Wednesday, March 27, 2019

Mozilla Firefox Version 66.0.2 Released


Firefox Mozilla sent Firefox Version 66.0.2 to the release channel today.  The update addresses several bugs.

Fixed

  • Fixed Web compatibility issues with Office 365, iCloud and IBM WebMail caused by recent changes to the handling of keyboard events (Bug 1538966)
  • Crash fixes (bug 1521370, bug 1539118)


Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References


Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.4.1 Released


Pale Moon
Pale Moon has been updated to version 28.4.1.  This is a security and bugfix update.  The Linux version will follow later today.

A fix identified as "DiD" ("Defense-in-Depth") means that it is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered. 

From the Release Notes:

Changes/fixes:

  • Fixed hover state arrows on some controls.
  • Fixed potential denial-of-service issues involving FTP (loading of subresources and spamming errors).
  • Disabled Microsoft Family Safety (Win 8.1) by default. This prevents security issues as a result of a local MitM setup.
  • Added several site-specific overrides (Firefox Send and polyfill.io) to work around website UA-sniffing isues.
  • Implemented the origin-clean algorithm for controlling access to image resources.
  • Cleaned up the helper application service code.
  • Ported applicable security fixes from Mozilla (CVE-2019-9791, CVE-2019-9792, CVE-2019-9796, CVE-2019-9801, CVE-2019-9793, CVE-2019-9794, CVE-2019-9808 and ZDI-CAN-8368).
  • Implemented several defense-in-depth measures (for CVE-2019-9790, CVE-2019-9797, CVE-2019-9804, and a JavaScript issue).
  • Fixed several memory safety hazards and crashes.
  • Binaries are now code-signed again (including the setup program for the installer).
     Download:

    Update

    To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.




    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...



    Friday, March 22, 2019

    Mozilla Firefox Version 66.0.1 Released With Critical Security Updates


    Firefox Mozilla sent Firefox Version 66.0.1 to the release channel today.  The update addresses two (2) CVE's rated critical, Firefox ESR has been updated to Version 60.6.1.

    The critical flaws were disclosed in the Zero Day Initiative #Pawn2Own event in Vancouver.

    Critical


    Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

    References


    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...

    Tuesday, March 19, 2019

    Mozilla Firefox Version 66.0 Released With Critical Security Updates


    Firefox Mozilla sent Firefox Version 66.0 to the release channel today.  The update addresses 21 CVE's of which five (5) are rated critical, seven (7) high, five (5) moderate and four (4) low in severity.

    Firefox ESR has been updated to Version 60.6.

    Critical

    High

    Moderate

    Low

    New

        Fixed

        • The Dark and Light Firefox themes now override the system setting for title bar accent color on Windows 10
        • Linux users: Resolved an issue that caused Firefox to freeze when downloading files
        Changed
        • System title bar is hidden by default to match Gnome guideline for Linux users

        Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

        References


        Remember - "A day without laughter is a day wasted."
        May the wind sing to you and the sun rise in your heart...

        Wednesday, March 13, 2019

        Adobe Flash Player Update


        Adobe Flashplayer

        Adobe has released Version 32.0.0.156 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. These updates address feature and performance bugs, and do not include security fixes.   

        Release date:  March 12, 2019
        Vulnerability identifier: APSB19-12
        Platform:  Windows, Macintosh, Linux and Chrome OS

        Update:

        *Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

          Verify Installation

          To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

          Do this for each browser installed on your computer.

          To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

          References



          Remember - "A day without laughter is a day wasted."
          May the wind sing to you and the sun rise in your heart...









          Tuesday, March 12, 2019

          Microsoft March, 2019 Security Updates



          The March security updates have been released and consist of 64 CVE's and four security advisories in which 17 are rated Critical, 45 are rated Important, 1 is rated Moderate and 1 low in severity. Four are listed as publicly known and two are listed as being under active attack at the time of release.

          In addition to a Servicing Stack Update (See the "Additional Update Notes" below for more information.), the updates apply to the following:  Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows,  Microsoft Office and Microsoft Office SharePoint, ChakraCore, Team Foundation Server, Skype for Business, Visual Studio, and NuGet.

          ImportantWindows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstation, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, updating to the latest version of Windows 10 is strongly recommended.  Note, however, that Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.

          Known Issues In the March Update:

          KB Article
          Applies To
          4489878 Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Monthly Rollup)
          4489881 Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
          4489882 Windows 10 version 1607, Windows Server 2016
          4489883 Windows 8.1, Windows Server 2012 R2 (Security-only update)
          4489884 Windows Server 2012 (Security-only update)
          4489885 Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Security-only update)
          4489891 Windows Server 2012 (Monthly Rollup)
          4489899 Windows 10 version 1809, Windows Server 2019

          Recommended Reading:  

          See Dustin Childs review and analysis in Zero Day Initiative — The March 2019 Security Update Review.

          For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

          Additional Update Notes:

          • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
          • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
          • Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. 
          • Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog.
          • Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update.
          • For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.

          References


          Remember - "A day without laughter is a day wasted."
          May the wind sing to you and the sun rise in your heart...





          Friday, March 01, 2019

          Microsoft Cumulative Update Released for Windows 10 Version 1809


          Microsoft has released a cumulative update with non-security improvements and fixes for Windows 10 version 1809.  This update includes quality improvements with no new operating system features introduced. 

          The update is available from Windows Update or the Microsoft Update Catalog.  See KB4482887 for the list of improvements and fixes.

          Known Issues in this Update

          Symptom Workaround
          After installing this update, Internet Explorer 11 may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
          • Cache size and location show zero or empty.
          • Keyboard shortcuts may not work properly.
          • Webpages may intermittently fail to load or render correctly.
          • Issues with credential prompts.
          • Issues when downloading files.
          Create unique user accounts so that two people don’t share the same user account when logging on to a Windows Server machine. Additionally, disable multiple RDP sessions for a single user account for a specific Windows Server.
          Microsoft is working on a resolution and will provide an update in an upcoming release.

          Note:
          Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU.  If you are using Windows Update, the latest SSU (KB4470788) will be offered to you automatically. To get the stand-alone package for the latest SSU, go to the Microsoft Update Catalog.


          Home
          Remember - "A day without laughter is a day wasted."
          May the wind sing to you and the sun rise in your heart...