Ciritical Vulnerability In PHPMailer

There has been found a critical vulnerability in PHPMailer library. The vulnerability (CVE-2016-10033) is related to the way that websites handle web-based email submission forms using the PHPMailer component. PHPMailer is used by many popular web-publishing platforms such as WordPress, Drupal and Joomla.

Affected versions:
PHPMailer versions earlier than 5.2.18

Fresh version of the PHPMailer can be downloaded here.

More information:
about the vulnerability
Drupal advisory

VMware ESXi Updates Available

VMware has released security update to patch a cross-site scripting issue in VMware ESXi.

Affected versions:
- VMware ESXi 6.0 without patch ESXi600-201611102-SG
- VMware ESXi 5.5 without patch ESXi550-201612102-SG

Further information including updating instructions can be read from VMware's security advisory.

Mozilla Firefox Updates Released

Mozilla have released updates to Firefox browser to address security vulnerabilities of which some are critical.

Affected products are:
- Mozilla Firefox earlier than 50.1
- Mozilla Firefox earlier than ESR 45.6

Lists of the fixed vulnerabilities:
Firefox ESR 45.6
Firefox 50.1

Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix a critical vulnerability that could potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 23.0.0.207 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 24.0.0.186

- Users of Adobe Flash Player 11.2.202.644 and earlier versions for Linux should update to Adobe Flash Player 24.0.0.186

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.1 and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

ESET Threat Radar Report for November 2016

ESET have published a report discussing global threats of November 2016.

TOP 10 threats list (previous ranking listed too):
1. JS/Danger.ScriptAttachment (1.)
2. Win32/TrojanDownloader.Wauchos (2.)
3. LNK/Agent.DA (4.)
4. Win32/Bundpil (5.)
5. Win64/TrojanDownloader.Wauchos (6.)
6. JS/ProxyChanger (9.)
7. JS/TrojanDownloader.FakejQuery (-)
8. HTML/Refresh (9.)
9. HTML/FakeAlert (8.)
10. Win32/Adware.ELEX (-)

Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Microsoft Security Updates For December 2016

Microsoft have released security updates for December 2016. This month update contains 12 security bulletins of which six categorized as critical and six as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Symantec Intelligence Report: November 2016

Symantec have published their Intelligence report that sums up the latest threat trends for November 2016.

The report can be viewed here.

New PHP Versions Released

PHP development team has released 7.0.14 and 5.6.29 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.14
Version 5.6.29

Google Chrome Updated

Google have released a version 55.0.2883.75 of their Chrome web browser. Among other changes the new version contains 36 security fixes. More information about changes in Google Chrome Releases blog.

Updates To Mozilla Products Released

Mozilla have released updates to Firefox browser and Thunderbird email client to address a critical vulnerability.

Affected products are:
- Mozilla Firefox earlier than 50.0.2
- Mozilla Firefox earlier than ESR 45.5.1
- Mozilla Thunderbird earlier than 45.5.1


Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird

New Version Of Foxit Reader And Foxit PhantomPDF Available

Foxit Software has released version 8.1.1 of their Foxit Reader and Foxit PhantomPDF software. The new versions contains fixes for security vulnerabilities that if exploited may allow an attacker to execute arbitrary code in target system.

Affected versions:
Foxit Reader 8.1.0.1013 and earlier (Windows)
Foxit PhantomPDF 8.1.0.1013 and earlier (Windows)

More information can be read here.

Vulnerabilities Fixed In Wireshark

There have been fixed vulnerabilities in Wireshark, free open source program for analyzing network protocols.

Vulnerable are 2.0.x versions 2.0.0-2.0.7 and 2.2.x versions 2.2.0-2.2.1

Non vulnerable version can be downloaded here.

More information can be read from the related advisories:
- wnpa-sec-2016-62
- wnpa-sec-2016-61
- wnpa-sec-2016-60
- wnpa-sec-2016-59
- wnpa-sec-2016-58

Google Chrome Updated

Google have released updated versions (54.0.2840.99 for Windows, 54.0.2840.98 for Mac, and 54.0.2840.100 on Linux) of their Chrome web browser. Among other changes the new versions contain security vulnerability fixes. More information about changes in Google Chrome Releases blog.

New PHP Versions Released

PHP development team has released 7.0.13 and 5.6.28 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.13
Version 5.6.28

VMware Updates Available

VMware has released security update to patch an out-of-bounds memory access vulnerability (CVE-2016-7461) in their virtualization applications. The vulnerability may allow a guest to execute code on the operating system that runs affected version of Workstation or Fusion.

Affected versions:
- VMware Workstation Pro versions earlier than 12.5.2
- VMware Player versions earlier than 12.5.2
- VMware Fusion and Fusion Pro earlier than 8.5.2

Further information including updating instructions can be read from VMware's security advisory.

Google To Flag Malware Spreading Sites For A Month

Google has introduced a new class in its Safe Browsing anti-malware system called "repeat offenders". This status is reserved for websites "that repeatedly switch between compliant and policy-violating behavior for the purpose of having a successful review and having warnings removed". Once site has been determined as a repeat offender the webmaster will be unable to request additional reviews via the Search Console for 30 days and warnings continue to show to users. According to Google the new class won't be used on hacked websites.

More information in Google's blog post.

Adobe Connect Update Available

Adobe have released updated versions of Adobe Connect for Windows. The new update resolves an input validation vulnerability in the events registration module that could be used in cross-site scripting attacks.

Affected versions:
- Adobe Connect earlier than 9.5.7


More information can be read from Adobe's security bulletin.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix a critical vulnerability that could potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 23.0.0.205 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 23.0.0.207

- Users of Adobe Flash Player 11.2.202.643 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.644

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.1 and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

Microsoft Security Updates For November 2016

Microsoft have released security updates for November 2016. This month update contains 14 security bulletins of which six categorized as critical and eight as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Symantec Intelligence Report: October 2016

Symantec have published their Intelligence report that sums up the latest threat trends for October 2016.

