Adobe rolled out a set of patches on Tuesday, addressing more than 20 security issues. The patch that is being hailed as the most important, however, is one for Flash Player that has been actively exploited in order to compromise Windows-based systems.
In all, there were 26 CVE reports addressed by Adobe in three security bulletins. The largest is Adobe Reader, with 20 separate security issues on its own. The problems exist in the Windows and Macintosh versions, and if exploited could lead to issues ranging from software crashes to complete system compromise.
For Flash, Adobe addressed a flaw within the ActiveX version of the software, which is actively being exploited online via malicious Word documents. Moreover, the underlying vulnerability also exists in the Macintosh and Linux versions of Flash Player, making the need to patch even greater.
Finally, Adobe released an update to Shockwave, which addresses five issues. As is the case with the Reader vulnerabilities, the Shockwave issues could lead to software crashes or compromise of exploited. Both the Windows and Macintosh versions of the application have been updated.
The bulletin for Reader is here, while the Shockwave and Flash bulletins are here and here.
In related news, Adobe has pulled Flash for Android out of Google Play. The removal became official today, but the move has been expected for a while since word first made it to the public last November.
Adobe is said to be focusing more on HTML5 development for their mobile applications, making Flash obsolete. Given the security issues that have plagued Flash, the move is a welcome one for many platform development gurus.