Forest Global Training Partners

Cyber Risks · Krebs on Security

Flash, Windows Users: It’s Time to Patch

Summary: Adobe released Flash Player 29.0.0.113 to fix at least two critical bugs, and Microsoft shipped 14 updates covering more than 75 vulnerabilities across all supported Windows versions, Internet Explorer/Edge, Office, SharePoint and Exchange Server. Two of the Microsoft flaws were publicly disclosed before the patch - CVE-2018-0940 in Exchange Server 2010 through 2016 and CVE-2018-0808 in ASP.NET Core 2.0 - and Microsoft says it has no evidence either was exploited in active attacks.

Bottom line: Public disclosure of those two flaws gives attackers a head start or possible proof-of-concept code, and Ivanti's Chris Goettl notes the risk of exploit is higher for that reason even though both are rated Important rather than Critical. All of Microsoft's critical vulnerabilities this month sit in browsers and browser-related technologies, which Qualys says should be prioritized on any system that reaches the Internet through a browser.

Read the original at Krebs on Security ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2018-0808CVE-2018-0940
Related