Microsoft January 2022 Security Updates

       

The Microsoft January 2022 security updates have been released and consist of 96 CVEs.  Of these CVEs, 9 are rated Critical, and 89 are rated Important severity.  At the time of release, six are listed as publicly known but none are listed as under active exploit.

The updates apply to a very long list of products, available here.  Additionally announced in the Release Notes is a new notification system.  See Coming Soon: A Brand-New Notification System!

See the KBs listed at January 2022 Security Updates - Release Notes - Security Update Guide - Microsoft for information regarding known issues with the security updates as well as the CVEs with FAQs, Mitigations and/or Workarounds.

Recommended Reading:   See Dustin Childs review and analysis in Zero Day Initiative -- The January 2022 Security Update Review.

 

Additional Update Notes:

• MSRT -- The Malicious Software Removal Tool is now run on a quarterly basis rather than monthly.  See Remove specific prevalent malware with Windows Malicious Software Removal Tool. 
• Servicing Stack Updates -- Microsoft now combines the latest servicing stack update (SSU) for your operating system with the Latest Cumulative Updates (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.
  
• Windows updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows, in addition to non-security updates. The updates are also available via search for the KB number in the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 and Windows 11 operating systems, please see Windows 10 Home and Pro - Microsoft Lifecycle | Microsoft Docs and Windows 11 Home and Pro (Version 21H2) - Microsoft Lifecycle | Microsoft Docs.
• Windows Update History:
• Windows 11
• Windows 10
• Windows 8.1

 

References

• Security Update FAQ
• Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

 

Adobe Acrobat DC and Reader DC Security Updates Released

     

Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address multiple critical and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, memory leak, application denial of service, security feature bypass and privilege escalation 

 

Release date:  January 11, 2022
Vulnerability identifier: APSB21-104
Platform: Windows and MacOS

Update or Complete Download

Reader DC and Acrobat DC were updated to version 21.011.20039.  Updates should become available via the internal updater or checks can be manually activated by choosing Help/Check for Updates.  Reader DC and other versions are available here: https://get.adobe.com/reader/

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.

References

• PSIRT
• Release Notes
• Security Bulletin
• System Requirements

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Mozilla Firefox Version 96.0 Released with Security Updates

        Mozilla sent Firefox Version 96.0 to the release channel today.  The update includes eighteen security updates of which nine (9) are rated high, six (6) are rated moderate, and three (3) are rated low.

Firefox ESR was updated to Version 91.5.

High

• #CVE-2022-22746: Calling into reportValidity could have lead to fullscreen window spoof
• #CVE-2022-22743: Browser window spoof using fullscreen mode
• #CVE-2022-22742: Out-of-bounds memory access when inserting text in edit mode
• #CVE-2022-22741: Browser window spoof using fullscreen mode
• #CVE-2022-22740: Use-after-free of ChannelEventQueue::mOwner
• #CVE-2022-22738: Heap-buffer-overflow in blendGaussianBlur
• #CVE-2022-22737: Race condition when playing audio files
• #CVE-2021-4140: Iframe sandbox bypass with XSLT
• #CVE-2022-22751: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

Moderate

• #CVE-2022-22750: IPC passing of resource handles could have lead to sandbox bypass
• #CVE-2022-22749: Lack of URL restrictions when scanning QR codes
• #CVE-2022-22748: Spoofed origin on external protocol launch dialog
• #CVE-2022-22745: Leaking cross-origin URLs through securitypolicyviolation event
• #CVE-2022-22744: The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection
• #CVE-2022-22752: Memory safety bugs fixed in Firefox 96

 Low

• CVE-2022-22747: Crash when handling empty pkcs7 sequence
• #CVE-2022-22736: Potential local privilege escalation when loading modules from the install directory.
• #CVE-2022-22739: Missing throttling on external protocol launch dialog

New

• We’ve made significant improvements in noise-suppression and auto-gain-control as well as slight improvements in echo-cancellation to provide you with a better overall experience.
• We’ve also significantly reduced main-thread load.
• Firefox will now enforce the Cookie Policy: Same-Site=lax by default which provides a solid first line of defense against Cross-Site Request Forgery (CSRF) attacks.
• 
  

Fixed

• On macOS, command-clicking links in Gmail now opens them in a new tab as expected.
• Our newest release fixes an issue where video intermittently drops SSRC.
• It also fixes an issue where WebRTC downgrades screen sharing resolution to provide you with a clearer browsing experience.
• Plus, we’ve fixed video quality degradation issues on certain sites.
• Detached video in fullscreen on macOS has been temporarily disabled to avoid some issues with corruption, brightness changes, missing subtitles and high cpu usage. 

Update: To get the update now, select "Help" from the Firefox menu, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu. If you do not use the English language version, Fully Localized Versions are available for download.

References

• Security Updates
• Release Notes
• Rapid Release Calendar