Adobe has patched vulnerabilities in nine of its products, including Flash Player, which is affected by a zero-day flaw that has been exploited in targeted attacks.
Flash Player 24.0.0.186 resolves a total of 17 vulnerabilities, a majority of which can be exploited for arbitrary code execution. The most interesting of the security holes is CVE-2016-7892, a use-after-free reported to Adobe by an individual who wanted to remain anonymous.
According to Adobe, an exploit for CVE-2016-7892 exists in the wild and the vulnerability has been leveraged in limited, targeted attacks aimed at Windows users running a 32-bit version of Internet Explorer.
The other Flash Player vulnerabilities were reported to Adobe by independent researchers and experts from Microsoft, Pangu LAB, Tencent, CloverSec Labs, Qihoo 360, Trend Micro’s Zero Day Initiative (ZDI) and Palo Alto Networks.
The Flash Player patches have also been included in one of the security bulletins released by Microsoft on Tuesday.
Adobe also announced the availability of security updates that patch a memory corruption flaw in Animate, two cross-site scripting (XSS) issues in Experience Manager Forms, and a critical memory corruption in DNG Converter.
Three XSS and one cross-site request forgery (CSRF) flaws in Experience Manager, a memory corruption in InDesign, information disclosure bugs in ColdFusion Builder and Digital Editions, and an XSS flaw in RoboHelp have also been patched.
The software giant said there was no evidence that any of these vulnerabilities had been exploited in the wild.
While the Patch Tuesday updates released by Adobe in the past three months did not address any zero-days, Adobe did release an out-of-band patch for Flash Player in late October to fix a use-after-free exploited in a low-volume spear phishing campaign by the Russia-linked threat actor known as Pawn Storm, APT28, Fancy Bear, Sednit, Sofacy and Tsar Team.
Related: U.S. Authorities Reach Settlement With Adobe Over 2013 Breach
Related: Adobe Patches 9 Flash Player Flaws Reported via ZDI
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
- Cybersecurity M&A Roundup: 36 Deals Announced in May 2023
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
Latest News
- Dozens of Malicious Extensions Found in Chrome Web Store
- What if the Current AI Hype Is a Dead End?
- Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security
- Zyxel Urges Customers to Patch Firewalls Against Exploited Vulnerabilities
- Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards
- SBOMs – Software Supply Chain Security’s Future or Fantasy?
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
- Cybersecurity M&A Roundup: 36 Deals Announced in May 2023
