Researcher warns of unpatched iPhone bugs
Security vulnerabilities in the iPhone's e-mail application and Safari Web browser can be used by phishers to dupe users into visiting malicious sites or by spammers to flood the phone's in-box with junk mail, a researcher warned today. Computerworld, 07/23/2008.

Aviv Raff: iPhone is Phishable and SPAMable
**********

Asterisks patches DoS vulnerability
A description of the flaw from Asterisk: "By flooding an Asterisk server with IAX2 'POKE' requests, an attacker may eat up all call numbers associated with the IAX2 protocol on an Asterisk server and prevent other IAX2 calls from getting through." A fix is available.

Patch for Asterisk's traffic provisioning system
A flaw in a Asterisk's traffic provisioning system could be exploited to flood a server with data, resulting in a denial of service. A fix is available.
**********

Four new patches from Debian:

xulrunner (multiple flaws)

iceweasel (multiple flaws)

libgd2 (multiple flaws)

Ruby 1.8 (multiple flaws)
**********

Five new updates from Mandriva:

emacs (code execution)

wireshark (denial of service)

libxslt (buffer overflow, code execution)

MySQL (unauthorized access)

Firefox (multiple flaws)
**********

Three new fixes from Gentoo:

BitchX (multiple flaws)

PeerCast (buffer overflow, code execution)

Bacula (information disclosure)
**********

Two new patches from Ubuntu:

PHP (multiple flaws)

Dnsmasq (cache poisoning)
**********

Today's malware news:

Attack code released for new DNS attack
Hackers have released software that exploits a recently disclosed flaw in the Domain Name System (DNS) software used to route messages between computers on the Internet. The attack code was released Wednesday by developers of the Metasploit hacking toolkit. IDG News Service, 07/24/2008.

Also: Details of major Internet flaw posted by accident
**********

From the interesting reading department:

Podcast: Open source tools help secure city network
How does a fiscally constrained city department help get its network into compliance with PCI? Best of breed open source tools are a big help, explains Alan Boulanger, former director of Information Security for the City of Springfield, Mass. (7:52)

Open source software a security risk, study claims
Open source software is a significant security risk for corporations that use it because in many cases, the open source community fails to adhere to minimal security best practices, according a study released Monday. Network World, 07/21/2008.

Jason Meserve is multimedia editor at Network World.