June Patch Tuesday 2019

Patch Tuesday Webinar
Wednesday, June 12, 2019
Hosted by: Chris Goettl & Brian Secrist
Dial in: 1-877-668-4490
Event ID: 809 750 050

Copyright©2019Ivanti.Allrightsreserved
Agenda
June 2019 Patch Tuesday Overview
In the News
Bulletins
Q & A
1
2
3
4

 Overview

 In the News

BlueKeep Vulnerability (CVE-2019-0708)
 https://blogs.technet.microsoft.com/msrc/2019/05/14/prevent-a-worm-by-
updating-remote-desktop-services-cve-2019-0708/
 https://www.nsa.gov/News-Features/News-Stories/Article-
View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-
services-on-legacy-versions-of/
 https://www.ivanti.com/blog/bluekeep-the-global-cyber-security-threat-we-can-
still-prevent

GoldBrute Campaign Brute Forces 1.6m RDP Servers
 Not a vulnerability
 Brute force password guessing
 Currently targeting 1.6 million public facing RDP Servers
 This is a common entry point for threat actors
 SamSam used this to great effect
 Does not require a vulnerability or phishing attempt
 Do you have public facing RDP Servers?
 Put them behind a VPN
 Turn on NLA
 Enforce strong passwords and change frequently

Windows 10 Lifecycle Awareness
 Windows 10 Branch Support
 Complete Lifecycle Fact Sheet
 https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet
Source: Microsoft

Publicly Disclosed Vulnerabilities
 CVE-2019-1069 Task Scheduler Elevation of Privilege Vulnerability
 An elevation of privilege vulnerability exists in the way the Task
Scheduler Service validates certain file operations. An attacker who
successfully exploited the vulnerability could gain elevated privileges on
a victim system.
 To exploit the vulnerability, an attacker would require unprivileged code
execution on a victim system.
 The security update addresses the vulnerability by correctly validating
file operations.

 CVE-2019-1064 Windows Elevation of Privilege Vulnerability
 An elevation of privilege vulnerability exists when Windows AppX
Deployment Service (AppXSVC) improperly handles hard links. An
attacker who successfully exploited this vulnerability could run
processes in an elevated context. An attacker could then install
programs; view, change or delete data.
 To exploit this vulnerability, an attacker would first have to log on to the
system. An attacker could then run a specially crafted application that
could exploit the vulnerability and take control of an affected system.
 The security update addresses the vulnerability by correcting how
Windows AppX Deployment Service handles hard links.

 CVE-2019-1053 Windows Shell Elevation of Privilege Vulnerability
 An elevation of privilege vulnerability exists when the Windows Shell
fails to validate folder shortcuts. An attacker who successfully exploited
the vulnerability could elevate privileges by escaping a sandbox.
 To exploit this vulnerability, an attacker would require unprivileged
execution on the victim system.
 The security update addresses the vulnerability by correctly validating
folder shortcuts.

 CVE-2019-0973 Windows Installer Elevation of Privilege Vulnerability
 An elevation of privilege vulnerability exists in the Windows Installer
when the Windows Installer fails to properly sanitize input leading to an
insecure library loading behavior.
 A locally authenticated attacker could run arbitrary code with elevated
system privileges. An attacker could then install programs; view,
change, or delete data; or create new accounts with full user rights.
 The security update addresses the vulnerability by correcting the input
sanitization error to preclude unintended elevation.

Exchange Update for June
 This is not a regular patch, but an Advisory (ADV190018)
 Defense in Depth update
 Very vague on the details
 Does affect 2010-2019
 https://portal.msrc.microsoft.com/en-us/security-
guidance/advisory/ADV190018
 https://support.microsoft.com/en-us/help/4503028/security-update-
for-microsoft-exchange-server-2013-and-2010
 https://support.microsoft.com/en-us/help/4503027/security-update-
for-microsoft-exchange-server-2019-june-11-2019

