Adobe Shipping Critical Fixes for Reader and Acrobat in May Patch
Adobe is set to publish security updates in various versions of its Acrobat and Reader software packages along with Microsoft in the May edition of Patch Tuesday.
Vulnerabilities
Microsoft to Patch IE Flaw, 9 Others Next Week
The Microsoft Security Response Center announced today that it will ship ten bulletins in the March edition of patch Tuesday. MSRP considers just two of the patches critical, one of which supplements the currently available “Fix it” tool that resolved the IE vulnerability exploited recently in an attack targeting the U.S. Department of Labor.
Adobe to Patch Critical Flaw in ColdFusion
Adobe is readying a patch for a critical vulnerability in its ColdFusion Web application server that is being used in attacks right now. The vulnerability affects several versions of ColdFusion running on Windows, Unix and OS X.
One of the largest online music streaming services was briefly singing a different tune after learning a new Google Chrome plug-in allowed users to download copies of songs for free.
Microsoft reports that a 15-month-old Internet Explorer exploit has been included into the Cool Exploit Kit. The bug was first exploited at the 2012 Pwn2Own contest.
In its annual report to Congress detailing the capabilities of and threats from China, Pentagon officials spend dozens of pages explaining the People’s Liberation Army’s strengths and weaknesses in each area, from nuclear weapons to artillery to information warfare. It reads the way you would expect, written as it is by a committee of military officials.
Security researcher Adam Gowdiak and his team at Security Explorations have discovered another slew of issues that stem from the way Java is implemented in certain versions of software, in this case, IBM’s SDK.
Adobe is planning to patch a fairly low severity security vulnerability in all of the current versions of Reader and Acrobat that could enable an attacker to track which users have opened a certain PDF document. The vulnerability can’t be used for code execution, but researchers say it could be used as part of a larger attack.
For at least the third year in a row, the number of serious vulnerabilities per website has fallen. That sounds like good news until you look at the numbers and realize that the average website carried an astonishing 56 holes in 2012, according to statistics compiled by WhiteHat Security and based upon data gathered from tens of thousands of websites.
On Friday, Jay Freeman announced on Twitter that he exploited a known vulnerability and subsequently achieved root access to his developer-model of Google Glass – Google’s highly anticipated, wearable, head-mounted computer.
