Adobe informed users on Tuesday that it’s preparing a patch for a Flash Player zero-day vulnerability that has been actively exploited by malicious actors.
According to the company, the critical flaw, identified as CVE-2016-1019, exists in Flash Player 21.0.0.197 and earlier versions for Windows, Mac, Linux and Chrome OS.
Fortunately, Flash Player 21.0.0.182, a version released in March, introduces a mitigation that prevents attackers from exploiting the vulnerability. Adobe says attacks involving CVE-2016-1019 have been launched against systems running Windows XP and Windows 7 with Flash 20.0.0.306 and earlier.
The vendor has promised to release a patch for this zero-day as early as Thursday, April 7. In the meantime, users are advised to ensure that their Flash installation is updated to version 21.0.0.182 or later.
Adobe has credited Kafeine of Proofpoint, Genwei Jiang of FireEye, and Clement Lecigne of Google for reporting the issue.
This will be the third Flash Player update issued by Adobe this year. The first, released in February, fixed 22 memory corruption flaws that could have been exploited for arbitrary code execution. The second update was released in March, when the company resolved a total of 23 vulnerabilities, including CVE-2016-1010, which had been exploited in targeted attacks.
Adobe also released this year updates for Acrobat, Reader, Digital Editions, Photoshop, Connect and Experience Manager.
Related Reading: Adobe Patches 17 Vulnerabilities in Reader, Acrobat
Related Reading: Adobe Patches Flaws in Acrobat, Reader, Digital Editions
Related Reading: Adobe Patches Flaws in Flash, Photoshop, Connect
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
