Important Security Updates
Adobe Flash Player: Adobe has released version 220.127.116.117 to fix a highly critical vulnerability reported in previous versions. Updates are available from Adobe’s website. [See Newly Announced Unpatched Vulnerabilities]
Google Chrome: Google has released Google Chrome version 40.0.2214.91 to fix at least 26 unpatched vulnerabilities some of which are highly critical reported in previous versions. Updates are available from within the browser or from Google Chrome’s website.
Oracle Java: Oracle has released versions Java SE 8 Update 31 to fix at least 19 vulnerabilities, some of which are highly critical. The update is available through Windows Control Panel or Java’s website. [See Citadel’s recommendation below]
Siber Systems RoboForm: Siber Systems has released version 18.104.22.168 of Roboform. Updates are available from within the program, look for the “Check New Version” button on the Options menu or download from the Roboform website.
Current Software Versions
Adobe Flash 22.214.171.1247 [Windows 7: IE]
Adobe Flash 126.96.36.1997 [Windows 7: Firefox, Mozilla]
Adobe Flash 188.8.131.527 [Windows 8: IE]
Adobe Flash 184.108.40.2067 [Macintosh OS X: Firefox, Opera, Safari]
Adobe Reader 11.0.10
Dropbox 3.0.5 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]
Firefox 35.0 [Windows]
Google Chrome 40.0.2214.91
Internet Explorer 11.0.9600.17501
Java SE 8 Update 31 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]
Safari 5.1.7 [Windows]
Safari 7.1.1 [Mac OS X]
Newly Announced Unpatched Vulnerabilities
Adobe Flash: Secunia reports an extremely critical unpatched vulnerability in the most recent version of Adobe Flash Player, version 220.127.116.117 referenced above. No official solution is currently available. Adobe is currently planning to release an update on January 26, 2015.
For Your IT Department
Cisco Multiple Products: Secunia reports Cisco has released updates for its Adaptive Security Appliance (ASA), TelePresence VCS and Cisco Expressway Series, IronPort AsyncOS, WebEx Meetings Server, MDS 9000 Series and others. Apply updates. Secunia reports unpatched vulnerabilities in Cisco’s Unified Communications Domain Manager (CUCDM) and ACNS (Application and Content Networking System). No official solution is available.
HP Systems Insight Manager: Secunia reports HP has released updates for its Systems Insight Manager. Apply hot fix.
McAfee Multiple Products: Secunia reports McAfee has released updates for its Data Loss Prevention Endpoint, Email Gateway and others. Apply updates.
Oracle Multiple Products: US-CERT reports Oracle has released updates to fix hundreds of vulnerabilities in its Database Server, Fusion Middleware, Enterprise Manager Grid Control, E-Business Suite, Supply Chain Products Suite, PeopleSoft Products, JD Edwards Products, Siebel CRM, iLearning, Communications Applications, Retail Applications, Health Sciences Applications, Sun Systems Products Suite, Linux and Virtualization, and MySQL and others.
If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.
Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.
Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.
Copyright © 2015 Citadel Information Group. All rights reserved.