March 2022 Update Summary

Early last week Adobe and Microsoft released their scheduled security updates to address 6 and 71 vulnerabilities (respectively)(more formally known as CVEs (defined)).

First, please find below the list of Adobe products affected:

Adobe After Effects: Resolves 4x Priority 3 severity CVEs (4x Critical Severity)

Adobe Illustrator: Resolves 1x Priority 3 severity CVE (1x Critical Severity)

Adobe Photoshop: Resolves 1x Priority 3 severity CVE (1x Important Severity)

If you use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical severity updates.

====================

Useful source of update related information are the US Computer Emergency Readiness Team (CERT) and the Cybersecurity & Infrastructure Security Agency (CISA)  (please see the “Information on Security Updates” heading of the “Protecting Your PC” page): 

https://www.us-cert.gov/

https://www.cisa.gov/uscert/ncas/bulletins

==================== 

For this month’s Microsoft updates, I will prioritise the order of installation below and provide further relevant links and steps where necessary:

====================

HEVC Video Extensions Remote Code Execution Vulnerability: CVE-2022-22006

Microsoft Exchange Server Remote Code Execution Vulnerability: CVE-2022-23277

VP9 Video Extensions Remote Code Execution Vulnerability: CVE-2022-24501

Remote Desktop Client Remote Code Execution Vulnerability: CVE-2022-21990

Windows Fax and Scan Service Elevation of Privilege Vulnerability: CVE-2022-24459

.NET and Visual Studio Remote Code Execution Vulnerability: CVE-2022-24512

Windows SMBv3 Client/Server Remote Code Execution Vulnerability: CVE-2022-24508

Azure Site Recovery Elevation of Privilege Vulnerability: CVE-2022-24469

Windows Event Tracing Remote Code Execution Vulnerability: CVE-2022-23294

====================

Following standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues. 

I have also provided further details of updates available for other commonly used applications below. I will add to this list over time.

To all of my readers, I hope you and your families are staying safe. Thank you.

==================== 
Mozilla Firefox 
==================== 

So far this month Mozilla have released 2 sets of security updates for Firefox and Firefox (Extended Support Release) detailed below:

Firefox 97.0.2: Addresses 2x Critical Severity CVEs

Firefox 98: Addresses 4x High Severity CVEs and 3x Moderate Severity CVEs

Firefox ESR 91.6.1: Addresses 2x Critical Severity CVEs

Firefox ESR 91.7: Addresses 4x High Severity CVEs and 1x Low Severity CVE

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above changes.

==================== 
Google Chrome
==================== 

Google has released 1 (stable channel) Chrome update so far this month version 99.0.4844.51 for Linux, Mac and Windows to address 28 security vulnerabilities.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect. 

August 2021 Update Summary

I hope you and your families are staying safe.

Earlier today, as expected Adobe and Microsoft earlier today made available their monthly security updates. They address 29 and 44 vulnerabilities (respectively) also known as CVEs (defined).

First, a summary Adobe’s updates for this month:

Magento: Resolves 26x Priority 2 CVEs (20x Critical Severity and 6x Important Severity)

Adobe Connect: Resolves 3x Priority 3 CVEs (3x Important Severity)

If you use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical updates to Magento.

==================== 

A useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):  

https://www.us-cert.gov/

====================  

For this month’s Microsoft updates, I will prioritise the order of installation below and provide further relevant links and steps where necessary:

====================

Windows Print Spooler Remote Code Execution Vulnerability: CVE-2021-36936: Apply this update and follow the guidance in KB5005652

Windows LSA Spoofing Vulnerability: CVE-2021-36942: Install this update and then follow the guidance with these two links: ADV210003 and KB5005413 (to mitigate the PetitPotam attack)

Remote Desktop Client Remote Code Execution Vulnerability: CVE-2021-34535

Windows TCP/IP Remote Code Execution Vulnerability: CVE-2021-26424

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability: CVE-2021-26432

Windows Elevation of Privilege Vulnerability: CVE-2021-36934: Please make certain you have adequate backups before installing this update and then Delete the Volume Shadow Copies stored on your system to protect against this vulnerability (to protect against the vulnerability named “Serious Sam” (my thanks to BleepingComputer for this article).

Scripting Engine Memory Corruption Vulnerability: CVE-2021-34480

Windows Graphics Component Remote Code Execution Vulnerability: CVE-2021-34530

Windows Update Medic Service Elevation of Privilege Vulnerability: CVE-2021-36948

Windows MSHTML Platform Remote Code Execution Vulnerability: CVE-2021-34534

====================

Following standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues. 

I have also provided further details of updates available for other commonly used applications below. I will add to this list over time.

To all of my readers, I hope you and your families are staying safe and well during these continuing uncertain times. Thank you.

==================== 
Mozilla Firefox 
==================== 
Earlier today Mozilla released Firefox 91 and Firefox ESR (Extended Support Release) 78.13 to resolve the following vulnerabilities: 

Firefox 91: Addresses 8x High Severity CVEs, 2x Moderate Severity CVEs and 1 Low Severity CVE

Firefox ESR 78.13: Addresses 5x High Severity CVEs and 1x Moderate CVE

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above change. Firefox 91 also introduced the features listed at this link.

====================  

Google Chrome 

====================  

Google has released 1 Chrome updates in August so far version 92.0.4515.131 for Linux, Mac and Windows to resolve 10 security vulnerabilities.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect. 

July 2021 Update Summary

I hope you and your families are doing well.

As scheduled, Adobe and Microsoft earlier today made available their monthly security updates. They address 29 and 117 vulnerabilities (respectively) also known as CVEs (defined).

