http://www.iss.net en 2007 IBM Internet Security Systems. All rights reserved worldwide. http://www.iss.net/threats/470.html A vulnerability exists in Microsoft Windows Server 2012 and Microsoft Windows 8 that if exploited successfully will cause denial of service. Wed, 15 May 2013 00:00:00 -0400 http://www.iss.net/threats/469.html There is a use-after-free vulnerability affecting Microsoft Internet Explorer 8 (only ). The vulnerability came to light when it was used in a watering hole attack after a breach of a US Department of Labor (DoL) server. This vulnerability has been exploited in the wild by attackers to gain remote code execution in the context of the current user. Wed, 15 May 2013 00:00:00 -0400 http://www.iss.net/threats/471.html Backdoors on Apache, Lighthttpd and nginx servers have been discovered in the wild which have been observed distributing links to the Blackhole exploit kit. Wed, 15 May 2013 00:00:00 -0400 http://www.iss.net/threats/468.html The sandbox feature of Adobe Flash Player for Firefox has a buffer overflow vulnerability which could result in privilege escalation. ADVISORY NOTE: Due to the nature of this vulnerability, IBM X-Force is not issuing any specific signature coverage on this advisory. We recommend applying the patch released by Adobe for this issue. Wed, 27 Feb 2013 00:00:00 -0500 http://www.iss.net/threats/467.html Malware has been seen in the wild which combines and exploits two vulnerabilities in Java to execute arbitrary code. One of the vulnerabilities is in the implementation of certain classes in the package com.sun.jmx.mbeanserver which when exploited, can allow restricted classes to be loaded. IBM has existing coverage for this vulnerability with the signature Java_MBean_Code_Execution (see alert #459). IBM X-Force is adding coverage for the other vulnerability used for exploitation, CVE-2013-1486, which is a vulnerability in the com.sun.jmx.mbeanserver.Introspector class. Tue, 26 Feb 2013 00:00:00 -0500 http://www.iss.net/threats/466.html A vulnerability exists in Adobe Reader and Adobe Acrobat which can lead to remote code execution. Exploits for this previously unknown vulnerability were initially reported to have been used in targeted attacks. Mon, 18 Feb 2013 00:00:00 -0500