Virtual Event Today: Supply Chain Security Summit - Join Event In-Progress

Security Experts:

Connect with us

Hi, what are you looking for?



Flash Zero-Day Exploited in Targeted Attacks

Adobe has released security updates for several of its products, but a critical Flash Player zero-day vulnerability exploited in targeted attacks will only be resolved later this week.

Adobe has released security updates for several of its products, but a critical Flash Player zero-day vulnerability exploited in targeted attacks will only be resolved later this week.

The Flash Player zero-day, tracked as CVE-2016-4171, affects versions and earlier for Windows, Mac, Linux and Chrome OS. The flaw, reported by Anton Ivanov of Kaspersky, allows an attacker to take control of vulnerable systems.

Adobe noted that while the vulnerability does not appear to have been exploited in large-scale attacks, the company has learned that it has been leveraged in limited, targeted attacks. A patch for this vulnerability is expected to become available on June 16.

Adobe also informed customers about the availability of security updates for the Digital Negative (DNG) software development kit (SDK). The Windows and Mac versions of the product are plagued by a memory corruption vulnerability (CVE-2016-4167) reported by Kinan Hakim of Google.

A security bulletin has also been published for Adobe Brackets, an open source code editor for web designers and front-end developers. The software is affected by a JavaScript injection flaw (CVE-2016-4164) and an issue related to the extension manager (CVE-2016-4165). The weakness, reported by Kacper Rybczyński, affects the Windows, Mac and Linux versions of the product.

Security updates released for the Windows version of the Creative Cloud Desktop Application resolve an untrusted search path (CVE-2016-4157) and an unquoted service path enumeration vulnerability (CVE-2016-4158).

Adobe has also issued hotfixes for ColdFusion versions 10, 11 and the 2016 release to address a cross-site scripting (XSS) vulnerability. The flaw has been assigned the identifier CVE-2016-4159.

The vulnerabilities in DNG, Brackets, Creative Cloud and ColdFusion have been assigned priority ratings of 2 and 3. Adobe says it’s not aware of any exploits existing in the wild for these flaws.

Updates released by the company last month for its Reader, Acrobat, Flash Player, Connect and ColdFusion products patched more than 100 vulnerabilities.

Of the 25 flaws addressed by the company in Flash Player, one was a zero-day that had been exploited by malicious actors via specially crafted documents. Just ten days after the patch was released, researchers noticed that the vulnerability, tracked as CVE-2016-4117, had been exploited by the Magnitude exploit kit. The exploit was later added to the Neutrino and Angler exploit kits.

Microsoft also released security bulletins on Tuesday to address nearly 40 vulnerabilities in Windows, Office, Internet Explorer, Edge and Exchange Server.

Related: Adobe Patches Flash Zero-Day Exploited by Magnitude EK

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet