It is ‘Patch Tuesday’ again (Falls on a Wednesday for us Aussies), and Microsoft have released 14 security bulletins for various products including Internet Explorer, Adobe Flash, Microsoft Office, and Edge.

Even if you are not using Internet Explorer or Edge it is important to update the products as they cannot be removed from you machine.

To run Windows Update hold the ‘Windows Key’ and Press ‘R’ to bring up the Run dialog box. Type in ‘Control Update’ (without the Apostrophes) and Press Enter. When the Windows Update window appears click ‘Check for updates’. This may take some time, after which you may have to click ‘Install‘.

Critical Updates

6 of the 14 security bulletins are rated critical, meaning updates should be installed as soon as possible.

Cumulative Security Update for Internet Explorer (3198467): Patches a vulnerability that can allow remote code execution if the user is to visit a specially crafted website. If the user is logged in as  an Administrator, the attacker can install software, view, change or delete files.

Security Update for Adobe Flash Player (3202790): Patches a use-after-free vulnerability. This kind of vulnerability corrupts memory and may allow an attacker to execute code on the affected machine. Information about disabling Flash can be found here.

Security Update for Microsoft Graphics Component (3199120): Patches a vulnerability in how Windows handles fonts. A specially crafted font installed by the user could allow a remote code execution. If the user is logged in as an Administrator the attacker can install software, view, change, or delete files.

Security Update for Microsoft Video Control (3199151): Patches a vulnerability that allows an attacker to run code as the current user. The user would first have to be tricked into opening a malicious file from a website or email.

Security Update for Microsoft Windows (3199172): Patches a vulnerability that allows remote code execution if a locally authenticated attacker runs a malicious program.

Cumulative Security Update for Microsoft Edge (3199057): Patches a vulnerability that can allow remote code execution if the user is to visit a specially crafted website. If the user is logged in as  an Administrator, the attacker can install software, view, change or delete files.