December 2015 Security Updates Summary

Today Microsoft released it’s final scheduled collection of security bulletins for 2015. There are 12 bulletins in total addressing 71 security issues more formally known as CVEs (defined)(only 58 of those are unique CVEs since some updates address the same issue within different updates).

The Security Bulletin Summary at this time does not list any Known Issues. An excellent additional source for information on Known Issues is the IT Pro Patch Tuesday blog which is usually updated shortly after the release of the updates if any issues are encountered.

Adobe issued updates to Flash Player and Adobe AIR, its application runtime to resolve a record number of 79 critical CVEs. Flash Player updates for Linux, Apple Mac OS X and Windows are available from this link (which can be used if you don’t have automatic updating enabled or simply wish to install the update as soon as possible). Users of Google Chrome have received (I have confirmed this); this Flash update within this Chrome update. Microsoft has announced the availability of their Flash update by updating this security advisory for users of Internet Explorer 10, 11 and Microsoft Edge installed on Windows 8.0, 8.1 and Windows 10 (respectively).

You can monitor the availability of security updates for the majority of your software from the following website (among others) or use Secunia PSI:

US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the Protecting Your PC page):

If you use any of the above software, please install the appropriate updates as soon as possible. Steps for installing updates for Windows are provided on the “Protecting Your PC” page.

I would recommend installing the update to Adobe Flash Player first if you make use of this web browser plugin. Their update addresses 79 critical security issues which may be exploited by exploit kits (defined) within a short timeframe. In addition, it has been a very eventful year for Adobe with a record number of security issues patched making this update even more important to install.

With regards to prioritizing Microsoft’s updates I would recommend installing the Windows Kernel update first since it addresses a zero day (defined) vulnerability. Next install the updates for Internet Explorer, Microsoft Edge Microsoft Office, JScript and VBScript, Windows DNS, Windows Graphics Component, Silverlight and Microsoft Uniscribe due to their critical severities. You can then install any remaining applicable updates. The DNS, Internet Explorer, Edge and Office updates will be of particular importance to large organizations due to the prevalence of this software.

One other security pre-caution that you may wish to take if you have Microsoft EMET installed is to use it to protect you from Adobe Flash being used to exploit vulnerabilities when you open a Microsoft Office document or Adobe PDF file. I provide recommendations of how to do this at the end of July’s Update Summary.

As always as a routine precaution I would recommend backing up the data on any device for which you are installing updates in order to prevent data loss in the rare event that any update causes unexpected issues.

Thank you.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.