While we are still weeks away from the next patch Tuesday, Apple has kept us busy this week with a series of security releases for its software catalog.

A new ransomware campaign has been discovered by security researchers that’s being delivered through spam emails. This attack, titled “GandCrab Ransomware,” is detailed by BleepingComputer where an attached Word document titled “Emergencyexitmap.doc” can be opened. Once the user enables macros, a PowerShell script will be executed that downloads and installs the ransomware on the system. Older, unsupported versions of Microsoft Office are especially vulnerable to this attack and many antivirus programs do not detect these malicious scripts, so make sure to educate your end users around these attacks that require user interaction.

Security Releases

Apple released new updates for both iCloud and iTunes for Windows on its Security Updates page, patching a total of 14 CVEs. Three of the CVEs released affect SQLite with a critical CVSSv3 score of 9.8, where an attacker can execute arbitrary code through a memory corruption issue and are shared by both iCloud and iTunes. While not as ubiquitous as Adobe Flash or Google Chrome, this software can still be an attack vector on a subset of your systems, so make sure to roll out these updates soon.

Third-Party Updates

While only Apple released security updates this week, many other vendors released non-security updates for their products. These might not cover any CVEs, but they also contain valuable stability fixes.

Software Title

Ivanti ID

Ivanti KB

DropBox 65.4.177

DROPBOX-101

QDROPBOX654177

Evernote 6.17.5.8281

ENOT-015

QENOT61758281

FileZilla Client 3.40.0

FILEZ-084

QFILEZ3400X86

GOM Player 2.3.37.5299

GOM-022

QGOM23375299

GoodSync 10.9.22

GOODSYNC-108

QGS10922

LogMeIn 4.1.12000

LMI-014

QLMI41120000

Node.JS 11.8.0 (Current)

NOJSC-007

QNODEJSC1180

Opera 58.0.3135.47

OPERA-198

QOP580313547

Plex Media Player 2.26.0

PLXP-028

QPLXP2260

Royal TS 5.00.61322.0

RTS5-003

QRTS500613220

TeamViewer 14.1.9025.0

TVIEW-043

QTVIEW14190250

TreeSize Free 4.3.0.489

TSF-015

QTSF430489

Zoom Client 4.3.46185

ZOOM-015

QZOOM4346185

Zoom Client 4.3.46260

ZOOM-016

QZOOM4346260

Zoom Outlook Plugin 4.5.44665.0109

ZOOMOUT-004

QZOOMO4544665

How Ivanti Endpoint Security Customers Can Achieve a 176% ROI Over 3 Years - DOWNLOAD THE STUDY