Adobe Patches Flash Flaw Targeted by Exploit in the Wild

Intego.com ^ | April 14th, 2015 | by Derek Erwin

[Swordmaker]

Adobe Systems has released a patch for 22 vulnerabilities in Flash Player, one of which is reportedly under attack by an exploit that exists in the wild. The most critical vulnerability, CVE-2015-3043, could lead to code execution. Adobe's Flash Player security updates are available for Macintosh, Windows and Linux.

"Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations," said Adobe. If you reached this page because you're unsure if a popup alert from Adobe is real, take a look at our helpful guide for best practices how to safely install and update Adobe Flash Player.

Affected software versions (now out of date and vulnerable) include: Adobe Flash Player 17.0.0.134 and earlier versions, Adobe Flash Player 13.0.0.277 and earlier 13.x versions, and Adobe Flash Player 11.2.202.451 and earlier 11.x versions.

Adobe's security buletin describes the vulnerabilities patched in these updates as follows:

• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
• These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-0356).
• These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).
• These updates resolve double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).
• These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
• These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).

Adobe Flash users running Mac OS X and Windows computers should update to Adobe Flash Player 17.0.0.169 (14.9 MB) as soon as possible to avoid potential attacks. Linux users should update to Adobe Flash Player 11.2.202.457.

Adobe Flash Player installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Flash Player 17.0.0.169. Moreover, Adobe Flash installed with Internet Explorer (IE) for Windows 8.x will automatically be updated to the latest version when available, which will include Adobe Flash Player 17.0.0.169.

In addition to patching Flash Player vulnerabilities, Adobe has also released security updates for ColdFusion and Adobe Flex—each addressing a separate vulnerability.

[Larry381]

Adobe Flash is probably the worst offender when it comes to problems with most browsers.

[RayChuang88]

That does explain why my system automatically updated to Adobe Flash 17.0.0.169 (both the regular version and the version that comes with Google Chrome 42.0).

[Maudeen]

I’m a little on the . . . .make that a lot on the computer illiteracy side. What happens if I would just delete the Flash?

[Maudeen]

I have Avast and it lists the software and says all are up to date. Listed is Flash Active X and Flash Plugin whatever they are. Should I delete either one of them?

[Swordmaker]

I have Avast and it lists the software and says all are up to date. Listed is Flash Active X and Flash Plugin whatever they are. Should I delete either one of them?

Check the article for the correct version number for your computer and see if they match your Flash. You can always go in to your control panel and remove your current Flash and install one you download from Adobe's official site. That should guarantee you've got the right one.

The Adobe Flash Download page is here: Official Adobe Flash Downloader OS Selection Page

[Swordmaker]

I have Avast and it lists the software and says all are up to date. Listed is Flash Active X and Flash Plugin whatever they are. Should I delete either one of them?

Some versions of Windows are set to automatically keep Flash updated. . . so you may be OK. . . but CHECK to be sure.

[Maudeen]

Ok. . . thanks for taking the time to help this senior citizen out!

[Swordmaker]

I’m a little on the . . . .make that a lot on the computer illiteracy side. What happens if I would just delete the Flash?

You would not be able to see some videos on certain websites, some websites would not work that use Flash animations or scripts, all FLASH games would not work (there are a lot on Facebook), and you wouldn't be vulnerable to the next bi-weekly Flash exploits trying to steal your identity. ;^)

[dayglored]

> *facepalm* Why is Flash allowed to continue to exist? I wish everyone would just move to HTML5 and be done with it.

Me too. Why it continues is sad but simple: It's still making money (as Swordmaker said) and there's still a ton of it that people love to watch.

Makes me crazy.

[Viking2002]

FYI - Adobe's web site is experiencing a partial outage. I tried to update an end user's Flash an hour sgo, and the download page is down. Problem solved. LOL

[ArcadeQuarters]

> buffer overflow
> use-after-free
> memory leak

It’s a laundry list of the most basic programming errors. Are 12-year-olds writing the code? Something is very, very wrong at Adobe. There’s no excuse for this.

[Finatic]

I am at that point myself. Between their constant vulnerability and all those viruses that pass themselves off as a Flash update. Good Riddance.

[Swordmaker]

FYI - Adobe's web site is experiencing a partial outage. I tried to update an end user's Flash an hour sgo, and the download page is down. Problem solved. LOL

Obviously their website runs on Flash and another exploit has been discovered. . . ;^)

[Viking2002]

LOL And you probably aren't far from the truth........

[Deagle]

Not likely but they must have a poor bunch of programmers working for them.

[Maudeen]

I CHECKED. . .DON’T ASK ME HOW I FOUND IT. . .THE GOOD LORD HELPS ME IN EVERYTHING. AVAST LET ME DOWN. . .I DID NOT HAVE THE LATEST VERSION. THE FIRST TIME I TRIED IT DIDN’T WORK AND I AM GLAD IT DIDN’T SINCE I DIDN’T WANT THE GOOGLE TOOL BAR AND WHATEVER ELSE THEY WERE ADVERTISING AND HAD ALREADY CHECKED. THANKS SO MUCH FOR YOUR HELP!

[Swordmaker]

THANKS SO MUCH FOR YOUR HELP!

You are very welcome, Maudeen.

[lonevoice]

Ask the hubby to check your Flash version and see if it needs to be updated.

[glock rocks]

bkmk. Thanks.

[Excellence]

srbfl