MS Silverlight

[Harold Dye]

What is Microsoft Silverlight? I keep getting an update for this but I can't find any info as to what it is or what it does. Since I have had the problem with Win 10 coming back so often I am afraid to install it.

[Wiz Feinberg]

Silverlight is a multimedia plug-in from Microsoft, for browsers. In the event you should open a web page that contains some content that was created using Silverlight, you will need this plug-in to view it.

Since Silverlight is installed with Windows, it is important to keep it updated when patches are offered. Failure to update Silverlight is like doing the same with the Java Runtime Environment plug-ins. Allowing unpatched versions to remain on your computer makes it more likely you can be exploited by a exploit kit.

Nobody, other than malware researchers, wants to have their computer infected with malware. So, please do us all a favor and update any software add-ons, extensions and plug-ins you have, whether you use them or not.

If you don't want or care to use Silverlight, disable it in each browser you have installed. Otherwise, try to uninstall it from the entire system using your administrator level account.

[Wiz Feinberg]

On January 15, Harold Dye asked me if it was important to update "Silverlight" on his computer. I strongly advised him to do so to maintain the security of his computer against certain scripted attacks.

As it turned out, my advice couldn't have come at a better time. On January 12, among the 9 Windows Updates released that day, this one dealt with a zero day vulnerability in Silverlight.

MS16-006

Critical
Remote Code Execution


Security Update for Silverlight to Address Remote Code Execution (3126036)

This security update resolves a vulnerability in Microsoft Silverlight. The vulnerability could allow remote code execution if a user visits a compromised website that contains a specially crafted Silverlight application. An attacker would have no way to force users to visit a compromised website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email or instant message that takes users to the attacker's website.

[Harold Dye]

Thanks Wiz. After reading your post I immediately installed it that day.