To my readers; I hope you and your families are doing well in these still challenging times.
Last week Adobe and Microsoft released their scheduled security updates. Adobe’s updates resolve 10 and Microsoft’s updates 114 vulnerabilities (respectively) more formally known as CVEs (defined).
====================
Adobe released updates for the following products:
Adobe Bridge: Resolves 6x Priority 3 vulnerabilities (4x Critical Severity and 2x Important Severity)
Adobe Digital Editions: Resolves 1x Priority 3 vulnerability (1x Critical Severity)
Adobe Photoshop: Resolves 2x Priority 3 vulnerabilities (2x Critical Severity)
RoboHelp: Resolves 1x Priority 3 vulnerability (1x Important Severity)
As always, if you use any of the above Adobe products, please make certain to install the relevant updates as soon as possible. This is especially important in the case of the critical severity updates.
====================
A useful source of update related information is the US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):
====================
For this month’s Microsoft updates, I will prioritise the order of installation below:
====================
Important
====================
If you use Microsoft Exchange (the on-premises, non-cloud Office 365 version); please follow the steps from last month to first verify your server is first not infected before installing this month’s security updates for Exchange server. This post from BleepingComputer may be helpful with providing hints on how to install the Exchange Server updates for this month (many thanks to BleepingComputer for this advice):
====================
Microsoft Exchange Server Remote Code Execution Vulnerability: CVE-2021-28480
Microsoft Exchange Server Remote Code Execution Vulnerability: CVE-2021-28481
Microsoft Exchange Server Remote Code Execution Vulnerability: CVE-2021-28482
Microsoft Exchange Server Remote Code Execution Vulnerability: CVE-2021-28483
Remote Procedure Call Runtime Remote Code Execution Vulnerabilities: CVE-2021-28329 , CVE-2021-28330, CVE-2021-28331, CVE-2021-28332, CVE-2021-28333, CVE-2021-28334, CVE-2021-28335, CVE-2021-28336, CVE-2021-28337, CVE-2021-28338, CVE-2021-28339 and CVE-2021-28343
Win32k Elevation of Privilege Vulnerability: CVE-2021-28310
Azure Sphere Unsigned Code Execution Vulnerability: CVE-2021-28460
Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability: CVE-2021-28458
RPC Endpoint Mapper Service Elevation of Privilege Vulnerability: CVE-2021-27091
Windows Media Video Decoder Remote Code Execution Vulnerabilities: CVE-2021-27095 and CVE-2021-28315
Windows Installer Information Disclosure Vulnerability: CVE-2021-28437
Windows NTFS Denial of Service Vulnerability: CVE-2021-28312 (Resolving the issue discussed in this post)
====================
Update: 8th May 2021
The gaming performance issue introduced with the security update kb5001330 is not resolved and does affect more systems that only have single monitors. AMD GPUs also appear to be impacted.
Further Reddit threads discussing this issue are located here and here.
Microsoft have since released a Known Issue Rollback (KIR) update to resolve the performance issues caused by kb5001330.
While some users are confirming that the resolves some of their issues; some issues remain (please also see the Reddit thread I previously linked). I have patched all of my Windows 8.1 and Windows 10 systems. My most powerful Windows 10 system is affected by this performance issue but only in some games, others play fine.
====================
Please note: For Windows 10 systems which use AMD and Nvidia graphics cards; there are reports of stability issues and loss of performance after the Windows 10 Version 20H2 security update kb5001330 is installed. Further details are here, here and here. Please note the prior update mentioned in these links kb5000842 was the April preview update released in late March. Not all systems with Nvidia graphics cards seem to be affected. Some affected systems have the latest models while others have older models. It is not clear if AMD graphics are affected too. At this time; it is unknown when these issues will be resolved.
As per standard best practice, I would recommend backing up the data on any device for which you are installing updates to prevent data loss in the rare event that any update causes unexpected issues.
I have also provided further details of updates available for other commonly used applications below
(I will continue to add to this list).
To all of my readers; I hope you and your families continue to do well during these challenging times. Thank you.
====================
Google Chrome (and a potential privacy issue)
====================
Google has released 2 Chrome updates so far in April version 89.0.4389.128 and 90.0.4430.72 for Linux, Mac and Windows to resolve 2 and 37 security vulnerabilities (respectively).
Another point to note is the initial incorporation of Federated Learning of Cohorts, or FLoC into Chrome. The EFF have published their feedback on this new technology. At this time, Microsoft Edge has not activated it. This is an emerging potential privacy issue. It’s unclear what action to take at this time but it is an item to aware of.
Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 vertically stacked dots) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the updates to take effect.
====================
Nvidia
====================
On the 19th April in Nvidia released security updates for its drivers (defined) which power their Geforce, Nvidia RTX, Tesla and Quadro/NVS GPUs as well as updates for Geforce Experience.
Not all drivers updates are available at this time but are in progress and will be released this week (timelines are provided within Nvidia’s security advisory).
As was the case with January’s security updates all of these vulnerabilities are local vulnerabilities rather than remote meaning that an attacker would first need to compromise your system before exploiting the vulnerabilities to elevate their privileges. The steps to install the drivers are located here. If you use the affected Nvidia graphics cards or Geforce Experience software, please consider installing these updates.