Adobe has released security updates for several of its products, but a critical Flash Player zero-day vulnerability exploited in targeted attacks will only be resolved later this week.
The Flash Player zero-day, tracked as CVE-2016-4171, affects versions 21.0.0.242 and earlier for Windows, Mac, Linux and Chrome OS. The flaw, reported by Anton Ivanov of Kaspersky, allows an attacker to take control of vulnerable systems.
Adobe noted that while the vulnerability does not appear to have been exploited in large-scale attacks, the company has learned that it has been leveraged in limited, targeted attacks. A patch for this vulnerability is expected to become available on June 16.
Adobe also informed customers about the availability of security updates for the Digital Negative (DNG) software development kit (SDK). The Windows and Mac versions of the product are plagued by a memory corruption vulnerability (CVE-2016-4167) reported by Kinan Hakim of Google.
A security bulletin has also been published for Adobe Brackets, an open source code editor for web designers and front-end developers. The software is affected by a JavaScript injection flaw (CVE-2016-4164) and an issue related to the extension manager (CVE-2016-4165). The weakness, reported by Kacper Rybczyński, affects the Windows, Mac and Linux versions of the product.
Security updates released for the Windows version of the Creative Cloud Desktop Application resolve an untrusted search path (CVE-2016-4157) and an unquoted service path enumeration vulnerability (CVE-2016-4158).
Adobe has also issued hotfixes for ColdFusion versions 10, 11 and the 2016 release to address a cross-site scripting (XSS) vulnerability. The flaw has been assigned the identifier CVE-2016-4159.
The vulnerabilities in DNG, Brackets, Creative Cloud and ColdFusion have been assigned priority ratings of 2 and 3. Adobe says it’s not aware of any exploits existing in the wild for these flaws.
Updates released by the company last month for its Reader, Acrobat, Flash Player, Connect and ColdFusion products patched more than 100 vulnerabilities.
Of the 25 flaws addressed by the company in Flash Player, one was a zero-day that had been exploited by malicious actors via specially crafted documents. Just ten days after the patch was released, researchers noticed that the vulnerability, tracked as CVE-2016-4117, had been exploited by the Magnitude exploit kit. The exploit was later added to the Neutrino and Angler exploit kits.
Microsoft also released security bulletins on Tuesday to address nearly 40 vulnerabilities in Windows, Office, Internet Explorer, Edge and Exchange Server.
Related: Adobe Patches Flash Zero-Day Exploited by Magnitude EK