Adobe Pre-notification of Reader 9.3.3 Patch

Adobe has already released an update of Flash player, they are expected to release the Reader Update on 8/19/2010. These vulnerabilities were the ones discussed and presented at Black Hat. Users and administrators should save the date.

Update on Thursday, August 19, 2010 at 09:14PM by drStrangeP0rk

The update is out, users should select Check for Updates and install the patch right away. Also make sure to update your latest version of Air and Arobat.com.

http://blogs.adobe.com/psirt/2010/08/security-updates-released-for-adobe-reader-and-acrobat.html

APPLE-SA-2010-08-12-1 QuickTime 7.6.7

Apple has released an update for QuickTime to address a vulnerability in the Windows version. There was a buffer overflow in the error logging which can result in arbitrary coded execution.

Microsoft Office 2008 for Mac 12.2.6 Update

Microsoft has released an update for Office 2008 for Mac programs. the update addresses vulnerabilities that allowed an attacker to overwrite the contents of memory with malicious code leading to arbitrary code execution or privilege escalation. Users should update their versions of Office immediately.

APPLE-SA-2010-08-11-2 iOS 3.2.2 Update for iPad

Apple has released updates to address CVE-2010-1797 (FreeType) and CVE-2010-2973 (IOSurface) vulnerabilities. These vulnerabilities were being used by the jailbreakme_com site which users could visit to jailbreak their phone. The iPad is vulnerable to these exploits as well. Reports of the vulnerability being exploited in the wild surface but were unsubstantiated. 

A PDF file could be used to exploit a stack buffer overflow in FreeType handling of CCF opcodes resulting in arbitrary code execution. The issue has been solved by establishing better bounds checking. In addition an integer overflow existed in the IOSurface which allowed elevated privileges to be gained. The combination of the above vulnerabilities resulted in a jail broken iPad or could be leveraged by malicious attackers using spear phish, drive by downloads or mass malware assault. Users should update their iPad using iTunes immediately. 

APPLE-SA-2010-08-11-1 iOS 4.0.2 Update for iPhone and iPod touch

Apple has released updates to address CVE-2010-1797 (FreeType) and CVE-2010-2973 (IOSurface) vulnerabilities. These vulnerabilities were being used by the jailbreakme_com site which users could visit to jailbreak their phone. Reports of the vulnerability being exploited in the wild surface but were unsubstantiated. 

A PDF file could be used to exploit a stack buffer overflow in FreeType handling of CCF opcodes resulting in arbitrary code execution. The issue has been solved by establishing better bounds checking. In addition an integer overflow existed in the IOSurface which allowed elevated privileges to be gained. The combination of the above vulnerabilities resulted in a jail broken iPhone or could be leveraged by malicious attackers using spear phish, drive by downloads or mass malware assault. Users should update their IPhone and IPod Touch using iTunes immediately.