Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Adobe Patches Flash Player Against Active Attacks

Adobe issued an update for its Flash Player on Thursday, which hardens the media player against two vulnerabilities being actively exploited. Of note, is the warning that one of the flaws is being used in drive-by attacks targeting users of both Windows and Mac OS X.

Adobe issued an update for its Flash Player on Thursday, which hardens the media player against two vulnerabilities being actively exploited. Of note, is the warning that one of the flaws is being used in drive-by attacks targeting users of both Windows and Mac OS X.

According to the advisory, Adobe says they are aware of reports that CVE-2013-0633 is being exploited in the wild, as well as being aware that CVE-2013-0634 is being exploited in the wild via drive-by-download, targeting users of Firefox or Safari on the Macintosh platform. In addition, both vulnerabilities are being exploited via Spam, where Microsoft Word documents contain malicious Flash content. Adobe credits Kaspersky Lab with the discovery of CVE-2013-0633, and the Shadowserver Foundation with the discovery of CVE-2013-0634.

Experts urge users to update as soon as possible, given the nature of the flaws being exploited. Updates are available to Windows users, Macintosh users, and both Linux and Android users. Those with Auto Updates enabled will see the notifications; particularly those using Chrome and Internet Explorer 10 updated automatically by Google and Microsoft respectively. Otherwise, Adobe recommends downloading and installing from the direct download on their website.

Because of the emergency release from Adobe, Microsoft has updated Security Advisory 2755801 in order to address issues in Adobe Flash Player in Internet Explorer 10 on Windows 8. 

RelatedAdobe’s Hunt for Sandbox Bypass Flaw a Frustrating Exercise

Written By

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.