Hello, welcome to the Wednesday, January 11th, 2017 edition of the Sandsenet Stormsenders Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Today we'll start, of course, with Microsoft's patch Tuesday and we actually can cover every vulnerability today in detail because there were only three vulnerabilities

and three bulletins to go with it this month. This is actually a little bit typical for January.

I posted a little graph in January. We usually only have sort of four or five different bulletins being published, probably because of the holidays.

Microsoft just didn't have the time to really come up with any more patches.

The first bulletin for the year fixes privilege escalation vulnerability in Microsoft's edge

browser. It deals with cross-domain policies and how they're dealt with with the

about plank pages. So just the privilege escalation vulnerability, nothing critical Microsoft,

and we as well rated as important. However, the vulnerability had already been disclosed. This month, no update for

Internet Explorer, so only this one for Microsoft Edge. The second bulletin fixes a vulnerability in

Microsoft Office and memory corruption vulnerability that can lead to code execution. Microsoft rates it as important because the user

has to open a document. We rate code execution vulnerabilities like this as critical, at least

for clients. Nothing publicly disclosed or exploited about this vulnerability so far. Now then the numbering gets a little bit

tricky. The third Microsoft bulletin was actually MS-14-4. That one addresses a denial of service

vulnerability in the LSAS, the local security authority subsystem service.

That one is, again, rate as important.

It's only a denial of service.

The third bulletin in Microsoft's numbering is actually the Adobe Flash Player bulletin,

and that, of course, also affects Microsoft's browsers like in Explorer 10, 11 and Edge. Now Adobe fixed a total of 13 vulnerabilities in its flash update.

They can lead to remote code execution and I would actually rate that update as the number one, the most important

update to apply this time around. Adobe also updated a PDF reader bulletin that they released

earlier this month and that one fixes 29 vulnerabilities. Again, they also can lead to code execution. So short summary here, I would say start

...