Tuesday, February 14, 2017

Microsoft February Security Update Postponed


The MSRC Team has advised that the Microsoft February security updates have been postponed.  From February 2017 security update release – MSRC:
"Our top priority is to provide the best possible experience for customers in maintaining and protecting their systems. This month, we discovered a last minute issue that could impact some customers and was not resolved in time for our planned updates today.

After considering all options, we made the decision to delay this month’s updates. We apologize for any inconvenience caused by this change to the existing plan."

Update:
"UPDATE: 2/15/17: We will deliver updates as part of the planned March Update Tuesday, March 14, 2017. "
Home
Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player and AIR Critical Security Updates

Adobe Flashplayer

Adobe has released Version 24.0.0.221 of Adobe Flash Player for Microsoft Windows, Macintosh, Chrome and Linux.

These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. 

Release date: February 14, 2017
Vulnerability identifier: APSB17-04
CVE number: CVE-2017-2982,CVE-2017-2984, CVE-2017-2985, CVE-2017-2986, CVE-2017-2987, CVE-2017-2988,CVE-2017-2990, CVE-2017-2991, CVE-2017-2992, CVE-2017-2993, CVE-2017-2994, CVE-2017-2995, CVE-2017-2996
Platform: Windows, Macintosh, Linux and Chrome OS

Update:

Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

    Verify Installation

    To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

    Do this for each browser installed on your computer.

    To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

    References



    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...








    Thursday, February 09, 2017

    Pale Moon Version 27.1 Released with Security Updates


    Pale Moon
    Pale Moon has been updated to Version 27.1.  The update is a major development update.  Also included are bug fixes as well as security and privacy updates.  Many of the security updates are DiD* patches.

    Of note: Version 27.1 introduces the so-called "PMkit" modules, Pale Moon's effort to restore most compatibility with Firefox Jetpack/SDK extensions and making it possible for extension developers to convert their Firefox SDK extensions with little effort to a Pale Moon compatible format.
    Details from the Release Notes:

    Security/privacy changes:
    • Changed CORS handling to allow data: sources, assuming they are same-origin. This should fix the infamous "Facebook endless reload" issue and may make some other sites that assume this particular (unspecified) CORS behavior happy with Pale Moon.
    • Reinstated the network.stricttransportsecurity.enabled preference so people who choose privacy over HSTS can do so again.
    • Added, In HSTS "off" state, prevention of HSTS site status from being written to disk.
    • Updated the IDN blacklist with more extended unicode characters that "look very similar to" normal ASCII characters, to prevent spoofing of well-known domains. If blacklisted characters are found, the IDN domain name will be displayed in its punycode form. (CVE-2017-5383 and similar)
    • Fixed an exploitable crash when using MP4 video. (CVE-2017-5396)
    • Fixed an exploitable crash in XSL parsing. (CVE-2017-5376)
    • Fixed a potential security issue when exporting certificates with specially-crafted credentials. (CVE-2017-5381)
    • Fixed a potential use-after-free situation in frame selection. (CVE-2017-5380) DiD
    • Fixed a leak of window details through the Ion compiler in certain situations.
    • Fixed the potential for an exploitable crash involving Javascript GC. DiD
    • Fixed a potential overflow situation in (non-released) WebRTC code. DiD
    • Fixed a potentially unsafe situation in websockets. DiD
    • Fixed several memory and other safety hazards (BMO bugs 1318766, 1325877, 1328834 DiD, 1288561 DiD, 1322420 DiD, 1293327 DiD, 1322315, 1325344, 1285960).
    Changes/Fixes:
    • Reworked the media back-end completely (thanks Travis!) to use FFmpeg (including support for FFmpeg v3 and MP3 playback) and our own MP4 parser, and no longer relying on gstreamer on Linux, as well as adding some improvements on Windows for media parsing and playing.
    • On Linux, Apple .mov files of the correct type will also be played through FFmpeg now, for those rare occasions where they are still in use, considering there is no Quicktime plug-in available on that operating system.
    • Restored the classic about:config styling.
    • Added a fallback to US-ASCII if the autoconfig UTF-8 conversion fails.
    • Improved cross-compartment wrapper handling when managing a large number of tabs (fixes a performance regression with v27).
    • Changed the way audio and video synchronization is calculated to account for (slow) device latency, preventing things from getting out of sync on e.g. BlueTooth-connected speakers.
    • Changed the way scripts are handled when they are stopped from the "unresponsive script" dialog, to prevent browser lockup. We will now stop all scripts in the affected compartment in one go.
    • Fixed several errors in the devtools.
    • Fixed a nasty crash caused by cross-origin referrers.
    • Fixed the installer to allow 64-bit versions of the browser to be installed on Vista again.
    • Added HTML5-spec clipboard handling for content (cut&copy only -- paste is not allowed for security reasons).
    • Made multiple changes to the toolkit jetpack modules to cater to PMkit extensions.
      This should make running SDK-based extensions as PMkit extensions fairly simple for extension developers. See the introductory text to these release notes.
    • Fixed a css layout issue: make max-width affect contributions to intrinsic min-width.
    • Implemented several updates to the permissions manager. Among others, Improved the permissions manager (about:permissions) with a more complete set of permissions for pages.
    • Removed otherwise unused Metro browser platform/widget code.
    • Removed support for non-standard/deprecated let blocks and expressions.
    • Made the use of let as a keyword versionless and ES6 compliant.
    • Made the privacy category in preferences a tabbed setup to better fit the current options.
    • Fixed a regression preventing certain MP4 video files from playing.
    • Fixed a regression where seeking in media files would halt playback/jump to the end of the stream.
    • Fixed a crash caused by certain downloadable fonts with DirectWrite in use.
    • Improved downloads-button indicator legibility on some combinations of Windows versions and system theme colors.
    • Changed the Facebook user-agent override to be our native one, based on reports from users that it is (finally) working acceptably.
    • Fixed site-specific useragents being ignored if a global override is defined.
    Minimum system Requirements (Windows):
    • Windows Vista/Windows 7/8/10/Server 2008 or later
    • Windows Platform Update (Vista/7) strongly recommended
    • A processor with SSE2 instruction support
    • 256 MB of free RAM (512 MB or more recommended)
    • At least 150 MB of free (uncompressed) disk space
    Pale Moon includes both 32- and 64-bit versions for Windows:
    ____________

    *DiD stands for "Defense-in-Depth" and is a fix that does not apply to an actively exploitable vulnerability in Pale Moon but prevents future vulnerabilities caused by the same code when surrounding code changes, exposing the problem.
    Update: To get the update now, select "Help" from the Pale Moon menu.  Then select About Pale Moon and Check for Updates.




    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...