Let us begin with summarising Adobe’s updates for this month:

Adobe Acrobat and Reader: Addresses 20x Priority 2 CVEs (14x Critical Severity and 6x Important Severity)

Adobe Bridge: Addresses 5x Priority 3 CVEs (4x Critical Severity and 1x Moderate Severity)

Adobe Dimension: Addresses 1x Priority 3 CVE (1x Critical Severity)

Adobe Framemaker: Addresses 1x Priority 3 CVE (1x Critical Severity)

Adobe Illustrator: Addresses 3x Priority 3 CVEs (2x Critical Severity and 1 Important Severity)

If you use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical severity updates. 

==================== 

A useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):  

https://www.us-cert.gov/

====================  

For this month’s Microsoft updates, I will prioritise the order of installation below:

The most important update this month was released earlier in July. It is the Windows Print Spooler Remote Code Execution Vulnerability: CVE-2021-34527 which addresses the vulnerability known as PrintNightmare. After installing this update, please make certain that steps 1, 2 and the Group policy setting from this KB article are also implemented (both registry DWORD entries should be zero) to better protect against other related exploits.

The image below is a flow diagram (courtesy of Carnegie Mellon University, image is Copyright ©2021 Carnegie Mellon University. My thanks to them for publishing this diagram) which details how an exploit may attempt to either remotely or locally compromise your Windows system. In addition, the diagram shows how the extra registry values described in this KB article help to protect your system from the locally exploitable aspect of this vulnerability.

Image is Copyright ©2021 Carnegie Mellon University

====================

Windows Print Spooler Remote Code Execution Vulnerability: CVE-2021-34527

Microsoft Exchange Server Remote Code Execution Vulnerability: CVE-2021-34473

Windows Kernel Elevation of Privilege Vulnerability: CVE-2021-31979

Windows Kernel Elevation of Privilege Vulnerability: CVE-2021-33771

Scripting Engine Memory Corruption Vulnerability: CVE-2021-34448

Microsoft Exchange Server Elevation of Privilege Vulnerability: CVE-2021-34523

Windows Kernel Remote Code Execution Vulnerability: CVE-2021-34458

Active Directory Security Feature Bypass Vulnerability: CVE-2021-33781

Windows ADFS Security Feature Bypass Vulnerability: CVE-2021-33779

Windows Certificate Spoofing Vulnerability: CVE-2021-34492

Windows DNS Server Remote Code Execution Vulnerability: CVE-2021-34494

Windows Hyper-V Remote Code Execution Vulnerability: CVE-2021-34450

Dynamics Business Central Remote Code Execution Vulnerability: CVE-2021-34474

Microsoft Defender Remote Code Execution Vulnerability: CVE-2021-34464

Microsoft Defender Remote Code Execution Vulnerability: CVE-2021-34522

Microsoft Windows Media Foundation Remote Code Execution Vulnerability: CVE-2021-34439

Microsoft Windows Media Foundation Remote Code Execution Vulnerability: CVE-2021-34503

Windows Media Remote Code Execution Vulnerability: CVE-2021-33740

Windows MSHTML Platform Remote Code Execution Vulnerability: CVE-2021-34497

====================

Following standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues. 

I have also provided further details of updates available for other commonly used applications below. I will add to this list over time.

To all of my readers, I hope you and your families are safe and well during these continuing uncertain times. Thank you.

==================== 
Mozilla Firefox 
==================== 
Earlier today Mozilla released Firefox 90 and Firefox ESR (Extended Support Release) 78.12 to resolve the following vulnerabilities: 

Firefox 90: Addresses 5x High Severity CVEs and 4x Moderate Severity CVEs

Firefox ESR 78.12: Addresses 3x High Severity CVEs

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above change. Firefox 90 also introduced the features listed at this link.

==================== 
VMware 
==================== 
VMware has released 2 security advisories so far in July to resolve vulnerabilities within the following products: 

==================== 
Advisory 1: Severity: Important 
VMware ESXi and VMware Cloud Foundation (Cloud Foundation)

Advisory 2: Severity: Moderate:

VMware ThinApp

If you use any of the above VMware products, please review the above advisories and install the applicable security updates as soon as possible. 

June 2021 Update Summary

I hope you are all safe and well.

Earlier today Adobe and Microsoft released their expected monthly security updates. The updates resolve 41 and 50 vulnerabilities (respectively) more formally known as CVEs (defined).

Similar to last month Adobe’s updates for June address vulnerabilities across a diverse set of their products:

Adobe Acrobat and Reader: Addresses 5x Priority 2 vulnerabilities (5x Critical Severity)

Adobe After Effects: Addresses 16x Priority 3 vulnerability (8x Critical Severity, 7x Important Severity and 1x Moderate Severity)

Adobe Animate: Addresses 8x Priority 3 vulnerability (4x Critical Severity, 3x Important Severity and 1x Moderate Severity)

Adobe Connect: Addresses 1x Priority 3 vulnerability (1x Important Severity)

Adobe Creative Cloud Desktop: Addresses 2x Priority 3 vulnerabilities (1x Critical and 1x Important Severity)

Adobe Experience Manager: Addresses 4x Priority 2 vulnerabilities (3x Important Severity, 1x Moderate Severity)

Adobe Photoshop: Addresses 2x Priority 3 vulnerabilities (2x Critical Severity)

Adobe Photoshop Elements: Addresses 1x Priority 3 vulnerability (1x Important Severity)

Adobe Premiere Elements:  Addresses 1x Priority 3 vulnerability (1x Important Severity)

Adobe RoboHelp Server: Addresses 1x Priority 3 vulnerability (1x Critical Severity)

If you use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical severity updates.  

