Flash 12.0.0.44 released
- http://helpx.adobe.com/security/products/flash-player/apsb14-04.html
Feb 4, 2014
CVE number: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0497 - 10.0 (HIGH)
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player 12.0.0.43 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.335 and earlier versions for Linux. These updates address a critical vulnerability that could potentially allow an attacker to remotely take control of the affected system. Adobe is aware of reports that an exploit for this vulnerability exists in the wild, and recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player 12.0.0.43 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 12.0.0.44.
- Users of Adobe Flash Player 11.2.202.335 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.336.
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 12.0.0.44 for Windows 8.1…
These updates address -critical- vulnerabilities in the software…
Shockwave Player 12.0.9.149 released
- http://helpx.adobe.com/security/products/shockwave/apsb14-06.html
Feb 11, 2014
CVE number:
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0500 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0501 - 10.0 (HIGH)
Platform: Windows and Macintosh
Summary: Adobe has released a security update for Adobe Shockwave Player 12.0.7.148 and earlier versions on the Windows and Macintosh operating systems. This update addresses critical vulnerabilities that could potentially allow an attacker to remotely take control of the affected system… Adobe recommends users of Adobe Shockwave Player 12.0.7.148 and earlier versions update to the newest version 12.0.9.149, available here:
- http://get.adobe.com/shockwave/
___
Flash 12.0.0.70 released
- http://helpx.adobe.com/security/products/flash-player/apsb14-07.html
Feb 20, 2014
CVE number:
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0498 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0499 - 7.8 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0502 - 10.0 (HIGH)
Last revised: 02/21/2014 - "… as exploited in the wild in February 2014…"
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player 12.0.0.44 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.336 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that an exploit for CVE-2014-0502 exists in the wild, and recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player [removed] and earlier versions for Windows and Macintosh should update to Adobe Flash Player 12.0.0.70.
- Users of Adobe Flash Player 11.2.202.336 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.341.
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player [removed] for Windows 8.1.
- Users of Adobe AIR 4.0.0.1390 and earlier versions for Android should update to Adobe AIR 4.0.0.1628.
- Users of the Adobe AIR 4.0.0.1390 SDK and earlier versions should update to the Adobe AIR 4.0.0.1628 SDK.
- Users of the Adobe AIR 4.0.0.1390 SDK & Compiler and earlier versions should update to the Adobe AIR 4.0.0.1628 SDK & Compiler…
- https://secunia.com/advisories/57057/
Release Date: 2014-02-21
Criticality: Extremely Critical
Where: From remote
Impact: Exposure of sensitive information, System access…
Solution:
Update to a fixed version…
Flash 12.0.0.77 released
- http://helpx.adobe.com/security/products/flash-player/apsb14-08.html
March 11, 2014
CVE number:
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0503 - 6.4
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0504 - 5.0
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player 12.0.0.70 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.341 and earlier versions for Linux. These updates address -important- vulnerabilities, and Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player [removed] and earlier versions for Windows and Macintosh should update to Adobe Flash Player 12.0.0.77
- Users of Adobe Flash Player 11.2.202.341 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.346
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 12.0.0.77 for Windows 8.1…
Shockwave 12.0.9.150 released
- http://helpx.adobe.com/security/products/shockwave/apsb14-10.html
March 13, 2014
CVE number: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0505 - 10.0 (HIGH)
Platform: Windows and Macintosh
Summary: Adobe has released a security update for Adobe Shockwave Player 12.0.9.149 and earlier versions on the Windows and Macintosh operating systems. This update addresses a -critical- vulnerability that could potentially allow an attacker to remotely take control of the affected system. Adobe recommends users of Adobe Shockwave Player 12.0.9.149 and earlier versions update to Adobe Shockwave Player 12.1.0.150 using the instructions provided in the "Solution" section…
Solution: Adobe recommends users of Adobe Shockwave Player 12.0.9.149 and earlier versions update to the newest version 12.1.0.150, available here:
- http://get.adobe.com/shockwave/
___
- https://secunia.com/advisories/57277/
Release Date: 2014-03-14
Criticality: Highly Critical
Where: From remote
Impact: System access…
… vulnerability is reported in versions 12.0.9.149 and prior running on Windows and Macintosh.
Solution: Update to version 12.1.0.150.
Flash 13.0.0.182 released
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
Release date: April 8, 2014
Vulnerability identifier: APSB14-09
CVE number: CVE-2014-0506, CVE-2014-0507, CVE-2014-0508, CVE-2014-0509
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player [removed] and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.346 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player [removed] and earlier versions for Windows and Macintosh should update to Adobe Flash Player 13.0.0.182
- Users of Adobe Flash Player 11.2.202.346 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.350.
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player [removed] for Windows 8.1.
- Users of Adobe AIR 4.0.0.1628 and earlier versions for Android should update to Adobe AIR [removed].
- Users of the Adobe AIR 4.0.0.1628 SDK and earlier versions should update to the Adobe AIR [removed] SDK.