Microsoft Finally Switching to SHA2 Certificates
 https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-signing-
support-requirement-for-windows-and-wsus
 Phased migration process from March to September 2019
 Dual signed SHA1/SHA2 migrating to SHA2 signed only
 Legacy OS and WSUS require updates
 Advisory 190009 SHA-2 Code Sign Support Advisory
 This security update was updated June 11, 2019 for Windows Server 2008 SP2
to correct an issue with the SHA-2 support for MSI files.
 https://support.microsoft.com/en-us/help/4474419/sha-2-code-signing-support-
update
 All current Ivanti products support this change

Microsoft Finally Switching to SHA2 Certificates
 June 18, 2019
 Windows 10 updates signatures changed from dual signed (SHA-1/SHA-2) to
SHA-2 only. No customer action required.
 Windows 10 1709, Windows 10 1803, Windows 10 1809, Windows Server
2019
 Required: For those customers using WSUS 3.0 SP2, KB4484071 must be
manually installed by this date to support SHA-2 updates.
 WSUS 3.0 SP2

Microsoft Patch Tuesday Updates of Interest
 Advisory 990001 Latest Servicing Stack Updates
 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV990001
 May Releases
 KB 4503537 – Windows 10 1607/Server 2016 (pre-req for new updates)
 May servicing stack update will also fulfill the requirement KB4498947
 KB 4504369 – Windows 10 1809/Server 2019

Microsoft Patch Tuesday Updates of Interest (cont)
 Development Tool Updates
 Azure DevOps Server 2019
 Updated Development Components/Packages
 ChakraCore

Patch for Windows is now Ivanti Security Controls!
Ivanti Security Controls 2019.1.1 is available!
• https://forums.ivanti.com/s/product-downloads
• https://go.ivanti.com/Web-Download-Security-Controls.html
What’s New:
• Support for RedHat Linux
• CVE Import
• Application Control (new module)

Weekly Patch BLOG
 Latest Patch Releases
 Microsoft and Third-party
 Security and non-Security
 CVE Analysis
 Security Events of Interest
 Host: Brian Secrist
 https://www.ivanti.com/blog/
topics/patch-tuesday

Patch Content Announcement System
Announcements Now Posted on Community Forum Pages
 https://forums.ivanti.com/s/group/CollaborationGroup/00Ba0000009oKICEA2
 Subscribe to receive email for the desired product(s)

 Bulletins

APSB19-30: Security Update for Adobe Flash Player
 Maximum Severity: Critical
 Affected Products: Adobe Flash Player for Desktop Runtime, Google Chrome,
Internet Explorer 11 and Edge
 Description: Adobe has released security updates for Adobe Flash Player for
Windows, macOS, Linux and Chrome OS. These updates address
a critical vulnerability in Adobe Flash Player. Successful exploitation could lead
to arbitrary code execution in the context of the current user.
 Impact: Remote Code Execution
 Fixes 1 Vulnerability: CVE-2019-7845
 Restart Required: Requires application restart

MS19-06-AFP: Security Update for Adobe Flash Player
 Affected Products: Adobe Flash Player
 Description: This security update resolves vulnerabilities in Adobe Flash Player that is
installed on Windows Server 2019, all versions, Windows 10, version 1903, Windows
10, version 1809, Windows Server version 1803, Windows 10, version 1803, Windows
Server 2016 Version 1709, Windows 10, version 1709, Windows 10, version 1703,
Windows Server 2016, Windows 10, version 1607, Windows 10, Windows Server 2012
R2, Windows RT 8.1, Windows 8.1, and Windows Server 2012. This bulletin is based
on KB 4503308 and ADV190015.
 Fixes 1 Vulnerability: CVE-2019-7845

MS19-06-W10: Windows 10 Update
 Affected Products: Microsoft Windows 10 Versions 1607 (LTSB), 1703, 1709, 1803,
1809,1903, Server 2016 (LTSB), Server 2019, Server 1709, Server 1803, IE 11 and
Microsoft Edge
 Description: This bulletin references 6 KB articles. See KBs for the list of changes.
 Impact: Remote Code Execution, Security Feature Bypass, Tampering, Elevation of
Privilege, Denial of Service and Information Disclosure
 Fixes 68 Vulnerabilities: CVE-2019-1069, CVE-2019-1064, CVE-2019-1053, and
CVE-2019-0973 are publicly disclosed. See Details column of Security Update Guide
for the complete list of CVEs.
 Restart Required: Requires restart
 Known Issues: See next slides

