Patching in Review – Week 31 of 2019

We still have one more week to relax between Patch Tuesdays, but it’s going to come sooner than you expect! With a new Google Chrome release this week and a bypassed CVE, there’s plenty to talk about during this lull.

On Patch Tuesday, LibreOffice released version 6.2.5 that remediated two CVEs (CVE-2019-9848, CVE-2019-9849). According to TheHackerNews, CVE-2019-9848 has already been bypassed by security researcher Alex Inführ, where scripts embedded within documents can be executed by arbitrary actions such as mouseover. For those of you that use this software, keep an eye out for an expedited fix for this vulnerability.

Security Releases

Google Chrome 76 released this week with 43 security fixes and 16 CVEs. The most notable feature of this new release is the overdue default blocking of Flash on all websites, as well as the prevention of detecting incognito mode. Five vulnerabilities are categorized as High Severity, with nearly all the vulnerabilities detailing a scenario where a specially crafted website could allow a user to execute code on the endpoint. In fact, BleepingComputer elaborates on CVE-2019-5859 where a security researcher built a proof of concept demo video where a specially crafted website opened Internet Explorer and escaped the sandbox, opening a command prompt.

Third-Party Updates

While Chrome was the highest-profile security release, other vendors have released non-security updates for their product. Review the list below to see if there are any updates that are critical to your environments.