August 2019 Patch Tuesday forecast: Expect updates from Adobe, stay current on other updates
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-1125 | An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further. On January 3, 2018, Microsoft released an advisory and security updates related to a newly-discovered class of hardware vulnerabilities (known as Spectre) involving speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. This vulnerability, released on August 6, 2019, is a variant of the Spectre Variant 1 speculative execution side channel vulnerability and has been assigned CVE-2019-1125. Microsoft released a security update on July 9, 2019 that addresses the vulnerability through a software change that mitigates how the CPU speculatively accesses memory. Note that this vulnerability does not require a microcode update from your device OEM. NVD description · AI analysis pending | 5.6 | 5% |
| — |
Full article495 words · extracted from helpnetsecurity.com · click to collapse
Microsoft released details on August 6 regarding another variant of the Spectre Variant 1 speculative execution side channel vulnerability (CVE-2019-1125). The vulnerability was actually patched in the July 9 update for all currently supported Microsoft Windows operating systems, so if you are caught up on your OS security updates you are already covered. Unlike many of the Spectre and Meltdown vulnerabilities, this one did not require microcode updates from the device OEM.
Also, the mitigation went into effect with the update for all platforms, which was a little different than previous mitigations. Previous mitigations were enabled on workstation OSs but had to be enabled as a separate step on server operating systems.
Since July’s Patch Tuesday, a number of security updates have been released by a variety of vendors. Depending on what updates you may have already addressed, you may have paid down some of this accumulation. However, there has been a steady stream so it is likely there are some non-Microsoft updates that you will need to address in your next maintenance window.
- PuTTy: Released v0.72 which did not have identified CVE IDs, but did have a security warning that it resolved multiple vulnerabilities
- Virtual Box: 14 CVEs resolved
- Java 8: 10 CVEs resolved
- A huge list of other Oracle products like Oracle Middleware, MySQL, Oracle DB were also updated as part of the Oracle CPU on July 16
- SnagIT: 1 CVE resolved
- Apple iTunes: 23 CVEs resolved
- Apple iCloud: 23 CVEs resolved
- Google Chrome: 15 CVEs resolved
- Wireshark: 1 CVE resolved
Every month you can expect Microsoft to release updates for the Windows Operating System, IE & Edge, and Microsoft Office. SQL Server, Exchange, and .Net Framework updates are often mixed in sporadically from month to month. July was the largest Patch Tuesday release from Microsoft in 2019 and included updates for all of the above. Keep your fingers crossed we will see a light Patch Tuesday from Microsoft this month. Expect the normal lineup of OS, IE and Office for sure.
Adobe surprised us in July by not having a security update for Flash Player. This is the first time in a long time we did not see a Flash security update. Likely we will not see a repeat of that, so expect a Flash update for August. Acrobat has not had a security update since May so there is a strong chance that we may see an update there as well.
Mozilla had their most recent update (Firefox 68) on July Patch Tuesday. There are currently no scheduled updates for August. The next expected release will be Firefox 69 which has an expected release date of September 3rd.
August 2019 Patch Tuesday forecast:
- We are hoping for a light month from Microsoft (OS, IE, Office)
- Expect Flash and possibly Adobe Acrobat and Reader
- Expect a light third party set this month outside of Adobe
- Make sure to account for the many non-Microsoft updates that have released since July Patch Tuesday
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/08/09/august-2019-patch-tuesday-forecast/