Patch Tuesday for August 2017

It’s once again time for the monthly headache otherwise known as Patch Tuesday.

As you’re no doubt aware from my previous whining, Microsoft no longer publishes a bulletin for each update, and finding useful information in the Security Update Guide is awkward at best. It feels like Microsoft is trying to get everyone to just give up and enable auto-update. Of course with Windows 10 you no longer have a choice: you get updates when Microsoft wants you to have them. Which is one of the reasons I don’t use that particular O/S.

From my analysis of the Security Update Guide‘s entries for August 2017, it appears that we have thirty-nine updates, addressing fifty-three vulnerabilities in Internet Explorer, Edge, Windows, SharePoint, Adobe Flash Player, and SQL Server. Eighteen of the updates are flagged as Critical. Time to fire up Windows Update on all your Windows 8.1 and Windows 7 computers.

Adobe released updates for Flash and Reader today. The Reader update (Reader DC/Continuous: 2017.012.20093; Reader 2017: 2017.011.30059; Reader DC/Classic: 2015.006.30352) addresses sixty-seven vulnerabilities. The Flash update (version 26.0.0.151) addresses two vulnerabilities. Anyone still using Flash or Reader, especially as web browser plugins, should install the new versions as soon as possible.

Flash will plague us no longer… after 2020

Flash was a useful gadget at one time. Used by everyone to play animation, games, and other multimedia content, it was on almost every Windows PC and many mobile devices.

At some point, unknown persons took it upon themselves to determine whether this ubiquitous chunk of software had any weaknesses. And boy, were they rewarded. Flash has, at times, seemed like a bottomless well of security vulnerabilities. No sooner was one hole closed, than another was revealed.

In hindsight, one wonders whether Adobe could have saved Flash with a major, security-focused rewrite. But that’s not what happened. Instead, Adobe kept up the little Dutch boy act, plugging each hole as it was discovered. During this time, Adobe’s updates to Flash sometimes seemed to create more problems than they solved.

Which brings us to the present. The major web browsers have either already dumped support for Flash, or are in the process of doing so. According to Adobe, Flash is still scheduled for its trip behind the woodshed in 2020. Prior to its final exit, Flash will gradually disappear from most of its remaining hiding places.

What remains of Flash will exist in systems that are not easily updated: A/V and advertising kiosks, PCs in business and industry running old versions of Windows, and a few dying phones.

That just leaves one question: what’s the next piece of software that will drive us crazy with terrible security and endless updates?

Peter Bright is a bit sad about the impending demise of Flash.

Brian Krebs provides some additional details.