ID: IRCNE2013031786
Date: 2013-03-12
According to "computerworld", Adobe today patched Flash Player, the fifth time this year it's updated the vulnerability-plagued software.
Last November, Adobe announced it would pair its Flash security updates with the monthly Patch Tuesday releases by partner Microsoft. Adobe has fixed Flash flaws on the second Tuesday of each month since then.
The Flash update, designated APSB13-09, patched four critical vulnerabilities that included a use-after-free bug, integer and buffer overflows, and an unspecified memory corruption flaw. All could be used by attackers to execute malicious code, hack Flash and hijack a Windows PC or OS X-powered Mac.
Adobe said that none of the four vulnerabilities has been seen exploited in the wild.
Adobe did not patch the bug or bugs that a team from Vupen, a French vulnerability research and exploit-selling firm, used to hack Flash Player at last week's Pwn2Own contest. The Vupen team demonstrated their hack of Flash on IE9 running in Windows 7.
Adobe confirmed today that it plans to patch the Vupen bug(s) next month as part of its April 9 update.
The patched versions of Flash Player for Windows, Mac and Linux can be downloaded from Adobe's website. Windows and Mac users can also wait for Flash's automatic updating tool to kick in. Users of Google's Chrome and Microsoft's IE10 on Windows 8 will receive the newest Flash via those browsers' own update mechanisms.
Android 2.x, 3.x, and 4.x users who installed Flash Player before Adobe pulled the plug-in from distribution must jump through hoops to update the software. For details, check out this post by Computerworld blogger Michael Horowitz.
- 2