The report can be viewed here.

Google Chrome Updated

Google have released version 54.0.2840.87 of their Chrome web browser. Among other changes the new version contains a security vulnerability fix (CVE-2016-5198). More information about changes in Google Chrome Releases blog.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix a critical vulnerability that could potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 23.0.0.185 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 23.0.0.205

- Users of Adobe Flash Player 11.2.202.637 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.643

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.1 and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

New Version Of Foxit Reader And Foxit PhantomPDF Available

Foxit Software has released version 8.1 of their Foxit Reader and Foxit PhantomPDF software. The new versions contains fixes for security vulnerabilities that if exploited may allow an attacker to execute arbitrary code in target system.

Affected versions:
Foxit Reader 8.0.2.805 and earlier (Windows)
Foxit PhantomPDF 8.0.2.805 and earlier (Windows)

More information can be read here.

Oracle Critical Patch Update For Q4 of 2016

Oracle have released updates for their products that fix 253 security issues (including seven Java fixes) in total. The updates are a part of Oracle's quarterly released critical patch update (CPU).

Detailed list of vulnerabilities with patching instructions can be read from Oracle CPU Advisory.

Next Oracle CPU is planned to be released in January 2017.

Google Chrome Updated

Google have released version 54.0.2840.59 of their Chrome web browser. Among other changes the new version contains also 21 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Creative Cloud Desktop Application Update

Adobe have released a security update to fix a vulnerability in their Creative Cloud Desktop Application. The vulnerability (CVE-2016-6935) may allow local privilege escalation.

Affected versions:
Creative Cloud 3.7.0.272 and earlier versions

More information can be read from Adobe's security bulletin.

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix some vulnerabilities in their PDF products, Adobe Reader and Adobe Acrobat. The vulnerabilities could allow an attacker to take over the affected system.

Affected versions:
*Acrobat DC and Acrobat Reader DC, continuous track
version 15.017.20053 and earlier

*Acrobat DC and Acrobat Reader DC, classic track
version 15.006.30201 and earlier

*of series XI (11.x)
Adobe Reader 11.0.17 and earlier
Adobe Acrobat 11.0.17 and earlier


Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Adobe Acrobat

More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 23.0.0.162 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 23.0.0.185

- Users of Adobe Flash Player 11.2.202.635 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.637

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.1 and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

Microsoft Security Updates For October 2016

Microsoft have released security updates for October 2016. This month update contains ten security bulletins of which five categorized as critical, four as important and one as moderate.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Symantec Intelligence Report: September 2016

Symantec have published their Intelligence report that sums up the latest threat trends for September 2016.

The report can be viewed here.

Google Chrome Updated

Google have released version 53.0.2785.143 of their Chrome web browser. Among other changes the new version contains also three security vulnerability fixes. More information about changes in Google Chrome Releases blog.

ESET Threat Radar Report for August 2016

ESET have published a report discussing global threats of August 2016.

TOP 10 threats list (previous ranking listed too):
1. JS/Danger.ScriptAttachment (1.)
2. LNK/Agent.DA (-)
3. Win32/Bundpil (2.)
4. HTML/Refresh (5.)
5. Win32/Agent.XWT ( 3.)
6. JS/Adware.Agent.L (5.)
7. HTML/ScrInject (6.)
8. HTML/FakeAlert (-)
9. Win32/Ramnit (7.)
10. Win32/Sality (8.)

Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Mozilla Firefox Updates Released

Mozilla have released updates to Firefox browser to address a bunch of vulnerabilities of which several categorized as critical and high.

Affected products are:
- Mozilla Firefox earlier than 49
- Mozilla Firefox earlier than ESR 45.4

Lists of fixed vulnerabilities:
- Security vulnerabilities fixed in Firefox 49
- Security vulnerabilities fixed in Firefox ESR 45.4

Fresh version can be obtained via inbuilt updater or by downloading from the product site:
Firefox

VMware Updates Available

VMware has released security update to patch multiple vulnerabilities in their virtualization applications.

Affected versions:
- VMware Workstation Pro versions earlier than 12.5.0 on Windows platform
- VMware Player versions earlier than 12.5.0 on Windows platform
- VMware Tools versions earlier than 10.0.9 on Mac OS X platform
- VMware ESXi versions 6.0 and 5.5 and Fusion versions earlier than 8.5.0 include also vulnerable version of VMware Tools

Further information including updating instructions can be read from VMware's security advisory.

Security Update Available for Adobe AIR SDK & Compiler

There has been released a new version of Adobe AIR SDK & Compiler. New version adds support for secure transmission of runtime analytics for AIR applications on Android (CVE-2016-6936).

Affected are Adobe AIR SDK & Compiler 22.0.0.153 and earlier versions on Windows and Macintosh.

More information from Adobe security bulletin.

Vulnerabilities Fixed In Adobe Digital Editions

Adobe have released a new version of their ebook reader software Adobe Digital Editions. The new version fixes critical memory corruption vulnerabilities that may allow an attacker to execute arbitrary code in vulnerable system.

Affected versions are Adobe Digital Editions 4.5.1 and earlier versions on Windows, Macintosh, iOS and Android. Users of affected versions should update their versions to the latest one (currently 4.5.2).

More information (including download instructions for new version) can be read from Adobe security bulletin.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 22.0.0.211 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 23.0.0.162

- Users of Adobe Flash Player 11.2.202.632 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.635

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

Google Chrome Updated

Google have released version 53.0.2785.113 of their Chrome web browser. Among other changes the new version contains also security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Microsoft Security Updates For September 2016

Microsoft have released security updates for September 2016. This month update contains 14 security bulletins of which seven categorized as critical and also seven as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Vulnerabilities Fixed In Wireshark

There have been fixed vulnerabilities in Wireshark, free open source program for analyzing network protocols.

Vulnerable are 2.0.x versions 2.0.0-2.0.5

Non vulnerable version can be downloaded here.

More information can be read from the related advisories:
- wnpa-sec-2016-55
- wnpa-sec-2016-54
- wnpa-sec-2016-53
- wnpa-sec-2016-52
- wnpa-sec-2016-51
- wnpa-sec-2016-50

Symantec Intelligence Report: August 2016

Symantec have published their Intelligence report that sums up the latest threat trends for August 2016.

The report can be viewed here.

WordPress 4.6.1 Released

There has been released a new version of WordPress (blogging tool and content management system) which contains updates to security vulnerabilities. It's also recommended to check if there are any updates available for WordPress extensions in use. Also, it's recommended to disable those extensions that are not needed.

Affected versions:
WordPress versions earlier than 4.6.1

More information can be read from the WordPress blog.

Adobe ColdFusion Hotfix Available

Adobe have released updated versions of ColdFusion web application development platform. These hotfixes resolve an issue associated with parsing crafted XML entities that could lead to information disclosure (CVE-2016-4264).  

Affected versions:
- ColdFusion 11: update 9 and earlier versions
- ColdFusion 10: update 20 and earlier versions


More information can be read from Adobe's security bulletin.

Google Chrome Updated

Google have released versions 53.0.2785.89 (for Windows & Mac) and 53.0.2785.92 (for Linux) of their Chrome web browser. Among other changes the new version contains 33 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Opera Browser Sync Users Told To Reset Passwords

Opera Software is warning 1.7 million users of its Opera web browser sync feature of a possible attack that exposes passwords to hackers. The company says that it has reset all the Opera sync account passwords as a precaution. More information in Opera blog.

Dropbox Forces Password Reset For Older Users

Online storage service Dropbox began notifying users over the weekend that if they haven’t updated their password since 2012 they’ll be prompted to update it the next time they log into their account.

Dropbox says this is  “purely a preventative measure” and stresses that there’s no proof that users’ accounts have been improperly accessed.

More information here.

ESET Threat Radar Report for July 2016

ESET have published a report discussing global threats of July 2016.

TOP 10 threats list (previous ranking listed too):
1. JS/Danger.ScriptAttachment (1.)
2. Win32/Bundpil (2.)
3. Win32/Agent.XWT ( 3.)
4. HTML/Refresh (5.)
5. JS/Adware.Agent.L (4.)
6. HTML/ScrInject (9.)
7. Win32/Ramnit (8.)
8. Win32/Sality (7.)
9. Defo (-)
10. INF/Autorun (10.)

Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

New PHP Versions Released

PHP development team has released 7.0.10 and 5.6.25 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.10
Version 5.6.25

New Version Of Foxit Reader Available

Foxit Software has released a new version of their PDF viewer, Foxit Reader. The new version contains fixes for security vulnerabilities that if exploited may allow an attacker to execute arbitrary code in target system.

Affected versions:
Foxit Reader 8.0.0.624 and earlier (Windows)
Foxit Reader 2.0.0.0625 and earlier (Mac OS X)
Foxit Reader 1.1.1.0602 and earlier (Linux)
Foxit PhantomPDF 8.0.1.628 and earlier (Windows)

More information can be read here.

Fix For vBulletin Available

There has been released an update to vBulletin software that is used on many internet forums. The update fixes a SSRF (Server Side Request Forgery) vulnerability that allows unauthenticated remote attackers to access internal services (such as mail servers, memcached, couchDB, zabbix etc.) running on the server hosting vBulletin as well as services on other servers on the local network that are accessible from the target. A public method for exploiting is available so it's strongly advised that vBulletin using forums are updated with the latest version.

Affected versions:
vBulletin 5.2.2 and earlier
vBulletin 4.2.3 and earlier
vBulletin 3.8.9 and earlier

More information:
- http://www.securityfocus.com/archive/1/539149
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta

Microsoft Security Updates For August 2016

Microsoft have released security updates for August 2016. This month update contains nine security bulletins of which five categorized as critical and four as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Symantec Intelligence Report: July 2016

Symantec have published their Intelligence report that sums up the latest threat trends for July 2016.

The report can be viewed here.

Mozilla Firefox Updates Released

Mozilla have released updates to Firefox browser to address a bunch of vulnerabilities of which three categorized as critical, seven as high, 11 as moderate and two as low.

Affected products are:
- Mozilla Firefox earlier than 48
- Mozilla Firefox earlier than ESR 45.3

Links to the security advisories with details about addressed security issues:
MFSA 2016-84 Information disclosure through Resource Timing API during page navigation
MFSA 2016-83 Spoofing attack through text injection into internal error pages
MFSA 2016-82 Addressbar spoofing with right-to-left characters on Firefox for Android
MFSA 2016-81 Information disclosure and local file manipulation through drag and drop
MFSA 2016-80 Same-origin policy violation using local HTML file and saved shortcut file
MFSA 2016-79 Use-after-free when applying SVG effects
MFSA 2016-78 Type confusion in display transformation
MFSA 2016-77 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
MFSA 2016-76 Scripts on marquee tag can execute in sandboxed iframes
MFSA 2016-75 Integer overflow in WebSockets during data buffering
MFSA 2016-74 Form input type change from password to text can store plain text password in session restore file
MFSA 2016-73 Use-after-free in service workers with nested sync events
MFSA 2016-72 Use-after-free in DTLS during WebRTC session shutdown
MFSA 2016-71 Crash in incremental garbage collection in JavaScript
MFSA 2016-70 Use-after-free when using alt key and toplevel menus
MFSA 2016-69 Arbitrary file manipulation by local user through Mozilla updater and callback application path parameter
MFSA 2016-68 Out-of-bounds read during XML parsing in Expat library
MFSA 2016-67 Stack underflow during 2D graphics rendering
MFSA 2016-66 Location bar spoofing via data URLs with malformed/invalid mediatypes
MFSA 2016-65 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
MFSA 2016-64 Buffer overflow rendering SVG with bidirectional content
MFSA 2016-63 Favicon network connection can persist when page is closed
MFSA 2016-62 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)


Fresh version can be obtained via inbuilt updater or by downloading from the product site:
Firefox

ESET Threat Radar Report for June 2016

ESET have published a report discussing global threats of June 2016.

