Adobe Flash Player Security Updates Released

Adobe has released Version 31.0.0.148 of Adobe Flash Player and AIR for Windows, macOS, Linux and Chrome OS. These updates address an important vulnerability in Adobe Flash Player 31.0.0.122 and earlier versions.  Successful exploitation could lead to information disclosure.

Release date:  November 13, 2018
Vulnerability identifier: APSB18-39
Platform:  Windows, Macintosh, Linux and Chrome OS

Fixed Issues

Flash Player

• IE quits unexpectedly on opening multiple tabs with Flash Content (FP-4198903)
• Assorted security and functional fixes

Vulnerability details

Vulnerability Category	Vulnerability Impact	Severity	CVE Number
Out-of-bounds Read	Information Disclosure	Important	CVE-2018-15978

Update:

• With the option to 'Allow Adobe to install updates', the update will be automatic. Without that setting enabled, either install the update via the update mechanism when prompted or via the Download Center*.
• Windows 7 and earlier:  Installation links for Windows 7 and earlier are provided by Adobe at Installation problems | Flash Player | Windows 7 and earlier: 
• Flash Player for Internet Explorer - ActiveX 
• Flash Player for Firefox/Pale Moon - NPAPI
• Flash Player for Opera and Chromium-based browsers - PPAPI
• Microsoft Edge and Internet Explorer 11:  Adobe Flash Player will be automatically updated to the latest version for Windows 8.1 and 10.
• Google Chrome:  Adobe Flash Player will be automatically updated to the latest Google Chrome version.
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  Adobe - Adobe AIR

*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Installing and Updating Flash Player - FAQ
• Release Notes:  Flash Player® 31 AIR® 31
• Security Bulletin
• PSIRT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Acrobat DC and Reader DC Security Updates Released

Adobe has released security updates for Adobe Acrobat and Reader for Windows to resolve an important vulnerability.  Successful exploitation could lead to an inadvertent leak of the user’s hashed NTLM password.  Proof-of-concept code for CVE-2018-15979 is publicly available. 

Release date:  November 13, 2018
Vulnerability identifier: APSB18-40
Platform: Windows

Update or Complete Download

Reader DC and Acrobat DC were updated to version 2019.008.20081. Update checks can be manually activated by choosing Help & Check for Updates. 

• Reader DC and other versions are available here:  https://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
  
• Acrobat DC for Windows is available here:  http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Pale Moon Version 28.2.0 Released with Security Updates

Pale Moon has been updated to version 28.2.0, a major development release addressing performance, web compatibility, bugfixes, regressions and security vulnerabilities.  In particular, security fixes have been implemented for CVE-2018-12381, CVE-2017-7797, a better fix for CVE-2018-12386 (DiD), CVE-2018-12401 (DiD), CVE-2018-12398, CVE-2018-12392, several Skia bugs, and several crashes and memory safety hazards that do not have a CVE number.

From the Release Notes:

Changes/fixes:

• Fixed a major performance issue with web workers.
• Fixed a rare crash on local networks with HTTP basic auth and unsupported cipher suites.
• Fixed a performance/timer issue when leaving the browser idle.
• Fixed an issue causing an empty dialog when launching executable files from the browser.
• Fixed an issue preventing making entries to disallow sites to store data for off-line use.
• Removed code to prevent extensions with binary components.
• Fixed an issue with common dialogs being sized incorrectly for their content.
• Fixed an issue with event handling on the tab bar that would cause frustrating behavior when trying to open/close tabs in rapid succession.
• Switched default behavior for scrolling when a context or pop-up menu is open to allow scrolling, like in v27. This also affects scrolling in very long menus, e.g. bookmarks.
  
• Added experimental Asynchronous Panning and Zooming (APZ) for desktop use.
• Re-enabled the use and parsing of ICC v4 color profiles.
• Removed telemetry code from the caching subsystem.
• Improved full-screen detection for suppressing status messages.
• Made all arguments passed to Init*Event() optional except the first for parity with other browsers.
• Cleaned up some internal installer code.
• Fixed making caret width configurable when dealing with CJK characters (regression).
• Fixed drawing of table borders consistently when zooming a page (regression).
• Exposed the "Save download location per site" pref in about:config.
• Improved media handling (ongoing).
• Added experimental support for AV1 in WebM videos (disabled by default).
  Note: this is for WebM only for now, so MP4 and MSE AV1 streams (e.g. YouTube) will not (yet) play.
• Removed the (defunct and incomplete) in-browser translation code.
• Fixed an issue with CSS Grid layouts unnecessarily shrinking element blocks.
• Fixed notification settings menu entry (opes about:permissions with relevant data now).
• Fixed the launching of an undesirable background content process for capturing page thumbnails.
• Fixed a focus issue in the bookmark properties dialog.
  
• Changed the setting for reporting CSS errors to the console to false by default, to prevent unnecessary performance loss for recording this data.
• Added control mechanisms for Opportunistic Encryption (both for alternative services and upgrade-insecure-requests) in preferences, and disabled this by default due to potential security and privacy issues with this transitional technology.
• Updated the default reported Firefox version in Firefox Compatibility Mode to prevent "too old Firefox" complaints on websites.
  
• Updated libnestegg, ffvpx, reader view components and several other modules from upstream.
• Implemented security fixes for CVE-2018-12381, CVE-2017-7797, a better fix for CVE-2018-12386 (DiD), CVE-2018-12401 (DiD), CVE-2018-12398, CVE-2018-12392, several Skia bugs, and several crashes and memory safety hazards that do not have a CVE number.

Download:

• Pale Moon for Windows
• Pale Moon for Linux

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...