====================  

A useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):   

https://www.us-cert.gov/

====================   

For this month’s Microsoft updates, I will prioritise the order of installation below:  

==================== 

Windows MSHTML Platform Remote Code Execution Vulnerability: CVE-2021-33742 (This vulnerability has been publicly disclosed and is being exploited)

Microsoft DWM Core Library Elevation of Privilege Vulnerability: CVE-2021-33739 (This vulnerability has been publicly disclosed and is being exploited)

Windows NTFS Elevation of Privilege Vulnerability: CVE-2021-31956 (This vulnerability is being exploited)

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability: CVE-2021-31199 and CVE-2021-31201 (These vulnerabilities are being exploited)

Windows Kernel Information Disclosure Vulnerability: CVE-2021-31955 (This vulnerability is being exploited)

Remote Desktop Services Denial of Service Vulnerability: CVE-2021-31968 (This vulnerability has been publicly disclosed)

Microsoft SharePoint Server Remote Code Execution Vulnerability: CVE-2021-31963

Microsoft Windows Defender Remote Code Execution Vulnerability: CVE-2021-31985

Microsoft Scripting Engine Memory Corruption Vulnerability: CVE-2021-31959

Microsoft VP9 Video Extensions Remote Code Execution Vulnerability: CVE-2021-31967

==================== 

Following standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.  

I have also provided further details of updates available for other commonly used applications below. I will add to this list over time.

To all of my readers, I hope you and your families continue to do well during these tough times. Thank you. 

==================== 
Mozilla Firefox 
==================== 
On the 1st June Mozilla released Firefox 89 and Firefox ESR (Extended Support Release) 78.11 to resolve the following vulnerabilities: 

Firefox 89: Addresses 2x High Severity CVEs, 5x Moderate Severity CVEs and 2x Low Severity CVEs

Firefox ESR 78.11: Addresses 1x High Severity CVE and 1x Moderate Severity CVE

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above change. Firefox 88 also introduced the features listed at this link. Firefox 89 also introduced the features listed at this link.

May 2021 Update Summary

During the second week of May, Adobe and Microsoft released their expected monthly security updates. They addressed 44 and 55 vulnerabilities (respectively) more formally known as CVEs (defined). System administrators may be pleased to see the decrease in the number of updates from Microsoft for that month. Apologies for not publishing this post sooner.

Adobe’s updates for May month address issues across a diverse range of products: 

Adobe Acrobat and Reader: Resolves 14x Priority 1 vulnerabilities (10x Critical Severity and 4x Important Severity) 

Adobe After Effects: Resolves 3x Priority 3 vulnerabilities (2x Critical Severity and 1x Important Severity) 

Adobe Animate: Resolves 7x Priority 3 vulnerabilities (2x Critical and 5x Important Severity) 

Adobe Creative Cloud Desktop: Resolves 1x Priority 3 vulnerability (1x Critical Severity) 

Adobe Experience Manager: Resolves 2x Priority 2 vulnerabilities (1x Critical Severity and 1x Important Severity) 

Adobe Genuine Service: Resolves 1x Priority 3 vulnerability (1x Important Severity) 

Adobe Illustrator: Resolves 5x Priority 3 vulnerabilities (5x Critical Severity) 

Adobe InCopy: Resolves 1x Priority 3 vulnerability (1x Critical Severity) 

Adobe InDesign: Resolves 3x Priority 3 vulnerabilities (3x Critical Severity) 

Adobe Medium: Resolves 1x Priority 3 vulnerability (1x Critical Severity) 

Adobe Media Encoder: Resolves 1x Priority 3 vulnerability (1x Important Severity) 

Magento Security Updates: Resolves 7x Priority 2 vulnerabilities (1x Important Severity and 6x Moderate Severity) 

Just as always, if you use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical severity updates.  

====================  

A useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):   

https://www.us-cert.gov/

====================   

For this month’s Microsoft updates, I will prioritise the order of installation below:  

==================== 

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability: CVE-2021-31166 (This vulnerability is wormable and a proof of concept exploit is available) 

Microsoft Hyper-V Remote Code Execution Vulnerability: CVE-2021-28476 (a proof of concept exploit for this vulnerability is also available) 

Microsoft Exchange Server Security Feature Bypass Vulnerability: CVE-2021-31207 

Microsoft OLE Automation Remote Code Execution Vulnerability: CVE-2021-31194 

Microsoft .NET Core and Visual Studio Elevation of Privilege Vulnerability: CVE-2021-31204 

Microsoft Common Utilities Remote Code Execution Vulnerability: CVE-2021-31200

Microsoft Scripting Engine Memory Corruption Vulnerability: CVE-2021-26419 

==================== 

As per standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have also provided further details of updates available for other commonly used applications below.

To all of my readers, I hope you and your families are doing well during these challenging times. Thank you. 

==================== 
Mozilla Firefox 
==================== 
In the first week of May Mozilla released Firefox 88.0.1 and Firefox ESR (Extended Support Release) 78.10.1 to resolve the following vulnerabilities: 

Firefox 88.0.1: Addresses 1x Critical Severity CVE and 1x High Severity CVE 

Firefox ESR 78.10.1: Addresses 1x Moderate Severity CVE

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above change. Firefox 88 also introduced the features listed at this link. 

====================  

Google Chrome 

====================  

Google released 2 Chrome updates in May versions 90.0.4430.212 and 91.0.4472.77 for Linux, Mac and Windows to resolve 19 and 33 security vulnerabilities (respectively).

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect. 

======================= 
Putty 
======================= 
Putty, the open source and highly popular SSH (defined) client for Windows, was updated to version 0.75 in early May. It contains 1 security fixes (see below). Version 0.75 is downloadable from here. 

If you use Putty, please update it to version 0.75. Thank you. 

