Vulnerabilities

Adobe Issues Emergency Patch For Flash Zero-Day Under Attack

Adobe released an out-of-band security update on Monday to address multiple vulnerabilities rated as critical in its Flash Player, including one (CVE-2015-8651) that is currently being exploited in targeted attacks.

The software maker said the vulnerabilities affect all platforms and could allow an attacker to take control of an affected system.

Mike Lennon

December 28, 2015

The software maker said the vulnerabilities affect all platforms and could allow an attacker to take control of an affected system.

Adobe provided the following details on the vulnerabilities in a security bulletin posted Monday afternoon:

• These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-8644).

• These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-8651).

• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).

• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).

Adobe did not provide details on the attacks exploiting CVE-2015-8651, other than describing them as “limited, targeted attacks”.

A company spokesperson told SecurityWeek that the attacks appear to be limited to a spear phishing campaign at this point.

Users should update their products to the latest version using the instructions referenced in the security bulletin.

Several individuals and organizations were credited with reporting the relevant issues and for working with Adobe on the issue.

In early December, Adobe encouraged content creators to build content using new Web standards such as HTML5, but did not mention anything about discontinuing Flash, which has been extremely vulnerable and exploited in many high profile attacks via 0days, as well as commodity attacks leveraging popular exploit kits.

Written By Mike Lennon

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar