Flash, I love you, but we only have fourteen hours to save everyone’s computers. Adobe has urged users to patch their Windows, OS X and Linux editions of Flash Player to address 23 security vulnerabilities, including one that is actively being targeted in the wild.
The March update includes a number of fixes for vulnerabilities that could, if exploited, allow an attacker to remotely execute code on a targeted system simply by loading a malformed Flash file. In other words, visiting a booby-trapped webpage, or viewing a Flash ad, could inject malware into your computer.
One of those flaws, CVE-2016-1010, is being used for what Adobe calls “limited, targeted attacks.”
Users running Flash Player 20.0.0.306 and earlier for Windows, OS X and Linux should look to update the software.
Flash Player for Linux 11.2.202.569 and earlier and Adobe AIR Desktop Runtime and AIR SDK 20.0.0.260 as well as AIR for Android 20.0.0.233 and earlier should also be updated if possible. You can check your installed version here.
Users who have activated the “Allow Adobe to install updates” option on Flash Player for Windows and OS X should receive the update automatically. Google’s Chrome browser installs Flash updates automatically, too.
According to Adobe, the patched flaws, all of which could allow remote code execution, include three integer overflow vulnerabilities (one of those is CVE-2016-1010). Eleven of the flaws are use-after-free errors, and one is a heap overflow bug. The remaining eight exploitable programming blunders are memory corruption vulnerabilities.
Adobe has posted a full list of the CVE numbers as well as discovery credits for each of the vulnerabilities on its help site.
Adobe gave word of the Flash Player update earlier this week when it posted a scheduled security update for Adobe Acrobat and Reader to address a total of four vulnerabilities. That same day, Microsoft posted its monthly patch load for Windows, Office, Internet Explorer and Edge.
As always, going into you browser’s settings and enabling click-to-play for Flash is recommended as it will stop malicious Flash files from automatically firing up as soon as you load a page.
Source:https://www.theregister.co.uk/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
