Connect with us

Hi, what are you looking for?


Malware & Threats

Adobe Patches Flash Zero-Day Exploited in Targeted Attacks

Adobe has patched vulnerabilities in nine of its products, including Flash Player, which is affected by a zero-day flaw that has been exploited in targeted attacks.

Adobe has patched vulnerabilities in nine of its products, including Flash Player, which is affected by a zero-day flaw that has been exploited in targeted attacks.

Flash Player resolves a total of 17 vulnerabilities, a majority of which can be exploited for arbitrary code execution. The most interesting of the security holes is CVE-2016-7892, a use-after-free reported to Adobe by an individual who wanted to remain anonymous.

According to Adobe, an exploit for CVE-2016-7892 exists in the wild and the vulnerability has been leveraged in limited, targeted attacks aimed at Windows users running a 32-bit version of Internet Explorer.

The other Flash Player vulnerabilities were reported to Adobe by independent researchers and experts from Microsoft, Pangu LAB, Tencent, CloverSec Labs, Qihoo 360, Trend Micro’s Zero Day Initiative (ZDI) and Palo Alto Networks.

The Flash Player patches have also been included in one of the security bulletins released by Microsoft on Tuesday.

Adobe also announced the availability of security updates that patch a memory corruption flaw in Animate, two cross-site scripting (XSS) issues in Experience Manager Forms, and a critical memory corruption in DNG Converter.

Three XSS and one cross-site request forgery (CSRF) flaws in Experience Manager, a memory corruption in InDesign, information disclosure bugs in ColdFusion Builder and Digital Editions, and an XSS flaw in RoboHelp have also been patched.

The software giant said there was no evidence that any of these vulnerabilities had been exploited in the wild.

Advertisement. Scroll to continue reading.

While the Patch Tuesday updates released by Adobe in the past three months did not address any zero-days, Adobe did release an out-of-band patch for Flash Player in late October to fix a use-after-free exploited in a low-volume spear phishing campaign by the Russia-linked threat actor known as Pawn Storm, APT28, Fancy Bear, Sednit, Sofacy and Tsar Team.

Related: U.S. Authorities Reach Settlement With Adobe Over 2013 Breach

Related: Adobe Patches 9 Flash Player Flaws Reported via ZDI

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.