Adobe has patched vulnerabilities in nine of its products, including Flash Player, which is affected by a zero-day flaw that has been exploited in targeted attacks.
Flash Player 24.0.0.186 resolves a total of 17 vulnerabilities, a majority of which can be exploited for arbitrary code execution. The most interesting of the security holes is CVE-2016-7892, a use-after-free reported to Adobe by an individual who wanted to remain anonymous.
According to Adobe, an exploit for CVE-2016-7892 exists in the wild and the vulnerability has been leveraged in limited, targeted attacks aimed at Windows users running a 32-bit version of Internet Explorer.
The other Flash Player vulnerabilities were reported to Adobe by independent researchers and experts from Microsoft, Pangu LAB, Tencent, CloverSec Labs, Qihoo 360, Trend Micro’s Zero Day Initiative (ZDI) and Palo Alto Networks.
The Flash Player patches have also been included in one of the security bulletins released by Microsoft on Tuesday.
Adobe also announced the availability of security updates that patch a memory corruption flaw in Animate, two cross-site scripting (XSS) issues in Experience Manager Forms, and a critical memory corruption in DNG Converter.
Three XSS and one cross-site request forgery (CSRF) flaws in Experience Manager, a memory corruption in InDesign, information disclosure bugs in ColdFusion Builder and Digital Editions, and an XSS flaw in RoboHelp have also been patched.
The software giant said there was no evidence that any of these vulnerabilities had been exploited in the wild.
While the Patch Tuesday updates released by Adobe in the past three months did not address any zero-days, Adobe did release an out-of-band patch for Flash Player in late October to fix a use-after-free exploited in a low-volume spear phishing campaign by the Russia-linked threat actor known as Pawn Storm, APT28, Fancy Bear, Sednit, Sofacy and Tsar Team.
Related: U.S. Authorities Reach Settlement With Adobe Over 2013 Breach
Related: Adobe Patches 9 Flash Player Flaws Reported via ZDI
