Tuesday, April 16, 2019

Oracle Java Critical Security Updates Released

java

Oracle released the scheduled critical security updates for its Java SE Runtime Environment software.  This Critical Patch Update contains 5 new security fixes for Oracle Java SE.  All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. 

Update

If Java is still installed on your computer, it is recommended that this update be applied as soon as possible due to the threat posed by a successful attack.

Download Information

Java SE 8u201 or 8u202
Java SE 11.0.2  (x64-bit only) 

Note:  JDK only.

Notes:
  • UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.  Preferably, see the instructions below on how to handle "Unwanted Extras".  
  • Oracle does not plan to migrate desktops from Java 8 to Java 9 through the auto update feature.  Therefore, it is strongly recommended that you uninstall JRE 8 prior to updating.
  • Verify your versionhttp://www.java.com/en/download/testjava.jsp.   Note:  The Java version verification page will only work if your browser has NPAPI support.  In that case, to check the version, open a cmd window and enter the following (note the space following Java):  java -version

Critical Patch Updates

For Oracle Java SE Critical Patch Updates, the next scheduled dates are as follows:
  • 16 April 2019
  • 16 July 2019
  • 15 October 2019
  • 14 January 2020

Unwanted "Extras"

Although most people do not need Java on their computer, there are some programs and games that require Java.  In the event you need to continue using Java, How-to Geek discovered a little-known and  unpublicized option in the Java Control Panel to suppress the offers for the pre-checked unwanted extras that Oracle has long included with the updates.  Although the Ask Toolbar has been removed, tha does not preclude the pre-checked option for some other unnecessary add-on.

Do the following to suppress the sponsor offers:
  1. Launch the Windows Start menu
  2. Click on Programs
  3. Find the Java program listing
  4. Click Configure Java to launch the Java Control Panel
  5. Click the Advanced tab and go to the "Miscellaneous" section at the bottom.
  6. Check the box by the “Suppress sponsor offers when installing or updating Java” option and click OK.
Java suppress sponsor offers

Java Security Recommendations

1)  In the Java Control Panel, at minimum, set the security to high.
2)  Keep Java disabled until needed.  Uncheck the box "Enable Java content in the browser" in the Java Control Panel.
3)  Instructions on removing older (and less secure) versions of Java can be found at http://java.com/en/download/faq/remove_olderversions.xml

References




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...




Wednesday, April 10, 2019

Mozilla Firefox Version 66.0.3 Released


Firefox Mozilla sent Firefox Version 66.0.3 to the release channel today.  The update addresses several bug fixes.  Firefox ESR remains unchanged.

    Fixed

    • Address bar on tablets running Windows 10 now behaves correctly (Bug 1498973)
    • Performance issues with some HTML5 games (Bug 1537609)
    • Fixed a bug with keypress events in IBM cloud applications (Bug 1538970)
    • Fix for keypress events in some Microsoft cloud applications (Bug 1539618)

    Changed

    • Updated Baidu search plugin


      Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

      References


      Remember - "A day without laughter is a day wasted."
      May the wind sing to you and the sun rise in your heart...

      Tuesday, April 09, 2019

      Microsoft April 2019 Security Updates



      The April security updates have been released and consist of 74 CVE's and one security advisory (for Adobe Flash Player) in which 13 are rated Critical and 61 are rated Important. None are listed as publicly known but two are listed as being under active attack at the time of release.

      In addition to a Servicing Stack Update (See the "Additional Update Notes" below for more information.), the updates apply to the following:  Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows,  Microsoft Office and Microsoft Office SharePoint, ChakraCore, ASP.NET, Microsoft Exchange Server, Team Foundation Server, Azure DevOps Server, Open Enclave SDK, and Windows Admin Center.

      ImportantWindows 10, version 1709, reached end of service today, April 9, 2019, for devices running Windows 10 Home, Pro, Pro for Workstation, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, updating to the latest version of Windows 10 is strongly recommended.  Note, however, that Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.


