Adobe issued a significant update for Flash Player, Reader and Acrobat

Adobe issued an update to fix 52 flaws in Flash Player, Reader and Acrobat products, that fortunately aren’t being publicly exploited in the wild.

Adobe has released significant updates for its products Flash Player, Reader and Acrobat. The update was issued by the company to patch 52 vulnerabilities that according to Adobe aren’t being publicly exploited in the wild.

According to the Adobe security bulletin, the Flash Update for Windows, Mac OS X, and Linux patches vulnerabilities that could be exploited by an attacker to remotely control a victim’s computer.

“Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions” reported Adobe.

The Adobe product versions affected by the vulnerabilities are:

Adobe Flash Player 17.0.0.169 and earlier versions
Adobe Flash Player 13.0.0.281 and earlier 13.x versions
Adobe Flash Player 11.2.202.457 and earlier 11.x versions
AIR Desktop Runtime 17.0.0.144 and earlier versions
AIR SDK and SDK & Compiler 17.0.0.144 and earlier versions

The update fixes one heap overflow vulnerability, an integer overflow bug, three type confusion flaws, four memory corruption vulnerabilities and a use-after-free vulnerability that would allow a threat actor to run code remotely and gain control over the targeted machine. Other bugs include two memory leak issues that lead to bypass of Address Space Layout Randomization (ASLR), a security bypass vulnerability that could lead to data leakage and three further bugs that allow an attacker to write data to a file system with the same permission as the user.

Giving a look to the list of bugs in the Adobe Flash product solved by the update it is possible to note a time-of-check time-of-use race condition that that allow an attacker to bypass the Internet Explorer’s Protected Mode.

The Adobe Security Bulletin for the Reader and Acrobat updates states that the version affected by the flaws are:

Adobe Reader XI (11.0.10) and earlier 11.x versions
Adobe Reader X (10.1.13) and earlier 10.x versions
Adobe Acrobat XI (11.0.10) and earlier 11.x versions
Adobe Acrobat X (10.1.13) and earlier 10.x versions

“Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system.” reported Adobe.

As explained by adobe in the security bulletin, some of the addressed flaws could be exploited to execute arbitrary code on the vulnerable machines and control them.

Also for the Adobe Reader and Acrobat products, the company confirmed the presence of memory corruption vulnerabilities, use-after free vulnerabilities, buffer overflow and heap-based buffer overflow flaws.

“These updates resolve various methods to bypass restrictions on Javascript API execution” continues the bulletin.

Pierluigi Paganini

(Security Affairs – cyber threats, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.