Adobe released an out-of-band security update on Monday to address multiple vulnerabilities rated as critical in its Flash Player, including one (CVE-2015-8651) that is currently being exploited in targeted attacks.
The software maker said the vulnerabilities affect all platforms and could allow an attacker to take control of an affected system.
Adobe provided the following details on the vulnerabilities in a security bulletin posted Monday afternoon:
• These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-8644).
• These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-8651).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).
• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).
Adobe did not provide details on the attacks exploiting CVE-2015-8651, other than describing them as “limited, targeted attacks”.
A company spokesperson told SecurityWeek that the attacks appear to be limited to a spear phishing campaign at this point.
Users should update their products to the latest version using the instructions referenced in the security bulletin.
Several individuals and organizations were credited with reporting the relevant issues and for working with Adobe on the issue.
In early December, Adobe encouraged content creators to build content using new Web standards such as HTML5, but did not mention anything about discontinuing Flash, which has been extremely vulnerable and exploited in many high profile attacks via 0days, as well as commodity attacks leveraging popular exploit kits.
Related: Visit The Advanced Security Operations Resource Center