Security vulnerability fixed: 

• vuln-windows-remote-title-dos: Rapid changes of window title can DoS Windows GUI 

==================== 
VideoLAN VLC 
==================== 
On the 10th of May VideoLAN released version 3.0.13 resolving 4 known vulnerabilities. The other non-security improvements introduced are detailed in the above 3.0.13 link and within the changelog. Version 3.0.14 was later released to address an auto-update issue (not security related). 

The most recent versions of VLC can be downloaded from: 
http://www.videolan.org/vlc/ 

==================== 
VMware 
==================== 
VMware released 4 security advisories to resolve vulnerabilities within the following products: 

==================== 
Advisory 1: Severity: Critical: 
VMware vRealize Business for Cloud 

Advisory 2: Severity: Low: 

VMware Workspace ONE UEM console 

Advisory 3: Severity: Low: 

VMware Workstation Pro / Player (Workstation) 

VMware Horizon Client for Windows 

Advisory 4: Severity: Critical: 

VMware vCenter Server (vCenter Server) 

VMware Cloud Foundation (Cloud Foundation) 

If you use any of the above VMware products, please review the above advisories and install the applicable security updates as soon as possible. 

February 2021 Update Summary

To my readers; I hope you and your families are safe and well. Sorry for the delay in publishing this post. However, it does contain information made available after the 9th February and should still prove useful.

Tuesday, 9th February was the release day for Adobe and Microsoft’s scheduled security updates. Adobe addressed 50 vulnerabilities and Microsoft resolved 56 vulnerabilities more formally known as CVEs (defined).

Let’s begin with Adobe’s security updates:

Adobe Acrobat and Reader: Addresses 23x Priority 1 (17x Critical Severity and 6x Important Severity) vulnerabilities

Adobe Animate: Addresses 1x Priority 3 (1x Critical Severity) vulnerabilities

Adobe Dreamweaver: Addresses 1x Priority 3 (1x Important Severity) vulnerabilities

Adobe Illustrator: Addresses 2x Priority 3 (2x Critical Severity) vulnerabilities

Magento: Addresses 18x Priority 2 (7x Critical, 10x Important and 1x Moderate Severity) vulnerabilities

Adobe Photoshop: Addresses 5x Priority 3 (5x Critical Severity) vulnerabilities

If you  use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical severity updates.

Separately, Microsoft from the 16th February onwards began releasing an optional update for Windows 10 that removes the embedded version of Flash Player (that was previously used by Internet Explorer).

I installed this update on my 3x Windows 10 20H2 systems (2x physical and 1x virtual machine). The update never requested a reboot. It left behind some empty folders (the locations of which are detailed here). This was a very smooth removal. I will install this update on my 2x physical Windows 8.1 systems when it is offered to them (likely in March 2021).

=======================

Microsoft currently lists 36 Known Issues within its monthly summary. Almost all have workarounds or resolutions (others have solutions currently being worked upon). Please review the list from the above link if you have any concerns.

====================
A further useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/
====================

For this month’s Microsoft updates, as always I will prioritise the order of installation below:
====================

Microsoft Windows Win32k Elevation of Privilege Vulnerability: CVE-2021-1732

Windows TCP/IP Remote Code Execution Vulnerability: CVE-2021-24074

Windows TCP/IP Remote Code Execution Vulnerability: CVE-2021-24094

Windows DNS Server Remote Code Execution Vulnerability: CVE-2021-24078

Windows Local Spooler Remote Code Execution Vulnerability: CVE-2021-24088

Windows Graphics Component Remote Code Execution Vulnerability: CVE-2021-24093

.NET Core for Linux Remote Code Execution Vulnerability: CVE-2021-14112

Microsoft .NET Core and Visual Studio Remote Code Execution Vulnerability: CVE-2021-26701

Windows Fax Service Remote Code Execution Vulnerability: CVE-2021-24077

Windows Fax Service Remote Code Execution Vulnerability: CVE-2021-1722

Sysinternals PsExec Elevation of Privilege Vulnerability: CVE-2021-1733 (a revised fixed was made available by Microsoft in March 2021)

Microsoft Windows Codecs Library Remote Code Execution Vulnerability: CVE-2021-24081

Windows Camera Codec Pack Remote Code Execution Vulnerability: CVE-2021-24091

Microsoft Windows Installer Elevation of Privilege Vulnerability: CVE-2021-1727

Microsoft .NET Core and Visual Studio Remote Code Execution Vulnerability: CVE-2021-1721

Windows Console Driver Denial of Service Vulnerability: CVE-2021-24098

Windows DirectX Information Disclosure Vulnerability: CVE-2021-24106

As per standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have also provided further details of updates available for other commonly used applications below.

To all of my readers; I hope you and your families stay safe during these tough times. Thank you.

====================
Mozilla Firefox
====================
In the first week of February Mozilla made available Firefox 85.0.1 and Firefox ESR (Extended Support Release) 78.7.1 to resolve the following critical vulnerability:

Firefox 85.0.1 and Firefox ESR 78.7.1: Resolves 1x Critical severity CVE

A mitigation for the Windows 10 NTFS Corruption vulnerability was also added to Firefox 85.0.1. My thanks to BleepingComputer for their article on that issue.

Later on, the 23rd February, Mozilla made available Firefox 86 and Firefox ESR 78.8 to resolve the following vulnerabilities:

Firefox 86: Resolves 5x High severity, 4x Moderate and 3x Low severity CVEs

Firefox ESR 78.8: Resolves 3x High and 1x Low severity CVEs

Firefox 86 introduces Total Cookie Protection and multiple picture in picture (among other features detailed here).

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above change.

