Patching in Review – Week 26 of 2019

Week 26! It’s hard to believe we’re already at the midway point of the year. For a quick review of these six months, CVEDetails has a great Top 50 Vendors chart covering the most vulnerable vendors so far. As of writing this article, Microsoft leads the pack with a whopping 363 vulnerabilities! The first half of 2019 has been far from calm, and I doubt the trailing half of the year will be any less so.

Speaking of top vendors, Microsoft Excel appeared twice this week in the security world with a new vulnerability and an attack campaign discovered:

• Mimecast released an article this week revealing a method to exploit a feature called Power Query. Within this attack, malicious data could be included in a separate source, then executed when loaded onto the spreadsheet. Surprisingly enough, when Mimecast reached out to Microsoft, it declined to fix the feature directly, but released a Security Advisory with workaround recommendations.
• Microsoft warned users via Twitter about a discovered malware campaign that’s able to compromise fully patched Windows PCs. Within this campaign, a malicious .xls file is attached to an email that will download and run the FlawedAmmyy remote access trojan on an endpoint. Since this malware runs within memory, it has a chance to avoid detection from common antivirus solutions.

Security Releases

Although not as high profile as Firefox and Firefox ESR from last week , Thunderbird 60.7.2 released with the same zero-day CVEs under MFSA2019-20. In this advisory, both CVE-2019-11707 and CVE-2018-11708 are remediated, which were used in combination to compromise cryptocurrency firms. The chances of exploitation on Mozilla’s email client is much slimmer than Firefox, but make sure to close this security vulnerability as soon as possible.

Third-Party Updates

Here are the other updates we released in our content this week. These updates might not have CVEs, but they may still have helpful stability fixes as well as undisclosed security fixes: