Mozilla Firefox 29

Mozilla sent Firefox Version 29.0, referred to as Australis, to the release channel.

Edit:  No security updates are included in the update.   Security updates have been published.  The update includes five (5) Critical, six (6) High and three (3) Moderate updates.

The update to Australis incorporates major GUI (Graphic User Interface) changes.  Some of those changes include the following:

• Removal of the Firefox button, replaced with three diagonal lines located to the far right in the Navigation Toolbar.
• If you used the add-on bar, it is now gone with the content moved to navigation bar.
• The bookmarks icon is no longer available in the Address Bar and has been merged with the bookmarks button.
• The ability to move some elements such as the back and forward buttons has been removed.
• Elimination of small icons and no option to display icons and text in the interface.

After you have had an opportunity to experiment with the changes, if your experience with the updated version is similar to mine and there are some you just don't think you can live with, check out the suggestions at gHacks on How to turn the new Firefox 29 into the old Firefox.

You could also switch to the Pale Moon Browser, based on Firefox ESR.  The developer is fast to include any needed security fixes but doesn't make changes merely for the sake of change.

Personal comment:  These latest changes to Firefox have resulted in a rather ugly interface.  I'm glad I switched to Pale Moon as my go-to browser.

Fixed in Firefox 29

• MFSA 2014-47 -- Debugger can bypass XrayWrappers with JavaScript
• MFSA 2014-46 -- Use-after-free in nsHostResolve
• MFSA 2014-45 -- Incorrect IDNA domain name matching for wildcard certificates
• MFSA 2014-44 -- Use-after-free in imgLoader while resizing images
• MFSA 2014-43 -- Cross-site scripting (XSS) using history navigations
• MFSA 2014-42 -- Privilege escalation through Web Notification API
• MFSA 2014-41 -- Out-of-bounds write in Cairo
• MFSA 2014-40 -- Firefox for Android addressbar suppression
• MFSA 2014-39 -- Use-after-free in the Text Track Manager for HTML video
• MFSA 2014-38 -- Buffer overflow when using non-XBL object as XBL
• MFSA 2014-37 -- Out of bounds read while decoding JPG images
• MFSA 2014-36 -- Web Audio memory corruption issues
• MFSA 2014-35 -- Privilege escalation through Mozilla Maintenance Service Installer
• MFSA 2014-34 -- Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

What’s New

• New -- Significant new customization mode makes it easy to personalize your Web experience to access the features you use the most (learn more)
• New -- A new, easy to access menu sits in the right hand corner of Firefox and includes popular browser controls
• New -- Sleek new tabs provide an overall smoother look and fade into the background when not active
• New -- An interactive onboarding tour to guide users through the new Firefox changes
• New -- The ability to set up Firefox Sync by creating a Firefox account (learn more)
• New -- Gamepad API finalized and enabled (learn more)
• New -- Malay [ma] locale added
• Changed -- Clicking on a W3C Web Notification will switch to the originating tab

Known Issues

• unresolved -- Text Rendering Issues on Windows 7 with Platform Update KB2670838 (MSIE 10 Prerequisite) or on Windows 8.1 has a workaround (see 812695)
• unresolved -- Without affecting security, after restoring your session, Extended Validation Certificates might not display (See 995801)

Update

To get the update now, select "Help" from the Firefox menu at the upper left of the browser window, then pick "About Firefox."  Mac users need to select "About Firefox" from the Firefox menu.

If you do not use the English language version, Fully Localized Versions are available for download.

References

• Common questions after updating Firefox
• Security Updates
• Mozilla Firefox Release Notes
• Bug Fixes 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Adobe Flash Player Critical Security Updates

Adobe has released security updates for Adobe Flash Player 13.0.0.182 and earlier versions for Windows, version 13.0.0.201 and earlier versions for Macintosh and Adobe Flash Player 11.2.202.350 and earlier versions for Linux.

With today's Windows Update, Internet Explorer 10 and 11 in Windows 8 and Windows 8.1 will be updated.  Windows RT must obtain the update from Windows Update.  Google Chrome will be automatically updated. 

These updates are rated as "Critical".  However, the updates do not address the zero-day vulnerability in Internet Explorer versions 6-11, which will require a Microsoft update to IE.  

