Adobe Acrobat DC and Reader DC Security Updates Released

Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user. 

 

Adobe has received a report that CVE-2021-28550 has been exploited in the wild in limited attacks targeting Adobe Reader users on Windows.

 

Release date:  May 11, 2021
Vulnerability identifier: APSB21-09
Platform: Windows and MacOS

Update or Complete Download

Reader DC and Acrobat DC were updated to version 21.001.20155.  Updates should become available via the internal updater or checks can be manually activated by choosing Help/Check for Updates.  Reader DC and other versions are available here: https://get.adobe.com/reader/

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Release Notes
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft May 2021 Security Updates

The Microsoft May 2021 security updates have been released and consist of 55 CVEs.  Of these 55 CVEs, 4 are rated Critical, 50 Important, and 1 is rated Moderate in severity.

 

According to Microsoft, although three of the bugs are listed as being publicly known, none are listed as currently being exploited.

  

The  updates apply to the following products: .NET Core & Visual Studio, HTTP.sys, Internet Explorer, Microsoft Accessibility Insights for Webk, Microsoft Bluetooth Driver, Microsoft Dynamics Finance & Operations, Microsoft Exchange Server, Microsoft Graphics Component, Microsoft Office, Microsoft Office Access, Microsoft Office Excel, Microsoft Office SharePoint, Microsoft Office Word, Microsoft Windows Codecs Library, Microsoft Windows IrDA, Open Source Software, Role: Hyper-V, Skype for Business and Microsoft Lync, Visual Studio, Visual Studio Code, Windows Container , Isolation FS Filter Driver, Windows Container Manager Service, Windows Cryptographic Services, Windows CSC Service, Windows Desktop Bridge, Windows OLE, Windows Projected File System FS Filter, Windows RDP Client, Windows SMB, Windows SSDP Service, Windows WalletService, and Windows Wireless Networking.

 

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

 

For Windows 10 Version 1909, see KB5003209.

 

The KBs listed below contain information about known issues with the security updates:

 

KB Article	Applies To
5003169	Windows 10, Version 1909, Windows Server, Version 1909
5003171	Windows 10, Version 1809, Windows Server 2019
5003173	Windows 10, Version 2004, Windows Server, Version 2004, Windows 10, Version 20H2, Windows Server, Version 20H2
5003197	Windows 10, Version 1607, Windows Server 2016
5003203	Windows Server 2012 (Security-only update)
5003208	Windows Server 2012 (Monthly Rollup)
5003209	Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
5003210	Windows Server 2008 SP2 (Monthly Rollup)
5003220	Windows 8.1 Windows Server 2012 R2 (Security-only update)
5003225	Windows Server 2008 SP2 (Security-only update)
5003228	Windows 7 SP2, Windows Server 2008 R2 (Security-only update)
5003233	Windows 7 SP2, Windows Server 2008 R2 (Monthly Rollup)
5003435	Exchange Server 2019, 2016, and 2013

 

 Recommended Reading:   See Dustin Childs review and analysis in Zero Day Initiative -- The May 2021 Security Update Review.

 

Additional Update Notes:

• MSRT -- The Malicious Software Removal Tool is now run on a quarterly basis rather than monthly.  See Remove specific prevalent malware with Windows Malicious Software Removal Tool.
• Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001.
• Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are also available via the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.
• Windows Update History:
• Windows 10
• Windows 8.1

 

References

• Security Update FAQ
• April Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 88.0.1 and ESR Version 78.10.1 Released With Security Updates

Mozilla sent Firefox Version 88.0.1 to the release channel today.  The update includes two security updates of which one (1) is rated critical and one (1) is rated high.

 

In addition, Firefox ESR was updated to Version 78.10.1 with one (1) security update, rated moderate:

#CVE-2021-29951: Mozilla Maintenance Service could have been started or stopped by domain users

Critical
 

• #CVE-2021-29953: Universal Cross-Site Scripting

High

• #CVE-2021-29952: Race condition in Web Render Components

 

Fixed

• Resolved an issue caused by a recent Widevine plugin update which prevented some purchased video content from playing correctly (bug 1705138)
• Fixed corruption of videos playing on Twitter or WebRTC calls on some Gen6 Intel graphics chipsets (bug 1708937)
• Fixed menulists in Preferences being unreadable for users with High Contrast Mode enabled (bug 1706496)

Update:  To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

 

References

• Security Updates
• Release Notes
• Rapid Release Calendar

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...