Adobe Flash Player Security Update

Adobe has released security updates for Adobe Flash Player 15.0.0.242 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.424 and earlier versions for Linux.

These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.  Adobe is aware of reports that an exploit for CVE-2014-9163 exists in the wild. The updates to Flash Player are rated Critical. 

Note: Users who have been updated to version 15.0.0.246 are not affected by CVE-2014-9163.

Update Information

Release date: December 9, 2014
Vulnerability identifier: APSB14-27
CVE number: CVE-2014-0580, CVE-2014-0587, CVE-2014-8443, CVE-2014-9162, CVE-2014-9163, CVE-2014-9164
Platform: All Platforms

• Users of the Adobe Flash Player desktop runtime for Windows and Macintosh should update to Adobe Flash Player 16.0.0.235.
• Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash Player 13.0.0.259.
• Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.425.
• Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, will automatically update to the current version.

Flash Player Update Instructions

Warning:  Although Adobe suggests downloading the update from the Adobe Flash Player Download Center, that link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras.

It is recommended that you either use the auto-update mechanism within the product when prompted, or my preference, the direct download links.

• Non-IE Plugin (Opera, Firefox, Etc.):  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_16_plugin.exe
   
• Flash Player For Internet Explorer, Windows 7 and earlier:  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_16_active_x.exe
  
  Internet Explorer, Windows 8 and above: Microsoft updated Security Advisory 2755801.  If you do not have Automatic Updates enabled, the Flash Player update can be downloaded from Microsoft Security Advisory: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10: July 9, 2013.
  
  
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  http://get.adobe.com/air/

Notes:

• If you use the Adobe Flash Player Download Center, be careful to uncheck any optional downloads that you do not want.  Any pre-checked option is not needed for the Flash Player update.
• Uncheck any toolbar offered with Adobe products if not wanted.
• If you use alternate browsers, it is necessary to install the update for both Internet Explorer as well as the update for alternate browsers.
• The separate 32-bit and 64-bit uninstallers have been replaced with a single uninstaller.
• Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash Player 13.0.0.259.

Adobe Flash Player for Android

The latest version for Adobe Flash Player for Android is available by downloading it from the Android Marketplace by browsing to it on a mobile phone.   

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Security Bulletin: APSB14-27
• Release Notes:  Flash Player® 16 AIR® 16

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Bulletin Advance Notice for December 2014

On Tuesday, December 9, 2014, Microsoft is planning to release seven (7) bulletins.  Three bulletins are identified as Critical and four as Important in severity.

These updates will address vulnerabilities in Microsoft Windows, Internet Explorer (IE), Office and Exchange.

As happens each month, Microsoft will also release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

References

• MSRC:   Advance Notification Service for December 2014 Security Bulletin Release
• TechNet: Microsoft Security Bulletin Advance Notification for December 2014 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 34 Released with Critical Security Updates

Mozilla sent Firefox Version 34.0.5 to the release channel.  The update includes eight (8) security updates, three (3) of which are Critical, three (3) High and two (2) moderate.

Default Search Engine Changes

Mozilla is including major changes in default search engines in the release of version 34, reportedly "Promoting Choice and Innovation". Looking deeper, perhaps the real reason is the flat revenue from Google-Firefox search deal.

Regardless of the reason behind the change, the default search engine in North America has been changed to Yahoo!  According to the agreement, Yahoo! will support "do not track".  Google, Bing, DuckDuckGo, eBay, Amazon, Twitter and Wikipedia continue to be built-in as alternate search options.  After updating, there was no change to Bing as my choice for search engine.

For search engine changes in other countries, see New Search Strategy for Firefox: Promoting Choice & Innovation.

Fixed in Firefox 34

• 2014-90 -- Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory
• 2014-89 -- Bad casting from the BasicThebesLayer to BasicContainerLayer
• 2014-88 -- Buffer overflow while parsing media content
• 2014-87 -- Use-after-free during HTML5 parsing
• 2014-86 -- CSP leaks redirect data via violation reports
• 2014-85 -- XMLHttpRequest crashes with some input streams
• 2014-84 -- XBL bindings accessible via improper CSS declarations
• 2014-83 -- Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)

What’s New

• New -- Default search engine changed to Yahoo! for North America
• New -- Default search engine changed to Yandex for Belarusian, Kazakh, and Russian locales
• New -- Improved search bar (en-US only)
• New -- Firefox Hello real-time communication client
• New -- Easily switch themes/personas directly in the Customizing mode
• New -- Wikipedia search now uses HTTPS for secure searching (en-US only)
• New -- Implementation of HTTP/2 (draft14) and ALPN
• New -- Recover from a locked Firefox process in the "Firefox is already running" dialog on Windows
• Changed -- Disabled SSLv3
• Changed -- Proprietary window.crypto properties/functions re-enabled (to be removed in Firefox 35)
• Changed -- Firefox signed by Apple OS X version 2 signature
• Fixed -- CSS transitions start correctly when started at the same time as changes to display, position, overflow, and similar properties

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...