May Known Issues for Windows 10
 KB 4503267 – Windows 10, Version 1607 and Server 2016
 For hosts managed by System Center Virtual Machine Manager (SCVMM), SCVMM cannot
enumerate and manage logical switches deployed on the host after installing the update.
Additionally, if you do not follow the best practices, a stop error may occur in vfpext.sys on the
hosts. Workaround: 1.Run mofcomp on the following mof files on the affected host:
Scvmmswitchportsettings.mof and VMMDHCPSvr.mof. Follow the best practices.
 After installing KB 4467684, the cluster service may fail to start with the error “2245
(NERR_PasswordTooShort)” if the group policy “Minimum Password Length” is configured with
greater than 14 characters. Workaround: Set the domain default "Minimum Password Length"
policy to less than or equal to 14 characters. Microsoft is working on a resolution.
 [File Rename] Certain operations, such as rename, that you perform on files or folders that are
on a Cluster Shared Volume (CSV) may fail with the error,
“STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the
operation on a CSV owner node from a process that doesn’t have administrator privilege.
Workaround: Perform the operation from a process that has administrator privilege or perform
the operation from a node that doesn’t have CSV ownership. Microsoft is working on a
resolution.

May Known Issues for Windows 10 (cont)
 KB 4503267 – Windows 10, Version 1607 and Server 2016 (cont)
 After installing this update and restarting, some devices running Windows Server 2016 with
Hyper-V enabled may enter Bitlocker recovery mode and receive an error, "0xC0210000".
Note Windows 10, version 1607 may also be affected when Bitlocker and Hyper-V are enabled.
Workaround: for this issue, please see KB4505821. Microsoft is working on a resolution and
will provide an update in an upcoming release.
 Some applications may fail to run as expected on clients of Active Directory Federation Services
2016 (AD FS 2016) after installation of this update on the server. Applications that may exhibit
this behavior use an IFRAME during non-interactive authentication requests and receive X-
Frame Options set to DENY. Workaround: You can use the Allow-From value of the header if
the IFRAME is only accessing pages from a single-origin URL. On the affected server, open a
PowerShell window as an administrator and run the following command: set-
AdfsResponseHeaders -SetHeaderName X-Frame-Options -SetHeaderValue "allow-from
https://example.com“ Microsoft is working on a resolution and will provide an update in an
upcoming release.

 KB 4503279 – Windows 10, Version 1703
 [File Rename] Issue

 [PXE Start] Issue should be resolved.
 [File Rename] Issue still present.
 KB 4503327 – Windows 10, Version 1809, Server 2019 All Versions
 [PXE Start] Issue should be resolved.
 When attempting to print from Microsoft Edge or other Universal Windows Platform (UWP)
applications, you may receive the error, "Your printer has experienced an unexpected
configuration problem. 0x80070007e.“ Workaround: Use another browser, such as Internet
Explorer to print your documents. Microsoft is working on a resolution.
 After installing KB4493509, devices with some Asian language packs installed may receive the
error, "0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.“ Workaround:
Uninstall and reinstall any recently added language packs or select Check for Updates and
install the April 2019 Cumulative Update. See KB for more recovery details.

 Windows Sandbox may fail to start with "ERROR_FILE_NOT_FOUND (0x80070002)" on
devices in which the operating system language is changed during the update process when
installing Windows 10, version 1903.

MS19-06-IE: Security Updates for Internet Explorer
 Affected Products: Microsoft Internet Explorer 9,10,11
 Description: The fixes that are included in the cumulative Security Update for Internet
Explorer are also included in the June 2019 Security Monthly Quality Rollup. Installing
either the Security Update for Internet Explorer or the Security Monthly Quality Rollup
installs the fixes that are in the cumulative update. This bulletin references 14 KB
articles.
 Impact: Remote Code Execution, Information Disclosure
 Fixes 7 Vulnerabilities: CVE-2019-0920, CVE-2019-0988, CVE-2019-1005, CVE-
2019-1038, CVE-2019-1055, CVE-2019-1080, CVE-2019-1081
 Restart Required: Requires browser restart
 Known Issues: None Reported

