Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Adobe Issues Emergency Patch For Flash Zero-Day Under Attack

Adobe released an out-of-band security update on Monday to address multiple vulnerabilities rated as critical in its Flash Player, including one (CVE-2015-8651) that is currently being exploited in targeted attacks.

The software maker said the vulnerabilities affect all platforms and could allow an attacker to take control of an affected system.

Adobe released an out-of-band security update on Monday to address multiple vulnerabilities rated as critical in its Flash Player, including one (CVE-2015-8651) that is currently being exploited in targeted attacks.

The software maker said the vulnerabilities affect all platforms and could allow an attacker to take control of an affected system.

Adobe provided the following details on the vulnerabilities in a security bulletin posted Monday afternoon:

• These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-8644).

• These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-8651).

• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).

• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).

Adobe did not provide details on the attacks exploiting CVE-2015-8651, other than describing them as “limited, targeted attacks”.

A company spokesperson told SecurityWeek that the attacks appear to be limited to a spear phishing campaign at this point.    

Users should update their products to the latest version using the instructions referenced in the security bulletin.  

Several individuals and organizations were credited with reporting the relevant issues and for working with Adobe on the issue.

In early December, Adobe encouraged content creators to build content using new Web standards such as HTML5, but did not mention anything about discontinuing Flash, which has been extremely vulnerable and exploited in many high profile attacks via 0days, as well as commodity attacks leveraging popular exploit kits. 

Related: Visit The Advanced Security Operations Resource Center

Written By

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.