Vulnerability In Microsoft Windows Task Scheduler

There has been found a vulnerability in Microsoft Windows task scheduler. The local privilege escalation vulnerability exists in the Advanced Local Procedure Call (ALPC) interface. By exploiting the vulnerability a local user can obtain SYSTEM privileges of the affected system.

Currently there is no official patch available for the vulnerability. Acros Security has published an unofficial micropatch against the vulnerability for fully updated 64bit Windows 10 version 1803 and fully updated 64bit Windows Server 2016. It's always good to remember that if unofficial patch/workaraound is used then it should be considered only a temporary solution and removed when the official patch by Microsoft becomes available.

Creative Cloud Desktop Application Update

Adobe has released a security update to fix a vulnerability in their Creative Cloud Desktop Application. The vulnerability is an improper certificate validation vulnerability that could lead to privilege escalation (CVE-2018-12829).

Affected versions:
Creative Cloud Desktop Application 4.6.0 and earlier versions

More information can be read from Adobe's security bulletin.

Vulnerability In Drupal Fixed

There has been fixed a security vulnerability in open-source content management framework Drupal. The vulnerability is related to Drupal Commerce Module.

Affected:
8.x-2.x-dev

Solution:
Update to Commerce 8.x-2.9 version

More information in Drupal security advisory.

Vulnerabilities Found In Adobe Photoshop

Adobe have released new versions of Adobe Photoshop for Windows and Macintosh. These updates resolve two critical memory corruption vulnerabilities (CVE-2018-12810 and CVE-2018-12811) that could lead to code execution in the context of the current user.

Affected versions:
Adobe Photoshop CC 2018 19.1.5 and earlier versions (Windows and macOS)
Adobe Photoshop CC 2017 18.1.5 and earlier versions (Windows and macOS)

Instructions for updating are given in related security bulletin.

Vulnerability In Oracle Database

Oracle have released a patch to fix a vulnerability (CVE-2018-3110) in their Oracle Database product. The vulnerability is in the Java VM component of Oracle Database Server, a remote authenticated attacker can exploit it take complete control of the product and establish a shell access to the underlying server.

Affected versions:
Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18

More information (including instructions for patching) in Oracle's security advisory.

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix some vulnerabilities in their PDF products, Adobe Reader and Adobe Acrobat. The vulnerabilities could allow an attacker to execute arbitrary code in the context of the current user in the affected system.

Affected versions:
*Acrobat DC and Acrobat Reader DC, continuous track
version 2018.011.20055 and earlier

*Acrobat 2017 and Acrobat Reader 2017
version 2017.011.30096 and earlier

*Acrobat DC and Acrobat Reader DC, classic track
version 2015.006.30434 and earlier


Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Adobe Acrobat

More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Adobe Experience Manager Updated

Adobe has released updated versions of their Experience Manager. Updates fix three moderate categorized vulnerabilities: CVE-2018-5005, CVE-2018-12806 and CVE-2018-12807.

Affected are versions 6.0, 6.1, 6.2, 6.3 and 6.4

More information from the Adobe's security advisory.

Adobe Flash Player Updated

Adobe have released updated versions of their Flash Player. The new versions fix security vulnerabilities that could allow remote execution of arbitrary code in the context of the current user.

Affected versions:
- Users of Adobe Flash Player 30.0.0.134 and earlier versions for Windows should update to Adobe Flash Player 30.0.0.154

- Users of Adobe Flash Player 30.0.0.134 and earlier versions for Macintosh should update to Adobe Flash Player 30.0.0.154

- Users of Adobe Flash Player 30.0.0.134 and earlier versions for Linux should update to Adobe Flash Player 30.0.0.154

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 11 (on Windows 8.1 and Windows 10) and Microsoft Edge (Windows 10) will be updated via Windows Update


More information can be read from Adobe's security bulletin.

Creative Cloud Desktop Application Update

Adobe has released a security update to fix a vulnerability in their Creative Cloud Desktop Application (installer). The vulnerability is an insecure library loading vulnerability in the installer that could lead to privilege escalation (CVE-2018-5003).

Affected versions:
Creative Cloud Desktop Application (installer) 4.5.0.324 and earlier versions

More information can be read from Adobe's security bulletin.

Foxit PhantomPDF Fix Available

Foxit Software has released version 8.3.7 of their Foxit PhantomPDF software. The new version contains fixes for security vulnerabilities that if exploited may allow an attacker to execute arbitrary code in target system.

Affected versions:
Foxit PhantomPDF 8.3.6.35572 and earlier (Windows)

More information can be read here.

VMware Workstation And Fusion Updates Available

VMware has released new versions of their Workstation and Fusion software. New versions fix an out-of-bounds write vulnerability (CVE-2018-6973).

Affected versions:
-VMware Workstation 14.x earlier than version 14.1.3 for Windows
-VMware Fusion 10.x earlier than version 10.1.3 for Windows

More information (including links to patches) in security advisory.

Microsoft Security Updates For August 2018

Microsoft have released security updates for August 2018.

Summary of the updates (filter by inserting 7/11/2018 to the From field and 8/18/2018 to the To field) here.

Symantec Intelligence Report: July 2018

Symantec have published their Intelligence report that sums up the latest threat trends for July 2018.

The report can be viewed here.

Google Chrome Updated

Google have released a version 68.0.3440.106 of their Chrome web browser. More information about changes in Google Chrome Releases blog.

VMware Horizon Updates Available

VMware has released new versions of their Horizon and Horizon Client for Windows. New versions fix an out-of-bounds read vulnerability (CVE-2018-6970).

Affected versions:
-VMware Horizon 6 earlier than version 6.2.7 for Windows
-VMware Horizon 7 earlier than version 7.5.1 for Windows
-VMware Horizon Client earlier than version 4.8.1 for Windows

More information (including links to patches) in security advisory.

New Drupal Version Available

There has been released a new version of open-source content management framework Drupal. The new version includes fixed version of Symfony library (details about Symfony vulnerability here in Symfony blog).

Affected versions:
Drupal core 8.x versions prior to 8.5.6

More information in Drupal security advisory.

Vulnerability In Symfony PHP Library

There has been found a severe vulnerability in widely used Symfony PHP library. The vulnerability may lead to authentication bypass vulnerabilities.

Affected versions:
2.7.x earlier than 2.7.49
2.8.x earlier than 2.8.44
3.3.x earlier than 3.3.18
3.4.x earlier than 3.4.14
4.0.x earlier than 4.0.14
4.1.x earlier than 4.1.3

Symfony 3.0, 3.1, and 3.2 are not maintained anymore and won't get a fix. Users of these versions should move to more recent versions.

More information in Symfony blog.

Google Chrome Updated

Google have released a version 68.0.3440.84 of their Chrome web browser. More information about changes in Google Chrome Releases blog.