Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Flash Zero-Day Exploited in Targeted Attacks

Adobe has released security updates for several of its products, but a critical Flash Player zero-day vulnerability exploited in targeted attacks will only be resolved later this week.

Adobe has released security updates for several of its products, but a critical Flash Player zero-day vulnerability exploited in targeted attacks will only be resolved later this week.

The Flash Player zero-day, tracked as CVE-2016-4171, affects versions 21.0.0.242 and earlier for Windows, Mac, Linux and Chrome OS. The flaw, reported by Anton Ivanov of Kaspersky, allows an attacker to take control of vulnerable systems.

Adobe noted that while the vulnerability does not appear to have been exploited in large-scale attacks, the company has learned that it has been leveraged in limited, targeted attacks. A patch for this vulnerability is expected to become available on June 16.

Adobe also informed customers about the availability of security updates for the Digital Negative (DNG) software development kit (SDK). The Windows and Mac versions of the product are plagued by a memory corruption vulnerability (CVE-2016-4167) reported by Kinan Hakim of Google.

A security bulletin has also been published for Adobe Brackets, an open source code editor for web designers and front-end developers. The software is affected by a JavaScript injection flaw (CVE-2016-4164) and an issue related to the extension manager (CVE-2016-4165). The weakness, reported by Kacper Rybczyński, affects the Windows, Mac and Linux versions of the product.

Security updates released for the Windows version of the Creative Cloud Desktop Application resolve an untrusted search path (CVE-2016-4157) and an unquoted service path enumeration vulnerability (CVE-2016-4158).

Adobe has also issued hotfixes for ColdFusion versions 10, 11 and the 2016 release to address a cross-site scripting (XSS) vulnerability. The flaw has been assigned the identifier CVE-2016-4159.

The vulnerabilities in DNG, Brackets, Creative Cloud and ColdFusion have been assigned priority ratings of 2 and 3. Adobe says it’s not aware of any exploits existing in the wild for these flaws.

Advertisement. Scroll to continue reading.

Updates released by the company last month for its Reader, Acrobat, Flash Player, Connect and ColdFusion products patched more than 100 vulnerabilities.

Of the 25 flaws addressed by the company in Flash Player, one was a zero-day that had been exploited by malicious actors via specially crafted documents. Just ten days after the patch was released, researchers noticed that the vulnerability, tracked as CVE-2016-4117, had been exploited by the Magnitude exploit kit. The exploit was later added to the Neutrino and Angler exploit kits.

Microsoft also released security bulletins on Tuesday to address nearly 40 vulnerabilities in Windows, Office, Internet Explorer, Edge and Exchange Server.

Related: Adobe Patches Flash Zero-Day Exploited by Magnitude EK

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.