Adobe Flash Player And Adobe AIR Updates Available

Adobe have released updated version of their Flash Player . The new version fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:

- Users of Adobe Flash Player 11.9.900.117 and earlier versions for Windows should update to Adobe Flash Player 11.9.900.152

- Users of Adobe Flash Player 11.9.900.117 and earlier versions for Macintosh should update to Adobe Flash Player 11.9.900.152

- Users of Adobe Flash Player 11.2.202.310 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.327

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 10 and 11 (on Windows 8.0 and Windows 8.1) will be updated via Windows Update

- Users of Adobe AIR 3.9.0.1030 and earlier versions for Windows and Macintosh should update to Adobe AIR 3.9.0.1210

- Users of the Adobe AIR 3.9.0.1030 SDK should update to the Adobe AIR 3.9.0.1210 SDK

- Users of the Adobe AIR 3.9.0.1030 SDK & Compiler and earlier versions should update to the Adobe AIR 3.9.0.1210 SDK & Compiler

- Users of the Adobe AIR  3.9.0.1060 and earlier versions for Android should update to Adobe AIR 3.9.0.1210 by browsing to Google play on an Android device


More information can be read from Adobe's security bulletin.

Adobe ColdFusion Hotfix Update Available

Adobe have released updated version of ColdFusion web application development platform. This hotfix addresses a reflected cross site scripting vulnerability (CVE-2013-5326) that could be exploited by a remote, authenticated user on ColdFusion 10 and earlier when the CFIDE directory is exposed. This hotfix also addresses a vulnerability (CVE-2013-5328) in ColdFusion 10 that could permit unauthorized remote read access.

Affected versions:
- ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and Linux


More information can be read from Adobe's security bulletin.

Google Chrome Updated

Google have released version 31.0.1650.48 of their Chrome web browser. New version contains fixes to 25 vulnerabilities. Also, Flash Player is updated.

More information in Google Chrome Releases blog.

Microsoft Security Updates For November 2013

Microsoft have released security updates for November 2013. This month update contains eight security bulletins of which three critical and five important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Vulnerability in Microsoft Graphics Component

Microsoft is investigating private reports of a vulnerability in the Microsoft Graphics component. By exploiting the vulnerability successfully an attacker may be able to execute arbitrary code in affected system.

Affected are:
Windows Vista and Windows Server 2008 versions
Microsoft Office versions older than Microsoft Office 2013
Microsoft Lync versions

At the moment there is no patch for the vulnerability available. For a workaround and more information please see the related security advisory.

ESET Global Threat Report for October 2013

ESET have published a report discussing global threats of October 2013.

TOP 10 threats list (previous ranking listed too):

1. WIN32/Bundpil (1.)
2. INF/Autorun (2.)
3. Win32/Sality (3.)
4. HTML/Iframe (4.)
5. HTML/ScrInject (5.)
6. Win32/Dorkbot (6.)
7. Win32/Conficker (7.)
8. Win32/Ramnit (8.)
9. Win32/TrojanDownloader.Small.AAB (-)
10. Win32/Qhost (9.)



Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Microsoft Security Intelligence Report Volume 15 Released

Microsoft have released volume 15 of their Security Intelligence Report (SIR)). The Security Intelligence Report (SIR) is an investigation of the current threat landscape. The report can be downloaded here.