Category Archives: Patches and updates

Firefox, Patches and updates

Firefox 24 released

Leave a comment

Most of the world considers a version increase from 23.x to 24 to represent a major release, with many new and changed features. Not so with Firefox. In the interest of marketing, Mozilla has tossed out anything resembling industry standards for naming Firefox’s version numbers.

Version 24 of Firefox fixes a few minor bugs and adds some very minor enhancements: nothing worthy of a major version increase. Version 24 does include several security fixes, which can be seen on the Security Advisories page.

I suppose it almost goes without saying by now, but the release notes and related announcements for Firefox still leave a lot to be desired (see my post about Firefox 23 for details).

Java, Patches and updates

Java 7 update 40 released with no announcement

Leave a comment

A new version of Java was released yesterday with zero fanfare from Oracle. Presumably that’s because there are no security vulnerability fixes in this release, since normally there would be an announcement on Oracle’s Critical Patch Updates, Security Alerts and Third Party Bulletin blog.

The update is listed on the main release notes page for Java 7. The release notes page for 7u40 shows that there have been a lot of changes in this release, including some related to security, but no fixes for specific security vulnerabilities. The complete list of bugs fixed in this release is enormous.

It will be interesting to see what Adam Gowdiak says about this release, since some of the vulnerabilities he has reported still existed in the previous Java release, 7u25. Update 2013Sep24: According to the vendor log on the Security Explorations site, “Oracle provides a monthly status report for the reported issues. The company informs that Issue 69 is fixed in main codeline and is scheduled for a future CPU.” In other words, Issue 69 is STILL not fixed.

Internet Explorer, Microsoft, Patches and updates, Security, Windows

Patch Tuesday for September 2013

Leave a comment

Another month, another pile of patches from Microsoft. This month there are fourteen bulletins, addressing security vulnerabilities in Windows, Internet Explorer, Office, and the .NET framework. Four of the bulletins are rated Critical.

As usual, the updates will become available after 10am PST from Windows Update.

The SANS Internet Storm Center has a detailed look at the vulnerabilities addressed by this month’s patches.

The Microsoft Security Response Center has a somewhat friendlier summary of this month’s updates.

Adobe, Chrome, Flash, Internet Explorer, Patches and updates, Security, Windows, Windows 8.x

Flash 11.8.800.168 fixes several security vulnerabilities

1 Comment

A new version of Flash was announced by Adobe today. Version 11.8.800.168 fixes four critical vulnerabilities. The official release announcement from Adobe provides details on all of the changes in this new version.

Anyone who uses a Flash-enabled web browser should install the new version as soon as possible. That includes anyone who uses Youtube.

The changes in this version will be ported to the Chrome web browser as embedded Flash version 11.8.800.170. Flash updates for Chrome tend to happen silently in the background. You can see what version of Flash Chrome is currently running by browsing to the chrome://flash/ page. Recently, the version of Flash in Chrome mysteriously rolled back to 11.8.800.97, so it will be interesting to see what happens with 11.8.800.170 (Chrome finally updated itself with Flash 11.8.800.170 on 2013Sep18, a delay of one week, which is somewhat alarming. The version of Chrome itself also changed at the same time, to 29.0.1547.76.)

Internet Explorer 10 on Windows 8 also uses embedded Flash code. Microsoft Security Advisory 2755801, now available from Windows Update, patches IE10 on Windows 8 to use the new Flash version 11.8.800.168.