Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Adobe Issues Security Fixes for Reader, Shockwave, and Flash

Adobe rolled out a set of patches on Tuesday, addressing more than 20 security issues. The patch that is being hailed as the most important, however, is one for Flash Player that has been actively exploited in order to compromise Windows-based systems.

Adobe rolled out a set of patches on Tuesday, addressing more than 20 security issues. The patch that is being hailed as the most important, however, is one for Flash Player that has been actively exploited in order to compromise Windows-based systems.

In all, there were 26 CVE reports addressed by Adobe in three security bulletins. The largest is Adobe Reader, with 20 separate security issues on its own. The problems exist in the Windows and Macintosh versions, and if exploited could lead to issues ranging from software crashes to complete system compromise.

For Flash, Adobe addressed a flaw within the ActiveX version of the software, which is actively being exploited online via malicious Word documents. Moreover, the underlying vulnerability also exists in the Macintosh and Linux versions of Flash Player, making the need to patch even greater.

Finally, Adobe released an update to Shockwave, which addresses five issues. As is the case with the Reader vulnerabilities, the Shockwave issues could lead to software crashes or compromise of exploited. Both the Windows and Macintosh versions of the application have been updated.

The bulletin for Reader is here, while the Shockwave and Flash bulletins are here and here.  

In related news, Adobe has pulled Flash for Android out of Google Play. The removal became official today, but the move has been expected for a while since word first made it to the public last November.

Adobe is said to be focusing more on HTML5 development for their mobile applications, making Flash obsolete. Given the security issues that have plagued Flash, the move is a welcome one for many platform development gurus.

Written By

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.