Updates

Although there’s a heated Adobe vs. Apple discussion going on, creative professionals are probably much more excited about the latest version of Adobe’s Creative Suite, which is now officially available. Besides the new versions of Photoshop, Illustrator, InDesign, Premiere Pro and Dreamweaver, Adobe Creative Suite 5 also brings Flash Player 10.1 and Adobe AIR® 2, which are “optimized for high performance on mobile screens and designed to take advantage of native device capabilities for a richer, more immersive user experience.” ...

Many patches are announced for tomorrow: The Redmond company expects to release 11 security bulletins. Of those 5 are rated critical, 5 important and 1 moderate. The patches belonging to the bulletins will close 25 security vulnerabilities in Windows, Exchange and in Office. Adobe plans to deliver security updates for critical vulnerabilities in Adobe Reader and Acrobat for all supported platforms tomorrow. Additionally, the automatic updater will be activated with the patches so in future updates get installed silent.

Adobe has announced that it will release an updater along with Adobe Reader and Acrobat versions 9.3.2 and 8.2.2 on patch Tuesday next week. On the Adobe blog, Steve Gottwals wrote: “…we have been testing a new updater technology with select beta customers since our October 13, 2009 quarterly update. The purpose of the new updater is to keep end-users up-to-date in a much more streamlined and automated way. “During our quarterly update on January 12, 2010, and then again for an out-of-cycle update on February 16, 2010, we exercised the new updater with our beta testers. This allowed us to test a variety of network configurations encountered on the Internet in order to ensure a robust update experience. That beta process has been a successful one, and we’ve incorporated several positive changes to the end-user experience and system operation. Now, we’re ready for the next phase of deployment.” ...

Microsoft has put the PC-using world on notice that next Tuesday there will be 11 bulletins released addressing 25 vulnerabilities in Windows, Exchange and Office. Jerry Bryant, Group Manager of Microsoft’s Response Communications, said: “I also want to point out to customers that we will be closing the following open Security Advisories with next week’s updates: — Microsoft Security Advisory 981169 – Vulnerability in VBScript could allow remote code execution. ...

A couple of weeks ago, Digg (finally) launched its official iPhone application to much fanfare. Like all first versions, however, it suffered from a couple of glitches, some of which have been addressed in this latest update, which brings the version number to 1.1.0. The list of improvements and fixes is as follows: – Closing the app on a Digg story page doesn’t result in a crash when reopening the app – A range of stability improvements allows the app to be used for longer periods without crashing – An “open in Safari” option for viewing websites from the story pages – The app opens on the last page viewed when it was last closed ...

In March, the Windows team announced the upcoming release of Service Pack 1 for Windows 7, and Windows Server 2008 R2, but did not set a date of availability. At the time, Microsoft’s Brandon LeBlanc said, “For Windows 7, SP1 includes only minor updates, among which are previous updates that are already delivered through Windows Update. SP1 for Windows 7 will, however, deliver an updated Remote Desktop client that takes advantage of RemoteFX introduced in the server-side with SP1 for Windows Server 2008 R2.” ...

As expected, Microsoft has pushed out a mandatory update to the Xbox 360 today, which adds support for USB storage devices, expanding the memory capacity of the five-year old video game console. The update will ostensibly allow any FAT32-formatted USB storage device between 1GB-16GB in size to be used to save profiles, game saves, and downloadable content. There are, however, a number of caveats, which mean users can’t just plug anything in and have it work. ...

Apple has issued Security Update 2010-002 (Mac OS X v10.6.3) that fixes 100 enumerated vulnerabilities in: — Mac OS X 10.5 — Mac OS X 10.6 — Mac OS X Server 10.5 — Mac OS X Server 10.6 The 400 MB+ download takes a while, so, be prepared. Info here: http://support.apple.com/kb/HT4077

MS10–018 If you’re using Internet Explorer versions 6 or 7 it wouldn’t be a good idea to miss this one. “Actively exploited” for drive by down loads from malicious web sites sums it up. There’s something in it for IE8 as well. See our post yesterday: “Microsoft out-of-band patch tomorrow”

Let the iPad hype and excitement begin: Apple’s preparation for the launch of the iPad has kicked into high gear. Today, the tech giant released version 9.1 of iTunes, its vastly popular music, app, and now book-managing software. The new update doesn’t do anything like radically change the iTunes interface. Instead, it is focused on providing support for the iPad, which launches this Saturday. The big addition in this software update is iPad syncing. Thus if and when you plug that glorious iPad of yours into your computer on Saturday, it’ll sync your computer’s music, movies, books, and other media with your tablet device. ...

Microsoft said today it will issue an out-of-band patch tomorrow for a vulnerability in Internet Explorer 6 and 7 that is being actively exploited. “The vulnerability exists due to an invalid pointer reference being used within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution,” Microsoft said in its Security Advisory 981374 earlier this month. ...

Last month, Microsoft sent flowers to a mock funeral for Internet Explorer 6, in a show of support for the ideal that the old browser should be declared defunct worldwide. But for a few years yet, the company is still bound to support the product for those users (generally businesses) who refuse to upgrade it. That’s why new exploits that continue to target old browsers, such as IE6 and IE7, continue to get attention even a full year after the proper security fix — IE8 — has been deployed. ...

Mozilla Foundation has released version 3.6.2 of its Firefox browser a week early. The group had said the update would be available March 30. The update fixes a widely reported vulnerability (CVE-2010-1028) that prompted Germany’s CERT to advise Web users to switch to another browser until a fix was made. (My blog post “Germany’s CERT warns against Firefox use” ) Intevydis researcher Evgeny Legerov had found that Wide Open Font Format decoder in Firefox had an integer overflow in its font decompression mechanism. The flaw involved a memory buffer that was too small to handle a downloadable font. Legerov had found that exploiting the vulnerability could crash a victim’s browser making it possible to run arbitrary code on the system. ...

For the current vulnerability in Internet Explorer 6 and 7 which already gets actively exploited on the net, Microsoft is already testing a patch. The company is still considering whether to release the patch on the regular Patchday or out-of-band. Meanwhile, a “Fix-it”-solution is available. With some registry changes the affected peers factory in iepeers.dll gets disabled by a mouse click. You can download it from Microsoft’s knowledgebase.

A little more than a week ago Microsoft started delivering a new Browser Choice for Windows to be compliant to the European Union law. There are plenty of web browsers to choose from, and my colleague Sorin Mustaca recommended Firefox. Usually a good choice, but currently users should be cautious about which browser they choose: Opera just released version 10.51 of their web browser. According to the changelog, it fixes a vulnerability which could lead to execution of injected code. Users of opera 10.50 should update as soon as possible. ...