MS19-06-MR2K8: Monthly Rollup for Windows Server 2008
 Affected Products: Microsoft Windows Server 2008 and IE 9
 Description:
 This security update includes improvements and fixes that were a part of update KB4499184 (released May
23, 2019). Security updates to Windows App Platform and Frameworks, Windows Input and Composition,
Windows Shell, Windows Server, Windows Authentication, Windows Datacenter Networking, Windows Storage
and Filesystems, Windows Virtualization, Windows Kernel, Internet Information Services, Windows Server, and
the Microsoft JET Database Engine.
 Provides protections against a new subclass of speculative execution side-channel vulnerabilities, known
as Microarchitectural Data Sampling, for 64-Bit (x64) versions of Windows (CVE-2019-11091, CVE-2018-
12126, CVE-2018-12127, CVE-2018-12130). Use the registry settings as described in the Windows
Server article. (These registry settings are disabled by default for Windows Server OS editions).
 Impact: Remote Code Execution, Elevation of Privilege, Denial of Service, Security
Feature Bypass and Information Disclosure
 Fixes 36 + 7 (IE) Vulnerabilities: CVE-2019-1053 and CVE-2019-0973 are publicly
disclosed. See Details column of Security Update Guide for the complete list of CVEs.
 Known Issues: See next slide

May Known Issues for Server 2008
 Servicing Stack Update - Windows Server 2008 Service Pack 2 (Monthly Rollup)
 Servicing Stack Update – Windows Server 2008 Service Pack 2 (Security-only Update)
 Restart stuck on "Stage 2 of 2" or "Stage 3 of 3"
 After you install a servicing stack update together with other updates, a restart may be required
to complete the installation. During this restart, you may find yourself stuck at a particular stage
and see a "Stage 2 of 2" or "Stage 3 of 3" message.
 If you experience this issue, press Ctrl+Alt+Delete to continue to log on. This should occur only
one time and does not prevent updates from installing successfully.
 Note In managed environments, such as by using Windows Server Update Services (WSUS),
you can avoid this issue by deploying this update as a standalone update.

MS19-06-SO2K8: Security-only Update for Windows Server 2008
 Affected Products: Microsoft Windows Server 2008
 Description:
 Security updates to Windows App Platform and Frameworks, Windows Input and Composition, Windows Shell,
Windows Server, Windows Authentication, Windows Datacenter Networking, Windows Storage and
Filesystems, Windows Virtualization, Windows Kernel, Internet Information Services, Windows Server, and the
Microsoft JET Database Engine.
 Provides protections against a new subclass of speculative execution side-channel vulnerabilities, known
as Microarchitectural Data Sampling, for 64-Bit (x64) versions of Windows (CVE-2019-11091, CVE-2018-
12126, CVE-2018-12127, CVE-2018-12130). Use the registry settings as described in the Windows
Server article. (These registry settings are disabled by default for Windows Server OS editions).
Feature Bypass and Information Disclosure
 Fixes 36 Vulnerabilities: CVE-2019-1053 and CVE-2019-0973 are publicly
 Known Issues: See previous slide

MS19-06-MR7: Monthly Rollup for Win 7 and Server 2008 R2
 Affected Products: Microsoft Windows 7, Server 2008 R2, and IE
 Description: This security update includes improvements and fixes that were a part of
update KB4499178 (released May 23, 2019) and addresses the following issues:
 Addresses an issue with the HTTP and HTTPS string character limit for URLs when using
Internet Explorer.
 Security updates to Windows App Platform and Frameworks, Microsoft Graphics Component,
Windows Input and Composition, Windows Shell, Windows Server, Windows Authentication,
Windows Datacenter Networking, Windows Storage and Filesystems, Windows Virtualization,
Internet Information Services, and the Microsoft JET Database Engine.
 Impact: Remote Code Execution, Elevation of Privilege, Denial of Service and
Information Disclosure

