Comodo lets consumers 'hunt' buffer overflow bugs
107521
BO test bit whiffy Security firm Comodo, best known for its digital certificate business, has released a free diagnostic tool designed to identify buffer overflows in desktop security products. Our try-out, however, suggests that Comodo's BO Tester is principally designed to help poach users than provide a detailed breakdown of bugs.â¦
515247
Symantec has released a patch for its Veritas NetBackup software, saying it had discovered a buffer overflow vulnerability in the application. The flaw exists in the web programming language PHP used within NetBackup.
568430
Developer launches a Month of PHP Bugs project with 11 bugs in five days.
112205
Software update patches bug in wireless drivers that left systems vulnerable.
367071
Restrictive hardware and convoluted rights management crimp consumer choices.
559035
Michael Kimsal has posted a formal prediction that a patch, created by someone in the community, will emerge making it simple to bridge the gap between PHP4 and PHP5 applications.   Given the high number of shared hosts still running PHP4, the backwards compatibility issues going from 4->5 (yes, there are some!) and the new PHP4 "end of life" date (8/8/8), someone will likely find a way to make these run together, and possibly even charge money for it.   He suggests that many hosts out there would happily pay a sum to get this kind of functionally for their customers. It would provide a solution to customers who just don't understand the force towards PHP5 and would make them (and their PHP4 applications) happier.
277141
Microsoft is looking into reports this week of a serious buffer overflow vulnerability in its Internet Explorer Web browser, but has not yet seen malicious code that exploits the reported flaw.
437494
Popular posts from PHPDeveloper.org for the past week:PHPClasses.org: A PHP killer feature - Streams abstractionRob Thompson's Blog: Switch vs. IfPHPEverywhere: Octopussy numbers in PHPJob Posting: MODE Visual Seeks PHP Developer (Charlotte, NC)ProDevTips.com: Why PHP as a templating language sucksMatthew Turland's Blog: The Yin and Yang of TypingStubbles Blog: Stubbles 0.5.0 releasedChristopher Jones' Blog: Updated connection pooling in PHP's OCI8 extensionBen Ramsey's Blog: Congrats Costa Rica PHP!Carsten Lucke's Blog: Configuration issues with Xdebug on Debian Etch
734680
The SecurityReason website has three new advisories posted concerning the latest release in the PHP 5 series:   PHP 5.2.4  - input for the dl() function is not handled correctly and can lead to arbitrary code being loaded and executed PHP  - memory limit issue can be used in a DoS attack PHP  - memory limit issue can be used for a DoS attack   The dl() overflow is marked as a medium threat (largely because it allows for arbitrary code execution) but the other two are shown as low threat. A patch is also given for the dl() issue to help correct the problem.
300638
SableVM is a robust, extremely portable, efficient, and specifications-compliant Java Virtual Machine that aims to be easy to maintain and to extend. It features a state-of-the-art and efficient interpreter engine. Its source code is very accessible and easy to understand. It also has many robustness features that have been the object of careful design.     SableVM is a clean-room implementation of the publicly available specifications.    In this version, we added an experimental generational garbage collector, we imported a new GNU Classpath snapshot, we added handling of Jar/Zip files on boot classpath, we added user-friendly failure messages for bootstrap problems, we added added a profiling switch, we made sablevm-classpath install its files in standard locations, we made jikes and gcc be less verbose by default, and we made several important bugfixes and improvements.  You can download the SableVM from: http://sourceforge.net/project/showfiles.php?group_id=5523&release_id=281502
759266
Demo shows the chip running a Java applet, a browser and displaying some video at the same time.
