April 2016 ~ Security Garden

Tuesday, April 26, 2016

Mozilla Firefox Version 46.0 Released with Security Updates

Although scheduled for April 19, Mozilla sent Firefox Version 46.0.0 to the release channel today. The update is a major release and includes one (1) critical, four (4) high and four (4) moderate security updates.

Firefox ESR ~~remains at Version 38.7.1.~~ was updated to Version 38.8.0.

The next scheduled release is June 7, 2016.

Of interest to Thunderbird users, it appears that Mozilla is looking for a new home for the email client. See Thunderbird is GO: Mozilla prepares to jettison mail client for additional information.

Fixed in Firefox 46

2016-48 Firefox Health Reports could accept events from untrusted domains
2016-47 Write to invalid HashMap entry through JavaScript.watch()
2016-45 CSP not applied to pages sent with multipart/x-mixed-replace
2016-44 Buffer overflow in libstagefright with CENC offsets
2016-43 Disclosure of user actions through JavaScript with motion and orientation sensors
2016-42 Use-after-free and buffer overflow in Service Workers
2016-41 Content provider permission bypass allows malicious application to access data
2016-40 Privilege escalation through file deletion by Maintenance Service updater
2016-39 Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)

New

Improved security of the JavaScript Just In Time (JIT) Compiler
GTK3 integration (GNU/Linux only)

Fixed

Screen reader behavior with blank spaces in Google Docs corrected
Correct rendering for scaled SVGs that use a clip and a mask/li>

Changed

WebRTC fixes to improve performance and stability/li>

HTML5

Added support for document.elementsFromPoint
Added HKDF support for Web Crypto API

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox." Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Tuesday, April 19, 2016

Oracle Java Quarterly Security Update, April 2016

Following two out-of-band security updates since the last quarterly update, Oracle released the scheduled critical security updates for its Java SE Runtime Environment software and, once again, released two versions.

Java Version 8 Update 91 contains important security fixes and Java Version 8 Update 92 is described as a patch-set update, which includes the updates in Version 8u91 plus the additional features described in the release notes.

Unwanted "Extras"

Although most people do not need Java on their computer, there are some programs and games that require Java. In the event you need to continue using Java, How-to Geek discovered a little-known and unpublicized option in the Java Control Panel to suppress the offers for the pre-checked unwanted extras that Oracle has long included with the updates. Although the Ask Toolbar has been removed, tha does not preclude the pre-checked option for some other unnecessary add-on.

Do the following to suppress the sponsor offers:

Launch the Windows Start menu
Click on Programs
Find the Java program listing
Click Configure Java to launch the Java Control Panel
Click the Advanced tab and go to the "Miscellaneous" section at the bottom.
Check the box by the “Suppress sponsor offers when installing or updating Java” option and click OK.

Windows XP

For information on Java support for Windows XP, organizations and individuals who must continue using Windows XP and have Java installed are referred to the Oracle blog post, The future of Java on Windows XP (Henrik on Java).

Update

If Java is still installed on your computer, it is recommended that this update be applied as soon as possible due to the threat posed by a successful attack.

Download Information

Download link: Java SE 8u91

Java SE 8u92 can be found here. Select the appropriate version for your operating system.

Verify your version: http://www.java.com/en/download/testjava.jsp

Notes:

UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.
Starting with Java SE 7 Update 21 in April 2013, all Java Applets and Web Start Applications should be signed with a trusted certificate. It is not recommended to run untrusted/unsigned Certificates. See How to protect your computer against dangerous Java Applets

Critical Patch Updates

For Oracle Java SE Critical Patch Updates, the next scheduled dates are as follows:

19 July 2016
18 October 2016
17 January 2017
18 April 2017

Java Security Recommendations

For those people who have desktop applications that require Java and cannot uninstall it, Java can now be disabled in Internet Explorer. See Microsoft Fix it to Disable Java in Internet Explorer.

1) In the Java Control Panel, at minimum, set the security to high.
2) Keep Java disabled until needed. Uncheck the box "Enable Java content in the browser" in the Java Control Panel.