May Known Issues for Windows 7 and Server 2008 R2
 KB 4503292 – Windows 7 SP1 and Server 2008 R2 SP1 (Monthly Rollup)
 [McAfee] Microsoft and McAfee have identified an issue on devices with McAfee Endpoint
Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or
McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup
or become unresponsive at restart after installing this update.
 Workarounds:
 McAfee Security(ENS) Threat Prevention 10.x
 McAfee Host Intrusion Prevention (Host IPS) 8.0
 McAfee VirusScan Enterprise (VSE) 8.8
 Microsoft is working on a resolution.
 Internet Explorer 11 may stop working when loading or interacting with Power BI reports that
have line charts with markers. This issue may also occur when viewing other content that
contains Scalable Vector Graphics (SVG) markers.
 Workaround: To mitigate the issue with Power BI reports, the report needs to be
republished with markers turned off. Markers can be turned off by selecting the line chart
that is having issues and going to the Visualizations pane. Then on the Format tab under
Shapes, set the Show marker slider to off.We are working on a resolution and estimate a
solution will be available in mid-July.

MS19-06-SO7: Security-only Update for Win 7 and Server 2008 R2
 Affected Products: Microsoft Windows 7 SP1, Server 2008 R2 SP1
 Description: This bulletin is based on KB 4503269.
 Security updates to Windows App Platform and Frameworks, Microsoft Graphics Component,
Windows Input and Composition, Windows Shell, Windows Server, Windows Authentication,
Windows Datacenter Networking, Windows Storage and Filesystems, Windows Virtualization,
Internet Information Services, and the Microsoft JET Database Engine.
 Impact: Remote Code Execution, Elevation of Privilege, Denial of Service and
Information Disclosure
 Known Issues: None reported

MS19-06-MR8: Monthly Rollup for Server 2012
 Affected Products: Microsoft Server 2012 and IE
 Description: This security update includes improvements and fixes that were a part of update
KB4499145 (released May 23, 2019). This bulletin is based on KB 4503285.
 Addresses a security vulnerability by intentionally preventing connections between Windows and Bluetooth
devices that are not secure and use well-known keys to encrypt connections, including security fobs. For more
information, see CVE-2019-2102 and KB4507623.
 Addresses an issue that may prevent the Preboot Execution Environment (PXE) from starting a device from a
Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause
the connection to the WDS server to terminate prematurely while downloading the image. This issue does not
affect clients or devices that are not using Variable Window Extension.
 Security updates to Adobe Flash Player, Windows App Platform and Frameworks, Windows Shell, Windows
Input and Composition, Windows Authentication, Windows Server, Windows Cryptography, Windows Storage
and Filesystems, Windows Datacenter Networking, Windows Virtualization, Internet Information Services,
Windows Kernel, and the Microsoft JET Database Engine.
 Impact: Remote Code Execution, Elevation of Privilege, and Information Disclosure

May Known Issues for Server 2012
 KB 4503285 – Windows Server 2012, Windows Embedded 8 Standard
(Monthly Rollup)
 [IE 11] Internet Explorer 11 may stop working when loading or interacting with Power BI reports
that have line charts with markers. This issue may also occur when viewing other content that
contains Scalable Vector Graphics (SVG) markers. To mitigate the issue with Power BI reports,
the report needs to be republished with markers turned off. Markers can be turned off by
selecting the line chart that is having issues and going to the Visualizations pane. Then on
the Format tab under Shapes, set the Show marker slider to off. We are working on a
resolution and estimate a solution will be available in mid-July.
 [PXE Start] Issue is resolved.
 KB 4503263 – Windows Server 2012, Windows Embedded 8 Standard
(Security-only Update)
 [PXE Start] Issue is resolved.

