Adobe issued an update for its Flash Player on Thursday, which hardens the media player against two vulnerabilities being actively exploited. Of note, is the warning that one of the flaws is being used in drive-by attacks targeting users of both Windows and Mac OS X.
According to the advisory, Adobe says they are aware of reports that CVE-2013-0633 is being exploited in the wild, as well as being aware that CVE-2013-0634 is being exploited in the wild via drive-by-download, targeting users of Firefox or Safari on the Macintosh platform. In addition, both vulnerabilities are being exploited via Spam, where Microsoft Word documents contain malicious Flash content. Adobe credits Kaspersky Lab with the discovery of CVE-2013-0633, and the Shadowserver Foundation with the discovery of CVE-2013-0634.
Experts urge users to update as soon as possible, given the nature of the flaws being exploited. Updates are available to Windows users, Macintosh users, and both Linux and Android users. Those with Auto Updates enabled will see the notifications; particularly those using Chrome and Internet Explorer 10 updated automatically by Google and Microsoft respectively. Otherwise, Adobe recommends downloading and installing from the direct download on their website.
Because of the emergency release from Adobe, Microsoft has updated Security Advisory 2755801 in order to address issues in Adobe Flash Player in Internet Explorer 10 on Windows 8.
Related: Adobe’s Hunt for Sandbox Bypass Flaw a Frustrating Exercise