ESET Global Threat Report for October 2014

ESET have published a report discussing global threats of October 2014.

TOP 10 threats list (previous ranking listed too):

1. HTML/Refresh (1.)
2. WIN32/Bundpil (2.)
3. JS/Kryptik.I (3.)
4. Win32/RiskWare.NetFilter (5.)
5. Win32/Adware.MultiPlug (4.)
6. HTML/ScrInject (-)
7. LNK/Agent.AK (6.)
8. Win32/Sality (7.)
9. HTML/Iframe (8.)
10. INF/Autorun (10.)


Complete report (with a description about each of the above listed threats) can be downloaded here (in PDF format).

Microsoft Security Updates For December 2014

Microsoft have released security updates for December 2014. This month update contains seven security bulletins of which three categorized as critical and four as important.

A new version of Windows Malicious Software Removal Tool (MSRT) was released too.

More information can be read from the bulletin summary.

Mozilla Product Updates Released

Mozilla have released updates to Firefox browser and Thunderbird email client to address a bunch of vulnerabilities of which three categorized as critical, three as high and three as moderate.

Affected products are:
- Mozilla Firefox earlier than 34
- Mozilla Firefox ESR earlier than 31.3
- Mozilla Thunderbird earlier than 31.3

Links to the security advisories with details about addressed security issues:
MSFA-2014-91 Privileged access to security wrapped protected objects
MSFA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory
MSFA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer
MSFA-2014-88 Buffer overflow while parsing media content
MSFA-2014-87 Use-after-free during HTML5 parsing
MSFA-2014-86 CSP leaks redirect data via violation reports
MSFA-2014-85 XMLHttpRequest crashes with some input streams
MSFA-2014-84 XBL bindings accessible via improper CSS declarations
MSFA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)



Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird

Google Chrome Updated

Google have released version 39.0.2171.71 of their Chrome web browser. New version contains an update for Adobe Flash and some other fixes.

More information about these in Google Chrome Releases blog.

Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new version adds extra hardening against the vulnerability CVE-2014-8439 (a vulnerability in the handling of a dereferenced memory pointer that could lead to code execution) which was mitigated in the October release.

Affected versions:

- Users of Adobe Flash Player 15.0.0.223 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 15.0.0.239

- Users of Adobe Flash Player 11.2.202.418 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.424

- Flash Player integrated with Google Chrome will be updated by Google via Chrome update

- Flash Player integrated with Internet Explorer 10 and 11 (on Windows 8.x) will be updated via Windows Update



More information can be read from Adobe's security bulletin.

WordPress 4.0.1 Released

There have been released new versions of WordPress (blogging tool and content management system) which contains updates to critical security vulnerabilities.

Affected versions:
3.9.2, 3.8.4, 3.7.4 and their earlier versions

More information can be read from the WordPress blog.

Google Chrome Updated

Google have released version 39.0.2171.65 of their Chrome web browser. New version contains fixes to 42 security issues.

More information about these in Google Chrome Releases blog.