      Known Issues In the April Security Update:

      KB Article Applies To
      4487563 Microsoft Exchange Server 2019, 2016, and 2013
      4491413 Update Rollup 27 for Exchange Server 2010 Service Pack 3
      4493441 Windows 10 version 1709, Windows Server Version 1709
      4493446 Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
      4493448 Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Security-only update)
      4493450 Windows Server 2012 (Security-only Rollup)
      4493451 Windows Server 2012 (Monthly Rollup)
      4493458 Windows Server 2008 Service Pack 2 (Security-only update)
      4493464 Windows 10 version 1803, Windows Server Version 1803
      4493467 Windows 8.1, Windows Server 2012 R2 (Security-only update)
      4493470 Windows 10 version 1607, Windows Server 2016
      4493471 Windows Server 2008 Service Pack 2 (Monthly Rollup)
      4493472 Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Monthly Rollup)
      4493474 Windows 10 version 1703
      4493509 Windows 10 version 1809, Windows Server 2019
      4493730 Windows Server 2008 SP2
      4493435 Internet Explorer Cumulative Update

      Recommended Reading:  

      See Dustin Childs review and analysis in Zero Day Initiative — The April 2019 Security Update Review.

      For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

      Additional Update Notes:

      • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
      • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
      • Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. 
      • Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog.
      • Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update.
      • For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.

      References


      Remember - "A day without laughter is a day wasted."
      May the wind sing to you and the sun rise in your heart...





      Adobe Flash Player and AIR Critical Security Update Released


      Adobe Flashplayer

      Adobe has released Version 32.0.0.171 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. These updates address important bug and security fixes.  

      Release date:  APRIL 9, 2019
      Vulnerability identifier: APSB19-19
      Platform:  Windows, Macintosh, Linux and Chrome OS

      Update:

      *Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

        Verify Installation

        To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

        Do this for each browser installed on your computer.

        To verify the version of Adobe Flash Player for Android, go to Settings/Applications/Manage Applications/Adobe Flash Player x.x.

        References



        Remember - "A day without laughter is a day wasted."
        May the wind sing to you and the sun rise in your heart...









        Adobe Acrobat DC and Reader DC Critical Security Update Released

        Adobe
        Adobe has released critical security updates for Adobe Acrobat and Reader for Windows and macOS. Successful exploitation could lead to arbitrary code execution in the context of the current user.  

        Release date:  April 9, 2019
        Vulnerability identifier: APSB19-17
        Platform: Windows and MacOS

        Update or Complete Download

        Reader DC and Acrobat DC were updated to version 2019.010.20099. Update checks can be manually activated by choosing Help/Check for Updates. 
        Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.


        References





        Home
        Remember - "A day without laughter is a day wasted."
        May the wind sing to you and the sun rise in your heart...



        Thursday, April 04, 2019

        Windows 10 Update Changes and Improvements

        Windows Update


        Microsoft announced major changes in the Windows 10 Update process today.  The changes are included in Windows 10 Version 1903, currently being tested by Windows Insiders and planned for release in late May.

        Windows 10 Home users who have complained about lack of control for Windows Updates are going to be particularly happy with the changes.

        Following is a brief synopsis of the changes. 

        • Feature Updates --"Download and install now" is being added to Windows Update options.  As long as your device has no known blocking issues, selecting that option will allow users to get the latest version without having to wait for it to be offered.  This change is expected to available in Windows 10 versions 1803 and 1809 by late May.
        • Pause Updates -- Windows 10 Home Users will be able to pause updates up to 35 days.  This can be done in 7-day increments up to five times.  This applies to both feature and monthly updates.
        • Intelligent Active Hours -- A new option will be available to let Windows Update intelligently adjust active hours based on device-specific usage patterns.
        • Update Coordination -- Referred to as "improved update orchestration", the concept is to improve system performance by coordinating both Windows Updates and Microsoft Store updates when users are away from their devices.

        Information about "Expanded focus on quality" including early detection of low-volume, high-severity issues, a "New public dashboard for increased issue transparency" on the Windows 10 Update History page, and more is available in the complete announcement on the Windows Experience Blog at Improving the Windows 10 update experience with control, quality and transparency.




        Home
        Remember - "A day without laughter is a day wasted."
        May the wind sing to you and the sun rise in your heart...

        Tuesday, April 02, 2019

        Windows 10 Version 1809 Cumulative Update Released


        Microsoft has released a cumulative update with non-security improvements and fixes for Windows 10 version 1809.  This update includes a long list of improvements and fixes with no new operating system features introduced.

        See KB4490481 for the list of improvements and fixes as well as the various know issues and accompanying workarounds.

        If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.  The update is available from Windows Update or the Microsoft Update Catalog

        Note:
        Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU.  If you are using Windows Update, the latest SSU (KB4470788) will be offered to you automatically. To get the stand-alone package for the latest SSU, go to the Microsoft Update Catalog.