Windows XP 

Since Windows XP is out of support, Microsoft will not be releasing an IE update for Windows XP.  Anyone still using Windows XP and unable to move to a new computer/operating system, first should use an alternate browser.  In addition, unregister the VGX.DLL file as shown in Paul Ducklin's instructions here.

Update Information

The newest versions are as follows:

Windows and Macintosh:  13.0.0.206
Linux: 11.2.202.350

Release date: April 28, 2014
Vulnerability identifier: APSB14-13
CVE number: CVE-2014-0515
Platform: All Platforms

Flash Player Update Instructions

Warning:  Although Adobe suggests downloading the update from the Adobe Flash Player Download Center, that link includes a pre-checked option to install unnecessary extras, such as McAfee Scan Plus or Google Drive.  If you use the download center, uncheck any unnecessary extras.

It is recommended that you either use the auto-update mechanism within the product when prompted, or my preference, the direct download links.

• Non-IE (Opera, Firefox, Etc.):  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_13_plugin.exe
   
• Windows XP, Vista and 7:
  Flash Player For Internet Explorer 7, 8, 9, 10, 11:  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_13_active_x.exe
  
  Windows 8 and 8.1:
  Flash Player for Internet Explorer 10 and 11: Microsoft updated Security Advisory 2755801.  If you do not have Automatic Updates enabled, the Flash Player update can be downloaded from Microsoft Security Advisory: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10: July 9, 2013.
  
  
• Flash Player Uninstaller:  http://download.macromedia.com/get/flashplayer/current/support/uninstall_flash_player.exe

Notes:

• If you use the Adobe Flash Player Download Center, be careful to uncheck any optional downloads that you do not want.  Any pre-checked option is not needed for the Flash Player update.
• Uncheck any toolbar offered with Adobe products if not wanted.
• If you use alternate browsers, it is necessary to install the update for both Internet Explorer as well as the update for alternate browsers.
• The separate 32-bit and 64-bit uninstallers have been replaced with a single uninstaller.
• As requested by a Security Garden reader, the update information for the "Extended Release of Flash Player 11.7" can be found here. Note, however, that beginning May 13, 2014, Adobe Flash Player 13 for Mac and Windows will replace version 11.7 as the extended support version.

Adobe Flash Player for Android

The latest version for Adobe Flash Player for Android is available by downloading it from the Android Marketplace by browsing to it on a mobile phone.   

Verify Installation

To verify the Adobe Flash Player version number installed on your computer, go to the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe Flash Player" from the menu. 

Do this for each browser installed on your computer.

To verify the version of Adobe Flash Player for Android, go to Settings > Applications > Manage Applications > Adobe Flash Player x.x.

References

• Adobe Priority Ratings
• AIR Download Center 
• PSIRT Blog Post
• Security Bulletin: APSB14-13
• Release Notes:  Flash Player® 13 AIR® 13

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Security Advisory 2963983, IE Zero-Day Vulnerability

Microsoft released Security Advisory 2963983 which relates to a vulnerability in Internet Explorer.

With the vulnerability, an attacker could cause remote code execution if someone visited a malicious website with an affected browser. Generally, this would occur by an attacker convincing someone to click a link in an email or instant message.

Although the vulnerability affects all versions of IE, at this time, Microsoft is aware of limited, targeted attacks, in which the exploit observed appears to target IE9, IE10 and IE11.


Additional details about the exploit are available from the FireEye Blog, New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks.

Recommendations 

As illustrated in the "Security Research and Defense Blog" reference below, users of IE 10 and 11 should ensure they haven't disabled Enhanced Protection Mode. 

Another option is to install the Enhanced Mitigation Experience Toolkit (EMET).  The recommended setting for EMET 4.1, available from KB Article 2458544, is automatically configured to help protect Internet Explorer. No additional steps are required.

See the Tech Net Advisory for instructions on changing the following settings to help protect against exploitation of this vulnerability:

• Change your settings for the Internet security zone to high to block ActiveX controls and Active Scripting
• Change your settings to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone. 

References:

• CVE Reference:  CVE-2014-1776
• Microsoft KB Article 2953095: Microsoft security advisory: Vulnerability in Microsoft Word could allow remote code execution
• MSRC: Microsoft Releases Security Advisory 2963983
• Security Research & Defense: More Details about Security Advisory 2963983 IE 0day
• Tech Net Advisory:  Microsoft Security Advisory (2963983) Vulnerability in Internet Explorer Could Allow Remote Code Execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...