Instructions on removing older (and less secure) versions of Java can be found at http://java.com/en/download/faq/remove_olderversions.xml

References

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Tuesday, April 12, 2016

Microsoft Security Bulletin Release for April, 2016

Microsoft released thirteen (13) bulletins. Six (6) bulletins are identified as Critical and the remaining eight (7) are rated Important in severity. Of particular note is MS16-039 which is under active attack.

The updates address vulnerabilities in Microsoft Windows, Microsoft Edge, Internet Explorer, Microsoft Office, Microsoft Office, Microsoft Office Services and Web Apps, Skype for Business, Microsoft Lync and Microsoft .NET Framework.

Information about the updates in KB 3147458 for Windows 10 is available at Windows 10 update history.

Critical:

MS16-037 Cumulative Security Update for Internet Explorer (3148531)
MS16-038 Cumulative Security Update for Microsoft Edge (3148532)
MS16-039 Security Update for Microsoft Graphics Component (3148522)
MS16-040 Security Update for Microsoft XML Core Services (3148541)
MS16-042 Security Update for Microsoft Office (3148775)
MS16-050 Security Update for Adobe Flash Player in IE/Edge on Win8.1/10 (3154132)

Important:

MS16-041 Security Update for .NET Framework (3148789)
MS16-044 Security Update for Windows OLE (3146706)
MS16-045 Security Update for Windows Hyper-V (3143118)
MS16-046 Security Update for Secondary Logon (3148538)
MS16-047 Security Update for SAM and LSAD Remote Protocols (3148527)
MS16-048 Security Update for CSRSS (3148528)
MS16-049 Security Update for HTTP.sys (3148795)

Additional Update Notes

Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows 10 Version 1511, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates.
MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.
Windows 8.x and Windows 10 -- Non-security new features and improvements for Windows 8.1 and Windows 10 are included with the updates.
Windows 10 -- A summary of important product developments included in each update, with links to more details is available at Windows 10 Update History. The page will be regularly refreshed, as new updates are released.

References

MSRC
TechNet: Microsoft Security Bulletin for April 2016
Windows 10 Update History

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Monday, April 11, 2016

Mozilla Firefox 45.0.2 Bug Fix Released

Mozilla sent Firefox Version 45.0.2 to the release channel. The update is another set of bug fixes.

Firefox ESR remains at Version 38.7.1.

The next scheduled release is April 19, 2016.

Fixed

Fix an issue impacting the cookie header when third-party cookies are blocked (1257861)
Fix a web compatibility regression impacting the srcset attribute of the image tag (1259482)
Fix a crash impacting the video playback with Media Source Extension (1258562)
Fix a regression impacting some specific uploads (1255735)
Fix a regression with the copy and paste with some old versions of some Gecko applications like Thunderbird (1254980)

Update

References

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Thursday, April 07, 2016

Critical Out-of-Band Adobe Flash Player Update

Adobe has released Version 21.0.0.213 of Adobe Flash Player for Microsoft Windows and Macintosh due to reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier.

It is strongly advised that Flash Player be updated as soon as possible.

Release date: April 7, 2016
Vulnerability identifier: APSA16-01
CVE number: CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033
Platforms: Windows, Macintosh, Linux and Chrome OS

Warning: Although Adobe suggests downloading the update from the Adobe Flash Player Download Center, that link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive. If you use the download center, uncheck any unnecessary extras.

Non-IE Plugin (Opera, Firefox, Etc.): http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_21_plugin.exe
Flash Player For Internet Explorer, Windows 7 and earlier: http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_21_active_x.exe
Internet Explorer and Microsoft Edge: Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows 10 Version 1511: Adobe Flash Player is now a security bulletin rather than a security advisory and is distributed via the normal Windows Update channel.
Flash Player Uninstaller: http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
Adobe AIR: http://get.adobe.com/air/

Notes:

If you use the Adobe Flash Player Download Center, be careful to uncheck any optional downloads that you do not want. Any pre-checked option is not needed for the Flash Player update.
Uncheck any toolbar offered with Adobe products if not wanted.
If you use alternate browsers, it is necessary to install the update for both Internet Explorer as well as the update for alternate browsers.
The separate 32-bit and 64-bit uninstallers have been replaced with a single uninstaller.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu.