        Home
        Remember - "A day without laughter is a day wasted."
        May the wind sing to you and the sun rise in your heart...

        Wednesday, March 27, 2019

        Mozilla Firefox Version 66.0.2 Released


        Firefox Mozilla sent Firefox Version 66.0.2 to the release channel today.  The update addresses several bugs.

        Fixed

        • Fixed Web compatibility issues with Office 365, iCloud and IBM WebMail caused by recent changes to the handling of keyboard events (Bug 1538966)
        • Crash fixes (bug 1521370, bug 1539118)


        Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

        References


        Remember - "A day without laughter is a day wasted."
        May the wind sing to you and the sun rise in your heart...

        Pale Moon Version 28.4.1 Released


        Pale Moon
        Pale Moon has been updated to version 28.4.1.  This is a security and bugfix update.  The Linux version will follow later today.

        A fix identified as "DiD" ("Defense-in-Depth") means that it is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered. 

        From the Release Notes:

        Changes/fixes:

        • Fixed hover state arrows on some controls.
        • Fixed potential denial-of-service issues involving FTP (loading of subresources and spamming errors).
        • Disabled Microsoft Family Safety (Win 8.1) by default. This prevents security issues as a result of a local MitM setup.
        • Added several site-specific overrides (Firefox Send and polyfill.io) to work around website UA-sniffing isues.
        • Implemented the origin-clean algorithm for controlling access to image resources.
        • Cleaned up the helper application service code.
        • Ported applicable security fixes from Mozilla (CVE-2019-9791, CVE-2019-9792, CVE-2019-9796, CVE-2019-9801, CVE-2019-9793, CVE-2019-9794, CVE-2019-9808 and ZDI-CAN-8368).
        • Implemented several defense-in-depth measures (for CVE-2019-9790, CVE-2019-9797, CVE-2019-9804, and a JavaScript issue).
        • Fixed several memory safety hazards and crashes.
        • Binaries are now code-signed again (including the setup program for the installer).
           Download:

          Update

          To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.




          Remember - "A day without laughter is a day wasted."
          May the wind sing to you and the sun rise in your heart...



          Friday, March 22, 2019

          Mozilla Firefox Version 66.0.1 Released With Critical Security Updates


          Firefox Mozilla sent Firefox Version 66.0.1 to the release channel today.  The update addresses two (2) CVE's rated critical, Firefox ESR has been updated to Version 60.6.1.

          The critical flaws were disclosed in the Zero Day Initiative #Pawn2Own event in Vancouver.

          Critical


          Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

          References


          Remember - "A day without laughter is a day wasted."
          May the wind sing to you and the sun rise in your heart...

          Tuesday, March 19, 2019

          Mozilla Firefox Version 66.0 Released With Critical Security Updates


          Firefox Mozilla sent Firefox Version 66.0 to the release channel today.  The update addresses 21 CVE's of which five (5) are rated critical, seven (7) high, five (5) moderate and four (4) low in severity.

          Firefox ESR has been updated to Version 60.6.

          Critical

          High

          Moderate

          Low

          New

              Fixed

              • The Dark and Light Firefox themes now override the system setting for title bar accent color on Windows 10
              • Linux users: Resolved an issue that caused Firefox to freeze when downloading files
              Changed
              • System title bar is hidden by default to match Gnome guideline for Linux users

              Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

              References


              Remember - "A day without laughter is a day wasted."
              May the wind sing to you and the sun rise in your heart...

              Wednesday, March 13, 2019

              Adobe Flash Player Update


              Adobe Flashplayer

              Adobe has released Version 32.0.0.156 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. These updates address feature and performance bugs, and do not include security fixes.   

              Release date:  March 12, 2019
              Vulnerability identifier: APSB19-12
              Platform:  Windows, Macintosh, Linux and Chrome OS

              Update:

              *Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

                Verify Installation

                To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

                Do this for each browser installed on your computer.

                To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

                References



                Remember - "A day without laughter is a day wasted."
                May the wind sing to you and the sun rise in your heart...









                Tuesday, March 12, 2019

                Microsoft March, 2019 Security Updates



                The March security updates have been released and consist of 64 CVE's and four security advisories in which 17 are rated Critical, 45 are rated Important, 1 is rated Moderate and 1 low in severity. Four are listed as publicly known and two are listed as being under active attack at the time of release.

                In addition to a Servicing Stack Update (See the "Additional Update Notes" below for more information.), the updates apply to the following:  Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows,  Microsoft Office and Microsoft Office SharePoint, ChakraCore, Team Foundation Server, Skype for Business, Visual Studio, and NuGet.

