Security Experts:

Adobe Patches 'Business Logic Error' in Flash Player

The only security update released by Adobe this Patch Tuesday addresses a moderate severity regression issue affecting Flash Player.

The vulnerability, tracked as CVE-2017-11305 and described as a “business logic error,” can lead to the unintended reset of the global settings preference file.

There is no evidence of exploitation in the wild and Adobe appears to have discovered the bug on its own.

The flaw affects version and earlier of Flash Player on Windows, Mac, Linux and Chrome OS, and it has been patched with the release of version Microsoft has also updated the Flash Player components used by its software in order to address this issue.

Last month, Adobe addressed a total of 80 vulnerabilities across Flash Player, Photoshop, Connect, Acrobat and Reader, DNG Converter, InDesign, Digital Editions, Shockwave Player, and Experience Manager. Five of the security holes affected Flash.

In October, the company initially announced that it had no Patch Tuesday updates, but a few days later it was forced to release an out-of-band update for Flash Player after Kaspersky Lab researchers noticed that a Middle Eastern threat actor named BlackOasis had been exploiting a zero-day vulnerability to deliver spyware.

The number of flaws found in Flash Player in the past months has decreased considerably, which may be a result of the decision to kill Flash Player by 2020. Nevertheless, as long as the software is still widely utilized, zero-day exploits are highly valuable to malicious actors.

Related: Adobe Accidentally Posts Private PGP Key

Related: Adobe Patches Two Critical Flaws in Flash Player

Related: Adobe Patches 69 Flaws in Reader, Acrobat

view counter
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.