Windows 10 May 2020 Update 20H1 Released!

A  gradual release of the Windows 10 May 2020 update Version 2004 has begun today!  If you are anxious to move to this new version, see this article on How to get the Windows 10 May 2020 Update.  With an older device, you may want to wait until it is offered.  However, my 2008 PC has not had any issues with the Insider Builds.

There are many new features included in the update, outlined very nicely at Bleeping Computer in Windows 10 May 2020 Update released, Here are the new features.

For those anxious to move to the latest release, I suggest you review the Know Issues for information on issues that are still being worked on.  As always, before making changes to your PC, make a backup.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Remember And Honor

Vietnam Memorial Wall
April 30, 2005
Photograph by Luigi Masu

In honor of those who gave their all in the service of their country, 
with special thoughts of Mitch (Phantom Phixer) and Larry (Ghost).

Memorial Day History

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Acrobat DC and Reader DC Optional Hotfix Released

Adobe has released an optional hotfix for Adobe Acrobat and Reader for Windows and macOS that addresses some important bug fixes.

Release date:  May 21, 2020
Vulnerability identifier: None
Platform: Windows and MacOS

Update or Complete Download

Reader DC and Acrobat DC were updated to version 20.009.20065.

 Update checks can be manually activated by choosing Help/Check for Updates. 

• Reader DC and other versions are available here:  https://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
  
• Acrobat DC for Windows is available here:  http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Release Notes
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Build Sessions for Windows Insiders

Microsoft Build will soon be here!  The event will be digital this year and is scheduled for May 19-21, 2020.  There are over 600 events on the schedule this year and it is free! 

If you are a Windows Insider or are interested in the joining the Windows Insider Program, be sure plan on attending one of the Windows Insider Mixer sessions as well as the Build session, "Expert Q&A:  Windows Insider Program".  The sessions are as follows:

• May 19th Mixercast 7 pm to 9 pm (PDT) - https://mixer.com/windowsinsider
• May 20th Mixercast 10 am to 12 pm (PDT) - https://mixer.com/windowsinsider
• May 20th Expert Q&A: Windows Insider Program - 1:15 pm to 1:45 pm (PDT) https://mybuild.microsoft.com/sessions/f79445dd-fd8a-44b4-a7db-6fcb5ea29f94?source=sessions

From Microsoft Build 2020:

Free digital event

Starts: May 19, 2020 at 8 AM Pacific Time
Ends: May 21, 2020 at 8 AM Pacific Time

Choose from 48 hours of continuous content to create your own digital event experience. Registration is free and is required to get full, interactive access to the digital event. If you have any questions or need assistance, please contact the Registration Team.

If you were registered for the Microsoft Build in-person event, please select the option to Login to an Existing Registration and sign in using the same credentials previously used.

Event Website | Registration FAQs

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft May 2020 Security Updates

The Microsoft May security updates have been released and consist of 111 CVEs.  Of these 111 CVEs, 16 are rated Critical and 95 are rated Important in severity.

The updates apply to the following:  Microsoft Windows, Microsoft Edge (EdgeHTML-based), Microsoft Edge (Chromium-based), ChakraCore, Internet Explorer, Microsoft Office and Microsoft Office Services and Web Apps, Windows Defender, Visual Studio, Microsoft Dynamics, .NET Framework, .NET Core, and Power BI.

The KBs listed below contain information about known issues with the security updates.

KB Article	Applies To
4551853	Windows 10 Version 1809, Windows Server 2019
4556813	Windows 10, version 1607, Windows Server 2016
4556836	Windows 7, Windows Server 2008 R2 (Monthly Rollup)
4556843	Windows 7, Windows Server 2008 R2 (Security-only update)
4556854	Windows Server 2008 Service Pack 2 (Security-only update)
4556860	Windows Server 2008 Service Pack 2 (Monthly Rollup)

Recommended Reading:  

See Dustin Childs review and analysis in Zero Day Initiative — The May 2020 Security Update Review.

For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes:

• Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above. Note, however, that there are no Adobe Flash Player security updates for Active X.
• MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
• Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. Learn more about SSU's in Servicing Stack Updates (SSU)
• Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are also available via the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.
• Windows Update History:
  • Windows 10
  • Windows 8.1

References

• Security Update FAQ
• May Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Update Released

Adobe released Version 32.0.0.371 of Adobe Flash Player for Windows, macOS, Linux and Chrome OS. The update has assorted bug fixes.

