Adobe releases unscheduled Flash update to patch critical zero-day threat

[Arthur]

Source: Ars Technica

 

Adobe has released an unscheduled update for its ubiquitous Flash media player to patch a critical vulnerability that may already be under active exploit in the wild.

 

The security flaw exists in Adobe Flash Player 12.0.0.43 and earlier versions for Windows and OS X and 11.2.202.335 and earlier versions for Linux, according to an advisory published Tuesday morning. The vulnerability stems from an integer underflow bug in the underlying code that could be exploited to execute arbitrary code on the affected system. Because attackers can typically trigger such vulnerabilities surreptitiously after luring victims to websites hosting attacks, Adobe rated the threat as "critical," the company's highest severity category.

 

"Adobe is aware of reports that an exploit for this vulnerability exists in the wild and recommends users update their product installations to the latest versions," the Adobe advisory stated. It went on to thank Alexander Polyakov and Anton Ivanov of antivirus provider Kaspersky Labs for reporting the vulnerability, which was listed as CVE-2014-0497 under the standardized common vulnerabilities and exposure disclosure system.

 

An Adobe spokeswoman had no further details about the in-the-wild exploit mentioned in the advisory. Frequently, such zero-day attacks are waged in highly targeted campaigns against specific individuals in a corporation or government agency. Given the risk of complete system takeover, however, all readers are advised to update their systems as soon as possible, regardless of their risk profile or the operating system they use.

[jamesfed]

Caused some problems with our Macs as Apple decided to block flash player (and so in turn YouTube) from running on any OSX machine that didn't have the very latest version!

 

Glad that I got Munki deployed a few weeks ago as without it I would be looking at a manual roll out of the latest version (which is just a tiny increment) on 60+ iMacs and Macbooks!

[sonofsanta]

Oh joy.

 

Still not as bad as Java, though.

 

Cheers for the heads up!

[Danp]

Started rolling it out this morning, just what I wanted to do today

[seawolf]

Wazzup Adobe! Wasn't happy today...

 

YouTube and Mathletics broke on the PCs and Macs with this little gem until we scrambled to build a package and push out the update.

 

I cannot wait until The day I can dance a jig on the grave of the steaming pile of dung that is Adobe Flash Player.