Jump to content

Adobe Flash Update Includes Patches for 17 Vulnerabilities


RV_

Recommended Posts

The good news is that the critical Flash vulnerabilities being patched are not being exploited in the wild. But now that the patches have been released they will be reverse engineered by the criminals so don't delay.

 

Excerpt:

 

"In what’s becoming a monthly ritual, Adobe today pushed out an updated version of its Flash Player that includes patches for critical vulnerabilities.Today’s update isn’t as voluminous as a most have been since the start of summer, nonetheless, since July when a run of updates addressed zero days published after the Hacking Team breach and including an emergency update last month, Adobe has fixed more than 80 vulnerabilities in the beleaguered software.

 

Version 19.0.0.245 released today patches 17 vulnerabilities, all of them paving the way to remote code execution if exploited; Adobe said it has no reports of public exploits for any of the patched flaws.

 

In addition to the desktop version of Flash for Windows and Mac OS X, Adobe also updated Flash for Internet Explorer 11 and Microsoft Edge, both of which are expected to be included in today’s Microsoft Patch Tuesday security bulletins. Adobe also updated Flash Player for Linux and various Adobe Air products for Windows, iOS and Android mobile devices.

 

The lion’s share of the vulnerabilities (15) addressed today are use-after-free vulnerabilities that lead to code execution. The remaining two include a type confusion vulnerability that also leads to code execution, and a security bypass vulnerability that an attacker could use to write data to the computer’s file system, Adobe said.

 

Today’s update is a reprieve compared to last month’s scheduled update when Adobe patched not only Flash, but also Reader and Acrobat, addressing 69 critical vulnerabilities leading to code execution and information disclosure.

 

Three days later, Adobe updated Flash again with an out-of-band emergency patch that fixed a zero-day vulnerability under attack.

 

The zero-day was a type confusion vulnerability, and was tied to attacks carried out by a Russian-speaking APT group operating under the guise of Pawn Storm, or APT 28. Type confusion vulnerabilities occur when code doesn’t verify the type of object that’s passed to it, and uses it without type-checking."

More including hotlinks to the related articles within the article at: https://threatpost.com/adobe-flash-update-includes-patches-for-17-vulnerabilities/115322/#sthash.3kBHfrjK.dpuf

 

RV/Derek
http://www.rvroadie.com Email on the bottom of my website page.
Retired AF 1971-1998


When you see a worthy man, endeavor to emulate him. When you see an unworthy man, look inside yourself. - Confucius

 

“Those who can make you believe absurdities, can make you commit atrocities.” ... Voltaire

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

RVers Online University

campgroundviews.com

RV Destinations

Find out more or sign up for Escapees RV'ers Bootcamp.

Advertise your product or service here.

The Rvers- Now Streaming

RVTravel.com Logo



×
×
  • Create New...