisd(1M) Daemon may Cause a Denial of Service (DoS) Condition to a NIS+ Server