Release date:  May 12, 2020
Vulnerability identifier:  None
Platform:  Windows, Macintosh, Linux and Chrome OS

Update:

• With the option to 'Allow Adobe to install updates', the update will be automatic. Without that setting enabled, either install the update via the update mechanism when prompted or via the Download Center*.
• Windows 7 and earlier:  Installation links for Windows 7 and earlier are provided by Adobe at Installation problems | Flash Player | Windows 7 and earlier: 
• Flash Player for Internet Explorer - ActiveX -- Note:  No update released for ActiveX
• Flash Player for Firefox/Pale Moon - NPAPI
• Flash Player for Opera and Chromium-based browsers - PPAPI
• Uninstaller (if needed) : http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe 
• Microsoft Edge and Internet Explorer 11:  Security updates for Adobe Flash Player are automatically updated to the latest version for Windows 8.1 and 10 via Windows Update.  No Update released -- Flash Player remains at Version 32.0.0.330.
• Google Chrome:  Adobe Flash Player will be automatically updated to the latest Google Chrome version.
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  Adobe - Adobe AIR

*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings/Applications/Manage Applications/Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Installing and Updating Flash Player - FAQ
• Release Notes
• Security Bulletin
• PSIRT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Acrobat DC and Reader DC Security Updates Released

Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Release date:  May 12, 2020
Vulnerability identifier: APSB20-24
Platform: Windows and MacOS

Update or Complete Download

Reader DC and Acrobat DC were updated to version 20.009.20063.

 Update checks can be manually activated by choosing Help/Check for Updates. 

• Reader DC and other versions are available here:  https://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
  
• Acrobat DC for Windows is available here:  http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Release Notes
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 76.0.1 Released

Mozilla sent Firefox Version 76.0.1 to the release channel today.  The update includes bug fixes.

At the time of this posting, no update has been released for Firefox ESR which remains at Version 68.8.

Fixed

• Fixed a bug causing some add-ons such as Amazon Assistant to see multiple onConnect events, impairing functionality (bug 1635637)
  
• Fixed a crash on 32-bit Windows systems with some nVidia drivers installed (bug 1635823)
  

References

• Common questions after updating Firefox
• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.9.3 Released with Security Updates

Pale Moon version 28.9.3 has been released.  The update is a security update. 

The update includes DiD ("Defense-in-Depth") updates.  A DiD update is s a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.

From the Release Notes

• Fixed a potential vulnerability in the zip file reader. DiD
• Fixed a potential vulnerability in the JavaScript JIT compiler related to aliases. DiD
• Ported several upstream devtools fixes (addresses CVE-2020-12392 and CVE-2020-12393).
• Improved memory safety of some WebAudio calls.
• Improved memory safety in the XUL window destructor. DiD
  
• Unified XUL Platform Mozilla Security Patch Summary: 3 fixed, 3 Defense-in-depth, 16 not applicable.

Linux versions for this update will follow shortly.

Update:  To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Click About Pale Moon and  Check for Updates.


Release Notes

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Edge Security Update Released

Microsoft has released security updates for Microsoft Edge Version 81.0.416.72 which is based on Chromium Version 81.0.4044.138.  The update, rated high, included two updates addressing CVE's, CVE-2020-6831 and CVE-2020-6464. 

In order to easily determine if the update applies to your version of Microsoft Edge do the following:

1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right hand side of the window
2. Click on Help and Feedback
3. Click on About Microsoft Edge

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 76.0 Released With Critical Security Updates

Mozilla sent Firefox Version 76.0 to the release channel today.  The update included eleven (11) security updates of which three (3) are critical, three (3) are high, four (4) are moderate and one (1) is low in severity.

Also released was Firefox ESR Version 68.8.

Critical

• #CVE-2020-12387: Use-after-free during worker shutdown
• #CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens
• #CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

 High

• #CVE-2020-12389: Sandbox escape with improperly separated process types
• #CVE-2020-6831: Buffer overflow in SCTP chunk input validation
• #CVE-2020-12396: Memory safety bugs fixed in Firefox 76

Moderate

• #CVE-2020-12390: Incorrect serialization of nsIPrincipal.origin for IPv6 addresses
• #CVE-2020-12391: Content-Security-Policy bypass using object elements
• #CVE-2020-12392: Arbitrary local file access with 'Copy as cURL
• #CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

Low

• #CVE-2020-12394: URL spoofing in location bar when unfocussed

New

• With today’s release, Firefox strengthens protections for your online account logins and passwords, with innovative approaches to managing your accounts during this critical time:
  
  • Firefox displays critical alerts in the Lockwise password manager when a website is breached;
  • If one of your accounts is involved in a website breach and you've used the same password on other websites, you will now be prompted to update your password. A key icon identifies which accounts use that vulnerable password.
  • Automatically generate secure, complex passwords for new accounts across more of the web that are easily saved right in the browser;
  • You have been able to access and see your saved passwords under Logins and Passwords easily under the main menu. If your device happens to be shared among your family or roommates, the latest update helps to prevent casual snooping over your shoulder. If you don’t have a master password set up for Firefox, Windows and macOS now requires a login to your operating system account before showing your saved passwords.
  • Picture-in-Picture allows you to multitask, the small video window following along no matter what you are doing on your computer, across different applications and even workspaces. Now, when you are ready to focus on the video, a double click can take the small window into full screen. Double click again to reduce the size again. 

• Firefox now supports Audio Worklets that will allow more complex audio processing like VR and gaming on the web; and is being adopted by some of your favorite software programs.
  • With this change, you can now join Zoom calls on Firefox without the need for any additional downloads. 

• WebRender continues its roll out to more Firefox for Windows users, now available by default on modern Intel laptops with a small screen (<= 1920x1200) for improved graphics rendering. Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...