Microsoft has quietly issued a fix for a security update from its May Patch Tuesday for Office for Mac 2011 that killed Outlook for many Apple users. Microsoft on Wednesday released Office for Mac 2011 update 14.5.1 to address what it concedes were “critical issues” in the prior update 14.5.0.

By many accounts on Apple’s forums, it was a disaster for people who installed it., 14.5.1 “fixes an issue that causes the main window not to open in Outlook for Mac 2011.” It addresses an accidental side-effect of an from Redmond on its Tuesday May 12 patch, which fixed multiple flaws that allowed a remote attacker to “overwrite the contents of your computer's memory with malicious code”. The issues affected Excel, PowerPoint and Word for Mac 2011. While it fixed the vulnerability, for some Mac users it also killed Outlook — arguably one of the most if not the most critical tool for workers. The first user who reported problems on Apple’s forums said the update could be.

The update left Outlook on his iMac running the latest version of OS X Yosemite (10.10.3) useless. He said Microsoft support was aware of an issue with the update but that there wasn’t a fix. Some reported experiencing the same problems, compounded by hours spent with Microsoft support attempting to resolve the issue. Others reported a smooth update. Mac users who had a Time Machine backup could roll back to the previous version but that would also leave them running a version of Office with a flaw in the public domain. Mac security firm Intego said it normally encouraged users to install critical updates immediately but on this occasion. “After all, the new Office for Mac 2011 fixes a remote code execution vulnerability.

However, the update, as numerous reports are suggesting, can be a double-edged sword,” the company noted. This article is brought to you by Enex TestLab, content directors for CSO Australia. Feeling social?

Follow us on and Now!

A powerful, easy-to-use password stealing program known as Agent Tesla has been infecting computers since 2014, but recently this malware strain has seen a surge in popularity — attracting more than 6,300 customers who pay subscription fees to license the software. Although Agent Tesla includes a multitude of features designed to help it remain undetected on host computers, the malware’s apparent creator seems to have done little to hide his real-life identity. The proprietors of Agent Tesla market their product at agenttesla-dot-com, selling access to the software in licenses paid for via bitcoin, for prices ranging from $15 to $69 depending on the desired features. The Agent Tesla Web site emphasizes that the software is strictly “for monitoring your personel sic computer.” The site’s “about” page states that Agent Tesla “is not a malware.

Please, don’t use for computers which is not access permission.” To backstop this disclaimer, the site warns that any users caught doing otherwise will have their software licenses revoked and subscriptions canceled. At the same time, the Agent Tesla Web site and its 24/7 technical support channel (offered via ) is replete with instances of support personnel instructing users on ways to evade antivirus software detection, use software vulnerabilities to deploy the product, and secretly bundle the program inside of other file types, such as images, text, audio and even Microsoft Office files. Most of the options included in Agent Tesla revolve around stealth, persistence, evading security tools, spreading to other computers, or tampering with system settings. I CAN HAZ TESLA The earliest versions of Agent Tesla were made available for free via a Turkish-language WordPress site that oddly enough remains online (agenttesla.wordpress-dot-com), although its home page now instructs users to visit the current AgentTesla-dot-com domain. Not long after that WordPress site was erected, its author(s) began charging for the software, accepting payments via a variety of means, including, Bitcoin and even wire transfer to several bank accounts in Turkey.

Historic WHOIS Web site registration records maintained by show that the current domain for the software — agenttesla-dot-com — was registered in 2014 to a young man from Antalya, Turkey named Mustafa can Ozaydin, and to the email address mcanozaydin@gmail.com. Sometime in mid-2016 the site’s registration records were hidden behind WHOIS privacy services full disclosure: Domaintools is a previous advertiser on KrebsOnSecurity.

That Gmail address is tied to for a Turkish individual by the same name who has uploaded exactly three videos over the past four years. In, uploaded in October 2017 and titled “web panel,” Mr.

Can Ozaydin demonstrates how to configure a Web site. At around 3:45 in the video, we can see the purpose of this demonstration is to show people one way to install an Agent Tesla control panel to keep track of systems infected with the malware. Incidentally, the administrator of the 24/7 live support channel for Agent Tesla users at one point instructed customers to view this same video if they were having trouble figuring out how to deploy the control panel. The profile picture shown in that Youtube account is remarkably similar to the one displayed on the.” This Twitter profile makes no mention of Agent Tesla, but it does state that Mustafa can Ozaydin is an “information technology specialist” in Antalya, Turkey.

That Twitter profile also shows up on from Turkey. A for a person by the same name from Antalya, Turkey states that Mr. Can Ozaydin is currently a “systems support expert” for, a hospital in Istanbul. KrebsOnSecurity first reached out for comment to all of these accounts back in August 2018, but received no reply.