139275
Popular posts from PHPDeveloper.org for the past week:PHP-Coding-Practices.com: Try-Catch Syntax WeirdnessPHPBuilder.com: Cross-Platform Database PHP DevelopmentIBM developerWorks: Java and PHP technology on AIX - Integrate the Java business application w/ DB2OpenSourceCommunity.org: What do you think makes a good CMS?Jonathan Snook's Blog: Elemental: Conditional Content with CakePHPDevShed: The Basics of Using the Factory Pattern in PHP 5Builder.com.au: PHP exploit code plants itself in GIFJohn Cox's Blog:  Linux.com Now PHP PoweredNick Halstead's Blog: Solving Programming ProblemsPHP-Tools Blog: Testing FIT
117011
KGuitar is powerful KDE-based music tabulature editor with support of guitar, drums, classic note scores, MIDI synthesizer output, chord, scales, modes, melody and rhythm construction and analysis tools, lots of tab effects, Guitar Pro files import.   After a long period of silence, I'm pleased to announce KGuitar 0.5.1 - a major bugfix release that covers most of issues for the last few years :)      * Compatiblity fixes: added support for autoconf 2.61, automake 1.10, gcc 4.2. Removed last bits of qt2->qt3 transition deprecations. Internal structures refactoring.     * Added zoom level (Ctrl Minus, Ctrl Plus), introducing multiple bars per row, automatically tuning to available window width;     * Finally introduced new exception-based framework for converters load/save. Makes converters much more bullet-proof and easier to write and debug.     * Guitar Pro import undergone major rewrite. Now it properly loads all gp4 files I have. Guitar Pro v3 and v5 formats are coming next. Anyway, Guitar Pro loader is now much more helpful about what errors it gets and less crash-prone. It detects and helps debug problems it encounters.     * Lots of displaying, mouse and keyboard control, printing fixes and prettifying. Track pane now has a header and it's synchronized with track list. Melody editor now has trapezoid and shark fin inlays.     * New QMap-based API for song metainformation - stores not a fixed number of fields, but key=value pairs.     * Misc things: project transitioned to Subversion.  As always, comments and especially bug reports are welcome. Also keep in mind that KGuitar is now registered at http://www.ohloh.net/projects/8959?p=KGuitar - so, take a look there too :)
357199
Back in February, Ralph Green asked me to speak at the North Texas Linux Users' Group. I discussed Linux administration and then took questions. Some one in the audience asked me about Mono. I gave a cavalier answer having a bias against it. Then someone else in the audience said that I needed to get my facts straight.
53150
Mozilla's latest pre-release version of its browser remains buggy, but performance enhancements give us reason to get excited. In Monkey Bites.
739909
(InfoWorld) - Hackers are hitting paydirt in their search for browser bugs. According to Symantec's twice-yearly Internet Security Threat Report, hackers found 47 bugs in Mozilla's open-source browsers and 38 bugs in Internet Explorer (IE) during the first six months of this year. That'sÂ up significantlyÂ from the 17 Mozilla and 25 IE bugs found in the previous six months. Even Apple's Safari browser saw its bugs double, jumping from six in the last half of 2005 to 12 in the first half of 2006. Opera was the only browser tracked by Symantec that saw the number of vulnerabilities decline, but not by much. Opera bugs dropped from nine to seven during the period. And while Internet Explorer remained theÂ most popular choice of attackers, no one is invulnerable. According to the report, 31 percent of attacks during the period targeted more than one browser, and 20 percent took aim at Mozilla's Firefox. "There is no safe browser," said Vincent Weafer, senior director with Symantec Security Response. "If you've got a browser, make sure you're configuring it correctly," he added. "That's a far better strategy than running some browser just because you haven't heard of it." Part of the rise is due to the growing market for vulnerabilities, Weafer said. Legitimate companies such as 3Com's Tipping Point and Verisign' s iDefense pay for this information, and there is also a growing black market for exploits. "People are encouraged and getting money for finding vulnerabilities, so now you have more people looking," said Weafer. Browser bugs are also relatively easy to find and exploit, said Marc Maiffret, chief technology officer with eEye Digital Security. "Everyone has realized that targeting the applications on the desktop is a better way to break into businesses and consumers and steal things than server flaws," he said via instant message. Businesses and consumers may both be targets, but home users are the victims in about 86 percent of all attacks, according to Symantec. And the U.S. is the biggest source of online attacks, thanks to its large number of compromised machines with broadband connections, Weafer said. About 37 percent of all online attacks originate in the U.S., he said. While there may have been more bugs in Mozilla than in IE, Symantec gave the open-source project high marks for its bug-fixing. On average, it patched bugs within one day of their public disclosure -- the fastest turn-around of all measured browsers. Opera came in second, averaging two days. Safari was next, with a five-day window, followed by Microsoft, which averaged nine days per patch. Microsoft may lag as a browser patcher, but when it comes to operating systems, the company leads the pack, according to Symantec. The slowest? Sun Microsystems.
580597
Mike Potter (from Adobe) has issued an invitation for all PHP and Ruby developers attending the MAX Conference to track each other down, as well as him.   I think this would be a perfect time for these groups of people to get together, showcase what you're working on, and talk about the problems that you're facing.  We're working out the details of MAXUP, but if you're going to MAX, plan on arriving on the Sunday so that on Monday we can get together and showcase and talk about the work that's going on with Flex and languages other than Java and ColdFusion.   He suggests using the entry's comments to help coordinate the meetings. The Early Bird pricing is still in effect for the conference, so there's no time like the present to reserve your spot.