TOP 10 threats list (previous ranking listed too):
1. JS/Danger.ScriptAttachment (1.)
2. Win32/Bundpil (3.)
3. Win32/Agent.XWT ( 4.)
4. JS/Adware.Agent.L (8.)
5. HTML/Refresh (10.)
6. JS/TrojanDownloader.FakejQuery (-)
7. Win32/Sality (7.)
8. Win32/Ramnit (9.)
9. HTML/ScrInject (6.)
10. INF/Autorun (-)

Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Google Chrome Updated

Google have released version 52.0.2743.82 of their Chrome web browser. Among other changes the new version contains 48 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

New PHP Versions Released

PHP development team has released 7.0.9, 5.6.24 and 5.5.38 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch. Version 5.5.38 is the last version to be released for 5.5 branch so it's recommended to move to 5.6 or 7.0 version branch.

Changelogs:
Version 7.0.9
Version 5.6.24
Version 5.5.38

Oracle Critical Patch Update For Q3 of 2016

Oracle have released updates for their products that fix 276 security issues (including 13 Java fixes) in total. The updates are a part of Oracle's quarterly released critical patch update (CPU).

Detailed list of vulnerabilities with patching instructions can be read from Oracle CPU Advisory.

Next Oracle CPU is planned to be released in October 2016.

ITunes 12.4.2 Released

Apple have released version 12.4.2 of their iTunes media player. New version fixes a bunch of security vulnerabilities.

More information about the security content of iTunes 12.4.2 can be read from related security advisory.

Users of old versions should update to the latest one available.

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix some vulnerabilities in their PDF products, Adobe Reader and Adobe Acrobat. The vulnerabilities could allow an attacker to take over the affected system.

Affected versions:
*Acrobat DC and Acrobat Reader DC, continuous track
version 15.016.20045 and earlier

*Acrobat DC and Acrobat Reader DC, classic track
version 15.006.30174 and earlier

*of series XI (11.x)
Adobe Reader 11.0.16 and earlier
Adobe Acrobat 11.0.16 and earlier


Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Acrobat Standard and Pro

More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 22.0.0.192 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 22.0.0.209

- Users of Adobe Flash Player 11.2.202.626 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.632

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

Microsoft Security Updates For July 2016

Microsoft have released security updates for July 2016. This month update contains 11 security bulletins of which six categorized as critical and five as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Symantec Intelligence Report: June 2016

Symantec have published their Intelligence report that sums up the latest threat trends for June 2016.

The report can be viewed here.

New PHP Versions Released

PHP development team has released 7.0.8, 5.6.23 and 5.5.37 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.8
Version 5.6.23
Version 5.5.37

LibreOffice Vulnerability Fixed

There has been released a new version of LibreOffice that fixes a vulnerability in RTF file handling. By exploiting the vulnerability an attacker may be able to execute arbitrary code in the target system.

Affected versions:
LibreOffice versions older than 5.1.4 and 5.2.0

More information can be read here.

WordPress 4.5.3 Released

There has been released a new version of WordPress (blogging tool and content management system) which contains updates to security vulnerabilities. It's also recommended to check if there are any updates available for WordPress extensions in use. Also, it's recommended to disable those extensions that are not needed.

Affected versions:
WordPress versions earlier than 4.5.3

More information can be read from the WordPress blog.

Bart Ransomware

Cyber criminals behind Dridex and Locky ransomware have started distributing a new file-encrypting software named as Bart. According to security company Proofpoint RockLoader malware is used to download Bart over HTTPS. Bart itself will encrypt the files without first connecting to a remote command and conquer (C&C) server.

Malware campaign has included sending messages with the subjects "Photos" containing malicious Javascript code file (e.g. PDF_123456789.js) zipped in as an attachment with name like "photos.zip", "image.zip", "Photos.zip", "photo.zip", "Photo.zip", or "picture.zip".

More information with details can be read from Proofpoint blog post here.

Vulnerability In Apache Struts Framework

Apache Struts is an open source framework for developing enterprise-ready Java web applications. There has been found a vulnerability (CVE-2016-4438) in its REST plugin. The vulnerability may allow an attacker to execute arbitrary code on server side when using the REST plugin.

Users of Struts versions 2.3.20 to 2.3.28.1 are recommended to update to Struts 2.3.29 version.

More information here.

Google Chrome Updated

Google have released version 51.0.2704.103 of their Chrome web browser. The new version contains three security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Vulnerabilities In Drupal Fixed

There have been fixed two vulnerabilities in open-source content management framework Drupal.

Affected versions:
Drupal core 7.x versions prior to 7.44
Drupal core 8.x versions prior to 8.1.3

Solution:
Users of 7.x should upgrade to 7.44
Users of 8.x should upgrade to 8.1.3


More information in Drupal security advisory.

Adobe AIR Update Available

Adobe have released updated version of Adobe AIR. The new version fixes a vulnerability (CVE-2016-4126) in the directory search path used by the AIR installer that could potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe AIR Desktop Runtime 21.0.0.215 and earlier versions for Windows should update to Adobe AIR 22.0.0.153


More information can be read from Adobe's security bulletin.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 21.0.0.242 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 22.0.0.192

- Users of Adobe Flash Player 11.2.202.621 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.626

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

Microsoft Security Updates For June 2016

Microsoft have released security updates for June 2016. This month update contains 17 security bulletins of which six categorized as critical and 11 as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Symantec Intelligence Report: May 2016

Symantec have published their Intelligence report that sums up the latest threat trends for May 2016.

