Out-of-Band Security Update for Internet Explorer

Microsoft released an out-of-band security update for Internet Explorer 11 on Windows 10, Internet Explorer 11 on Windows 8.1 Update, Internet Explorer 11 on Windows 7 SP1, Internet Explorer 10 on Windows Server 2012, Internet Explorer 9, Windows Embedded Standard 2009 and Windows Embedded POSReady 2009.

The update addresses  remote code execution vulnerability CVE-2018-8653 that exists in the way that the scripting engine handles objects in memory in Internet Explorer.

It is strongly advised that this update be installed as soon as possible. (Note: For Windows RT and Windows RT 8.1, this update is available through Microsoft Update only.)

 
More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

References

• CVE-2018-8653
• Security Advisory
• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Updates for December 2018

The December security updates have been released and consist of 39 security patches and one advisory in which 9 are listed as Critical and 30 are rated Important in severity. One of these bugs is listed as publicly known at the time of release and one of these is reported as being actively exploited.

The updates address Remote Code Execution, Information Disclosure, Elevation of Privilege, Denial of Service and Spoofing and apply to the following: Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, .NET Framework, Microsoft Dynamics NAV, Microsoft Exchange Server, Microsoft Visual Studio and Windows Azure Pack (WAP).

Known Issues In the December Update:

• 4471321
• 4471327
• 4471329
• 4471324
• 4471318

Recommended Reading: 

Note:  See Dustin Childs review and analysis in Zero Day Initiative — The December 2018 Security Update Review.
 
More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes

• Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
• MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].

References

• Release Notes
• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 64.0 Released With Security Updates

Mozilla sent Firefox Version 64.0 to the release channel today.  Firefox ESR Version 60.4 has also been released.
The update included nine (9) security updates of which one is critical, five are high, two (2) moderate and one (1) is rated low.

Critical

·        #CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 

High

·        #CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module

·        #CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11

·        #CVE-2018-18492: Use-after-free with select element

·        #CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia

·        #CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin U

Moderate

·        #CVE-2018-18495: WebExtension content scripts can be loaded in about: pages

·        #CVE-2018-18496: Embedded feed preview page can be abused for clickjacking

Low

·        #CVE-2018-12406: Memory safety bugs fixed in Firefox 64

New:

• Better recommendations: You may see suggestions in regular browsing mode for new and relevant Firefox features, services, and extensions based on how you use the web (for US users only)
• Enhanced tab management: You can now select multiple tabs from the tab bar and close, move, bookmark, or pin them quickly and easily
• Easier performance management: The new Task Manager page found at about:performance lets you see how much energy each open tab consumes and provides access to close tabs to conserve power
• Improved performance for Mac and Linux users, by enabling link time optimization (Clang LTO). (Clang LTO was enabled for Windows users in Firefox 63.)
• More seamless sharing on Windows: Windows users can now share web pages using the native sharing experience. You can access Share in the Page Actions menu
• Added option to remove add-ons using the context menu on their toolbar buttons
• New for enterprise users: Updated the policy engine on macOS to allow using configuration profiles to customize Firefox for enterprise deployments

Changed:

• RSS feed preview and live bookmarks are available only via add-ons
• TLS certificates issued by Symantec are no longer trusted by Firefox. Website operators are strongly encouraged to replace any remaining Symantec TLS certificates as soon as possible.
• about:crashes has been redesigned to make it clear when a crash is being submitted to Mozilla, as well as being clear that removing crashes locally does not remove them from crash-stats.mozilla.com
• The macOS keyboard shortcut to add "www" and ".com" to a URL is now ctrl-enter instead of [apple]-enter

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...

Adobe Acrobat DC and Reader DC Security Updates Released

Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS to address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.  

Release date:  December 11, 2018
Vulnerability identifier: APSB18-41
Platform: Windows and MacOS

Update or Complete Download

Reader DC and Acrobat DC were updated to version 2019.010.20064. Update checks can be manually activated by choosing Help & Check for Updates. 

• Reader DC and other versions are available here:  https://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
  
• Acrobat DC for Windows is available here:  http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.2.2 Released

Pale Moon has been updated to version 28.2.2 to address a critical usability issue in the history and bookmarks window. The Linux versions will follow.

From the Release Notes:

Changes/fixes:

• Changed the about:feeds icon for external applications to a generic icon, since that kind of access to executables is no longer allowed for security reasons.
• Fixed issues with copying/pasting bookmarks in the Library View.
• Fixed a crash occurring when using HTTP pipelining over some (broken) proxies.
• Fixed several issues with animated WebP display (animations stopping, corrupted frames on lossy images, etc.)
• Fixed an issue with the display of truncated GIF images.
• Fixed an issue with deleting recent history not working properly.
• Fixed incorrect duplicate compatibility mode preferences in about:config.

Download:

• Pale Moon for Windows
• Pale Moon for Linux

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Critical Security Update Released

Adobe has released Version 32.0.0.101 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. one critical vulnerability in Adobe Flash Player and one important vulnerability in Adobe Flash Player installer. Successful exploitation could lead to Arbitrary Code Execution and privilege escalation in the context of the current user respectively. 

Adobe is aware of reports that an exploit for CVE-2018-15982 exists in the wild.

Release date:  December 5, 2018
Vulnerability identifier: APSB18-42
Platform:  Windows, Macintosh, Linux and Chrome OS

Vulnerability details

Vulnerability Category	Vulnerability Impact	Severity	CVE Number
Use after free	Arbitrary Code Execution	Critical	CVE-2018-15982
Insecure Library Loading (DLL hijacking)	Privilege Escalation	Important	CVE-2018-15983

Fixed Issues

Flash Player

• Assorted security and functional fixes

Update:

• With the option to 'Allow Adobe to install updates', the update will be automatic. Without that setting enabled, either install the update via the update mechanism when prompted or via the Download Center*.
• Windows 7 and earlier:  Installation links for Windows 7 and earlier are provided by Adobe at Installation problems | Flash Player | Windows 7 and earlier: 
• Flash Player for Internet Explorer - ActiveX 
• Flash Player for Firefox/Pale Moon - NPAPI
• Flash Player for Opera and Chromium-based browsers - PPAPI
• Microsoft Edge and Internet Explorer 11:  Adobe Flash Player will be automatically updated to the latest version for Windows 8.1 and 10.
• Google Chrome:  Adobe Flash Player will be automatically updated to the latest Google Chrome version.
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  Adobe - Adobe AIR

*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Installing and Updating Flash Player - FAQ
• Release Notes:  Flash Player® 32 AIR® 32
• Security Bulletin
• PSIRT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...