Google Chrome 43 fixes 37 vulns

Google released Chrome 43 that provides patches for 37 security flaws along with numerous improvements across different components of the browser. Google is quite famous for its bug bounty program and this time is no exception as company has given around $40,000 to security researchers. Google awarded the highest amount of $16,337 to an anonymous researcher who has found a CRITICAL vulnerability in the sandbox escape and addressed under CVE-2015-1252. Another anonymous researcher is also given $7,500 for finding high severity cross-origin bypass in DOM covered under CVE-2015-1253. Armin Razmdjou of Rawsec was awarded $3,000 for revealing a cross-origin bypass in Editing covered under CVE-2015-1254. Similarly, Khalil Zhani reported use-after-free issues affecting WebAudio and WebRTC. A reward of $3,000 to Atte Kettunen of OUSPG for a high severity use-after-free flaw in SVG and a medium rated security flaw in PDFium. Besides this, Chrome 43 also come up with a new feature called "Upgrade Insecure Requests" content security policy (CSP) - used to automatically upgrade HTTP requests to HTTPS before they get the response by the browser. <more>

FIRST EVER Security update for Apple Watch

Apple rolled out the first security update for its recently launched Apple Watch that uses an iOS-based operating system. Company releases patches for 13 security flaws targeting kernel, Secure Transport, FontParser, the Foundation framework, IOHIDFamily and IOAcceleratorFamily components. According to advisory, security flaw in the FontParser allows execution of arbitrary code via malformed font, while Foundation framework is prone to XML External Entity (XXE) vulnerability due to improper handling of XML files in the NSXMLParser. The OHIDFamily and IOAcceleratorFamily components could allow malicious applications to disclose kernel memory layout. Rest of the issues are related to Kernel. Apple Watch OS 1.0.1 also fixes the FREAK vulnerability that allows an MitM attacker to intercept the encrypted data and force it to use weak encryption to aid further attacks. This security update targets Apple Watch, Apple Watch Sport and Apple Watch Edition. <more>

13 Bulletins for last PATCH Tuesday

Recently Microsoft official statement reveals that from now onwards users will get the security patch as soon as it is available. So this might the last Patch Tuesday and brings 13 security bulletins where three are rated as CRITICAL and remaining ten are rated as IMPORTANT. Critical bulletins include MS15-043 targets Internet Explorer that patches 22 CVEs. Second critical bulletin MS15-044 addresses Font Drivers issue in Microsoft Windows, Microsoft .NET Framework, Microsoft Office, Microsoft Lync, and Microsoft Silverlight; MS15-045 is the third critical bulletin resolves the Windows Journal issue in Microsoft Windows. All critical bulletins allow remote code execution on the vulnerable system. Rest of the bulletins are related to address elevation of privileges and information disclosure issues. <more>

Huge PATCHES for Adobe products

Along with Microsoft Patch Tuesday, Adobe systems has also released security updates covering 52 vulnerabilities in Flash, Reader and Acrobat. According to advisory the updates fix 18 vulnerabilities in Flash player 34 flaws in Adobe Reader and Acrobat. Fixes are issued for Windows, Mac and Linux platforms that allow intruders to take complete control over the vulnerable system. APSB15-09 updates cover Adobe Flash Player 17.0.0.169 and earlier, 13.0.0.281 and earlier 13.x versions, 11.2.202.457 and earlier 11.x versions, AIR Desktop Runtime 17.0.0.144 and earlier versions as well as AIR SDK and SDK & Compiler 17.0.0.144 and earlier versions. Similarly APSB15-10 provides security patches for Adobe Reader XI (11.0.10) and earlier 11.x versions, Reader X (10.1.13) and earlier 10.x versions, Acrobat XI (11.0.10) and earlier 11.x versions, as well as Acrobat X (10.1.13) and earlier 10.x versions. Adobe urges users to apply updates on earliest basis. <more>

Apple Safari gets NEW security fixes

On Wednesday, Apple rolled out a new version of Safari web browser fixing five security flaws found in the WebKit browser engine. The fixes address flaws in Safari versions 8.0.6, 7.1.6 and 6.2.6. Three out of Five fixes are related to memory corruption flaws that could allow intruders to execute arbitrary code or cause the vulnerable browsers to crash unexpectedly. According to advisory, these security flaws are covered under CVE-2015-1152, CVE-2015-1153 and CVE-2015-1154 - can be exploited by enticing victim to visit malicious website. Security researcher Joe Vennix of Rapid7 found a security flaw in the WebKit History component covered under CVE-2015-1155 - allows access to the information from an unprivileged source, related to a same-origin policy issue. <more>

Unpatched SAP apps pose security risks

Onapsis, a security firm famous for finding out security flaws in SAP applications revealed that cybercriminals usually use pivoting, portal attacks and database warehousing techniques to take control of SAP systems at the application layer. Onapsis Research Labs indicates in the assessment report which was conducted recently and declares that almost 95 percent of ERP implementations involving SAP applications are vulnerable due to lacking in proper patching results in high risk to security breaches. According to Mariano Nunez, CEO and co-founder of Onapsis, CISO should have greater visibility into their SAP applications so that they can figure out risks and provide mitigation accordingly. CISOs should also be able to detect new attack vectors and user behavior anomalies as being indicators of exploiting SAP implementations. <more>