More patch tuesday: adobe released security update for adobe flash player

Published: 2015-08-11
Last Updated: 2015-08-11 19:52:11 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
1 comment(s)

Adobe released today bulletin APSB15-19, which address the following vulnerabilities found in Adobe Flash Player: CVE-2015-3107, CVE-2015-5124, CVE-2015-5125, CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562 and CVE-2015-5563.

As of today, latest Adobe Flash Player version is 18.0.0.232. For Linux, current version is 11.2.202.508. Click here to check online the version you are running.

Please keep in mind that adobe flash player has been consistently insecure for the past few years. If you own a website running on this technology, perhaps you would like to explore other technologies like HTML5 and improve the security of your users.

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter: @manuelsantander
Web:http://manuel.santander.name
e-mail: msantand at isc dot sans dot org

Keywords:
1 comment(s)

August 2015 Microsoft Patch Tuesday

Published: 2015-08-11
Last Updated: 2015-08-11 17:33:04 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
0 comment(s)

Overview of the August 2015 Microsoft patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS15-079 Cumulative Security Update for Internet Explorer (Replaces MS15-065 )
Internet Explorer
CVE-2015-2423
CVE-2015-2441
CVE-2015-2442
CVE-2015-2443
CVE-2015-2444
CVE-2015-2445
CVE-2015-2446
CVE-2015-2447
CVE-2015-2448
CVE-2015-2449
CVE-2015-2450
CVE-2015-2451
CVE-2015-2452
KB 3082442 No. Severity:Critical
Exploitability: 1
Critical Important
MS15-080 Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (Replaces MS15-078 )
Microsoft Windows, Microsoft .NET Framework, Microsoft Office, Microsoft Lync, Microsoft Silverlight
CVE-2015-2435
CVE-2015-2455
CVE-2015-2456
CVE-2015-2463
CVE-2015-2464
KB 3078662 No. Severity:Critical
Exploitability: 1
Critical Important
MS15-081 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (Replaces MS12-046 MS15-046 MS13-072 MS15-070 MS13-044 MS11-089 )
Microsoft Office
CVE-2015-1642
CVE-2015-2423
CVE-2015-2466
CVE-2015-2467
CVE-2015-2468
CVE-2015-2469
CVE-2015-2470
CVE-2015-2477
KB 3080790 No. Severity:Critical
Exploitability: 1
Critical Important
MS15-082 Vulnerabilities in RDP Could Allow Remote Code Execution (Replaces MS13-029 MS15-069 )
Microsoft Windows
CVE-2015-2472
CVE-2015-2473
KB 3080348 No. Severity:Important
Exploitability: 1
Important Important
MS15-083 Vulnerability in Server Message Block Could Allow Remote Code Execution (Replaces MS10-012 )
Microsoft Windows
CVE-2015-2474
KB 3073921 No. Severity:Important
Exploitability: 2
Important Important
MS15-084 Vulnerabilities in XML Core Services Could Allow Information Disclosure (Replaces MS15-039 MS14-033 MS13-002 )
Microsoft XML Core Services
CVE-2015-2424
CVE-2015-2440
CVE-2015-2471
KB 3080129 No. Severity:Important
Exploitability: 3
Important Important
MS15-085 Vulnerability in Mount Manager Could Allow Elevation of Privilege (Replaces MS15-038 MS15-076 MS15-025 MS15-052 )
Microsoft Windows Mount Manager
CVE-2015-1769
KB 3082487 ExploitationDetected Severity:Important
Exploitability: 0
Important Important
MS15-086 Vulnerability in System Center Operations Manager Could Allow Elevation of Privilege (Replaces none )
Microsoft System Center Operations Manager
CVE-2015-2420
KB 3075158 No. Severity:Important
Exploitability: 2
Important Important
MS15-087 Vulnerability in UDDI Services Could Allow Elevation of Privilege (Replaces none )
Microsoft Windows UDDI Services
CVE-2015-2475
KB 3082459 No. Severity:Important
Exploitability: 2
Important Important
MS15-088 Unsafe Command Line Parameter Passing Could Allow Information Disclosure (Replaces MS15-020 )
Microsoft Windows, Internet Explorer, and Microsoft Office
CVE-2015-2423
KB 3082458 No. Severity:Important
Exploitability: 1
Important Important
MS15-089 Vulnerability in WebDAV Could Allow Information Disclosure (Replaces none )
Microsoft Windows WebDAV Server
CVE-2015-2476
KB 3076949 No. Severity:Important
Exploitability: 3
Important Important
MS15-090 Vulnerabilities in Microsoft Windows Could Allow Elevation of Privilege (Replaces MS15-038 MS15-025 MS15-076 MS15-052 )
Microsoft Windows
CVE-2015-2428
CVE-2015-2429
CVE-2015-2430
KB 3060716 No. Severity:Important
Exploitability: 1
Important Important
MS15-091 Cumulative Security Update for Microsoft Edge (Replaces none )
Microsoft Edge
CVE-2015-2441
CVE-2015-2442
CVE-2015-2446
CVE-2015-2449
KB 3084525 No. Severity:Critical
Exploitability: 1
Critical Important
MS15-092 Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (Replaces none )
Microsoft .NET Framework
CVE-2015-2479
CVE-2015-2480
CVE-2015-2481
KB 3086251 No. Severity:Important
Exploitability: 3
Important Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Important patches for servers that do not use outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threats.

       

Keywords: mspatchday
0 comment(s)
ISC StormCast for Tuesday, August 11th 2015 http://isc.sans.edu/podcastdetail.html?id=4607

Comments

What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
https://defineprogramming.com/
https://defineprogramming.com/
Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
Enter corthrthmment here...

Diary Archives