Category Archives: Flash

Patch Tuesday for October 2013

Patches from Microsoft and Adobe were announced today, along with a new version of Flash.

Eight bulletins from Microsoft fix security vulnerabilities in Windows, Internet Explorer, .NET, Office, Windows Server and Silverlight.

The Microsoft Security Research Center as usual provides a more friendly overview of this month’s patches, while the SANS Internet Storm Center provides a wealth of technical details.

Two bulletins from Adobe fix security vulnerabilities in Adobe Reader/Acrobat and Robohelp.

Flash 11.9.900.117 includes a long list of bug fixes. Chrome will be updated silently to match the new version of Flash. An update for Internet Explorer 10 on Windows 8 is also on the way.

Another bug fix for ActiveX version of Flash

Adobe released new versions of Flash for all platforms on September 10. A few days later, they released a new ActiveX version (11.8.800.174) to fix some bugs that were discovered in the previous release.

Today, Adobe released yet another ActiveX version of Flash to fix one more bug. The new version (11.8.800.175) is now available, but only via the Flash auto-updater.

For some unknown reason, Adobe has not posted the new version to the main download page, so anyone trying to update Flash in Internet Explorer by visiting this page will have no luck. According to Adobe, they hope to have version 11.8.800.175 available on the main download page on September 24.

Internet speed tests

I’ve tried a lot of different broadband speed tests. Up until the last year or two, they usually agreed fairly closely when measuring my connection. Recently, the reported speeds have been much more diverse.

Why do the results vary so much? Is there a truly accurate test out there?

It turns out that most of the speed tests offered by Internet Service Providers (ISPs) are actually using the same Flash-based test, provided by a company called Ookla. I’ve read that Flash-based tests are all currently unreliable due to technical limitations in the current versions of Flash. Here’s an excerpt from the TestMy.net web site:

There is buffering between the application and the browser and throughput bursting due to CPU usage. Flash based tests need to make adjustments for this… rough estimate adjustments of up to 40 percent. How can the test be accurate if it’s being adjusted by 30-40% to offset an unknown variable.

Emphasizing this problem with Flash-based tests is my recent experience with very slow speeds from my provider, Shaw. Shaw’s own test showed results that match exactly what I’m paying for: 25 Mbps down; 2.5 Mbps up. This made no sense, since even basic web surfing was painfully slow. I reported the problem; Shaw eventually found the cause and fixed it. Everything went back to normal: web surfing was extremely fast again. But what did Shaw’s Flash-based test show? The same results as when speeds were clearly slow.

So I started looking specifically for non-Flash tests. I’ve found two HTML5-based tests that seem to be much more reliable and accurate than the Flash-based tests: SpeedOf.Me and TestMy.net. Both of these tests avoid the problems inherent in Flash-based tests. Both also offer additional features, such as comparisons with previous tests and other test results in your region and from your ISP, and graphs that show previous test results.

But my overall favourite is SpeedOf.Me, because it comes closest to showing the actual speeds I’m experiencing at any given time.

Here’s a list of the speed tests I’ve looked at:

Flash 11.8.800.168 fixes several security vulnerabilities

A new version of Flash was announced by Adobe today. Version 11.8.800.168 fixes four critical vulnerabilities. The official release announcement from Adobe provides details on all of the changes in this new version.

Anyone who uses a Flash-enabled web browser should install the new version as soon as possible. That includes anyone who uses Youtube.

The changes in this version will be ported to the Chrome web browser as embedded Flash version 11.8.800.170. Flash updates for Chrome tend to happen silently in the background. You can see what version of Flash Chrome is currently running by browsing to the chrome://flash/ page. Recently, the version of Flash in Chrome mysteriously rolled back to 11.8.800.97, so it will be interesting to see what happens with 11.8.800.170 (Chrome finally updated itself with Flash 11.8.800.170 on 2013Sep18, a delay of one week, which is somewhat alarming. The version of Chrome itself also changed at the same time, to 29.0.1547.76.)

Internet Explorer 10 on Windows 8 also uses embedded Flash code. Microsoft Security Advisory 2755801, now available from Windows Update, patches IE10 on Windows 8 to use the new Flash version 11.8.800.168.

More malicious email and web site warnings

As if you needed more reasons to be cautious when using email or browsing the web, here are two new warnings, from CERT and Malwarebytes.

According to CERT and the FBI, a new, active spear-phishing campaign is sending email to targeted recipients. This particular email purports to be from “National Center for Missing and Exploited Children” and its subject line is “Search for Missing Children”. Do not open this email or any of its attachments, which contain malware.

Malwarebytes, a respected anti-malware software vendor, recently posted a warning about fake Flash player updates that appear on some (mostly pornographic) web sites. Users are tricked into clicking a link that supposedly updates the Flash player, but actually installs malware. Once the malware is installed, legitimate web-based advertisements will be replaced by ads served by the perpetrators. The new ads are often pornographic in nature, and can appear over ads on any web site.

Updates for Flash

Version 11.8.800.94 of Flash was announced today. As always, “[t]hese updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.” For a more complete change list for this version, see the Flash Player 11.8 Release Announcement on the Flash Runtime Announcements page.

A patch for Internet Explorer 10 that includes a new version of Flash (also 11.8.800.94) was released by Microsoft today as well.

An update for Flash in Chrome should also become available from Google in the near future. The new version of Flash in Chrome will be 11.8.800.97.