====================
Google Chrome
====================
Google has released 4 Chrome updates so far in February version 88.0.4324.146 , version 88.0.4324.150 and version 88.0.4324.182 for Linux, Mac and Windows to resolve 6, 1  and 10 security vulnerabilities (respectively). Version 88.0.4324.190 and 192 for Mac do not contain security updates. Version 88 of Chrome removes support for Adobe Flash.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

====================
Cyberpunk 2077
====================
The popular video game Cyberpunk 2077 has released a security update, hotfix version 1.12 to resolve the following security issues:

Fixed a buffer overrun (defined) issue

Removed/replaced non-ASLR (defined) DLLs (defined)

My thanks to BleepingComputer for their article listing the availability of this security update.

====================
Apple Security Updates
====================
Apple had released the following security updates so far in February:

Apple macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave: Addresses 66x CVEs

Apple Safari 14.0.3: Addresses 3X CVEs

Apple macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, and macOS Mojave 10.14.6 Security Update 2021-002: Addresses 3x CVEs

Windows 10 NTFS Corruption Vulnerability

====================

Update: 20th April 2021

====================

Microsoft have released a security update (part of the April 2021 security updates)  to address this vulnerability. Please install it to resolve this vulnerability. My thanks to BleepingComputer for the above linked to article.

Thank you.

====================

TL;DR:
Exercise standard caution when receiving unexpected email attachments or downloading attachments from websites. An unofficial fix is also available (please see below for the link). Mozilla Firefox 85.0.1 prevents exploitation from within that browser.

In mid-January 2021 a security researcher publicly disclosed a software bug within Windows 10 that could be used to cause a denial of service (DoS) upon an impacted system.

Why should this vulnerability be considered important?
This issue is very easy to trigger (via one line of code within a Windows shortcut file (.lnk), a ZIP archive or a batch file (*.bat)) and affects standard user and not just administrator accounts within Windows 10 Version 1803 and later. Separately Windows XP is also affected but will not be patched against this issue.

This The Verge article provides a summary “Attackers can hide a specially crafted line inside a ZIP file, folder, or even a simple Windows shortcut. All a Windows 10 user needs to do is extract the ZIP file or simply look at a folder that contains a malicious shortcut and it will automatically trigger hard drive corruption”.

More alarming is that for some systems which upon this command was executed were repairable via Microsoft’s Check Disk (Chkdsk) utility while at other times the same system is rendered unbootable.

How can I protect my organisation or myself from this vulnerability?
Please exercise standard caution when receiving unexpected email attachment or downloading attachments from websites since these sources could contain a Zip file. The Zip could contain a shortcut file designed to exploit this vulnerability. This will lower significantly the possibility of exploitation.

If you believe the risk of users within your organisation opening a Zip attachment is too high, please consider installing this unofficial filter driver which will mitigate the issue until an official fix from Microsoft is available.

Mozilla Firefox 85.0.1 prevents the exploitation of this issue from within Firefox but the other means of exploiting it from within Windows remain.

Thank you.

Special thanks to “The Verge” for the summary included above.

January 2021 Update Summary

To my readers; I hope you and your families are doing well. Happy New Year.

Today; Adobe and Microsoft released their scheduled security updates earlier today. Adobe’s updates resolve 8 and 83 vulnerabilities (respectively) more formally known as CVEs (defined).

Let’s start with Adobe updates:

Adobe Animate: 1x Priority 3 (1x Critical Severity)
Adobe Bridge: 1x Priority 3 (2x Important Severity)
Adobe Campaign Classic: 1x Priority 2 (1x Critical Severity)
Adobe Captivate: (1x Important Severity)
Adobe Illustrator: 1x Priority 3 (1x Critical Severity)
Adobe InCopy: 1x Priority 3 (1x Critical Severity)
Adobe Photoshop: 1x Priority 3 (1x Critical Severity)

As always; if you use any of the above Adobe products, please consider updating them especially those with critical severity updates.

While it does not appear that Microsoft made an automatic update available to remove Flash Player for Internet Explorer or Microsoft Edge (Legacy) today; you should still consider uninstalling it following the advice in my post from November. Corporate customers and consumers can make use of Microsoft’s manual update to uninstall this version of Flash Player. The other remaining versions are also addressed in that post; if you wish to take further action. Alternatively; simply wait until Microsoft makes the Flash Player uninstaller an automatic update and browser vendors take their scheduled actions later this month.

At the time of writing; Microsoft’s monthly summary; lists Known Issues for 11 Microsoft products this month, similar to last month all but one has a workaround.

In addition to the updates released by Microsoft; for all versions of Windows prior Windows 10 Version 2004; a further security update was released to address a security bypass vulnerability within the Secure Boot of Windows.

According to the above linked to Microsoft support article, if you are updating your Windows system manually, please make certain to install this update in the following order. Systems with automatic updates enabled (the default option) will automatically have the updates installed in the correct order:

1. Servicing Stack Update
2. Standalone Secure Boot Update listed in this CVE
3. January 2021 Security Update

Separately; I was able to confirm that for systems that pre-date Secure Boot (manufactured before 2012) and thus do not have a UEFI (defined) based firmware “While this update doesn’t include any security updates that will benefit your computer, it will address the vulnerability by adding the signatures of the known vulnerable UEFI modules to the DBX”.

For your information I have installed this update KB4535680 on the following systems without any issues. Secure Boot is enabled on both systems. This update does not apply to my custom Core i9 Extreme system running Windows 10 Version 20H2 64 bit:

Custom PC: Asus Z97-C motherboard (BIOS Version 2103): Windows 8.1 Update (64 bit)

Notebook PC: Lenovo ThinkPad E460 (BIOS Version 1.40): Windows 10 Version 1909 (64 bit)

The custom PC dates from late 2014 and the notebook from late 2016.