                ImportantWindows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstation, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, updating to the latest version of Windows 10 is strongly recommended.  Note, however, that Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.

                Known Issues In the March Update:

                KB Article
                Applies To
                4489878 Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Monthly Rollup)
                4489881 Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
                4489882 Windows 10 version 1607, Windows Server 2016
                4489883 Windows 8.1, Windows Server 2012 R2 (Security-only update)
                4489884 Windows Server 2012 (Security-only update)
                4489885 Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Security-only update)
                4489891 Windows Server 2012 (Monthly Rollup)
                4489899 Windows 10 version 1809, Windows Server 2019

                Recommended Reading:  

                See Dustin Childs review and analysis in Zero Day Initiative — The March 2019 Security Update Review.

                For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

                Additional Update Notes:

                • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
                • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
                • Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. 
                • Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog.
                • Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update.
                • For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.

                References


                Remember - "A day without laughter is a day wasted."
                May the wind sing to you and the sun rise in your heart...





                Friday, March 01, 2019

                Microsoft Cummulative Update Released for Windows 10 Version 1809


                Microsoft has released a cumulative update with non-security improvements and fixes for Windows 10 version 1809.  This update includes quality improvements with no new operating system features introduced. 

                The update is available from Windows Update or the Microsoft Update Catalog.  See KB4482887 for the list of improvements and fixes.

                Known Issues in this Update

                Symptom Workaround
                After installing this update, Internet Explorer 11 may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                • Cache size and location show zero or empty.
                • Keyboard shortcuts may not work properly.
                • Webpages may intermittently fail to load or render correctly.
                • Issues with credential prompts.
                • Issues when downloading files.
                Create unique user accounts so that two people don’t share the same user account when logging on to a Windows Server machine. Additionally, disable multiple RDP sessions for a single user account for a specific Windows Server.
                Microsoft is working on a resolution and will provide an update in an upcoming release.

                Note:
                Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU.  If you are using Windows Update, the latest SSU (KB4470788) will be offered to you automatically. To get the stand-alone package for the latest SSU, go to the Microsoft Update Catalog.


                Home
                Remember - "A day without laughter is a day wasted."
                May the wind sing to you and the sun rise in your heart...

                Thursday, February 28, 2019

                Mozilla Firefox Version 65.0.2 Released


                Firefox Mozilla sent Firefox Version 65.0.2 to the release channel today to fix one issue.  Firefox ESR has been updated to Version 60.5.2.

                Fixed

                  • Fixed an issue with geolocation services affecting Windows users

                    Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

                    References


                    Remember - "A day without laughter is a day wasted."
                    May the wind sing to you and the sun rise in your heart...

                    Tuesday, February 26, 2019

                    Adobe Shockwave Player EoL (End of Life)

                    Shockwave Player

                    Home
                    Remember - "A day without laughter is a day wasted."
                    May the wind sing to you and the sun rise in your heart...

                    Thursday, February 21, 2019

                    Adobe Acrobat DC and Reader DC Critical Security Update Released

                    Adobe

                    Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address a reported bypass to the fix for CVE-2019-7089 first introduced in 2019.010.20091, 2017.011.30120 and 2015.006.30475 and released on February 12, 2019. Successful exploitation could lead to sensitive information disclosure in the context of the current user.    

                    Release date:  February 21, 2019
                    Vulnerability identifier: APSB19-13
                    Platform: Windows and MacOS

                    Update or Complete Download

                    Reader DC and Acrobat DC were updated to version 2019.010.20098. Update checks can be manually activated by choosing Help & Check for Updates. 
                    Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.


                    References





                    Home
                    Remember - "A day without laughter is a day wasted."
                    May the wind sing to you and the sun rise in your heart...



                    Tuesday, February 19, 2019

                    Pale Moon Version 28.4.0 Released with Security Updates


                    Pale Moon
                    Pale Moon has been updated to version 28.4.0.  This is a major development, stability and security release. The Linux versions will follow later today.

                    A fix identified as "DiD" ("Defense-in-Depth") means that it is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered. 

