Adobe Flash Player Update Available

Adobe have released updated versions of their Flash Player. The new version fix critical vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Affected versions:
- Users of Adobe Flash Player 11.6.602.168 and earlier versions for Windows should update to Adobe Flash Player 11.6.602.171
- Users of Adobe Flash Player 11.6.602.167 and earlier versions for Macintosh should update to Adobe Flash Player 11.6.602.171
- Users of Adobe Flash Player 11.2.202.270 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.273
- Flash Player integrated with Google Chrome will be updated by Google via Chrome update
- Flash Player integrated with Internet Explorer 10 for Windows 8 will be updated via Windows Update

More information can be read from Adobe's security bulletin.

Google Chrome Updated

Google have released version 25.0.1364.97 of their Chrome web browser. New version contains fixes to 23 vulnerabilities:

-nine high (CVE-2013-0879, CVE-2013-0880, CVE-2013-0882, CVE-2013-0890, CVE-2013-0891, CVE-2013-0894, Linux / Mac affecting CVE-2013-0895, CVE-2013-0896, CVE-2013-0898)

-eight medium (CVE-2013-0881, CVE-2013-0883, CVE-2013-0885, Mac only affecting CVE-2013-0886, CVE-2013-0888, CVE-2013-0892, CVE-2013-0893, CVE-2013-0900)

-five low (CVE-2013-0884, CVE-2013-0887, CVE-2013-0889, CVE-2013-0897, CVE-2013-0899)


More information in Google Chrome Releases blog.

Mozilla Security Updates Available

Mozilla have released updates to Firefox and Seamonkey browsers and Thunderbird email client to address a bunch of vulnerabilities of which four categorized as critical, two as high and two as moderate.

Affected products are:
- Mozilla Firefox earlier than 19.0
- Mozilla Firefox ESR earlier than 17.0.3
- Mozilla Thunderbird earlier than 17.0.3
- Mozilla Thunderbird ESR earlier than 17.0.3
- Mozilla SeaMonkey earlier than 2.16

Links to the security advisories with details about addressed security issues:
MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer
MFSA 2013-27 Phishing on HTTPS connection through malicious proxy
MFSA 2013-26 Use-after-free in nsImageLoadingContent
MFSA 2013-25 Privacy leak in JavaScript Workers
MFSA 2013-24 Web content bypass of COW and SOW security wrappers
MFSA 2013-23 Wrapped WebIDL objects can be wrapped again
MFSA 2013-22 Out-of-bounds read in image rendering
MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)


Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Adobe Reader And Acrobat Security Updates

Adobe have released security updates to fix a couple of critical vulnerabilities (CVE-2013-0640, CVE-2013-0641) in their PDF products, Adobe Reader and Adobe Acrobat.

Affected versions:
*of series XI (11.x)
Adobe Reader 11.0.01 and earlier
Adobe Acrobat 11.0.01 and earlier

*of series X (10.x)
Adobe Reader 10.1.5 and earlier
Adobe Acrobat 10.1.5 and earlier

*of series 9.x
Adobe Reader 9.5.3 and earlier 9.x versions
Adobe Acrobat 9.5.3 and earlier 9.x versions


Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Acrobat Standard, Pro and Extended


More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Java Security Updates From Oracle

Oracle have released update for Java JRE & JDK. The update fixes five vulnerabilities.

Affected versions are:
- Java 7 JRE and JDK update 13 and earlier
- Java 6 JRE and JDK update 39 and earlier
- Java 5.0 JRE and JDK update 39 and earlier
- Java 1.4.2 JRE and JDK update 41 and earlier

More information about the update can be read from Java critical patch update document.

Java users are recommended to update their versions to the latest one available as soon as possible.

Symantec Intelligence Report: January 2013

Symantec have published their Intelligence report that sums up the latest threat trends for January 2013.

Report highlights:
- Spam – 64.1 percent (a decrease of 6.5 percentage points since December)
- Phishing – One in 508.6 emails identified as phishing (a decrease of 0.068 percentage points since December)
- Malware – One in 400 emails contained malware (a decrease of 0.11 percentage points since December)
- Malicious websites – 2,256 websites blocked per day (an increase of 196.1 percent since December)

The report can be viewed here.

Adobe Shockwave Player Update Available

Adobe have released an updated version of their Shockwave Player. The new version fixes two security vulnerabilities. The update is categorized as critical with priority level as 2.

Users of Adobe Shockwave Player 11.6.8.638 and earlier should update to Adobe Shockwave Player 12.0.0.112.

More about fixed vulnerabilities and other information can be read from Adobe's security bulletin.