The report can be viewed here.

Mozilla Firefox Updates Released

Mozilla have released updates to Firefox browser to address a bunch of vulnerabilities of which two categorized as critical, five as high, four as moderate and two as low.

Affected products are:
- Mozilla Firefox earlier than 47
- Mozilla Firefox earlier than ESR 45.2

Links to the security advisories with details about addressed security issues:
MFSA 2016-61 Network Security Services (NSS) vulnerabilities
MFSA 2016-60 Java applets bypass CSP protections
MFSA 2016-59 Information disclosure of disabled plugins through CSS pseudo-classes
MFSA 2016-58 Entering fullscreen and persistent pointerlock without user permission
MFSA 2016-57 Incorrect icon displayed on permissions notifications
MFSA 2016-56 Use-after-free when textures are used in WebGL operations after recycle pool destruction
MFSA 2016-55 File overwrite and privilege escalation through Mozilla Windows updater
MFSA 2016-54 Partial same-origin-policy through setting location.host through data URI
MFSA 2016-53 Out-of-bounds write with WebGL shader
MFSA 2016-52 Addressbar spoofing though the SELECT element
MFSA 2016-51 Use-after-free deleting tables from a contenteditable document
MFSA 2016-50 Buffer overflow parsing HTML5 fragments
MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / rv:45.2)


Fresh version can be obtained via inbuilt updater or by downloading from the product site:
Firefox

Bing To Offer More Detailed Warnings About Malware

Microsoft's search engine Bing has been updated to give more detailed warnings about malware. Previously warnings have been a generic type to cover all malware threat types. In addition to make users better aware of the threat with this improvement webmasters are also able to clean their site quicker by having stronger insights into why their site was flagged.

More information in the post in the Bing blog.

ESET Threat Radar Report for May 2016

ESET have published a report discussing global threats of May 2016.

TOP 10 threats list (previous ranking listed too):
1. JS/Danger.ScriptAttachment (3.)
2. JS/TrojanDownloader.Nemucod (2.)
3. Win32/Bundpil (1.)
4. Win32/Agent.XWT ( 4.)
5. Win32/Bayrob (-)
6. HTML/ScrInject (5.)
7. Win32/Sality (9.)
8. JS/Adware.Agent.L (-)
9. Win32/Ramnit (7.)
10. HTML/Refresh (6.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Google Chrome Updated

Google have released version 51.0.2704.63 of their Chrome web browser. The new version contains 42 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Microsoft Security Intelligence Report Volume 20 Released

Microsoft have released volume 20 of their Security Intelligence Report (SIR). The Security Intelligence Report (SIR) is an investigation of the current threat landscape. The report can be downloaded here.

Google Chrome Updated

Google have released version 50.0.2661.102 of their Chrome web browser. The new version contains five security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Adobe Flash Player And Adobe AIR Updates Available

Adobe have released updated versions of their Flash Player and AIR. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 21.0.0.226 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 21.0.0.242

- Users of Adobe Flash Player 11.2.202.616 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.621

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update

- Users of the Adobe AIR 21.0.0.198 SDK & Compiler and earlier versions should update to the Adobe AIR 21.0.0.215 SDK & Compiler

- Users of Adobe AIR 21.0.0.198 and earlier versions for Desktop Runtime should update to Adobe AIR 21.0.0.215.


More information can be read from Adobe's security bulletin.

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix some vulnerabilities in their PDF products, Adobe Reader and Adobe Acrobat. The vulnerabilities could allow an attacker to take over the affected system.

Affected versions:
*Acrobat DC and Acrobat Reader DC, continuous track
version 15.016.20039 and earlier

*Acrobat DC and Acrobat Reader DC, classic track
version 15.006.30172 and earlier

*of series XI (11.x)
Adobe Reader 11.0.16 and earlier
Adobe Acrobat 11.0.16 and earlier


Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Acrobat Standard and Pro

More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Available

Adobe have released updated versions of ColdFusion web application development platform. These hotfixes resolve an input validation issue (CVE-2016-1113), a host name verification problem with wild card certificates (CVE-2016-1115) and include an updated version of Apache Commons Collections library to mitigate java deserialization (CVE-2016-1114).  

Affected versions:
- ColdFusion 2016 release and versions 10 & 11


More information can be read from Adobe's security bulletin.

Microsoft Security Updates For May 2016

Microsoft have released security updates for May 2016. This month update contains 16 security bulletins of which eight categorized as critical and eight also as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

WordPress 4.5.2 Released

There has been released a new version of WordPress (blogging tool and content management system) which contains updates to security vulnerabilities. The fixed vulnerabilities are related to 3rd party libraries (Plupload and MediaElement.js) used in WordPress.

Affected versions:
WordPress versions earlier than 4.5.2

More information can be read from the WordPress blog. There's also information regarding vulnerabilities in ImageMagick addon which is supported in WordPress. The information can be accessed here.

Symantec Intelligence Report: April 2016

Symantec have published their Intelligence report that sums up the latest threat trends for April 2016.

The report can be viewed here.

New PHP Versions Released

PHP development team has released 7.0.6, 5.6.21 and 5.5.35 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.6
Version 5.6.21
Version 5.5.35

Mozilla Firefox Updates Released

Mozilla have released updates to Firefox browser to address a bunch of vulnerabilities of which one categorized as critical, four as high and five as moderate.

