Adobe Flash Player Update Plus Updater Change

Adobe Flash Player was updated again to address critical security vulnerabilities.  (The last update was just over three weeks ago.)  According to Adobe, the vulnerabilities are "priority 2"; critical but not yet exploited.

Flash Player Updater Change

Adobe recognizes the critical nature of updating third-party software.  As a result, this release of Flash Player contains a new background updater.  As explained by Peleus Uhley in An Update for the Flash Player Updater,

"If you read this September 2011 CSIS report, then you saw that 99.8 percent of malware installs through exploit kits are targeting out-of-date software installations. This point was reiterated recently in volume 11 of the Microsoft Security Intelligent Report. Also, attackers have been taking advantage of users trying to manually search for Flash Player updates by buying ads on search engines pretending to be legitimate Flash Player download sites. Improving the update process is probably the single most important challenge we can tackle for our customers at this time."

After updating to Adobe Flash Player 11.2, the following update options will be available:

• Install updates automatically when available (recommended)
• Notify me when updates are available
• Never check for updates (not recommended)

Update Information

The newest version for Windows, Macintosh, Linux and Solaris is 11.2.202.228.  Android 4.x devices using version 11.1.115.7 are not affected.  The update for Android 3.x and earlier versions is 11.1.111.8.

It is also recommended that Adobe AIR be updated to Adobe AIR 3.2.0.2070.

Release date: March 28, 2012
Vulnerability identifier: APSB12-07
Priority: 2
CVE numbers: CVE-2012-0772, CVE-2012-0773
Platform: All Platforms
 

Flash Player Update Instructions

Adobe Flash Player for Android

The latest version for Adobe Flash Player for Android is available by downloading it from the Android Marketplace by browsing to it on a mobile phone.

Flash Player for Windows, Macintosh, Linux and Solaris

Although Adobe suggests downloading the update from the Adobe Flash Player Download Center or by using the auto-update mechanism within the product when prompted, if you prefer, direct download links are available.

Notes:

• If you use the Adobe Flash Player Download Center, be careful to uncheck the optional McAfee Security Plus box.  It is not needed for the Flash Player update.
• Uncheck any toolbar offered with Adobe products if not wanted.
• If you use alternate browsers, it is necessary to install the update for both Internet Explorer as well as the update for alternate browsers.

Flash Player 11 (32-Bit)

• IE 32-Bit:  http://fpdownload.macromedia.com/get/flashplayer/pdc/11.2.202.228/install_flash_player_ax_32bit.exe
• Non-IE 32-Bit (Opera, Firefox etc):  http://fpdownload.macromedia.com/get/flashplayer/pdc/11.2.202.228/install_flash_player_32bit.exe

Flash Player 11 (64-Bit)

• IE 64-Bit:  http://fpdownload.macromedia.com/get/flashplayer/pdc/11.2.202.228/install_flash_player_ax_64bit.exe
• Non-IE 64-Bit (Opera Firefox etc):  http://fpdownload.macromedia.com/get/flashplayer/pdc/11.2.202.228/install_flash_player_64bit.exe

Flash Player Uninstallers:

32-Bit Uninstaller: http://download.macromedia.com/pub/flashplayer/current/uninstall_flash_player_32bit.exe
64-Bit Unisntaller: http://download.macromedia.com/pub/flashplayer/current/uninstall_flash_player_64bit.exe

*HatTip: ky331 for FTP download links.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 
Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

When Adobe Flash Player is updated, it is recommended that Adobe AIR version be checked as well.  Go to Adobe AIR Help to determine the version of Adobe AIR runtime installed.

References

• Adobe Priority Ratings
• Adobe Security Advisory: Security update available for Adobe Flash Player
• Adobe PSIRT Blog: Security Update for Adobe Flash Player (APSB12-07)

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox 11 Released

After a bit of hesitation, Mozilla released Firefox 11 today.  As explained in Update on Firefox Release Timing, the update was delay was initially for two reasons.

1. This Tuesday is Microsoft’s scheduled monthly update to Windows, and those updates have interacted badly with our updates before. We don’t have reason to expect specific problems with this month’s updates, but we’d rather take a day or two to understand the impact before we update all of our users.
2. We’re also waiting for a report from ZDI about a security vulnerability that may affect this new version of Firefox. We expect to receive the report by end of day Monday. Once we can evaluate the vulnerability, we’ll know whether we need to include a fix in Firefox before the update is released.

What's New

The Release Notes include new and fixed features in version 11.  The numerous Bug Fixes are in the link available in References.

• NEW --Firefox can now migrate your bookmarks, history, and cookies from Google Chrome
• NEW --With Sync enabled, add-ons can now be synchronized across your computers
• NEW --The CSS text-size-adjust property is now supported
• CHANGED --Redesigned media controls for HTML5 video
• HTML5 --The outerHTML property is now supported on HTML elements
• HTML5 --View source syntax highlighting now uses the HTML5 parser (see bug 482921)
• DEVELOPER --The Style Editor for CSS editing is now available to web developers
• DEVELOPER --Web developers can now visualize a web page in 3D using the Page Inspector 3D View
• DEVELOPER --SPDY protocol support for faster page loads is now testable
• DEVELOPER --XMLHttpRequest now supports HTML parsing
• DEVELOPER --Files can now be stored in IndexedDB (see bug 661877)
• DEVELOPER --Websockets has now been unprefixed
• FIXED --Firefox notifications may not work properly with Growl 1.3 or later (691662)

Known Issues

• If you try to start Firefox using a locked profile, it will crash (see 573369)
• For some users, scrolling in the main GMail window will be slower than usual (see 579260)
• Some synaptic touch pads are unable to vertical scroll (see 622410)
• OS X: WebGL performance may be degraded on some hardware (see 713305)
  Unresolved on v11 Resolved in v12
• Windows: The use of Microsoft's System Restore functionality shortly after updating Firefox may prevent future updates (see 730285)

Update

The upgrade to Firefox 11 will be offered through the browser update mechanism after any impacts related to the Microsoft Security Updates are analyzed.  To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Mozilla Firefox Release Notes
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft March 2012 Security Bulletin Release

Microsoft released six (6) bulletins, of which one bulletin is identified as Critical, four (4) as Important and the remaining bulletin as Moderate.  one Critical-class, four Important and one Moderate.

The bulletins address seven issues in Microsoft Windows, Visual Studio, and Expression Design.  Most updates will require a restart to complete the installation.

Security Bulletins

Bulletin Number	Bulletin Title	Bulletin KB
MS12-017	Vulnerability in Microsoft Windows	2647170
MS12-018	Vulnerability in Microsoft Windows	2641653
MS12-019	Vulnerability in Microsoft Windows	2665364
MS12-020	Vulnerabilities in Microsoft Windows	2671387
MS12-021	Vulnerability in Microsoft Visual Studio	2651019
MS12-022	Vulnerability in Microsoft Expression	2651018

Support

The following additional information is provided in the Security Bulletin:

• The affected software listed have been tested to determine which versions are affected. Other versions are past their support life cycle. To determine the support life cycle for your software version, visit Microsoft Support Lifecycle.
  
• Customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. For more information about available support options, see Microsoft Help and Support.
• International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit International Help and Support.

References

• MSRC: Strength, flexibility and the March 2012 security bulletins
• TechNet: Microsoft Security Bulletin Summary for March 2012
• Security and Safety Center:  Microsoft security updates for March 2012 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...