Adobe fixes Flash Player flaws that could lead to info theft, malware attacks

The company also released updates for the AIR runtime on Windows, Mac and Android

Adobe Systems fixed 13 security issues in Flash Player that could lead to serious attacks, including remote code execution and information disclosure.

Users should upgrade to Flash Player 18.0.0.160 for Windows and Mac, Adobe Flash Player 11.2.202.466 for Linux, or Flash Player 13.0.0.292 if they are on the extended support release channel.

Users of Internet Explorer on Windows 8.x and Google Chrome on Windows, Linux and Mac will receive the Flash Player update for their respective browser automatically.

Adobe also released updates for the AIR runtime on Windows, Mac and Android, as well AIR SDK and Compiler, because these programs bundle Flash Player.

Six of the new vulnerabilities patched in Flash Player could be exploited to achieve remote code execution. These are the kind of vulnerabilities used in drive-by download attacks launched through compromised websites or malicious ads to install malware on users' computers.

Adobe is not aware that any of the newly-patched vulnerabilities are being actively exploited by attackers. However, history has shown that attackers are quick to target new Flash flaws after a fix becomes available for them. Earlier this year, attackers started exploiting a Flash Player vulnerability just one week after Adobe released a patch for it.

The new Flash updates also fix four vulnerabilities that can be exploited to bypass the same-origin policy, a critical security mechanism in browsers that prevents code running on a website from accessing the content of other websites opened in the same browser. Without it, a rogue website could, for example, harvest the emails of users who have Gmail opened in another tab.

On Tuesday, Adobe again tried to patch a flaw it partially fixed twice before. That fix is for a publicly disclosed attack called the Rosetta Flash for which proof-of-concept exploits exist.

The remaining fixes in the new Flash Player updates address a flaw that can be used to bypass an OS anti-exploitation mechanism called the address space layout randomization (ASLR) and one that can be used to escalate the privilege of the Flash Player broker in Internet Explorer from low to medium integrity level.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags patchesonline safetyAdobe SystemssecurityExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?