MS19-06-SO8: Security-only Update for Server 2012
 Affected Products: Microsoft Server 2012
 Addresses an issue that may prevent the Preboot Execution Environment (PXE) from starting a device from a
Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause
the connection to the WDS server to terminate prematurely while downloading the image. This issue does not
affect clients or devices that are not using Variable Window Extension.
 Addresses a security vulnerability by intentionally preventing connections between Windows and Bluetooth
devices that are not secure and use well-known keys to encrypt connections, including security fobs. If
BTHUSB Event 22 in the Event Viewer states, “Your Bluetooth device attempted to establish a debug
connection….”, then your system is affected. Contact your Bluetooth device manufacturer to determine if a
device update exists. For more information, see CVE-2019-2102 and KB4507623.
 Security updates to Adobe Flash Player, Windows App Platform and Frameworks, Windows Shell, Windows
Input and Composition, Windows Authentication, Windows Server, Windows Cryptography, Windows Storage
and Filesystems, Windows Datacenter Networking, Windows Virtualization, Internet Information Services,
Windows Kernel, and the Microsoft JET Database Engine..
 Impact: Remote Code Execution, Elevation of Privilege, and Information Disclosure
 Fixes 32 Vulnerabilities: CVE-2019-1053 and CVE-2019-0973 are publicly disclosed. See Details
column of Security Update Guide for the complete list of CVEs.

MS19-06-MR81: Monthly Rollup for Win 8.1 and Server 2012 R2
 Affected Products: Microsoft Windows 8.1, Server 2012 R2, and IE
 Description: This security update includes improvements and fixes that were a part of update
KB4499182 (released May 23, 2019) . This bulletin is based on KB 4503276.
 Addresses [Bluetooth] and [PXE Start] issues.
 Addresses an issue with the HTTP and HTTPS string character limit for URLs when using
Internet Explorer.
 Security updates to Windows App Platform and Frameworks, Windows Input and Composition,
Windows Shell, Windows Server, Windows Authentication, Windows Datacenter Networking,
Windows Storage and Filesystems, Windows Virtualization, Internet Information Services, and
 Impact: Remote Code Execution, Elevation of Privilege, Denial of Service, Security Feature Bypass,
Tampering and Information Disclosure
 Fixes 29 + 7 (IE) Vulnerabilities: CVE-2019-1053 and CVE-2019-0973 are publicly disclosed. See
Details column of Security Update Guide for the complete list of CVEs.

May Known Issues for Windows 8.1 and Server 2012 R2
 KB 4499151 – Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
 KB 4499165 – Windows 8.1, Windows Server 2012 R2 (Security-only Update)
 [PXE Start] Issue is resolved
 [McAfee] Issue
 [IE 11] Issue

MS19-06-SO81: Security-only Update for Win 8.1 and Server 2012 R2
 Affected Products: Microsoft Windows 8.1, Server 2012 R2
 Addresses [Bluetooth] and [PXE Start] issues
 Security updates to Windows App Platform and Frameworks, Windows Input and Composition,
Windows Shell, Windows Server, Windows Authentication, Windows Datacenter Networking,
Windows Storage and Filesystems, Windows Virtualization, Internet Information Services, and
Feature Bypass, Tampering and Information Disclosure

MS19-06-OFF: Security Updates for Microsoft Office
 Maximum Severity: Important
 Affected Products: Office 2010, Office 2016 and 2019 for Mac, Word 2010-2016,
Lync 2010-2013
 Description: This security update resolves vulnerabilities in several Microsoft Office
applications. This bulletin references 5 KB articles plus release notes for MacOS.
 Fixes 3 Vulnerabilities: CVE-2019-1029, CVE-2019-1034, CVE-2019-1035

MS19-06-O365: Security Updates for Office 365 ProPlus
 Affected Products: Office 365 ProPlus, Office 2019
 Description: This month’s update resolved various bugs and performance issues in
Microsoft Office 365 applications. Information on Office 365 ProPlus updates is
available at https://docs.microsoft.com/en-us/officeupdates/release-notes-office365-
proplus
 Fixes 2 Vulnerabilities: CVE-2019-1034, CVE-2019-1035

MS19-06-SPT: Security Updates for SharePoint Server
 Affected Products: Microsoft Enterprise SharePoint Server 2010-2019
 Description: This security update resolves vulnerabilities in Microsoft Office that could
allow remote code execution if a user opens a specially crafted Office file. This bulletin
is based on 6 KB articles.
 Impact: Remote Code Execution, Spoofing
 Fixes 6 Vulnerabilities: CVE-2019-1031, CVE-2019-1032, CVE-2019-1033, CVE-
2019-1034, CVE-2019-1035, CVE-2019-1036
 Restart Required: Requires Restart