Repeated attempts to reach those accounts this past week also elicited no response. An organized gang of hackers from Russia and Ukraine has broken into internal networks at dozens of financial institutions and installed malicious software that allowed the gang to drain bank ATMs of cash. While none of the victim institutions were in the United States or Western Europe, experts say the stealthy methods used by the attackers in these heists would likely work across a broad range of western banks. Most cybercrime targets consumers and businesses, stealing account information such as passwords and other data that lets thieves cash out hijacked bank accounts, as well as credit and debit cards. But this gang specializes in hacking into banks directly, and then working out ingenious ways to funnel cash directly from the financial institution itself. A number of the gang’s members are believed to be tied to a group of Eastern European hackers accused of stealing more than USD $2 million from Russian banks using a powerful, custom-made banking trojan known as.

Eight men in Moscow and accused of building and using Carberp, but sources say the core members of the gang were out of jail within hours after their arrest and have been busy rebuilding their crime machine ever since. According to report released today by and, security firms based in The Netherlands and Russia, respectively, the Carberp guys have since changed their tactics: Instead of stealing from thousands of bank account holders, this gang has decided to focus on siphoning funds right out of banks’ coffers. So far, the security firms report, the gang has stolen more than $15 million from Eastern European banks. To gain a foothold inside financial institutions, this crime group — dubbed the “ Anunak group” — sent bank employees targeted, malware-laced emails made to look like the missives were sent by Russian banking regulators.

The phishing emails contained malicious software designed to exploit recently-patched security holes in Microsoft Office products. Incredibly, the group also reportedly bought access to Windows PCs at targeted banks that were already compromised by opportunistic malware spread by other cyber criminals. Indeed, Fox-IT and Group-IB report that the Anunak gang routinely purchased installations of their banking malware from other cybercriminals who operated massive botnets (collections of hacked PCs).

Once inside a financial institution, the criminals typically abused that access to launch even more convincing spear-phishing attacks against other banks. They also gained access to isolated bank network segments that handled ATM transactions, downloading malicious programs made to work specifically with Wincor ATMs.

The hackers used that malware — along with a modified legitimate program for managing ATM cash trays — to change the denomination settings for bank notes in 52 different ATMs. As a result, they were able to make it so that when co-conspirators went to affected ATMs to withdraw 10 bills totaling 100 Russian rubles, they were instead issued 10 bank notes with the denomination of 5,000 rubles, the report notes. Patch Tuesday is again upon us: Adobe today issued updates for Flash Player and AIR, fixing the same critical vulnerability in both products. Microsoft‘s patch bundle of five updates addresses 23 vulnerabilities in Windows, Internet Explorer, and Office, including one bug that is already being actively exploited. A majority of the vulnerabilities fixed in Microsoft’s June patch batch — 19 of them — are addressed in a cumulative update for Internet Explorer.

The other fix that Microsoft called specific attention to is, which tackles a flaw in Office that “could allow remote code execution if a user opens a specially crafted Office document.or previews or opens a specially crafted email message in Outlook while using Microsoft Word as the email reader.” This Office flaw, which is present in the latest versions of Office 2003 and Microsoft Office for Mac 2011, is already being exploited in targeted attacks, Microsoft said. According to the company’s, this vulnerability was reported by Google. These attacks fit the profile of previous zer0-day incidents, which use targeted email lures and previously unknown vulnerabilities to break into high-value targets.

“When Google encounters flaws that exploit users’ computers, even when the flaws are in other companies’ software, we take strong action to mitigate those attacks,” a Google spokesperson said in response to a request for comment. “Based on the exploit and the way it has been utilized by attackers, we strongly believe the attacks to be associated with a nation-state organization.” Adobe’s Flash and AIR updates also fix that was reported by Google’s security team, although Adobe says it is not aware of any exploits or attacks in the wild against the vulnerability address in its update. The latest Flash version is 11.7.700.224 for Windows and 11.7.700.225 for Mac OS X. Will tell you which version of Flash your browser has installed. IE10 and Chrome should auto-update their versions of Flash. If your version of Chrome is not yet updated to, you may just need to restart the browser. Adobe and Microsoft each issued security updates today to fix critical vulnerabilities in their software.

Adobe’s fixes include a patch for a Flash Player flaw that is actively being exploited to break into Windows computers. Microsoft’s Patch Tuesday release includes nine patch bundles — more than half of them rated critical — addressing at least 27 security holes in Windows and related software. The most pressing of the updates Adobe released today is the Flash Player patch, which fixes (CVE-2012-1535) in the ubiquitous media player software. Adobe says there are reports that the vulnerability is being exploited in the wild in limited targeted attacks, distributed through a malicious Microsoft Word document.

The exploit targets the ActiveX version of Flash Player for Internet Explorer on Windows. Microsoft today issued software updates to patch at least 19 security holes in Windows, including three flaws that earned the company’s most serious “critical” rating. Separately, Oracle released a security update that fixes several issues in its Java software.

The most talked-about vulnerability fixed in December’s patch batch is in all supported versions of Windows that’s been exploited for at least the past two months (and probably much longer) by the Duqu Trojan, a sophisticated information-stealer that experts say was an espionage tool constructed to extract sensitive data from industrial control systems. Microsoft issued just two updates today to fix at least three security flaws in its Windows and Microsoft Office products, a merciful respite following last month’s. One of the patches issued today earned a critical rating, the company’s most serious. The is mainly a concern for enterprises that are running Windows Server 2003 and 2008 server operating systems.