====================
A further useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/
====================

For this month’s Microsoft updates, as always I will prioritise the order of installation below:
====================

Microsoft Defender Remote Code Execution Vulnerability: CVE-2021-1647

Microsoft splwow64 Elevation of Privilege Vulnerability: CVE-2021-1648

GDI+ Remote Code Execution Vulnerability: CVE-2021-1665

HEVC Video Extensions Remote Code Execution Vulnerability: CVE-2021-1643

Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability: CVE-2021-1668

Microsoft Edge (HTML-based) Memory Corruption Vulnerability: CVE-2021-1705

Remote Procedure Call Runtime Remote Code Execution Vulnerability: CVE-2021-1658

Remote Procedure Call Runtime Remote Code Execution Vulnerability: CVE-2021-1660

Remote Procedure Call Runtime Remote Code Execution Vulnerability: CVE-2021-1666

Remote Procedure Call Runtime Remote Code Execution Vulnerability: CVE-2021-1667

Remote Procedure Call Runtime Remote Code Execution Vulnerability: CVE-2021-1673

As per standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have also provided further details of updates available for other commonly used applications below.

To all of my readers; I hope you and your families are continuing to stay safe during these tough times. Thank you.

====================
Nvidia
====================

====================
Update: 20th April 2021
====================

Nvidia driver version 461.92 and later resolve the stability issues mentioned in this blog post. This driver should be now be installed to address the security issues discussed in this post.

====================
Update: 19th January 2021
====================
It has been reported that this Nvidia driver update is causing instability of some systems. For this reason; I have not installed this on my systems. I will await a later driver which corrects these issues.

Earlier in January Nvidia released security updates for its drivers (defined) which power their Geforce, Nvidia RTX, Tesla and Quadro/NVS GPUs as well and updates for its vGPU software (for Linux, Windows, Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM, Nutanix AHV). Not all updates for the vGPU software are available at this time but are in progress and will be released over the coming weeks (timelines are provided within Nvidia’s security advisory).

As was the case with October’s security updates all of these vulnerabilities are local vulnerabilities rather than remote meaning that an attacker would first need to compromise your system before exploiting the vulnerabilities to elevate their privileges. The steps to install the drivers are located here. If you use the affected Nvidia graphics cards or software, please consider installing these updates.

====================
Mozilla Firefox
====================
In the first week of January Mozilla released Firefox 84.0.2 and Firefox ESR (Extended Support Release) 78.6.1 to resolve the following vulnerabilities:

Firefox 84.0.2 and Firefox 78.6.1 ESR: Addresses 1x critical severity CVE

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above change.

====================
VideoLAN VLC
====================
On the 12th of January VideoLAN released version 3.0.12 resolving at least 3 known vulnerabilities. The other non-security improvements introduced are detailed in the above 3.0.12 link and within the changelog.

The most recent versions of VLC can be downloaded from:
http://www.videolan.org/vlc/

====================
Google Chrome
====================
Last week, Google released Chrome version 87.0.4280.141 for Linux, Mac and Windows to resolve 16 security vulnerabilities.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

June 2020 Update Summary

I hope all is well during these challenging times.

Earlier today Adobe and Microsoft released their monthly security updates resolving 10 vulnerabilities and 129 vulnerabilities (respectively). These vulnerabilities are more formally known as CVEs (defined).

Adobe’s updates for this month are as following:
Adobe Experience Manager: 6x Priority 2 CVEs resolved (6x Important severity)

Adobe Flash Player: 1x Priority 2 CVE resolved, (1x Critical severity)

Adobe Framemaker: 2x Priority 3 CVEs resolved (3x Critical severity)

Adobe After Effects: 5x Priority 3 CVEs resolved (5x Critical severity)

Adobe Audition: 2x Priority 3 CVEs resolved (2x Critical severity)

Adobe Campaign Classic: 1x Priority 3 CVEs resolved (1x Important severity)

Adobe Illustrator: 5x Priority 3 CVEs resolved (5x Critical severity)

Adobe Premiere Pro: 3x Priority 3 CVEs resolved (3x Critical severity)

Adobe Premiere Rush: 3x Priority 3 CVEs resolved (3x Critical severity)

If you use any of the above Adobe products, especially Adobe Flash Player; please install these updates as soon as possible since both multiple critical vulnerabilities have been resolved.

====================
A further useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

====================
For this month’s Microsoft updates, I will prioritize the order of installation below:
====================

VBScript Remote Code Execution Vulnerability: CVE-2020-1213 , CVE-2020-1216

Microsoft Browser Memory Corruption Vulnerability: CVE-2020-1219

Microsoft SharePoint Server Remote Code Execution Vulnerability: CVE-2020-1181

Scripting Engine Memory Corruption Vulnerability: CVE-2020-1073

Windows GDI+: CVE-2020-1248

Windows OLE: CVE-2020-1281

Windows Shell Remote Code Execution Vulnerability: CVE-2020-1286

Windows Remote Code Execution Vulnerability: CVE-2020-1300

Please install the remaining updates at your earliest convenience.

As per standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have also provided further details of updates available for other commonly used applications and devices below.

To all of my readers and your families, I hope you are staying safe during these tough times. Thank you.

====================
Mozilla Firefox
====================
In the first week of June, Mozilla released Firefox 77 and Firefox ESR (Extended Support Release) 68.9 to resolve the following vulnerabilities:

Firefox 77.0: Addresses 4x high severity CVEs, 1x moderate CVE and 2x low CVEs

Firefox 68.9 ESR: Addresses 4x high severity CVEs

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above changes.

