Critical Update To Mozilla Products

Mozilla have released updates to Firefox and Seamonkey browsers and Thunderbird email client to address a critical vulnerability (MFSA 2012-90).

Affected products are:
- Mozilla Firefox earlier than 16.0.2
- Mozilla Firefox ESR earlier than 10.0.10
- Mozilla Thunderbird earlier than 16.0.2
- Mozilla Thunderbird ESR earlier than 10.0.10
- Mozilla SeaMonkey earlier than 2.13.2


Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Adobe Shockwave Player Update Available

Adobe have released an updated version of their Shockwave Player. The new version fixes several security vulnerabilities. The update is categorized as critical with priority level as 2.

Users of Adobe Shockwave Player 11.6.7.637 and earlier should update to Adobe Shockwave Player 11.6.8.638.

More about fixed vulnerabilities and other information can be read from Adobe's security bulletin.

Java Security Updates From Oracle

Oracle have released update for Java JRE & JDK and JavaFX. The update fixes 30 vulnerabilities.

Affected versions are:
- Java 7 JRE and JDK update 7 and earlier
- Java 6 JRE and JDK update 35 and earlier
- Java 5.0 JRE and JDK update 36 and earlier
- Java 1.4.2 JRE and JDK update 38 and earlier
- JavaFX 2.2 and earlier

More information about the update can be read from Java critical patch update document.

Java users are recommended to update their versions to the latest one available as soon as possible.

Oracle Critical Patch Update For Q4 of 2012

Oracle have released updates for their products that fix 109 security issues in total. The updates are a part of Oracle's quarterly released critical patch update (CPU).

Detailed list of vulnerabilities with patching instructions can be read from Oracle CPU Advisory.

Next Oracle CPU is planned to be released in January 2013.

ESET Global Threat Report for September 2012

ESET has released a report discussing global threats of September 2012.

TOP 10 threats list (previous ranking listed too):

1. INF/Autorun (1.)
2. HTML/ScrInject.B (2.)
3. HTML/Iframe.B (5.)
4. Win32/Conficker (3.)
5. Win32/Sirefef (4.)
6. JS/Iframe (6.)
7. Win32/Dorkbot (7.)
8. Win32/Qhost (8.)
9. JS/TrojanDownloader.Iframe.NKE (9.)
10. Win32/Sality (10.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Symantec Intelligence Report: September 2012

Symantec has published their Intelligence report that sums up the latest threat trends for September 2012.

Report highlights:
- Spam – 75.0 percent (an increase of 2.7 percentage points since August)
- Phishing – One in 245.4 emails identified as phishing (an increase of 0.088 percentage points since August)
- Malware – One in 211.0 emails contained malware (an increase of 0.04 percentage points since August)
- Malicious websites – 780 websites blocked per day (a decrease of 29.1 percent since August)
- A look at how attackers administer malicious Web servers
- An innovative Android app that’s too good to be true



The report can be viewed here.

Mozilla Security Updates Available

Mozilla have released updates to Firefox and Seamonkey browsers and Thunderbird email client to address a bunch of vulnerabilities of which 13 categorized as critical and three as high.

Affected products are:
- Mozilla Firefox earlier than 16.0.1
- Mozilla Firefox ESR earlier than 10.0.9
- Mozilla Thunderbird earlier than 16.0.1
- Mozilla Thunderbird ESR earlier than 10.0.9
- Mozilla SeaMonkey earlier than 2.13.1

Links to the security advisories with details about addressed security issues:
MFSA 2012-89 defaultValue security checks not applied
MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)
MFSA 2012-87 Use-after-free in the IME State Manager
MFSA 2012-86 Heap memory corruption issues found using Address Sanitizer
MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer
MFSA 2012-84 Spoofing and script injection through location.hash
MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties
MFSA 2012-82 top object and location property accessible by plugins
MFSA 2012-81 GetProperty function can bypass security checks
MFSA 2012-80 Crash with invalid cast when using instanceof operator
MFSA 2012-79 DOS and crash with full screen and history navigation
MFSA 2012-78 Reader Mode pages have chrome privileges
MFSA 2012-77 Some DOMWindowUtils methods bypass security checks
MFSA 2012-76 Continued access to initial origin after setting document.domain
MFSA 2012-75 select element persistance allows for attacks
MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ rv:10.0.8)


Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Microsoft Security Intelligence Report Volume 13 Released

Microsoft have released volume 13 of their Security Intelligence Report (SIR)). The Security Intelligence Report (SIR) is an investigation of the current threat landscape. The report can be downloaded here.

Chrome Update Available

Google have released version 22.0.1229.92 of their Chrome web browser. New version contains fixes to five vulnerabilities:
- one critical (CVE-2012-5108)
- one high (CVE-2012-2900)
- two medium (CVE-2012-5109, CVE-2012-5110)
- one low (CVE-2012-5111)

More information in Google Chrome Releases blog.

Microsoft Security Updates For October 2012

Microsoft have released security updates for October 2012. This month update contains seven security bulletins of which one critical and six important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Flash Player and AIR Update Available

Adobe have released updated versions of their Flash Player and AIR. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.


Affected versions: - Users of Adobe Flash Player 11.4.402.278 and earlier versions for Windows should update to Adobe Flash Player 11.4.402.287
- Users of Adobe Flash Player 11.4.402.265 and earlier versions for Macintosh should update to Adobe Flash Player 11.4.402.287
- Users of Adobe Flash Player 11.2.202.238 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.243
- Users of Adobe Flash Player 11.1.115.17 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.20 (applicable only for Flash Player installed before August 15, 2012)
- Users of Adobe Flash Player 11.1.111.16 and earlier versions for Android 3.x and 2.x versions should update to Flash Player 11.1.111.19 (applicable only for Flash Player installed before August 15, 2012)
- Flash Player integrated with Google Chrome will be updated by Google via Chrome update
- Flash Player integrated with Internet Explorer 10 will be updated via Windows Update
- Users of Adobe AIR 3.4.0.2540 for Windows and Macintosh should update to Adobe AIR 3.4.0.2710
- Users of the Adobe AIR 3.4.0.2540 SDK (includes AIR for iOS) should update to the Adobe AIR 3.4.0.2710 SDK
- Users of the Adobe AIR 3.4.0.2540 and earlier versions for Android should update to the Adobe AIR 3.4.0.2710

More information can be read from Adobe's security bulletin.

Regulators Close Down Global Phone Tech Support Scam

Regulators from five countries joined forces together in an operation to shut down a global criminal network that allegedly bilked tens of thousands of consumers by pretending to be tech support providers.

"The scam involved cold callers who claimed to work for major technology companies, such as Microsoft or Google, and who told consumers they had viruses on their PCs, according to regulators. The callers would attempt to dupe users into giving them remote access to their computers, locking the user out while attempting to "fix" the malware that the scammer claimed was on the machine."

CNET article can be read here.