Patching in Review – Week 3 of 2019

Is it just me, or does it feel like Patch Tuesday rolled into this week? With the quarterly release from Oracle and new security patches from Microsoft over the past 7 days, 2019 has kept the world of patching busy to say the least.

A zero-day proof-of-concept has been released for an unpatched Windows vulnerability related to vCard files. According to ZDNet, this vulnerability was expected to be addressed in January’s Patch Tuesday, but ultimately did not make it into this month’s set of patches. After this vulnerability remained unpatched, the security researcher published the vulnerability under Trend Micro’s Zero Day Initiative under ZDI-CAN-6920. According to the advisory, an attacker can craft a vCard file that can execute malicious code when clicked by a user. It’s currently unknown whether this zero-day will be remediated before February’s Patch Tuesday, but given the disclosure, it might come sooner than later.

Security Releases

Oracle released their Critical Patch Update Advisory for this quarter, addressing a total of 284 vulnerabilities. Surprisingly enough, the release for Java was relatively uneventful, with only 4 CVEs listed for Java SE, with a maximum CVSS base score of only 5.3. VirtualBox saw a much larger update with a total of 27 CVEs remediated in this quarterly release. Two of these vulnerabilities (CVE-2018-11784 and CVE-2018-0734) can be exploited remotely without authentication so be sure to get these patched quickly.

Microsoft returned this week with patches for Team Foundation Server and Skype For Business 2015 Server. The 2 CVEs for TFS (CVE-2019-0646 and CVE-2019-0647) have both been publicly disclosed, affecting version 2017 and 2018. With any publicly disclosed vulnerability, the chances an attacker could develop an exploit increases dramatically, so be sure to begin scheduling a patching window for this software.

Third-Party Updates

While we did have our security releases this week, many vendors also released non-security updates for the week. The updates below contain valuable stability improvements and possibly other undisclosed vulnerabilities.