====================
Google Chrome
====================
Last week, Google released Chrome version 83.0.4103.97 for Linux, Mac and Windows to resolve 5 security vulnerabilities.

Two further updates were released by Google in June resolving 4 and 2 vulnerabilities respectively. The latest version of Google Chrome in the stable channel is 83.0.4103.116

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

====================
Intel Security Advisories
====================
Intel have released a series of security advisories today. The advisories are prioritised below. If you use any of these products, software or devices, please update them as soon as possible especially in the case of the critical and high severity advisories:

Critical:

2020.1 IPU – Intel CSME, SPS, TXE, AMT, ISM and DAL Advisory

High:

2020.1 IPU – Intel SSD Advisory

2020.1 IPU – BIOS Advisory

Intel Innovation Engine Advisory

Medium:

Special Register Buffer Data Sampling Advisory

====================
Nvidia
====================
In late June Nvidia released security updates for its drivers which power their Geforce, Tesla and Quadro/NVS GPUs as well and updates for its vGPU software (for Linux, Windows, Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM, Nutanix AHV). Not all updates for the vGPU software are available at this time but are in progress and will be released over the coming weeks (timelines are provided within Nvidia’s security advisory).

As was the case with previous Nvidia security updates all of these vulnerabilities are local vulnerabilities rather than remote meaning that an attacker would first need to compromise your system before exploiting the vulnerabilities to elevate their privileges. The steps to install the drivers are located here. If you use the affected Nvidia graphics cards or software, please consider installing these updates. For Windows, this update also brings improved performance and functionality with Windows 10 Version 2004.

=======================
Putty
=======================
Putty, the open source and highly popular SSH (defined) client for Windows, was updated to version 0.74 in the latter half of June. It contains 2 security fixes (see below). Version 0.74 is downloadable from here.

If you use Putty, please update it to version 0.74. Thank you.

Security vulnerabilities fixed:

• vuln-agent-keylist-used-after-free: Key list from agent used after free if server rejects signature after PK_OK
• vuln-dynamic-hostkey-info-leak: Dynamic host key policy leaks information about known host keys

====================
VMware
====================
VMware released 4 security advisories to resolve vulnerabilities within the following products:

====================
Advisory 1: Severity: Important:

VMware vSphere ESXi (ESXi)
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)

Advisory 2: Severity: Important:

VMware Horizon Client for Windows
Advisory 3: Severity: Low

VMware Tools for macOS
Advisory 4: Severity: Critical

VMware ESXi
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
VMware Cloud Foundation

====================

If you use any of the above VMware products, please review the above advisories and install the applicable security updates as soon as possible.

====================
Mozilla Firefox
====================
In the final week of June, Mozilla released Firefox 78 and Firefox ESR (Extended Support Release) 68.10 to resolve the following vulnerabilities:

Firefox 78.0: Addresses 7x high severity CVEs, 4x moderate CVE and 2x low CVEs

Firefox 68.10 ESR: Addresses 4x high severity CVEs and 1x moderate CVE

Firefox 78 introduces a repair option within its uninstaller to attempt to fix issues the browser is experiencing and a refined version of the built-in PDF reader allowing downloaded PDFs to be easily read.

The day after the release of Firefox 78, Mozilla released 78.0.1 to resolve non-security issues:

1. All search engines are gone, list of one-click search engines is empty now
2. Auto complete in the address bar doesn’t work any longer
3. Search function on the start page doesn’t start a search any longer

Details of how to install updates for Firefox are here. If Firefox is your web browser of choice, if you have not already done so, please update it as soon as possible to benefit from the above changes.

====================
Google Chrome
====================
Two further updates were released by Google in June resolving 4 and 2 vulnerabilities respectively. The latest version of Google Chrome in the stable channel is 83.0.4103.116

=======================
Apple Security Updates:
=======================
On the 1st of June Apple made available the following updates.

Further details for these updates are as follows:
Apple iOS 13.5.1 and iPadOS 13.5.1 (resolves 1x CVE (defined))
Apple tvOS 13.4.6: Resolves 1x CVE.
Apple watchOS 6.2.6: Resolves 1x CVE
macOS Catalina 10.15.5 Supplemental Update, Security Update 2020-003 High Sierra: Resolves 1x CVE.

=======================

Please see these links from Apple for advice on backing up your iPhone and iPad. Advice for updating tvOS is available here while the steps for updating the Apple Watch are available here.

As always; further details of these updates are available on Apple’s dedicated security updates page.

For advice on how to install updates for Apple devices, please see the steps detailed at the end of this Sophos blog post as well as this link (from my “Protecting Your PC” page).

====================
VideoLAN VLC
====================
On the 16th of June VideoLAN released version 3.0.11 resolving at least 3 known CVEs (other vulnerabilities were addressed by upgrading internal 3rd party libraries used by VLC). CVE-2020-13428 however only affected Apple macOS/iOS but was of high severity (CVSSv3 base score (defined) of 7.8).

The most recent versions of VLC can be downloaded from:

http://www.videolan.org/vlc/

May 2020 Update Summary

I hope this posts finds you doing well in these difficult times.

I’m writing this post early to highlight the availability of 2 important updates, for Mozilla Firefox and Google Chrome. I’ll update the post when Adobe and Microsoft release their expected security updates.

Thank you and please stay safe.

====================
Update: 19th May 2020
====================
Sorry for not updating this post sooner.

As scheduled both Adobe and Microsoft released their monthly security updates addressing 36 vulnerabilities and 111 vulnerabilities (respectively). These vulnerabilities are more formally known as CVEs (defined).

