Microsoft Cumulative Updates Released for Windows 10

Microsoft has released cumulative updates with non-security improvements and fixes for Windows 10 April 2018 Update (version 1803) and Windows 10 Fall Creators Update (version 1709).

• Version 1803:  KB4346783
• Version 1709:  KB4343893)

The updates are available from Windows Update or the Microsoft Update Catalog.

Note that there is a known issue for both versions if you use Microsoft Edge using the New Application Guard Window.  If you’ve experienced the issue and already installed the update, there is a work-around for Version 1803 in the referenced KB article.  For Version 1709, Microsoft is working on a resolution and will provide an update in an upcoming release for that as well as an  additional known issue that affects some non-English platforms. 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.0.1 Released

Pale Moon version 28.0.1 has been released.  This is a bugfix point release to address serious performance bottlenecks and general run-time issues, particularly impacting 32-bit operating systems.

From the Release Notes:

Changes/fixes:

• Backed out a Mozilla upstream patch causing issues with IPC and texture allocation for the compositor.
• Backed out a Mozilla upstream patch causing issues with Javascript memory buffer allocation.

Linux versions will follow shortly.

Download:

• Pale Moon for Windows
• Pale Moon for Linux

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.0.0.1 Released

Pale Moon version 28.0.0.1 has been released. 

From the Release Notes:

"This is a Windows-only update to address some stability/performance issues that have popped up with the new milestone release on especially 32-bit systems.

The cause seems to be a compiler bug in Visual Studio 2015 with certain optimizations. Although 64-bit does not seem to be directly affected, we are still applying more cautious optimizations there too from this point forward until we can figure out exactly what the cause is and which (more aggressive) optimizations are safe to use."

 Minimum system Requirements (Windows):

• Windows 7/8/10/Server 2008 R2 or later
• A processor with SSE2 instruction support
• 1 GB of RAM
• At least 200 MB of free (uncompressed) disk space

Download:

• Pale Moon for Windows
• Pale Moon for Linux

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.0.0 Released

Pale Moon version 28.0.0 has been released.  This release is a new major milestone in Pale Moon's release history.

From the Release Notes, the most pertinent changes since the release of version 27.0.0:

• SpiderMonkey update: The JavaScript engine has received a major upgrade and now supports all landmark features from the ECMAScript standards as carried by mainstream browsers. This should put an end to the increasing JavaScript issues we've seen due to web frameworks not being browser-agnostic in that respect, or the browser not supporting what websites expect.
• Goanna update: The layout and rendering engine (Goanna) has been updated to its 4th generation (version 4.*) which brings with it improved compatibility with "trendy" CSS styling techniques that build on a few very specific features (e.g. CSS Grid). Goanna continues to build on tried-and-tested software fallbacks in case hardware acceleration can't be used, and Linux remote desktop users can continue to leverage xrender for speedy remote screen updates in Pale Moon.
• DOM enhancements: Enhancements in the Document Object Model provides websites with updated APIs to perform their tasks. (e.g. Fetch, WebAnimations, WebCrypto, HTML Input Element Extensions, etc.)
• Media enhancements: Our media back-end update is, for all intents and purposes, complete. MSE media streaming (for MP4) should be compatible with all major players on the market now. MSE for WebM is still disabled by default due to some compatibility issues that need to be examined, but you may enable this in preferences to e.g. allow 4k video playback on some sites that only offer UHD in WebM format. We now also support playback of FLAC-encoded audio.
  
• New: WebGL2 support! Pale Moon now supports the WebGL2 standard for enhanced graphical experiences in 2D and 3D.
• Devtools have been given a refresh. Just in case you thought they weren't extensive enough yet, some new categories have been added to inspect and manipulate all aspects of web content.
• Updates to the login manager: Login credentials can now be stored specifically with or without a user name, and selected individually. This is a behavior change from previous, and clicking a password field can now pop-up a selection list of user names for which passwords are stored (if multiple credentials are saved). Clicking the appropriate login name (or date-stamped version if no name is present) will fill in the accompanying password.

Also note what has not changed:

• We continue to support NPAPI plugins.
• We continue to support complete themes as well as lightweight themes.
• We continue to offer a fully customizable interface like before. Australis (like seen in Basilisk) is not used.
  