Affected products are:
- Mozilla Firefox earlier than 46
- Mozilla Firefox earlier than ESR 45.1
- Mozilla Firefox earlier than ESR 38.8

Links to the security advisories with details about addressed security issues:
MFSA 2016-48 Firefox Health Reports could accept events from untrusted domains
MFSA 2016-47 Write to invalid HashMap entry through JavaScript.watch()
MFSA 2016-46 Elevation of privilege with chrome.tabs.update API in web extensions
MFSA 2016-45 CSP not applied to pages sent with multipart/x-mixed-replace
MFSA 2016-44 Buffer overflow in libstagefright with CENC offsets
MFSA 2016-43 Disclosure of user actions through JavaScript with motion and orientation sensors
MFSA 2016-42 Use-after-free and buffer overflow in Service Workers
MFSA 2016-41 Content provider permission bypass allows malicious application to access data
MFSA 2016-40 Privilege escalation through file deletion by Maintenance Service updater
MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)



Fresh version can be obtained via inbuilt updater or by downloading from the product site:
Firefox

Oracle Critical Patch Update For Q2 of 2016

Oracle have released updates for their products that fix 136 security issues (including 9 Java fixes) in total. The updates are a part of Oracle's quarterly released critical patch update (CPU).

Detailed list of vulnerabilities with patching instructions can be read from Oracle CPU Advisory.

Next Oracle CPU is planned to be released in July 2016.

Google Chrome Updated

Google have released version 50.0.2661.75 of their Chrome web browser. The new version contains 20 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Symantec Intelligence Report: March 2016

Symantec have published their Intelligence report that sums up the latest threat trends for March 2016.

The report can be viewed here.

Microsoft Security Updates For April 2016

Microsoft have released security updates for April 2016. This month update contains 13 security bulletins of which six categorized as critical and seven as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Google Chrome Updated

Google have released version 49.0.2623.112 of their Chrome web browser. More information about changes in Google Chrome Releases blog.

ESET Threat Radar Report for March 2016

ESET have published a report discussing global threats of March 2016.

TOP 10 threats list (previous ranking listed too):
1. JS/TrojanDownloader.Nemucod (4.)
2. Win32/Bundpil (1.)
3. LNK/Agent.CR (-)
4. LNK/Agent.AV (3.)
5. HTML/ScrInject (10.)
6. LNK/Agent.BZ (2.)
7. Win32/Ramnit (7.)
8. Win32/Sality (5.)
9. HTML/Refresh (-)
10. HTML/iFrame (6.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Adobe Flash Player Updates Available

Adobe have released updated versions of their Flash Player. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 21.0.0.197 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 21.0.0.213

- Users of Adobe Flash Player 11.2.202.577 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.616

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

New PHP Versions Released

PHP development team has released 7.0.5, 5.6.20 and 5.5.34 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.5
Version 5.6.20
Version 5.5.34

Petya Ransomware

Ransomware, a type malware that restricts access in computer system and requires a ransom for removing the restriction, is currently a big problem in digital world. New member to this family is Petya. Instead of encrypting just some file types Petya prevents user from accessing all the files on the hard drive by encrypting Master File Table. The user is asked to pay a ransom in order to get the hard drive decrypted.

Petya targets mostly business users as it is being distributed in spam emails that are targeting the human resources departments. First spam messages contained a Dropbox link to a malicious file. Since Dropbox removed the malicious archives the bad guys will likely use other way of distribution.


More information can be read in Kaspersky's blog here.

Google Chrome Updated

Google have released version 49.0.2623.110 of their Chrome web browser. More information about changes in Google Chrome Releases blog.

Symantec Intelligence Report: February 2016

Symantec have published their Intelligence report that sums up the latest threat trends for February 2016.

The report can be viewed here.

Mozilla Product Updates Released

Mozilla have released updates to Firefox browser to address a bunch of vulnerabilities of which nine categorized as critical, seven as high, six as moderate and one as low.

Affected products are:
- Mozilla Firefox earlier than 45
- Mozilla Firefox earlier than ESR 38.7

Links to the security advisories with details about addressed security issues:
MFSA 2016-38 Out-of-bounds write with malicious font in Graphite 2
MFSA 2016-37 Font vulnerabilities in the Graphite 2 library
MFSA 2016-36 Use-after-free during processing of DER encoded keys in NSS
MFSA 2016-35 Buffer overflow during ASN.1 decoding in NSS
MFSA 2016-34 Out-of-bounds read in HTML parser following a failed allocation
MFSA 2016-33 Use-after-free in GetStaticInstance in WebRTC
MFSA 2016-32 WebRTC and LibVPX vulnerabilities found through code inspection
MFSA 2016-31 Memory corruption with malicious NPAPI plugin
MFSA 2016-30 Buffer overflow in Brotli decompression
MFSA 2016-29 Same-origin policy violation using performance.getEntries and history navigation with session restore
MFSA 2016-28 Addressbar spoofing though history navigation and Location protocol property
MFSA 2016-27 Use-after-free during XML transformations
MFSA 2016-26 Memory corruption when modifying a file being read by FileReader
MFSA 2016-25 Use-after-free when using multiple WebRTC data channels
MFSA 2016-24 Use-after-free in SetBody
MFSA 2016-23 Use-after-free in HTML5 string parser
MFSA 2016-22 Service Worker Manager out-of-bounds read in Service Worker Manager
MFSA 2016-21 Displayed page address can be overridden
MFSA 2016-20 Memory leak in libstagefright when deleting an array during MP4 processing
MFSA 2016-19 Linux video memory DOS with Intel drivers
MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages
MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports
MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)


Fresh version can be obtained via inbuilt updater or by downloading from the product site:
Firefox

Google Chrome Updated

Google have released version 49.0.2623.87 of their Chrome web browser. The new version contains three security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Adobe Flash Player And Adobe AIR Updates Available

Adobe have released updated versions of their Flash Player and AIR. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 20.0.0.306 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 21.0.0.182

- Users of Adobe Flash Player 11.2.202.569 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.577

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update

- Users of the Adobe AIR 20.0.0.260 SDK & Compiler and earlier versions should update to the Adobe AIR 21.0.0.176 SDK & Compiler

- Users of Adobe AIR 20.0.0.260 and earlier versions for Desktop Runtime should update to Adobe AIR 21.0.0.176.