Adobe’s updates for this month are as following:

Adobe Acrobat and Reader: 24x Priority 2 CVEs resolved (12x Critical and 12x Important severity)

Adobe DNG Software Development Kit (SDK): 12x Priority 3 CVEs resolved (4x Critical and 8x Important severity)

Adobe have since released further security updates:

Adobe Audition: 1x Priority 3 CVE resolved (1x Important severity)

Adobe Character Animator: 1x Priority 3 CVE resolved (1x Critical severity)

Adobe Premiere Pro: 1x Priority 3 CVE resolved (1x Important severity)

Adobe Premiere Rush: 1x Priority 3 CVE resolved (1x Important severity)

Adobe Acrobat and Reader: 24x Priority 2 CVEs resolved (12x Critical and 12x Important severity)

If you use the above Adobe products, please install these updates as soon as possible since they resolve multiple critical vulnerabilities. Similar to January, March and April no updates for Adobe Flash were released.

====================
A further useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

====================
As always for this month’s Microsoft updates, I will prioritize the order of installation below:
====================
Windows Graphics Component: CVE-2020-1135

Visual Studio Code Python Extension: CVE-2020-1058, CVE-2020-1060, CVE-2020-1171 , CVE-2020-1192

Microsoft Internet Explorer: CVE-2020-1062

VBScript Remote Code Execution Vulnerability: CVE-2020-1035

Microsoft Edge CVE-2020-1056 , CVE-2020-1059 , CVE-2020-1096

Microsoft SharePoint: CVE-2020-1023 , CVE-2020-1024, CVE-2020-1102

Windows kernel: CVE-2020-1054, CVE-2020-1143

Windows Media Foundation: CVE-2020-1126

Microsoft Color Management: CVE-2020-1117

Windows Print Spooler: CVE-2020-1048

Microsoft Windows Transport Layer Security Denial of Service Vulnerability: CVE-2020-1118

Please install the remaining updates at your earliest convenience.

As per standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.

I have also provided further details of updates available for other commonly used applications and devices below.

To all of my readers and your families, I hope you are staying safe during these challenging times. Thank you.

====================
Mozilla Firefox
====================
In the first week of May, Mozilla released Firefox 76 and Firefox ESR (Extended Support Release) 68.8 to resolve the following vulnerabilities:

Firefox 76.0: Addresses 3x critical severity CVEs, 2x high severity CVEs, 4x moderate CVEs and 1x low CVE

Firefox 68.8 ESR: Addresses 3x critical severity CVEs, 2x high severity CVEs and 2x moderate severity CVEs

Firefox 76 introduces a new password manager (with the ability to generate difficult to guess passwords) which includes a means of detecting if a password was part of a password breach and now requires changing or the use of the same password on multiple websites.

An improved picture in picture experience is also included. Firefox 76.0.1 has since been released resolving non-security issues such as crashing add-ons e.g. the Amazon Assistant extension and crashing with Nvidia GPU drivers on Windows 7 32 bit (my thanks to Bogdan Popa of Softpedia.com and Mozilla for this information).

====================
Google Chrome
====================
Early last week, Google released Chrome version 81.0.4044.138 for Linux, Mac and Windows to resolve 3 security vulnerabilities with the most severe 2 issues being of high severity.

In mid-May, Google released version 83 of Google Chrome for Linux, Mac and Windows resolves 38 security vulnerabilities and adds multiple security features and features such as tab groups.

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.

====================
VMware
====================

VMware released 3 security advisories this month to resolve vulnerabilities within the following products:

====================

Advisory 1: Severity: Critical:
VMware vRealize Operations Application Remote Collector (ARC)

Advisory 2: Severity: Important
VMware Cloud Director

Advisory 3: Severity: Important
VMware ESXi
VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)
VMware Remote Console for Mac (VMRC for Mac)
VMware Horizon Client for Mac

====================

If you use any of the above products, please review the above advisories and install the applicable security updates as soon as possible.

=======================
Apple Security Updates:
=======================
In mid May Apple made available the following updates. Further details for these updates are as follows:

Apple watchOS 6.2.5: Resolves 34x CVEs (defined)

Apple watchOS 5.3.7: Resolves 2x CVEs
Apple xCode 11.5: Resolves 1x CVE
Apple tvOS 13.4.5: Resolves 34x CVEs
Apple iOS 13.5 and iPadOS 13.5: Resolves 47x CVEs
Apple iTunes 12.10.7 for Windows: Resolves 12x CVEs
Apple iCloud for Windows 7.19 (for Windows 7): Resolves 12x CVEs
Apple Safari 13.1.1: Resolves 10x CVEs
Windows Migration Assistant 2.2.0.0: Resolves 1 CVE
Apple iCloud 11.2 for Windows 10 (available from the Microsoft Store): Resolves 12x CVEs
macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra: Resolves 54x CVEs

=======================

Please see these links from Apple for advice on backing up your iPhone and iPad. Advice for updating tvOS is available here while the steps for updating the Apple Watch are available here.

As always; further details of these updates are available on Apple’s dedicated security updates page.

For advice on how to install updates for Apple devices, please see the steps detailed at the end of this Sophos blog post as well as this link (from my “Protecting Your PC” page).

====================
Wireshark
====================
In the second half of May, Wireshark made available the following updates (I’ll detail only the 2 most recent versions here):

v3.2.4: Relating to 1 security advisory (relating to 1 CVE)
v3.0.11: Relating to 1 security advisory (relating to 1 CVE)

As per standard process Linux distributions can obtain this update using the operating systems standard package manager (if the latest version is not installed automatically using the package manager you can instead compile the source code (v3.2.4 or v3.0.9). This forum thread and this forum thread may also be helpful to you with installing Wireshark on your Linux based system.

For Mac OS X and Windows, the update is available within the downloads section of the Wireshark website. In addition, a detailed FAQ for Wireshark is available here.