Earlier this year Oracle ORCL 115,09 +0,56 +0,49% announced starting with JDK 9 (eta September 2016), they will remove the plugin support. They are encouraging developers to move towards the plugin free Java Web Start technology. Oracle’s reasoning for this move has to do with more and more browsers removing support the 20+ year old Netscape Plugin Application Programming Interface (NPAPI) plugin technology. GoogleGOOG 159,92 +1,97 +1,25% Chrome no longer supports NPAPI plugins such as Java and Silverlight. Google has partnered with Adobe ADBE 466,89 +1,87 +0,40% to include an integrated version of Flash within Chrome. The Windows 64-Bit version of Firefox also does not…
Security Alerts
Read More
Seems like every couple months people start crying ‘the sky is falling’ with Firefox and Netscape Plugin Application Programming Interface (NPAPI) plugins. Earlier this week there was a flurry of activity with Bug 1165981. Again people seem to think that Firefox is not going support NPAPI plugins anymore on Windows since the 64-Bit (Win64) versions does not (except for Flash). As a reminder the removal of NPAPI support only applies to the Win64 version of Firefox. The 32-bit Windows version still supports all the NPAPI plugins including Java and Silverlight. However, Mozilla does plan on discontinuing support in the future with the Firefox 32-bit…
On Thursday, October 15th, Mozilla released an update for the Firefox 41.0 branch with Firefox 41.0.2. This update addressed the following issues: Mozilla Foundation Security Advisory 2015-115: 2015-115 Cross-origin restriction bypass using Fetch The next planned release will be Firefox 42 on November 3rd.
Okay, maybe not ‘watching you’, but they are spying on you. Seems that Microsoft MSFT 400,96 +1,84 +0,46% was not content with just spying on Windows 10 users. They have pushed through some ‘Telemetry’ updates on Windows 7 and 8.1 which allow Windows to collect and send data back to Microsoft. Keep in mind if you have opted-out of previous ‘feedback/telemetry’ programs with Microsoft, these updates undo all that (including user privacy settings in the Windows hosts file). …(the updates) all add “customer experience and diagnostic telemetry” to Windows 7 and Windows 8. This is shorthand for monitoring how you use Windows…
On August 6, 2015 Mozilla released an emergency security update for Firefox 38 ESR and Firefox 39 with the Firefox 38.1.1 ESR and Firefox 39.0.3 releases. These releases were a result of MFSA 2015-78: Same origin violation and local file stealing via PDF reader. From The Mozilla Security Blog: The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation (the “same origin policy”) and Firefox’s PDF Viewer. Mozilla products that don’t contain the PDF Viewer, such as Firefox for Android, are not vulnerable. The vulnerability does not enable the execution of arbitrary code but the exploit was able…
Something I have learned over the years, Microsoft is never going to offer you something via email and if it looks fishy it is! So, now there is a ransomware email going around originating Thailand (with the address update@microsoft.com) claiming to be from Microsoft with a Windows 10 installer already attached (how handy!) First red flag should be getting an unsolicited email from Microsoft, much less one WITH an attachment. Windows Insider Program participants will get emails from Microsoft, but those will not have attachments. Next, there is an encoding issue with the email (likely since it originated from Thailand) though overall…
I was checking Amazon.com this morning on my Samsung Galaxy S4 with the Amazon Shopping App. Today is Prime Day so was seeing what they had to offer. I was presented with a pop-up notification to update what I thought was for the Amazon Shopping App. I started the update and the first red flag that came up was it wanted me to Enable Unknown Sources on my device’s security settings. Basically, this is to allow you to be able to install apps outside the Google Play Store. I was somewhat confused why I needed to do this, but went ahead and…
On Monday (July 13th), Trend Micro reported the now third bug (CVE-2015-5123) to Adobe’s Security Team. This comes just as Adobe was getting ready to push out the update 18.0.0.209 which had addressed two Zero Day vulnerabilities discovered with verison 18.0.0.203 earlier. No word yet when Adobe is going to push out a patch for this vulnerability. via: Krebs on Security
Adobe is dealing with a a lot of problems in the past week with Flash. Things got a whole lot worse from them this week. On Monday night, Mozilla Blacklisted (disabled) in Firefox, Flash Player version 18.0.0.203 for all Firefox users. On Sunday, Facebook’s new Chief Security Officer took to Twitter and called for Adobe “announce an end-of-life date for Flash,” so that we can finally “disentangle the dependencies and upgrade the whole ecosystem.” Adobe did release Flash Player version 18.0.0.209 earlier on Tuesaday morning. Source: Ars Technica
If you updated your Flash Player Plugin last week to version 18.0.0.203, you will need to update again today in order to use Flash in Firefox. Mozilla has blocked the 18.0.0.203 version of Shockwave Flash which contained security fixes for 0-day vulnerabilities, but was found to contain vulnerabilities itself. Adobe released version 18.0.0.209 ealier this morning which patched two vulnerabilities. To upgrade from within Firefox go to Tools > Add-ons then select Plugins on the left side. Above the list of plugins click the Check to see if your plugins are up to date link. A new tab will open with…