Tuesday, July 10, 2018

Microsoft Security Bulletin Release for July, 2018

The July security release consists of 53 CVEs, of which 18 are listed as Critical and 33 are rated Important, 1 is rated as Moderate and 1 is rated as Low in severity.

The updates address Remote Code Execution, Security Feature Bypass, Elevation of Privilege, Denial of Service, Tampering, Information Disclosure, and Spoofing with known issues for 4338825 and 4338818.

The release consists of security updates for the following software:  Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office, Services and Web Apps, ChakraCore, Adobe Flash Player, .NET Framework, ASP.NET, Microsoft Research JavaScript Cryptography Library, Skype for Business and Microsoft Lync, Visual Studio, Microsoft Wireless Display Adapter V2 Software, PowerShell Editor Services, PowerShell Extension for Visual Studio Code, and Web Customizations for Active Directory Federation Services.

Recommended Reading: 

ven though on vacation, Dustin Childs dedicated time to provide a
closer look at some of the patches for this month in Zero Day Initiative — The July 2018 Security Update Review.  Although he indicated "
None of the bugs patched this month are listed as publicly known or under active attack at the time of release." his evaluation is definitely appreciated.

More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes

  • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
  • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
  • Windows 10 -- A summary of important product developments included in each update, with links to more details is available at Windows 10 Update History. The page will be regularly refreshed, as new updates are released.


Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Security Update Released

Adobe Flashplayer

Adobe has released Version of Adobe Flash Player.  In addition to functional issues, the update address critical vulnerabilities that could lead to remote code execution affecting version and earlier.

Release date:  July 10, 2018
Vulnerability identifier: APSB18-24
Platform:  Windows, Macintosh, Linux and Chrome OS

Vulnerability details

Vulnerability Category Vulnerability Impact Severity CVE Number
Out-of-bounds read  Information Disclosure Important CVE-2018-5008
Type Confusion Arbitrary Code Execution Critical CVE-2018-5007


*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

    Verify Installation

    To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

    Do this for each browser installed on your computer.

    To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.


    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...

    Adobe Reader and Acrobat Critical Security Updates


    Adobe has released security updates for Adobe Reader DC and Adobe Acrobat DC for Windows and Macintosh.  These updates are rated as critical and important.  Successful exploitation could lead to arbitrary code execution in the context of the current user.

    Release date:  July 10, 2018
    Vulnerability identifier: APSB18-21
    Platform: Windows and Macintosh

    Update or Complete Download

    Reader DC and Acrobat DC were updated to version 2018.011.20055. Update checks can be manually activated by choosing Help > Check for Updates. 
    Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.


    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...

    Thursday, July 05, 2018

    Mozillia Firefox Version 61.0.1 Released

    FirefoxMozilla sent Firefox Version 61.0.1 to the release channel today.  It does not appear that Firefox ESR has been updated.


    • Fixed broken website loading for Chinese users with accessibility enabled (Bug 1471824)
    • Fix missing content on the New Tab Page and the Home section of the Preferences page (Bug 1471375)
    • Fixed loss of bookmarks under rare circumstances when upgrading from Firefox 60 (Bug 1472127)
    • Improved playback of Twitch 1080p video streams (Bug 1469257)
    • Web pages no longer lose focus when a browser popup window is opened (Bug 1471415)
    • Fixed launching of downloads without a file extension on Windows (Bug 1465458)
    • Re-allowed downloading files from FTP sites via the "Save Link As" option when linked from HTTP pages (Bug 1470295)
    • Fixed extensions being unable to override the default homepage in certain situations (Bug 1466846)

    Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.


    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...

    Sunday, July 01, 2018

    Windows Insider MVP! #WIMVP

    What a nice way to start the day!

    Windows Insider MVP

    Dear Corrine:

    Congratulations! Thank you for your continued contributions to the Windows community, we are excited to re-award you as a Windows Insider MVP. This award is a token of our appreciation, your leadership and passion help make Windows the best yet. We look forward to our on-going collaboration with you and all of our Windows Insider MVPs as we continue to strengthen the Windows Insider MVP (WI MVP) Program.


    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...