boot13It’s Patch Tuesday and Microsoft has released seven security bulletins, affecting Windows, Word, Internet Explorer and other Microsoft software. A total of 20 vulnerabilities are addressed by the updates. We covered the details in a previous post. As always, we encourage everyone running affected software to apply the updates as soon as possible.
Category Archives: Patches and updates
More security fixes for Adobe Flash
Released yesterday, version 11.4.402.287 addresses security, performance and stability issues in the previous versions of Flash. Users are encouraged to install the new Flash as soon as possible.
Note that at the time of this post, the Flash Player Update Announcement on Adobe’s site shows the wrong version in the first paragraph. It should show the new version as 11.4.402.287 but instead shows it as 11.4.402.278.
Updates for Internet Explorer 10 and Google Chrome, containing associated fixes for Adobe Flash, were also released yesterday.
Google Chrome Version 22.0.1229.92 released
There’s another new version of Google’s Chrome web browser. Version 22.0.1229.92 addresses several security holes and includes a new version of Flash. The full details are available in the update announcement.
October 2012 Patch Tuesday Advance Notice
Another month, another batch of updates from Microsoft. On October 9, starting at about 10 am PDT, Microsoft will release patches that address a total of twenty vulnerabilities in Windows and Office. Seven security bulletins will cover the defects being patched, one of which is a critical vulnerability in Word.
Also included in the upcoming updates will be Microsoft Security Advisory (2661254): Update For Minimum Certificate Key Length. This update is the final step in a series of actions taken by Microsoft to improve Internet-based security for its products. This update will force RSA-encrypted communications in Internet Explorer and Outlook to use keys that are 1024 bits in length or greater. If you access secure web sites with Internet Explorer or use encrypted email with Outlook, this update may cause those services to stop working. For further details, see:
Another new version of Google Chrome
Google’s been busily fixing security holes and adding interesting new features to its web browser.
The latest version of Chrome is 22.0.1229.79, and it includes fixes for at least forty-two vulnerabilities, as well as some enhancements specific to Windows 8, and a new ability for Javascript called ‘Pointer Lock‘.
New version of Flash
Version 11.4.402.278 of Flash for Internet Explorer and other major Windows web browsers was released on September 18 with little or no fanfare. No release notes are yet available, so it’s unclear what changes were made in the new version. Additional information will be posted here as it becomes available.
Firefox 15.0.1 released
Another new version of Firefox was made available on September 7. Firefox 15.0.1 corrects some serious security issues in the recently-released version 15.0. The most important fix affects anyone using ‘Private Browsing’ mode.
The release notes list all of the changes.
Patch Tuesday for September 2012
It’s a light month for Microsoft patches. Many users won’t be affected at all by the two updates announced by Microsoft for release today, since those updates are for Windows development and server software.
Windows 8 Internet Explorer shipping with vulnerable Flash
Update 2012Sep22: A Security Advisory published yesterday by Microsoft announced the availability of a patch for Flash in Internet Explorer 10. A related post on the Microsoft Security Response Center blog explains how security updates for Flash in Internet Explorer will be handled in the future. Anyone using Internet Explorer 10 or Windows 8 should install the Flash update as soon as possible.
Update 2012Sep11: Given the negative reaction to Microsoft’s previous announcement that recent Flash vulnerabilities would not be fixed in Internet Explorer 10 until after Windows 8 is released, today’s announcement is perhaps not much of a surprise. Microsoft is now saying that the Flash holes in IE10 will be plugged much sooner than originally announced. However, there will still be an easily-exploited delay between the launch of Windows 8 and the point at which all Windows 8 systems are patched.
Recently, Google switched to an integrated version of Flash in the Chrome web browser. They did this to simplify the update process: Chrome users no longer have to worry about keeping their browser’s Flash plugin up to date.
Microsoft has apparently done something similar with Internet Explorer 10, which is included with Windows 8. Unfortunately, the recent Flash vulnerabilities were not addressed in Internet Explorer 10 when Windows 8 was finalized recently. Which means Windows 8 has at least two very serious security holes in its integrated web browser, out of the box.
Microsoft says that the Flash vulnerabilities in Windows 8’s IE10 will be fixed during the regular patch cycle, but it’s not known exactly when the updates will appear.
Nefarious hackers are no doubt preparing for a surge of new Windows 8 systems to appear on the Internet, all with these rather large holes, ready to exploit.
If you are using Windows 8 or plan to start using it soon, your options are:
- Stop using Internet Explorer. This isn’t really a viable option, since the browser is integrated into the O/S.
- Disable Flash in Internet Explorer 10, assuming this is even possible.
- Avoid all Flash content while using Internet Explorer 10. This is increasingly difficult to accomplish, given the prevalence of Flash content on the web.
WordPress version 3.4.2 released
A new version of WordPress was made available today. Version 3.4.2 contains several bug fixes, including some related to security.
Anyone running a WordPress site/blog should install the new version as soon as possible. WordPress is a popular target among site hackers and malware purveyors.