More information can be read from Adobe's security bulletin.

Vulnerability Fixed In Adobe Digital Editions

Adobe have released a new version of their ebook reader software Adobe Digital Editions. The new version fixes a critical memory corruption vulnerability (CVE-2016-0954) that may allow an attacker to execute arbitrary code in vulnerable system.

Affected versions are Adobe Digital Editions 4.5.0 and earlier versions on Windows, Macintosh, iOS and Android. Users of affected versions should update their versions to the latest one (currently 4.5.1).

More information (including download instructions for new version) can be read from Adobe security bulletin.

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix some vulnerabilities in their PDF products, Adobe Reader and Adobe Acrobat. The vulnerabilities could allow an attacker to take over the affected system.

Affected versions:
*Acrobat DC and Acrobat Reader DC, continuous track
version 15.010.20059 and earlier

*Acrobat DC and Acrobat Reader DC, classic track
version 15.006.30119 and earlier

*of series XI (11.x)
Adobe Reader 11.0.14 and earlier
Adobe Acrobat 11.0.14 and earlier


Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Acrobat Standard and Pro

More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Microsoft Security Updates For March 2016

Microsoft have released security updates for March 2016. This month update contains 13 security bulletins of which five categorized as critical and eight as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

ESET Threat Radar Report for February 2016

ESET have published a report discussing global threats of February 2016.

TOP 10 threats list (previous ranking listed too):
1. Win32/Bundpil (1.)
2. LNK/Agent.BZ (3.)
3. LNK/Agent.AV (4.)
4. JS/TrojanDownloader.Nemucod (-)
5. Win32/Sality (8.)
6. HTML/iFrame (6.)
7. Win32/Ramnit (10.)
8. JS/TrojanDownloader.Iframe (5.)
9. LNK/Agent.BS (9.)
10. HTML/ScrInject (7.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Google Chrome Updated

Google have released version 49.0.2623.75 of their Chrome web browser. Among other fixes the new version contains 26 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Vulnerabilities In Drupal Fixed

There have been fixed a bunch of vulnerabilities in open-source content management framework Drupal.

Affected versions:
Drupal core 6.x versions prior to 6.38
Drupal core 7.x versions prior to 7.43
Drupal core 8.0.x versions prior to 8.0.4.

Solution:
Users of 6.x should upgrade to 6.38
Users of 7.x should upgrade to 7.43
Users of 8.0.x should upgrade to 8.0.4


More information in Drupal security advisory.

Symantec Intelligence Report: January 2016

Symantec have published their Intelligence report that sums up the latest threat trends for January 2016.

The report (in PDF format) can be viewed here.

ESET Threat Radar Report for January 2016

ESET have published a report discussing global threats of January 2016.

TOP 10 threats list (previous ranking listed too):
1. Win32/Bundpil (1.)
2. LNK/Agent.BZ (3.)
3. Win32/Bayrob (-)
4. LNK/Agent.AV (5.)
5. JS/TrojanDownloader.Iframe (7.)
6. HTML/iFrame (-)
7. HTML/ScrInject (4.)
8. Win32/Sality (8.)
9. LNK/Agent.BS (6.)
10. Win32/Ramnit (9.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Google Chrome Updated

Google have released version 48.0.2564.109 of their Chrome web browser. Among other fixes the new version contains six security vulnerability fixes. More information about changes in Google Chrome Releases blog.

Adobe Photoshop CC And Bridge CC Updated

Adobe have released updated versions for Photoshop CC and Bridge CC. The new versions fix critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Photoshop CC 2015 16.11 (2015.1.1) and earlier versions for Windows and Macintosh should update to Adobe Photoshop CC 2015 16.1.2 (2015.1.2)

- Users of Adobe Photoshop CC 2014 15.2.3 (2014.2.3) and earlier versions for Windows and Macintosh should update to Adobe Photoshop CC 2014 15.2.4 (2014.2.4)

- Users of Adobe Bridge CC 6.1.1 and earlier versions for Windows and Macintosh should update to Adobe Bridge CC 6.2.

For Adobe Photoshop CC 2015 and Adobe Bridge CC Adobe recommends to update by launching each application, navigating to the Help menu, and clicking "Updates.".

Note: The Adobe Photoshop CC 2014 15.2.4 updates are not available by selecting Help > Updates from the application and will not show in the Applications & Updates section of the Creative Cloud application or the Creative Cloud Packager. The updates can be only downloaded from the links below:

Win (32-bit): https://www.adobe.com/support/downloads/detail.jsp?ftpID=6015
Win (64-bit): https://www.adobe.com/support/downloads/detail.jsp?ftpID=6016
Mac: https://www.adobe.com/support/downloads/detail.jsp?ftpID=6017


More information can be read from Adobe's security bulletin.

Adobe Flash Player And Adobe AIR Updates Available

Adobe have released updated versions of their Flash Player and AIR. The new versions fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 20.0.0.286 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 20.0.0.306

- Users of Adobe Flash Player 11.2.202.559 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.569

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.x and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update

- Users of the Adobe AIR 20.0.0.233 SDK & Compiler and earlier versions should update to the Adobe AIR 20.0.0.260 SDK & Compiler

- Users of Adobe AIR 20.0.0.233 and earlier versions for Desktop Runtime should update to Adobe AIR 20.0.0.260.


More information can be read from Adobe's security bulletin.

Microsoft Security Updates For February 2016

Microsoft have released security updates for February 2016. This month update contains 13 security bulletins of which six categorized as critical and seven as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

New PHP Versions Released

PHP development team has released 7.0.3, 5.6.18 and 5.5.32 versions of the PHP scripting language. New versions contain fixes to vulnerabilities among other fixes. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.3
Version 5.6.18
Version 5.5.32

WordPress 4.4.2 Released

There has been released a new version of WordPress (blogging tool and content management system) which contains updates to two security vulnerabilities among a bunch of other bug fixes.

Affected versions:
WordPress versions earlier than 4.4.2

More information can be read from the WordPress blog.

Google Chrome Updated

Google have released version 48.0.2564.103 of their Chrome web browser. More information about the changes can be read in Google Chrome Releases blog.

Mozilla Product Updates Released

Mozilla have released updates to Firefox browser to address a bunch of vulnerabilities of which three categorized as critical, two as high, six as moderate and one as low.

Affected products are:
- Mozilla Firefox earlier than 44
- Mozilla Firefox earlier than ESR 38.6

Links to the security advisories with details about addressed security issues:
MFSA 2016-12 Lightweight themes on Firefox for Android do not verify a secure connection
MFSA 2016-11 Application Reputation service disabled in Firefox 43
MFSA 2016-10 Unsafe memory manipulation found through code inspection
MFSA 2016-09 Addressbar spoofing attacks
MFSA 2016-08 Delay following click events in file download dialog too short on OS X
MFSA 2016-07 Errors in mp_div and mp_exptmod cryptographic functions in NSS
MFSA 2016-06 Missing delay following user click events in protocol handler dialog
MFSA 2016-05 Addressbar spoofing through stored data url shortcuts on Firefox for Android
MFSA 2016-04 Firefox allows for control characters to be set in cookie names
MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation
MFSA 2016-02 Out of Memory crash when parsing GIF format images
MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 / rv:38.6)


Fresh version can be obtained via inbuilt updater or by downloading from the product site:
Firefox

Google Chrome Updated

Google have released version 48.0.2564.82 of their Chrome web browser. Among other fixes the new version contains 37 security vulnerability fixes. More information about changes in Google Chrome Releases blog.

ESET Threat Radar Report for December 2015

ESET have published a report discussing global threats of December 2015.

TOP 10 threats list (previous ranking listed too):
1. Win32/Bundpil (1.)
2. JS/TrojanDownloader.Nemucod (-)
3. LNK/Agent.BZ (2.)
4. HTML/ScrInject (4.)
5. LNK/Agent.AV (5.)
6. LNK/Agent.BS (3.)
7. JS/TrojanDownloader.Iframe (6.)
8. Win32/Sality (7.)
9. Win32/Ramnit (8.)
10. INF/Autorun (10.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Oracle Critical Patch Update For Q1 of 2016

Oracle have released updates for their products that fix 248 security issues (including 8 Java fixes) in total. The updates are a part of Oracle's quarterly released critical patch update (CPU).

Detailed list of vulnerabilities with patching instructions can be read from Oracle CPU Advisory.

Next Oracle CPU is planned to be released in April 2016.

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix a bunch of vulnerabilities in their PDF products, Adobe Reader and Adobe Acrobat. The vulnerabilities could allow an attacker to take over the affected system.

Affected versions:
*Acrobat DC and Acrobat Reader DC, continuous track
version 15.009.20077 and earlier

*Acrobat DC and Acrobat Reader DC, classic track
version 15.006.30097 and earlier

*of series XI (11.x)
Adobe Reader 11.0.13 and earlier
Adobe Acrobat 11.0.13 and earlier

*of series X (10.x)
Adobe Reader 10.1.15 and earlier
Adobe Acrobat 10.1.15 and earlier

Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Note: Adobe Acrobat X and Adobe Reader X are no longer supported. Those should be replaced with supported version.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Acrobat Standard and Pro

More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Microsoft Security Updates For January 2016

Microsoft have released security updates for January 2016. This month update contains nine security bulletins of which six categorized as critical and three as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

New PHP Versions Released

PHP development team has released 7.0.2, 5.6.17 and 5.5.31 versions of the PHP scripting language. New versions contain fixes to several vulnerabilities. All PHP users are recommended to upgrade their versions to the latest release of the correspondent branch.

Changelogs:
Version 7.0.2
Version 5.6.17
Version 5.5.31

QuickTime 7.7.9 Released

Apple have released a new version of their QuickTime multimedia player. Version 7.7.9 contains fixes for a bunch of vulnerabilities that could be exploited to run arbitrary code in target system.

Affected versions:
QuickTime versions earlier than 7.7.9 on Microsoft Windows 7 and Microsoft Windows Vista operating systems.

QuickTime users with version older than 7.7.9 should update to the latest one available.

More information about security content of QuickTime 7.7.9 can be read here.

WordPress 4.4.1 Released

There has been released a new version of WordPress (blogging tool and content management system) which contains an update to a cross-site scripting (XSS) vulnerability among a bunch of other bug fixes.

Affected versions:
WordPress versions earlier than 4.4.1

More information can be read from the WordPress blog.

Ransom32 JavaScript-Based Ransomware

Security company Emsisoft warns about a new JavaScript-based ransomware. Fabian Wosar from Emsisoft says that a new ransomware family called Ransom32 is using the NW.js platform for infiltrating the victims' computers and encrypting their files with AES encryption.

"NW.js is essentially a framework that allows you to develop normal desktop applications for Windows, Linux and MacOS X using JavaScript. It is based upon the popular Node.js and Chromium projects. So while JavaScript is usually tightly sandboxed in your browser and can’t really touch the system it runs upon, NW.js allows for much more control and interaction with the underlying operating system, enabling JavaScript to do almost everything “normal” programming languages like C++ or Delphi can do. The benefit for the developer is that they can turn their web applications into normal desktop applications relatively easily. For normal desktop application developers it has the benefit that NW.js is able to run the same JavaScript on different platforms." At the moment only Windows appears to be targetted but at least in theory it could be packaged for Linux and Mac OS X too.

The best way to protect from ransomware is to have proper backups regularly made of all important files. These should be stored on a disconnected device since a lot of ransomware targets backups specifically. Good option is for example an external hard drive that is usually detached the system.


The Emsisoft blog post can be read here.