Microsoft July 2019 Security Updates

The July security updates have been released and consist of 78 CVEs and 2 advisories. Of these 78 CVEs, 15 are rated Critical, 62 are rated Important, and one is rated Moderate in severity. Six are listed as publicly known, and two are listed as under active attack at the time of release.

The updates address Spoofing, Elevation of Privilege, Remote Code Execution, Denial of Service,  Information Disclosure and Security Feature Bypass. They apply to the following:  Adobe Flash Player, Microsoft Windows, Internet Explorer, Microsoft Edge, Microsoft Office and Microsoft Office Services and Web Apps, Azure DevOps, Open Source Software, .NET Framework, Azure, SQL Server, ASP.NET, Visual Studio and Microsoft Exchange Server.

Known Issues:  See the Known Issues and accompanying work-around in the KB Articles:

KB Article	Applies To
4493730	Servicing stack update for Windows Server 2008 SP2
4507434	Internet Explorer 11
4507435	Windows 10, version 1803
4507448	Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
4507449	Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Monthly Rollup)
4507450	Windows 10, version 1703
4507453	Windows 10, version 1903, Windows Server version 1903
4507455	Windows 10, version 1709
4507457	Windows 8.1, Windows Server 2012 R2 (Security-only update)
4507458	Windows 10
4507460	Windows 10 1607 and Windows Server 2016
4507462	Windows Server 2012 (Monthly Rollup)
4507464	Windows Server 2012 (Security-only update)
4507469	Windows 10, version 1809, Windows Server 2019

Recommended Reading:  

See Dustin Childs review and analysis in Zero Day Initiative — The July 2019 Security Update Review.

For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes:

• Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
• MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
• Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. 
• Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are also available via the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.
• Windows Update History:
  • Windows 10
  • Windows 8.1
  • Windows 7

References

• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 68.0 Released With Security Updates

Mozilla sent Firefox Version 68.0 to the release channel today.  The update included twenty-one (21) security updates of which two (2) are critical, four (4) are high, ten (10) moderate and five (5) are rated low.

Correction:   Firefox ESR 60.8.0 has been released and the Extended Support Release version upgrade to 68.0 ESR is now available.

Critical

• # CVE-2019-11710: Memory safety bugs fixed in Firefox 68
• # CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8

High

• # CVE-2019-9811: Sandbox escape via installation of malicious language pack
• # CVE-2019-11711: Script injection within domain through inner window reuse
• # CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
• # CVE-2019-11713: Use-after-free with HTTP/2 cached stream

Moderate

• # CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread
• # CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault
• # CVE-2019-11715: HTML parsing error can contribute to content XSS
• # CVE-2019-11716: globalThis not enumerable until accessed
• # CVE-2019-11717: Caret character improperly escaped in origins
• # CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML
• # CVE-2019-11719: Out-of-bounds read when importing curve25519 private key
• # CVE-2019-11720: Character encoding XSS vulnerability
• # CVE-2019-11721: Domain spoofing through unicode latin 'kra' character
• # CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin

Low

• # CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries
• # CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions
• # CVE-2019-11725: Websocket resources bypass safebrowsing protections
• # CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3
• # CVE-2019-11728: Port scanning through Alt-Svc header

New

• Dark mode in reader view expands so that windows are also dark on the controls, sidebars and toolbars.
  
• Improved extension security and discovery:
  
  • New reporting feature in about:addons allows you to report security and performance issues with extensions and themes.
  • Redesigned extensions dashboard in about:addons provides easy access to information about your extensions, including data and settings access required by each extension.
  • Find high quality, secure extensions via the Recommended Extensions program in about:addons, which now displays user count and ratings for each extension. "Recommended” badges for these extensions also appear on AMO. More extensions will be added over time.
• Cryptomining and fingerprinting protections are added to strict content blocking settings in Privacy & Security preferences.
  
• WebRender will roll out to Windows 10 users with AMD graphics cards.
  
• Windows Background Intelligent Transfer Service (BITS) update download support, which allows Firefox update downloads to continue when Firefox is closed.

Fixed

• Local files can no longer access other files in the same directory.

Changed

• Unified existing locales (bn-BD, bn-IN) under a single Bengali (bn) localization.
  
• The following unmaintained translations have been removed: Assamese (as), English - South Africa (en-ZA), Maithili (mai), Malayalam (ml), Odia (or). Existing users will be migrated to the British English (en-GB) version.
  
• When an HTTPS error caused by antivirus software is detected, Firefox will attempt to automatically fix it
  
• Camera and microphone access now require an HTTPS connection.
  
• The way non-default preferences are synced has changed. Please see this support article for more details

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Update Released

Adobe has released Version 32.0.0.223 of Adobe Flash Player for Windows, macOS, Linux and Chrome OS. The update addresses bug fixes described in the Release Notes as "Assorted functional fixes". 

Release date:  July 9, 2019
Vulnerability identifier: None
Platform:  Windows, Macintosh, Linux and Chrome OS

Update:

• With the option to 'Allow Adobe to install updates', the update will be automatic. Without that setting enabled, either install the update via the update mechanism when prompted or via the Download Center*.
• Windows 7 and earlier:  Installation links for Windows 7 and earlier are provided by Adobe at Installation problems | Flash Player | Windows 7 and earlier: 
• Flash Player for Internet Explorer - ActiveX 
• Flash Player for Firefox/Pale Moon - NPAPI
• Flash Player for Opera and Chromium-based browsers - PPAPI
• Uninstaller (if needed) : http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe 
• Windows 8.1 and Windows 10:  Adobe Flash Player for Microsoft Edge and Internet Explorer 11 will be automatically updated to the latest version 10 via Windows Update.
• Google Chrome:  Adobe Flash Player will be automatically updated to the latest Google Chrome version.
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe
• Adobe AIR:  Adobe - Adobe AIR

*Important Note:  Downloading the update from the Adobe Flash Player Download Center link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras that you do not want.  They are not needed for the Flash Player update.

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings/Applications/Manage Applications/Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• Installing and Updating Flash Player - FAQ
• Release Notes
• Security Bulletin
• PSIRT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...