Adobe issued an update for its Flash Player on Thursday, which hardens the media player against two vulnerabilities being actively exploited. Of note, is the warning that one of the flaws is being used in drive-by attacks targeting users of both Windows and Mac OS X.
According to the advisory, Adobe says they are aware of reports that CVE-2013-0633 is being exploited in the wild, as well as being aware that CVE-2013-0634 is being exploited in the wild via drive-by-download, targeting users of Firefox or Safari on the Macintosh platform. In addition, both vulnerabilities are being exploited via Spam, where Microsoft Word documents contain malicious Flash content. Adobe credits Kaspersky Lab with the discovery of CVE-2013-0633, and the Shadowserver Foundation with the discovery of CVE-2013-0634.
Experts urge users to update as soon as possible, given the nature of the flaws being exploited. Updates are available to Windows users, Macintosh users, and both Linux and Android users. Those with Auto Updates enabled will see the notifications; particularly those using Chrome and Internet Explorer 10 updated automatically by Google and Microsoft respectively. Otherwise, Adobe recommends downloading and installing from the direct download on their website.
Because of the emergency release from Adobe, Microsoft has updated Security Advisory 2755801 in order to address issues in Adobe Flash Player in Internet Explorer 10 on Windows 8.
Related: Adobe’s Hunt for Sandbox Bypass Flaw a Frustrating Exercise
More from Steve Ragan
- Anonymous Claims Attack on IP Surveillance Firm Brickcom, Leaks Customer Data
- Workers Don’t Trust Employers with Personal Data: Survey
- Root SSH Key Compromised in Emergency Alerting Systems
- Morningstar Data Breach Impacted 184,000 Clients
- Microsoft to Patch Seven Flaws in July’s Patch Tuesday
- OpenX Addresses New Security Flaws with Latest Update
- Ubisoft Breached: Users Urged to Change Passwords
- Anonymous Targets Anti-Anonymity B2B Firm Relead.com
Latest News
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
- Every Network Is Now an OT Network. Can Your Security Keep Up?
- Navigating the Digital Frontier in Cybersecurity Awareness Month 2023
- TransUnion Denies Breach After Hacker Publishes Allegedly Stolen Data
- Legit Security Raises $40 Million in Series B Financing
- Cisco to Acquire Splunk for $28 Billion
- Atlassian Security Updates Patch High-Severity Vulnerabilities
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