The fixes two vulnerabilities in Microsoft Powerpoint, and affects older versions of Office, including Office XP, Office 2003, Office 2007 and 2004 for Mac (Office 2010 for Mac and Windows are not affected). Updates are available through or via. As always, please leave a note in the comments if you experience any troubles during or after the installation of these patches. Microsoft Corp. Today issued three bundles of updates fixing at least 11 security vulnerabilities in its software, mainly flaws in Microsoft Office products.

Microsoft Tackles Critical Flaws In Office For Mac 2016

But the company did not release an update today to remedy a critical flaw built into in all versions of the Internet Explorer Web browser that is now being exploited by at least one common, automated hacker toolkit. Two of the updates address Office bugs, including one that is limited to older versions of PowerPoint and PowerPoint Viewer. Only of today’s patches earned a “critical” rating, Microsoft’s most serious. But experts are warning that this critical Office vulnerability is likely to be used in targeted e-mail attacks against Microsoft Outlook users. “One of the most dangerous aspects of this vulnerability is that a user doesn’t have to open a malicious email to be infected,” said Joshua Talbot, security intelligence manager for Symantec Security Response. “All that is required is for the content of the email to appear in Outlook’s Reading Pane. If a user highlights a malicious email to preview it in the Reading Pane, their machine is immediately infected.

The same holds true if a user opens Outlook and a malicious email is the most recently received in their inbox; that email will appear in the Reading Pane by default and the computer will be infected.” Microsoft did not issue an update to fix a zero-day flaw in Internet Explorer that to break into Windows computers. Last week, the software giant warned that crooks were exploiting the flaw in targeted attacks, and that it had no intention of issuing a fix for the security hole outside of its normal monthly patching process (the second Tuesday of each month — today — is Patch Tuesday).

Microsoft Tackles Critical Flaws In Office For Mac Download

Since that advisory, the IE exploit has into the, a powerful and that makes it trivial for attackers to turn legitimate Web sites into platforms for installing malware when visitors browse the sites with vulnerable PCs. If you have Office Installed, take a moment to visit to patch things up. If you use IE, either upgrade to IE8 — which provides additional protections against this zero-day attack — or consider implementing the that Microsoft has released to help mitigate the threat from the vulnerability.

A summary of today’s bulletins is available. Update, 7:03 p.m. ET: Added information at the end of this post on the Microsoft FixIt Tool. In its largest patch push so far this year, Microsoft today released 10 security updates to fix at least 34 security vulnerabilities in its Windows operating system and software designed to run on top of it. Separately, Apple has shipped another version of Safari for both Mac and Windows PCs that plugs some four dozen security holes in the Web browser. Microsoft assigned three of the updates covering seven vulnerabilities a “critical” rating, meaning they can be exploited to help attackers break into vulnerable systems with no help from users. At least 14 of the flaws fixed in this month’s patch batch are in Microsoft Excel, and another eight relate to Windows and Internet Explorer.

According to Microsoft, the most serious of the bugs involves a weakness in the way Windows handles certain media formats, and is present in all supported versions of Windows. Another critical update nixes six different insecure ActiveX controls (plug-ins for Internet Explorer), while the third critical update corrects at least a half dozen vulnerabilities in IE. Microsoft notes that Office XP users may not be able to install one of the needed updates; Rather, Redmond is releasing what it calls a “shim,” or essentially and point-and-click “FixIt” tool that apparently does the job. If you use Office XP, go ahead and click the “FixIt” icon when you’re done installing the rest of the updates. The Microsoft patches are available through or via.

As usual, please drop a note in the comments below if you experience any problems as a result of installing these updates. Apple’s Safari 5.0 update fixes at least in Safari on Mac OS X and Windows versions. Updates are available for Mac OS X v 10.4.11, Mac OS X v10.5.8, Mac OS X v10.6.2 or later, Windows 7, Vista, and XP. Mac users can grab the update from or; Safari users on Windows will need to update using the bundled Apple Software Update utility.

HitFilm 3 Pro for Mac lies within Design & Photo Tools, more precisely 3D Modeling. The file size of the latest downloadable setup file is 347.9 MB. This Mac download was checked by our antivirus and was rated as safe. The actual developer of this software for Mac is FXhome Limited. Hitfilm pro support. Mac and PC compatible. HitFilm Pro vibes with all types of operating systems. Spread your 3 seats across MAC or PC - or easily switch from one OS to another without fear. We’re flexible. The all-in-one editor, compositor, and VFX powerhouse. The bigger picture: HitFilm 3 Pro includes 130 premium plugins for Premiere Pro,Final Cut Pro X, Vegas and After Effects. HitFilm technology is designed to work for you, wherever and whenever you need it. HitFilm 4 Pro is a mix of video editing, visual effects and 3D compositing for filmmakers and professional motion artists. Programs for query ″hitfilm 3 express for mac″ mocha PLus.