Between Patch Tuesday’s
Security Updates: Apple iCloud (1), Apple iTunes (1), Apple Mobile Device Support (1),
Camtasia(1), DropBox (2), Firefox (2), Firefox ESR (1), GOM Player (1), Google Chrome
(2), GoToMeeting (1), LibreOffice (1), Microsoft Visual Studio Code (2), Nitro Pro (2),
Note.JS (1), Notepad++ (1), Opera (3), Oracle VirtualBox (2), Plex Media Server (1),
RealTimes (1), Splunk Forwarder (1), Tableau Desktop (5), Tableau Prep Builder (1),
Tableau Reader (1), Thunerbird (1), Tomcat (2), TeamViewer (2), VLC (1), VMware Player
(1), VMware Workstation (1), WinSCP (1), Wireshark (3)
Non-Security Updates: Audacity (1), Bandicut (1), Beyond Compare (1), CCleaner (1),
docuPrinter (1), Google Drive (1), GoodSync (1), Google Backup (1), IrfanView (1),
BlueJeans (1), KeePass Pro (1), LogMeIn (1), Microsoft (40), Power BI Desktop (2), Plex
Media Player (1), Skype (1), Snagit (2), Sumblime Text (1), TeamViewer (1), Zoom Client
(2), Zoom Outlook Plugin (1)

Third Party CVE Information
 Apple iCloud 7.12.0.14
 ICLOUD-019, QICLOUD712014
 Fixes 25 Vulnerabilities: CVE-2019-6237,CVE-2019-8571,CVE-2019-
8577,CVE-2019-8583,CVE-2019-8584,CVE-2019-8586,CVE-2019-8587,CVE-
2019-8594,CVE-2019-8595,CVE-2019-8596,CVE-2019-8597,CVE-2019-
2019-8608,CVE-2019-8609,CVE-2019-8610,CVE-2019-8611,CVE-2019-
8615,CVE-2019-8619,CVE-2019-8622,CVE-2019-8623,CVE-2019-8628
 VMware Workstation 15.1.0 Player
 VMWP-047, QVMWP1510
12130,CVE-2019-11091

Third Party CVE Information (cont)
 VMware Workstation 15.0.4 Pro
 VMWW-023, QVMWW1510
12130,CVE-2019-11091
 Firefox ESR 60.7.0
 FFE19-6070, QFFE6070
 Fixes 16 Vulnerabilities: CVE-2018-18511,CVE-2019-5798,CVE-2019-7317,CVE-
2019-9797,CVE-2019-9800,CVE-2019-9815,CVE-2019-9816,CVE-2019-9817,CVE-
2019-9818,CVE-2019-9819,CVE-2019-9820,CVE-2019-11691,CVE-2019-11692,CVE-
2019-11693,CVE-2019-11694,CVE-2019-11698

 Firefox 67.0
 FF19-011, QFF6700
 Fixes 21 Vulnerabilities CVE-2019-7317,CVE-2019-9800,CVE-2019-
2019-9819,CVE-2019-9820,CVE-2019-9821,CVE-2019-11691,CVE-2019-
11692,CVE-2019-11693,CVE-2019-11694,CVE-2019-11695,CVE-2019-
11696,CVE-2019-11697,CVE-2019-11698,CVE-2019-11699,CVE-2019-
11700,CVE-2019-11701
 Google Chrome 75.0.3770.80
 CHROME-254, QGC750377080
2019-5835,CVE-2019-5836,CVE-2019-5837,CVE-2019-5838,CVE-2019-
5839,CVE-2019-5840

 iTunes 12.9.5.7
 AI19-003, QAI12957
2019-8594,CVE-2019-8595,CVE-2019-8596,CVE-2019-8597,CVE-2019-
2019-8608,CVE-2019-8609,CVE-2019-8610,CVE-2019-8611,CVE-2019-
8615,CVE-2019-8619,CVE-2019-8622,CVE-2019-8623,CVE-2019-8628

June Patch Tuesday 2019

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to June Patch Tuesday 2019

Similar to June Patch Tuesday 2019 (20)

More from Ivanti

More from Ivanti (20)

Recently uploaded

Recently uploaded (20)

June Patch Tuesday 2019