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Tuesday, April 05, 2016

Pale Moon Version 26.2.0 Released with Security Updates

Pale Moon has been updated to version 26.2.0. The update is a major update including security and bug fixes. Linux versions will follow when the Linux maintainer publishes those builds.

The updates as described in the Release Notes include the following:

Security fixes:

Updated the graphite font library to 1.3.7+ to solve CVE-2016-2796 and no less than 14 of its friends.
Updated NSS to 3.19.4.2-PM to address several vulnerabilities (UAF, heap overflow).
Updated libvorbis to a much more recent version to fix multiple issues.
Crash fix and DiD fixes by holding strong references to objects in suspect places in the HTML parser. (CVE-2016-1961) (ZDI-CAN-3574)
Fixed several out-of-bounds issues in the VP8 decoder.
Fixed a potentially exploitable crash in XML/XSLT handling.
Applied some Kung Fu to HTML animations and transitions to prevent memory hazards.
Fixed applicable Mozilla code vulnerabilities CVE-2016-1965, CVE-2016-1960 (ZDI-CAN-3545), CVE-2016-1966, and CVE-2016-1963.

Changes:

Implemented the URL API that's needed for a number of websites.
Changed internal keystroke handling within the spec to better align with generally expected behavior.
This should fix the infamous "backpace" issue on Facebook.
Web developers please note: calling preventDefault() in a "keydown" event handler will now prevent most keypress events from firing.
Linux: gstreamer 1.0 support has been implemented and enabled by default (hats off to Travis!)
From this version forward you will need to have gstreamer 1.0 libraries for video playback (0.10 is no longer supported).
Re-styled about:sessionrestore to use more available screen real estate for tab info.
Added an option to use the mousewheel for horizontal scrolling (mouse action value 4).
(e.g. setting mousewheel.with_shift.action to 4 makes Shift+wheel scroll horizontally)
Bumped max icon size for search engine icons to 32 KB to cater to more common use of HiDPI icons.
Fixed some hard-coded branding strings in Sync still reading "Firefox", and similarly changed sync information URLs to point to our relevant pages.
Removed default profile bookmarks pointing to Firefox/Mozilla since the information there no longer applies to us.
Updated UA overrides and XSS configuration to deal with some problematic sites (e.g.: Google, Embedly)
Fixed several issues with the default theme causing problems with behavior due to styling (thanks, Antonius32) (Issue #384 and friends)
Fixed some miscellaneous issues in the internal jemalloc implementation.
Added a configure option to use the full jemalloc lib (jemalloc v3) if the builder so wishes (used for Linux, sys mallocs are not happy there either, so for our generic binaries we switched to this lib now)
Worked around a crash caused by the XSS filter on some fora by bailing on too short and empty strings.
Fixed layout of reflowed comboboxes without enough space.
Fixed a crash related to flexboxes overflowing themselves. (Issue #396)
Added a simple implementation for Weak Messagelisteners. (Issue #399)
Fixed a crash for losing our cache entry while finishing up compression.
(re-apply after unintentional back-out switching to Goanna)
Linux: Worked around driver bugs with Intel drivers that falsely report what they can support in max texture size.
Portable only: Removed compression of the browser components library after some reports that in certain configurations and environments it was causing issues with the browser.

Minimum system Requirements (Windows):

Windows Vista/Windows 7/Windows 8/Server 2008 or later
A processor with SSE2 support
256 MB of free RAM (512 MB or more recommended)
At least 150 MB of free (uncompressed) disk space

Pale Moon includes both 32- and 64-bit versions for Windows:

32x: Download the Pale Moon browser
64x: Pale Moon - x64 builds

Other versions:

PM4XP (Pale Moon for XP) has reached end of support and has been replaced with Pale Moon for Atom.
Linux version: Available from http://www.palemoon.org/contributed-builds.shtml

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window. Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...