Patching in Review – Week 32 of 2019

With Patch Tuesday on the horizon, make sure to sign up for our Patch Tuesday Webinar where we recap all of the upcoming surprises that our monthly patching holiday brings!

Security news was ablaze this week with the latest speculative execution vulnerability announced. CVE-2019-1125, also known as the “SWAPGS” vulnerability, allows an attacker to steal information by reading from privileged memory that could include passwords, credentials, keys, or other critical data. The most interesting thing about this vulnerability is that you’ve probably already remediated against it without noticing! Microsoft secretly included this vulnerability within the July Patch Tuesday patches. Lastly, this vulnerability type is notorious for impacting performance. Phoronix has begun performing preliminary benchmarks on an Ubuntu machine. Fortunately, Phoronix found that the impact is minimal, but measurable.

Security Releases

Google Chrome once again pushed another release this week, bringing a total of three security releases between Patch Tuesdays. Version 76.0.3809.100 is reported to include four security fixes with two CVEs. The “high” severity vulnerability, CVE-2019-5868, details a “use-after-free” vulnerability where specially crafted content could be used to execute code on the system. Given the numerous releases this month, I wouldn’t expect a surprise release for Patch Tuesday, but who knows?

Third-Party Updates

Other third-party vendors have been busy this week with numerous non-security releases. While these releases are not associated with a CVE, they can include valuable stability fixes as well as undisclosed security fixes: