Connect with us

Hi, what are you looking for?


Malware & Threats

Adobe Patches Flash Zero-Day Exploited in Targeted Attacks

Adobe has patched vulnerabilities in nine of its products, including Flash Player, which is affected by a zero-day flaw that has been exploited in targeted attacks.

Adobe has patched vulnerabilities in nine of its products, including Flash Player, which is affected by a zero-day flaw that has been exploited in targeted attacks.

Flash Player resolves a total of 17 vulnerabilities, a majority of which can be exploited for arbitrary code execution. The most interesting of the security holes is CVE-2016-7892, a use-after-free reported to Adobe by an individual who wanted to remain anonymous.

According to Adobe, an exploit for CVE-2016-7892 exists in the wild and the vulnerability has been leveraged in limited, targeted attacks aimed at Windows users running a 32-bit version of Internet Explorer.

The other Flash Player vulnerabilities were reported to Adobe by independent researchers and experts from Microsoft, Pangu LAB, Tencent, CloverSec Labs, Qihoo 360, Trend Micro’s Zero Day Initiative (ZDI) and Palo Alto Networks.

The Flash Player patches have also been included in one of the security bulletins released by Microsoft on Tuesday.

Adobe also announced the availability of security updates that patch a memory corruption flaw in Animate, two cross-site scripting (XSS) issues in Experience Manager Forms, and a critical memory corruption in DNG Converter.

Three XSS and one cross-site request forgery (CSRF) flaws in Experience Manager, a memory corruption in InDesign, information disclosure bugs in ColdFusion Builder and Digital Editions, and an XSS flaw in RoboHelp have also been patched.

Advertisement. Scroll to continue reading.

The software giant said there was no evidence that any of these vulnerabilities had been exploited in the wild.

While the Patch Tuesday updates released by Adobe in the past three months did not address any zero-days, Adobe did release an out-of-band patch for Flash Player in late October to fix a use-after-free exploited in a low-volume spear phishing campaign by the Russia-linked threat actor known as Pawn Storm, APT28, Fancy Bear, Sednit, Sofacy and Tsar Team.

Related: U.S. Authorities Reach Settlement With Adobe Over 2013 Breach

Related: Adobe Patches 9 Flash Player Flaws Reported via ZDI

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.