                    From the Release Notes:


                    Security fixes:
                    • Fixed a potential use-after-free in IndexedDB code. (DiD)
                    • Improved proxy handling to avoid localhost getting proxied. (CVE-2018-18506)
                    • Ported upstream Skia fixes. (CVE-2018-18356, CVE-2018-18335)
                    • Fixed an additional Skia issue. (CVE-2019-5785)
                    • Fixed several potentially-exploitable memory safety hazards and crashes. (DiD)
                    • Fixed a possible data race when performing compacting GC.
                    Changes/fixes:
                    • Removed more telemetry code from the platform.
                    • Fixed implementation of the IntersectionObserver API to avoid crashes, and enabled it by default.
                    • Switched to the new ffmpeg decode API to avoid dropping of frames.
                    • Fixed a buffering issue in the WebP decoder that caused intermittent browser crashes.
                    • Improved resource-efficiency for internal stopwatch timers.
                    • Improved handling of incorrectly-encoded CTTS in media files, resolving some playback issues of videos.
                    • Improved the Cycle Collector and Garbage Collector.
                    • Improved fullscreen navigation bar handling in the situation it has focus when switching to full screen.
                    • Aligned instanceof with the final ES6 spec.
                    • Improved Windows DIB (bitmap) clipboard data handling.
                    • Exposed TLS 1.3 cipher suite prefs in about:config in case people want to disable them individually.
                    • Allowed empty string on the location.search setter to clear URL query parameters from JS.
                    • Added a potential fix for external links not opening in the current window/tab (untested).
                    • Enabled C++11 thread-safe statics in the entire application.
                    • Updated several preferences for integration with the new add-ons site.
                     Download:

                    Update

                    To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.




                    Remember - "A day without laughter is a day wasted."
                    May the wind sing to you and the sun rise in your heart...



                    Tuesday, February 12, 2019

                    Mozilla Firefox Version 65.0.1 Released With Security Updates


                    Firefox Mozilla sent Firefox Version 65.0.1 to the release channel today.  Firefox ESR has been updated to Version 60.5.1
                    The update included three (3) security updates rated high.

                    High

                    Fixed

                    • Fixed accidental requests to addons.mozilla.org when an addon recommendation doorhanger is shown (bug 1526387)
                    • Improved playback of interactive Netflix videos (bug 1524500)
                    • Fixed color management not working on macOS (bug 1506495)
                    • Fixed incorrect sizing of the "Clear Recent History" window in some situations (bug 1523696)
                    • Fixed audio & video delays while making WebRTC calls (bug 1521577 & bug 1523817)
                    • Fixed video sizing problems during some WebRTC calls (bug 1520200)
                    • Fixed looping CONNECT requests when using WebSockets over HTTP/2 from behind a proxy server (bug 1523427)
                    • Fixed the "Enter" key not working on password entry fields for certain Linux distributions (bug 1523635)
                    Developer
                    • Made support for viewport tags in Responsive Design Mode, initially enabled in Firefox 64, pref-controlled and off by default (bug 1521814). To restore the previous behavior, change the devtools.responsive.metaViewport.enabled pref to true.

                    Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

                    References


                    Remember - "A day without laughter is a day wasted."
                    May the wind sing to you and the sun rise in your heart...

                    Microsoft February Security Updates Released



                    The February security updates have been released and consist of 77 CVE's and three security advisories in which 20 are rated Critical, 54 are rated Important, and three are rated Moderate in severity. Four are listed as publicly known and one is listed as being under active attack at the time of release.

                    In addition to defense-in-depth updates, the updates address Remote Code Execution, Security Feature Bypass, Information Disclosure, Elevation of Privilege, Spoofing, and Security Feature Bypass  and apply to the following:  Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, .NET Framework, Microsoft Exchange Server, Microsoft Visual Studio, Azure IoT SDK, Microsoft Dynamics, Team Foundation Server, and Visual Studio Code.

                    Important:  A Servicing Stack Update has been released for the following operating systems.  Windows 10 Version 1607, Windows Server 2016, and Windows Server 2016 (Server Core installation); Windows 10 Version 1703; Windows 10 Version 1709 and Windows Server, version 1709 (Server& Core Installation); Windows 10 Version 1803, and Windows Server, version 1803 (Server Core Installation). See the "Additional Update Notes" below for more information.

                    Known Issues In the February Update:
                    Recommended Reading: 

                    Note:  See Dustin Childs review and analysis in
                    Zero Day Initiative — The February 2019 Security Update Review.
                     
                    More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

                    Additional Update Notes:

                    • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
                    • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
                    • Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. 
                    • Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog.
                    • Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update.
                    • For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.

                    References


                    Remember - "A day without laughter is a day wasted."
                    May the wind sing to you and the sun rise in your heart...