# MA-466.042015: MyCERT Advisory - MyCERT Vulnerability and Threat Summary - February 2015

**Date:** 07 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-466.042015  
**Advisory ID:** MA-466.042015

---

**1.0     Introduction**
The MyCERT Vulnerability and Threat Summary contains list of Alert and Advisory that had been produced in February. It provides a summary of new vulnerabilities and current threats that have been observed by MyCERT in each month  which had been produced as MyCERT Alert and Advisory.
The MyCERT Vulnerability and Threat Summary will be very beneficial for System Administrators and Incident Response Teams as a reference on security 
**2.0    List of Advisory and Alert**
MyCERT has released seven advisories and one alert for the month of February 2015.  This is to address multiple vulnerabilities that affecting a few products and softwares.  Users and administrators are encouraged to review and apply the necessary updates.
2.1 [Security updates available for Google Chrome](https://www.mycert.org.my/portal/advisory?id=MA-449.022015)
Google has released Chrome 40.0.2214.111 for Windows, Mac, and Linux to address multiple vulnerabilities. Some of these vulnerabilities could potentially allow an attacker to take control of the affected system. Google Chrome users are advised to update to the latest version.
2.2 [Security updates for Adobe Flash Player](https://www.mycert.org.my/portal/advisory?id=MA-450.022015)
Adobe has released security updates to address multiple vulnerabilities in Flash Player, one of which could allow a remote attacker to take control of an affected system. Exploitation of these vulnerabilities could potentially allow an attacker to take control of the affected system.
2.3 [Google Releases Security Update for Chrome OS](https://www.mycert.org.my/portal/advisory?id=MA-451.022015)
Google has released Chrome OS 40.0.2214.114 for Chrome devices to address multiple vulnerabilities. Exploitation of one these vulnerabilities could allow a remote attacker to take control of an affected system. Google Chrome users are advised to update to the latest version.
2.4 [Microsoft Releases Critical Security Bulletin](https://www.mycert.org.my/portal/advisory?id=MA-452.022015)
Microsoft has released Security Bulletin MS15-011 to address a critical vulnerability in Windows. This security update contains a new policy feature (UNC Hardened Access), which is not enabled by default. To enable this feature, a system administrator must deploy the update, then apply the Group Policy settings described in the bulletin. For complete protection against this vulnerability, system reboots are required. Other than the update and configuration instructions contained in the Security Bulletin, there are no known workarounds or mitigations for this vulnerability. Updates are not available for Windows XP, Windows Server 2003, or Windows 2000.
2.5 [Microsoft Releases Critical Security Update for Internet Explorer](https://www.mycert.org.my/portal/advisory?id=MA-453.022015)
Microsoft has released a critical security update to address multiple vulnerabilities in Internet Explorer. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system if the user views a specially crafted webpage. Users and administrators are encouraged to review Microsoft Bulletin MS15-009 for details and apply the necessary update.
2.6 [Microsoft Security Bulletin Summary for February 2015](https://www.mycert.org.my/portal/advisory?id=MA-454.022015)
Microsoft has released updates to address nine vulnerabilities in Windows as part of the Microsoft Security Bulletin Summary for February 2015. Some of these vulnerabilities could allow remote code execution, security feature bypass, elevation of privilege, or disclosure of information. Users and administrators are encouraged to review Microsoft Security Bulletin Summary MS15-FEB and apply the necessary updates.
2.7 [Lenovo “Superfish” Adware Vulnerable to HTTPS Spoofing](https://www.mycert.org.my/portal/advisory?id=MA-455.022015)
MyCERT have received information and made aware that Lenovo consumer Notebooks are vulnerable to the HTTPS spoofing. The “Superfish” adware can enable remote attackers to read encrypted web traffic, redirect traffic from official websites to spoof websites, and perform other malicious activities.
2.8 [Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird](https://www.mycert.org.my/portal/advisory?id=MA-487.072015)
Mozilla Foundation has released security updates to address multiple vulnerabilities in Firefox, Firefox ESR, and Thunderbird. Mozilla encourages users and administrators to review Mozilla's Security Updates and apply the necessary updates.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [http://www.mycert.org.my](http://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**3.0     References**
- MyCERT Advisories, Alerts and Summaries for the year 2015;
<https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5&year=2015&ctype=&keyword=>