Nasty Bug Found in 'Classic' ICQ Client
15069
Security researchers discover a serious vulnerability in older version of ICQ IM software.
302277
Both Windows and Mac versions of the multimedia program have a buffer overflow flaw that puts users at risk.
767747
Jikes is a great compiler but they could really benefit from better project management.  This bug  has been open for greater than 3 years now with no resolution.  One of the developers sent me a *private* email (without commenting or closing the bug) this this could be fixed by avoiding the use of symlinks but wasn't sure. Of course this email was sent more than 2 years ago so I have no decent way of finding it.  Adding insult to injury is the fact that IBM won't let me comment on the bug without an account.  The only problem is that my account won't activate.  In a nutshell if you want to use incremental compile with jikes you need to specify relative paths not full paths.  For example if y ...
86929
In a new post to his Oracle blog today, Christopher Jones talks about a bug that's been found in the OCI8 extension involving statement caching and a fix he's presenting.   As part of some testing we were doing, we found that PHP's OCI8 extension had a bug in the way it used Oracle's statement caching. The fix is already in CVS and will be generally available in PHP 5.2.4. After a short period for you to send me comments, Antony Dovgal will also build a new PECL snapshot of OCI8.   He explains the issue, a problem attributed to the switching of a "hard pause" and "soft pause" when the script caching connects to the Oracle database server. This caching feature is enabled by adding an "oci8.statement_cache_size" value in your php.ini file (and has a default size of 20).    If you've been having issues with this request caching and want to get the fix right away, grab it from the CVS. Otherwise, keep an eye out for PHP 5.2.4 coming soon to correct the issue.
403071
Here's a screen shot of the HTML source.  Looks like it's trying to serve some kind of ActiveX control. Happy to be using a Mac.  PS: Scoble just showed up and TM works on his cell phone so there's something weird going on.
287143
Latest PECL Releases:syck 0.9ps 1.3.5syck 0.9.1imagick 2.0.0b3
737101
Dubbed MyDoom.AH by security firms, this latest variant in the MyDoom family of worms is exploiting the recently publicised vulnerability in Microsoft Internet Explorer&#39;s (IE) IFRAME buffer overflow.
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
289657
Spyrit is a MUSH/MUCK/MOO client written in Python using the Qt toolkit. It aims to be a pleasant, extensible, polished product, and to support all three major platforms.    Spyrit v0.2 is still a few features short of going gold, but should already be usable and pleasant to use.  Version 0.2 implements ANSI format codes rendering, preliminary Telnet negotiation support, SSL encryption where supported, unlimited input history, plus a few minor improvements and speedups.  It also offers experimental binaries for both Windows and Linux. Feedback on those is kindly welcome.
447903
This Quicktime buffer overflow vulnerability appears to be different from a similar vulnerability  patched by Apple in December 2007.
299728
TechWeb - The worm, dubbed &quot;Quickspace,&quot; exploits a bug in QuickTime JavaScript support and affects current Windows and Mac editions of QuickTime.
48844
According to this new post on DynamicWebPges.de and a message from Derick Rethans on the php.internals mailing list, there's an issue with PHP 4.4.5 where sessions are causing segfaults when register_globals is set to "On".   As per Derick:   Because of this I'd like to release a 4.4.6 soon with this fixes. As  there is also an upgrade to pcre 7.0 we'd need at least one RC, which I  plan to release on Thursday.   Users of the PHP 4.4.x series should keep watch for this new update to correct the issue quickly.
111829
An iptables based firewall for systems running the Linux 2.4 or later kernel. Very flexible configuration allows the firewall to be used in a wide variety of firewall/gateway/router and VPN environments.   A bug that was supposedly fixed in Shorewall 3.4.4 was not fixed. Furthermore, the bug is present as far back as 3.2.6.  If HIGH_ROUTE_MARKS=No, then PREROUTING and OUTPUT marking rules are behaving as if TC_EXPERT=Yes was specified in shorewall.conf. In other words, these rules are being applied even if the connection has been marked as being associated with a particular ISP.  The symptoms in this user's case were that requests through ISP1 that were port-forwarded to an SMTP server were being replied through ISP2. The reason was that there was a tcrule which selected ISP2 for all connections from the SMTP server.  Errata patches as follows:  http://www1.shorewall.net/pub/shorewall/3.2/shorewall-3.2.10/errata/patches/Shorewall/patch-3.2.10-2.diff http://www1.shorewall.net/pub/shorewall/3.4/shorewall-3.4.6/errata/patches/Shorewall/patch-3.4.6-1.diff http://www1.shorewall.net/pub/shorewall/4.0/shorewall-4.0.2/errata/patches/Shorewall-shell/patch-shell-4.0.2-2.diff  The 3.2.10 patch applies to all 3.2 releases from at least 3.2.6 onward and to 3.4 releases 3.4.0-3.4.3 (with offset). The 3.4.6 patch will also work on 3.4.4 and 3.4.5 (again, with possible offset).  It is also possible to work around the problem by adding these two rules at the beginning of your tcrules file:  CONTINUE:P      0.0.0.0/0       0.0.0.0/0       -       -       -       - !0 CONTINUE        $FW             0.0.0.0/0       -       -       -       - !0
699435
A researcher has posted proof-of-concept code for a zero-day flaw within Mac OS X dealing with its handling of disk image (.dmg) files. The issue causes a memory corruption vulnerability that could allow attackers to execute arbitrary code.
736650
Nice blog post via Slava  criticizing the quality of the Java runtime and hotspot compiler:  "The HotSpot source code is a bad joke We wasted an afternoon and had a good laugh on IRC today, looking over parts of the SCSL sources to HotSpot and the sun.* classes. I can't give too much detail or paste code samples because that would violate Sun's ... license, but here are some highlights:"  This is my favorite one:  "A lot of preprocessors are used. This includes a mix of awk, sed, shell scripts, and indeed, Scheme! Yes, the JVM source includes jscheme.jar, used to generate some CORBA classes. Considering that Sun talks about how bad preprocessors are, its hypocritical of them to use preproces ...
544632
How a seemingly simply Microsoft bug betrayed its author's disdain for a wide range of secure coding principles.
92226
Things get terse When I was young I built up a collection of system error messages. Ok, look, it's not as sad as collecting stamps! It is? Really? Oh well, never mind. Anyway, my recent piece about Borland putting rude words in Quattro Pro got me thinking it was time to revisit that collection.â¦