• We continue to support XUL overlay, bootstrapped and (deprecated) Jetpack extensions (collectively called "legacy extensions" by Mozilla).

 Minimum system Requirements (Windows):

• Windows 7/8/10/Server 2008 R2 or later
• A processor with SSE2 instruction support
• 1 GB of RAM
• At least 200 MB of free (uncompressed) disk space

Download:

• Pale Moon for Windows
• Pale Moon for Linux

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Bulletin Release for August, 2018

The August security release consists of 60 CVEs, of which 19 are listed as Critical and 39 are rated Important, 1 is rated as Moderate and 1 is rated as Low in severity.  In particular, note that CVE-2018-8373, Internet Explorer Memory Corruption Vulnerability and CVE-2018-8414, Windows Shell Remote Code Execution Vulnerability are listed as publicly known and exploited.

The release consists of security updates for the following: Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, Adobe Flash Player, .NET Framework, Microsoft Exchange Server, Microsoft SQL Server and Visual Studio.

The updates address Remote Code Execution, Elevation of Privilege, Security Feature Bypass, Information Disclosure, Defense in Depth, Tampering and Spoofing.

Recommended Reading: 

See Dustin Childs excellent review and recommendations in Zero Day Initiative — The August 2018 Security Update Review.  

More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes

• Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
• MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].

References

• Release Notes
• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Security Update Released

Adobe has released Version 30.0.0.154 of Adobe Flash Player.  The update addresses both security and functional issues.  Successful exploitation could lead to arbitrary code execution in the context of the current user.

Release date:  August 14, 2018
Vulnerability identifier: APSB18-25
Platform:  Windows, Macintosh, Linux and Chrome OS
 

Vulnerability details

Vulnerability Category	Vulnerability Impact	Severity	CVE Number
Out-of-bounds read	Information Disclosure	Important	CVE-2018-12824
Security Feature bypass	Information Disclosure	Important	CVE-2018-12825
Out-of-bounds read	Information Disclosure	Important	CVE-2018-12826
Out-of-bounds read	Information Disclosure	Important	CVE-2018-12827
Privilege Escalation	Remote Code Execution	Important	CVE-2018-12828

Update:

• With the option to 'Allow Adobe to install updates', the update will be automatic. Without that setting enabled, either install the update via the update mechanism when prompted or via the Download Center*.
• Windows 7 and earlier:  Installation links for Windows 7 and earlier are provided by Adobe at Installation problems | Flash Player | Windows 7 and earlier: 
• Flash Player for Internet Explorer - ActiveX 
• Flash Player for Firefox/Pale Moon - NPAPI
• Flash Player for Opera and Chromium-based browsers - PPAPI
• Microsoft Edge and Internet Explorer 11:  Adobe Flash Player will be automatically updated to the latest version for Windows 8.1 and 10.
• Google Chrome:  Adobe Flash Player will be automatically updated to the latest Google Chrome version.
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  Adobe - Adobe AIR

*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Installing and Updating Flash Player - FAQ
• Release Notes:  Flash Player® 30 AIR® 30
• Security Bulletin
• PSIRT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Acrobat DC and Reader DC Critical Security Updates Released

Adobe has released security updates for Adobe Reader DC and Adobe Acrobat DC for Windows and Macintosh.  These updates are rated as critical and important.  Successful exploitation could lead to arbitrary code execution in the context of the current user.

Release date:  August 14, 2018
Vulnerability identifier: APSB18-29
Platform: Windows and Macintosh

Update or Complete Download

Reader DC and Acrobat DC were updated to version 2018.011.20058. Update checks can be manually activated by choosing Help > Check for Updates. 

• Reader DC and other versions are available here:  https://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows 
• Acrobat DC for Windows is available here:  http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows  

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 61.0.2 Released

Mozilla sent Firefox Version 61.0.2 to the release channel today.  At the time of this posting, it does not appear that Firefox ESR has been updated or that it includes any security updates.

New

• Adds support for automatically restoring your Firefox session after Windows restarts. Currently, this feature is not enabled by default for most users, but will be gradually enabled over the coming weeks.

Fixed

• Improved website rendering with the Retained Display List feature enabled (Bug 1474402)
• Fixed broken DevTools panels with certain extensions installed (Bug 1474379)
• Fixed a crash for users with some accessibility tools enabled (Bug 1474007)

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...