Patch Tuesday

Ivanti’s Patch Tuesday breakdown goes beyond patching your applications and brings you the intelligence and guidance needed to prioritize where to focus your attention first. Catch early analysis on our Ivanti blog, then join industry expert Chris Goettl for the Patch Tuesday Webinar Event. There we’ll do a deep dive into each of the bulletins and give guidance on the risks associated with the newly-identified vulnerabilities.

Patch Tuesday has been around for years, but there’s too much emphasis on the Microsoft Updates. IT manages many diverse environments, including Mac OS X, and applications from Adobe, Oracle, Google, Mozilla, Citrix, and many other vendors. This can make vulnerability management difficult. Stay on top of patching with Ivanti.

Upcoming

No results found

Past

May 2017 (May 10)

There’s no fix today for Microsoft’s new “crazy bad” vulnerability in the Malware Protection Engine. Stay tuned and stay vigilant—while you tackle what May Patch Tuesday does have to offer. Top of mind should be the updates that patch exploited vulnerabilities as well as the Flash Player update. And in this second month since Microsoft nixed security bulletins, you’ll see we’re making tweaks to our approach to keep updates organized and easy to reference.

April 2017 (April 11)

Given last month’s torrential patch downpour, April Patch Tuesday was bound to make a quieter entrance-but that doesn’t mean that it sprinkled. Anything but, in fact. The list includes swan song security updates for one Windows OS and the first of many for another. And speaking of Vista: patch away, then deal with the aging software you can no longer patch. This month’s IIS 6.0 Zero Day underlines the need for continued vigilance.

March 2017 (March 15)

March Patch Tuesday certainly came in like a lion, with Microsoft releasing two months of updates at once. February’s SMB Zero Day disclosure made its entrance this month, IE updates struck out on their own, and those are far from the only bulletins to take the March Patch Tuesday stage. Rumors of the demise of Patch Tuesday Security bulletins have been greatly exaggerated.

January 2017 (January 10)

January has ushered in a new year of Patch Tuesdays with a manageable number of updates and no exploits or Zero Day vulnerabilities. This could be the calm before the storm. This is the lightest Patch Tuesday since January 2014. Next month you should expect some adjustments and more updates as Microsoft changes methodologies. This is also the last Patch Tuesday where Microsoft will use Security Bulletins.

December 2016 (December 13)

December Patch Tuesday has a flurry of exploits and public disclosures. Coming in to Patch Tuesday we already had one Zero Day from Mozilla (CVE-2016-9079), which updated on November 30th. Today Adobe released 9 bulletins, including a Critical update for Adobe Flash that resolves a Zero Day (CVE-2016-7892). And Microsoft is updating Flash for IE and resolving 5 publicly disclosed vulnerabilities.

November 2016 (November 8)

While the results of today’s US presidential election may be out of your hands, you can still impact the outcome of Patch Tuesday on your environment. You can’t buy votes for your favorite candidate, but you can buy yourself some time by implementing privilege management and application control. Reduce the risk of threats that could target your users before patches get applied.

October 2016 (October 11)

 

After several months with no zero day disclosures, October Patch Tuesday brings updates for four vulnerabilities already exploited in the wild. Beginning this month, Microsoft and Adobe are also changing how they distribute their updates, which may impact how you can access the patches. Finally, we are expecting a Google Chrome release today and Oracle’s Quarterly CPU next week, so plan on updates for Java JRE and many other Oracle solutions.

September 2016 (September 13)

This month's Patch Tuesday includes several critical updates that address vulnerabilities targeting end users, all of which should be considered top priorities. Both Adobe and Microsoft also released critical updates for Flash Player. September 2016 will be the final Patch Tuesday on the old servicing model. Starting in October, Microsoft has announced a change to the servicing models for all pre-Windows 10 operating systems.

August 2016 (August 9)

Google and Mozilla both released their critical updates last week, and there is plenty more to think about from Microsoft. This month, all five of the Critical bulletins from Microsoft addressed user-targeted vulnerabilities.  If you haven't already, it may be time to consider adding privilege management as extra protection against these kinds of threats. Finally, if you are looking at the most recent Windows 10 update, you might want to hold off for a bit.

July 2016 (July 12)

Even though there are no Zero Day vulnerabilities, July's Patch Tuesday is far from boring. Several of the vulnerabilities are user-targeted and could be mitigated with proper privilege management - a good reminder of the value of a layered security defense in protecting against both unknown and currently unpatched vulnerabilities.

June 2016 (June 14)

It is raining in the UK and Adobe Flash Player has a zero day. Neither of these events are all that surprising. CVE-2016-4171 was observed in limited, targeted attacks by members of Kaspersky Lab. Adobe has announced an imminent release of Adobe Flash Player as early as Thursday June 16 to add to Microsoft's 16 bulletins.

May 2016 (May 10)

Patch Tuesday has a few juicy surprises for us. One vulnerability being exploited in the wild affects both Internet Explorer and Windows, and two public disclosures will raise concerns with Internet Explorer and .Net Framework.  We also have a Zero Day in Flash Player.

April 2016 (April 12)

Leading up to April Patch Tuesday has been like the weather forecast with the stormy hype around the Badlock vulnerability that affects Samba and Windows. With Badlock, instead of rain, the reality is partly cloudy. There are eight total CVEs relatived to Badlock; only one affects Windows (MS16-047). The other 12 bulletins from Microsoft and updates from Adobe and Oracle should be the focus for this month.

March 2016 (March 8)

March Patch Tuesday brings lots of updates, but no public disclosures or exploited vulnerabilities -yet. The Microsoft updates tackle social engineering threats, addressing vulnerabilities the IE and Edge browsers and Windows, where users might be convinced to open specially crafted web content, files and media.

February 2016 (February 9)

February Patch Tuesday started a bit early with Oracle releasing an out-of-band update for Java to resolve a critical vulnerability that allows DLL Hijacking. Microsoft has released 13 bulletins, six of which are critical, resolving a total of 42 vulnerabilities. Of the vulnerabilities being resolved, two have been publicly disclosed. We also have releases from Adobe for Flash and Photoshop, Mozilla for Firefox, and Google is expected to release a Chrome udpate with security fixes and support for the latest Flash Plug-In.

January 2016 (January 12)

Microsoft has released 12 bulletins, nine of which are critical, resolving a total of 71 vulnerabilities. Adobe released a whopper of a Flash update resolving 78 vulnerabilities.  Google Chrome is dropping today as well. Aside from an update for the Flash Player plug-in and its 78 security fixes, there are reportedly security fixes coming for the browser as well.

No results found