Tuesday, December 11, 2018

Microsoft Security Updates for December 2018



The December security updates have been released and consist of 39 security patches and one advisory in which 9 are listed as Critical and 30 are rated Important in severity. One of these bugs is listed as publicly known at the time of release and one of these is reported as being actively exploited.

The updates address Remote Code Execution, Information Disclosure, Elevation of Privilege, Denial of Service and Spoofing and apply to the following: Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, .NET Framework, Microsoft Dynamics NAV, Microsoft Exchange Server, Microsoft Visual Studio and Windows Azure Pack (WAP).



Known Issues In the December Update:

Recommended Reading: 

Note:  See Dustin Childs review and analysis in
Zero Day Initiative — The December 2018 Security Update Review.
 
More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes

  • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
  • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].

References


Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...





Mozilla Firefox Version 64.0 Released With Security Updates


Firefox
Mozilla sent Firefox Version 64.0 to the release channel today.  Firefox ESR Version 60.4 has also been released.
The update included nine (9) security updates of which one is critical, five are high, two (2) moderate and one (1) is rated low.

Critical

High

Moderate


Low

New:

  • Better recommendations: You may see suggestions in regular browsing mode for new and relevant Firefox features, services, and extensions based on how you use the web (for US users only)
  • Enhanced tab management: You can now select multiple tabs from the tab bar and close, move, bookmark, or pin them quickly and easily
  • Easier performance management: The new Task Manager page found at about:performance lets you see how much energy each open tab consumes and provides access to close tabs to conserve power
  • Improved performance for Mac and Linux users, by enabling link time optimization (Clang LTO). (Clang LTO was enabled for Windows users in Firefox 63.)
  • More seamless sharing on Windows: Windows users can now share web pages using the native sharing experience. You can access Share in the Page Actions menu
  • Added option to remove add-ons using the context menu on their toolbar buttons
  • New for enterprise users: Updated the policy engine on macOS to allow using configuration profiles to customize Firefox for enterprise deployments

Changed:

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...

Adobe Acrobat DC and Reader DC Security Updates Released

Adobe

Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS to address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.  

Release date:  December 11, 2018
Vulnerability identifier: APSB18-41
Platform: Windows and MacOS

Update or Complete Download

Reader DC and Acrobat DC were updated to version 2019.010.20064. Update checks can be manually activated by choosing Help & Check for Updates. 
Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.


References





Home
Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...



Thursday, December 06, 2018

Pale Moon Version 28.2.2 Released


Pale Moon
Pale Moon has been updated to version 28.2.2 to address a critical usability issue in the history and bookmarks window. The Linux versions will follow.

From the Release Notes:

Changes/fixes:

  • Changed the about:feeds icon for external applications to a generic icon, since that kind of access to executables is no longer allowed for security reasons.
  • Fixed issues with copying/pasting bookmarks in the Library View.
  • Fixed a crash occurring when using HTTP pipelining over some (broken) proxies.
  • Fixed several issues with animated WebP display (animations stopping, corrupted frames on lossy images, etc.)
  • Fixed an issue with the display of truncated GIF images.
  • Fixed an issue with deleting recent history not working properly.
  • Fixed incorrect duplicate compatibility mode preferences in about:config.
Download:

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...



Wednesday, December 05, 2018

Adobe Flash Player Critical Security Update Released


Adobe Flashplayer

Adobe has released Version 32.0.0.101 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. one critical vulnerability in Adobe Flash Player and one important vulnerability in Adobe Flash Player installer. Successful exploitation could lead to Arbitrary Code Execution and privilege escalation in the context of the current user respectively. 

Adobe is aware of reports that an exploit for CVE-2018-15982 exists in the wild.

Release date:  December 5, 2018
Vulnerability identifier: APSB18-42
Platform:  Windows, Macintosh, Linux and Chrome OS

Vulnerability details

Vulnerability Category Vulnerability Impact Severity CVE Number
Use after free Arbitrary Code Execution Critical CVE-2018-15982 
Insecure Library Loading (DLL hijacking) Privilege Escalation Important CVE-2018-15983

Fixed Issues

Flash Player
  • Assorted security and functional fixes

Update:

*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

    Verify Installation

    To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

    Do this for each browser installed on your computer.

    To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

    References



    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...









    Tuesday, November 27, 2018

    Windows 10 and Windows 7 Cumulative Updates Released


    Microsoft has released cumulative updates with non-security improvements and fixes for Windows 10 versions 1803 and 1709 as well as for Windows 7.  The update for both versions 1803 and 1709 and Windows 7 (Preview of Monthly Rollup) includes quality improvements with no new operating system features introduced.

    The updates are available from Windows Update or the Microsoft Update Catalog.  See the referenced links below for the changes.  
    Note:  Among other Known Issues, please note the following which applies to all systems:
    "After installing this update, users may not be able to use the Seek Bar in Windows Media Player when playing specific files."
    Microsoft is working on a resolution for the Seek Bar issue and will provide an update in an upcoming release.




    Home
    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...

    Tuesday, November 20, 2018

    Adobe Flash Player Critical Security Update Released


    Adobe Flashplayer

    Adobe has released Version 31.0.0.153 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. These updates address a critical vulnerability in Adobe Flash Player 31.0.0.148 and earlier versions.  Successful exploitation could lead to arbitrary code execution in the context of the current user.
    Technical details about this vulnerability are publicly available. 

    Release date:  November 20, 2018
    Vulnerability identifier: APSB18-44
    Platform:  Windows, Macintosh, Linux and Chrome OS

    Vulnerability details

    Vulnerability Category Vulnerability Impact Severity CVE Number
    Type Confusion Arbitrary code execution Critical CVE-2018-15981


    Update:
    *Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

      Verify Installation

      To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

      Do this for each browser installed on your computer.

      To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

      References



      Remember - "A day without laughter is a day wasted."
      May the wind sing to you and the sun rise in your heart...









      Friday, November 16, 2018

      Pale Moon Version 28.2.1 Released


      Pale Moon
      Pale Moon has been updated to version 28.2.1.

      The purpose of the update is to address a critical usability issue in the history and bookmarks window.

      The Linux versions will follow.

      Download:

      Update

      To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.




      Remember - "A day without laughter is a day wasted."
      May the wind sing to you and the sun rise in your heart...



      Thursday, November 15, 2018

      Mozilla Firefox Version 63.0.3 Released


      FirefoxMozilla sent Firefox Version 63.0.3 to the release channel today, apparently skipping over releasing version  63.0.2.  There is no indication of any security updates or updates for Firefox ESR which remains at version 60.3.0.

      Fixed

      • Games using WebGL (created in Unity) get stucks after very short time of gameplay (bug 1502748)
      • Slow page loading for some users with specific proxy configurations (bug 1495024)
      • Disable HTTP response throttling by default for causing bugs with videos in background tabs (bug 1503354)
      • Opening magnet links no longer works (bug 1498934)
      • Crash fixes (bug 1498510, bug 1503424)


      Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

      References




      Remember - "A day without laughter is a day wasted."
      May the wind sing to you and the sun rise in your heart...

      Tuesday, November 13, 2018

      Microsoft Security Updates for November 2018



      The November security updates have been released and consists of security updates for the following:  Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, .NET Core, Skype for Business, Azure App Service on Azure Stack, Team Foundation Server and Microsoft Dynamics 365 (on-premises) version 8.

      The updates address Remote Code Execution, Defense in Depth, Information Disclosure, Tampering, Security Feature Bypass, Elevation of Privilege, Denial of Service and Spoofing.

      Important Note:  Windows 10 Version 1809 has been re-released:
      "While the April Update had the fastest Windows 10 update rollout velocity, we are taking a more measured approach with the October Update, slowing our rollout to more carefully study device health data. We will offer the October Update to users via Windows Update when data shows your device is ready and you will have a great experience. If we detect that your device may have an issue, such as an application incompatibility, we will not install the update until that issue is resolved, even if you “Check for updates,” so you avoid encountering any known problems. For those advanced users seeking to install the update early by manually using “Check for updates” in settings, know that we are slowly throttling up this availability, while we carefully monitor data and feedback."
      More at the Windows Experience Blog at Resuming the rollout of the Windows 10 October 2018 Update.


      Known Issues In the November Update:
            Recommended Reading: 

            Note:  Since Dustin Childs is in Tokyo for PawnToOwn, his  review and recommendations
            in  Zero Day Initiative will be delayed due to the time difference.  An update will be provided following his review.
              Update with Dustin Child's analysisZero Day Initiative — The November 2018 Security Update Review.
             
            More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

            Additional Update Notes

            • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
            • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].

            References


            Remember - "A day without laughter is a day wasted."
            May the wind sing to you and the sun rise in your heart...





            Adobe Flash Player Security Updates Released


            Adobe Flashplayer

            Adobe has released Version 31.0.0.148 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. These updates address an important vulnerability in Adobe Flash Player 31.0.0.122 and earlier versions.  Successful exploitation could lead to information disclosure.

            Release date:  November 13, 2018
            Vulnerability identifier: APSB18-39
            Platform:  Windows, Macintosh, Linux and Chrome OS

            Fixed Issues

            Flash Player
            • IE quits unexpectedly on opening multiple tabs with Flash Content (FP-4198903)
            • Assorted security and functional fixes

            Vulnerability details

            Vulnerability Category Vulnerability Impact Severity CVE Number
            Out-of-bounds Read Information Disclosure Important CVE-2018-15978

            Update:

            *Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

              Verify Installation

              To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

              Do this for each browser installed on your computer.

              To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

              References



              Remember - "A day without laughter is a day wasted."
              May the wind sing to you and the sun rise in your heart...









              Adobe Acrobat DC and Reader DC Security Updates Released

              Adobe

              Adobe has released security updates for Adobe Acrobat and Reader for Windows to resolve an important vulnerability.  Successful exploitation could lead to an inadvertent leak of the user’s hashed NTLM password.  Proof-of-concept code for CVE-2018-15979 is publicly available. 


              Release date:  November 13, 2018
              Vulnerability identifier: APSB18-40
              Platform: Windows

              Update or Complete Download

              Reader DC and Acrobat DC were updated to version 2019.008.20081. Update checks can be manually activated by choosing Help & Check for Updates. 
              Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.


              References





              Home
              Remember - "A day without laughter is a day wasted."
              May the wind sing to you and the sun rise in your heart...