Adobe, Microsoft Push Critical Security Fixes

Microsoft today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in Windows and associated software. Separately, Adobe pushed updates to fix a slew of critical flaws in its Flash Player and Adobe Air software, as well as patches to fix holes in Adobe Reader and Acrobat.

Three of the Microsoft patches earned the company’s most dire “critical” rating, meaning they fix flaws that can be exploited to break into vulnerable systems with little or no interaction on the part of the user. The critical patches plug at least 30 separate flaws. The majority of those are included in a cumulative update for Internet Explorer. Other critical fixes address problems with the Windows OS, .NET, Microsoft Office, and Silverlight, among other components.
According to security vendor Shavlik, the issues address in MS15-044 deserve special priority in patching, in part because it impacts so many different Microsoft programs but also because the vulnerabilities fixed in the patch can be exploited merely by viewing specially crafted content in a Web page or a document. More information on and links to today’s individual updates can be found here.

Adobe’s fix for Flash Player and AIR fix at least 18 security holes in the programs. Updates are available for Windows, OS X and Linux versions of the software. Mac and Windows users, the latest, patched version is v. 17.0.0.188. 

If you’re unsure whether your browser has Flash installed or what version it may be running, browse to this link. Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, should automatically update to the latest version. To force the installation of an available update, click the triple bar icon to the right of the address bar, select “About Google” Chrome, click the apply update button and restart the browser.

The most recent versions of Flash should be available from the Flash home page, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from here. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).

If you run Adobe Reader, Acrobat or AIR, you’ll need to update those programs as well. Adobe said it is not aware of any active exploits or attacks against any of the vulnerabilities it patched with today’s releases.

Reference:
http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-fixes-7

Microsoft Security Bulletin(s) for May 12, 2015

Today Microsoft released the following Security Bulletin(s).
Note: »www.microsoft.com/techne ··· security and »www.microsoft.com/security are authoritative in all matters concerning Microsoft Security Bulletins! ANY e-mail, web board or newsgroup posting (including this one) should be verified by visiting these sites for official information. Microsoft never sends security or other updates as attachments. These updates must be downloaded from the microsoft.com download center or Windows Update. See the individual bulletins for details.
Because some malicious messages attempt to masquerade as official Microsoft security notices, it is recommended that you physically type the URLs into your web browser and not click on the hyperlinks provided.
Bulletin Summary:
»technet.microsoft.com/li ··· ms15-may
Critical (3)
Microsoft Security Bulletin MS15-043
Cumulative Security Update for Internet Explorer (3049563)
»technet.microsoft.com/li ··· ms15-043
Microsoft Security Bulletin MS15-044
Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execution (3057110)
»technet.microsoft.com/li ··· ms15-044
Microsoft Security Bulletin MS15-045
Vulnerability in Windows Journal Could Allow Remote Code Execution (3046002)
»technet.microsoft.com/li ··· ms15-045
Important (10)
Microsoft Security Bulletin MS15-046
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3057181)
»technet.microsoft.com/li ··· ms15-046
Microsoft Security Bulletin MS15-047
Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (3058083)
»technet.microsoft.com/li ··· ms15-047
Microsoft Security Bulletin MS15-048
Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (3057134)
»technet.microsoft.com/li ··· ms15-048
Microsoft Security Bulletin MS15-049
Vulnerability in Silverlight Could Allow Elevation of Privilege (3058985)
»technet.microsoft.com/li ··· ms15-049
Microsoft Security Bulletin MS15-050
Vulnerability in Service Control Manager Could Allow Elevation of Privilege (3055642)
»technet.microsoft.com/li ··· ms15-050
Microsoft Security Bulletin MS15-051
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191)
»technet.microsoft.com/li ··· ms15-051
Microsoft Security Bulletin MS15-052
Vulnerability in Windows Kernel Could Allow Security Feature Bypass (3050514)
»technet.microsoft.com/li ··· ms15-052
Microsoft Security Bulletin MS15-053
Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (3057263)
»technet.microsoft.com/li ··· ms15-053
Microsoft Security Bulletin MS15-054
Vulnerability in Microsoft Management Console File Format Could Allow Denial of Service (3051768)
»technet.microsoft.com/li ··· ms15-054
Microsoft Security Bulletin MS15-055
Vulnerability in Schannel Could Allow Information Disclosure (3061518)
»technet.microsoft.com/li ··· ms15-055
Please note that Microsoft may release bulletins out side of this schedule if we determine the need to do so.
If you have any questions regarding the patch or its implementation after reading the above listed bulletin you should contact Product Support Services in the United States at 1-866-PCSafety 1-866-727-2338. International customers should contact their local subsidiary.
As always, download the updates only from the vendors website – visit Windows Update and Office Update or Microsoft Update websites. You may also get the updates thru Automatic Updates functionality in Windows system.
Security Tool
Find out if you are missing important Microsoft product updates by using MBSA.

Reference:
https://technet.microsoft.com/en-us/library/security/ms15-may.aspx
http://blogs.msmvps.com/donpatterson/2015/05/12/microsoft-security-bulletins-for-may-12-2015/