- Users of the Adobe AIR 4.0.0.1628 SDK & Compiler and earlier versions should update to the Adobe AIR [removed] SDK & Compiler…
* Beginning May 13, 2014, Adobe Flash Player 13 for Mac and Windows will replace version 11.7 as the extended support version. Adobe recommends users upgrade to version 13 to continue to receive security updates. See this blog post for further details:
- http://blogs.adobe.com/flashplayer/2014/03/upcoming-changes-to-flash-players-extended-support-release.html
___
Flash 13.0.0.206 released
- https://helpx.adobe.com/security/products/flash-player/apsb14-13.html
April 28, 2014
CVE number: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0515 - 10.0 (HIGH)
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player 13.0.0.182 and earlier versions for Windows, Adobe Flash Player [removed] and earlier versions for Macintosh and Adobe Flash Player 11.2.202.350 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that an exploit for CVE-2014-0515 exists in the wild, and is being used to target Flash Player users on the Windows platform. Adobe recommends users update their product installations to the latest versions:
• Users of Adobe Flash Player 13.0.0.182 and earlier versions for Windows should update to Adobe Flash Player 13.0.0.206.
• Users of Adobe Flash Player 13.0.0.201 and earlier versions for Macintosh should update to Adobe Flash Player [removed].
• Users of Adobe Flash Player 11.2.202.350 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.356.
• Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
• Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
• Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 13.0.0.206 for Windows 8.1…
___
Flash 13.0.0.214 released
- https://helpx.adobe.com/security/products/flash-player/apsb14-14.html
May 13, 2014
CVE number: CVE-2014-0510, CVE-2014-0516, CVE-2014-0517, CVE-2014-0518, CVE-2014-0519, CVE-2014-0520
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player [removed] and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.356 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player [removed] and earlier versions for Windows and Macintosh should update to Adobe Flash Player 13.0.0.214.
- Users of Adobe Flash Player 11.2.202.356 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.359.
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player [removed] for Windows 8.1.
- Users of the Adobe AIR 13.0.0.83 SDK and earlier versions should update to the Adobe AIR 13.0.0.111 SDK.
- Users of the Adobe AIR 13.0.0.83 SDK & Compiler and earlier versions should update to the Adobe AIR 13.0.0.111 SDK & Compiler…
___
Reader/Acrobat 11.0.07 released
- https://helpx.adobe.com/security/products/reader/apsb14-15.html
May 13, 2014
CVE numbers: CVE-2014-0511, CVE-2014-0512, CVE-2014-0521, CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0525, CVE-2014-0526, CVE-2014-0527, CVE-2014-0528, CVE-2014-0529
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Reader and Acrobat XI (11.0.06) and earlier versions for Windows and Macintosh. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Reader XI (11.0.06) for Windows and Macintosh should update to Adobe Reader XI (11.0.07).
- For users of Adobe Reader X (10.1.9) and earlier versions for Windows and Macintosh, who cannot update to Adobe Reader XI (11.0.07), Adobe has made available the update Adobe Reader X (10.1.10).
- Users of Adobe Acrobat XI (11.0.06) for Windows and Macintosh should update to Adobe Acrobat XI (11.0.07).
- For users of Adobe Acrobat X (10.1.9) and earlier versions for Windows and Macintosh, who cannot update to Adobe Acrobat XI (11.0.07), Adobe has made available the update Adobe Acrobat X (10.1.10)…
Users on Windows and Macintosh can utilize the product's update mechanism. The default configuration is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates …
___
This hotfix addresses a vulnerability that could be exploited to gain remote code execution on the affected system… These updates resolve a stack overflow vulnerability that could result in arbitrary code execution (CVE-2014-0513)…
Flash 14.0.0.125 released
- https://helpx.adobe.com/security/products/flash-player/apsb14-16.html
June 10, 2014
CVE numbers: CVE-2014-0531, CVE-2014-0532, CVE-2014-0533, CVE-2014-0534, CVE-2014-0535, CVE-2014-0536
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player 13.0.0.214 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.359 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player [removed] and earlier versions for Windows and Macintosh should update to Adobe Flash Player 14.0.0.125.
- Users of Adobe Flash Player 11.2.202.359 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.378.
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player [removed] for Windows 8.1.
- Users of the Adobe AIR [removed] SDK and earlier versions should update to the Adobe AIR [removed] SDK.
- Users of the Adobe AIR [removed] SDK & Compiler and earlier versions should update to the Adobe AIR [removed] SDK & Compiler.
- Users of Adobe AIR [removed] and earlier versions for Android should update to Adobe AIR [removed].
- Users of Adobe AIR [removed] and earlier versions for Windows and Macintosh should update to Adobe 14.0.0.110.
___
- http://www.securitytracker.com/id/1030368
CVE Reference: CVE-2014-0531, CVE-2014-0532, CVE-2014-0533, CVE-2014-0534, CVE-2014-0535, CVE-2014-0536
Jun 10 2014
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 13.0.0.214 and prior (Windows/Mac); 11.2.202.359 and prior (Linux)…
Solution: The vendor has issued a fix (14.0.0.125 for Windows/Mac, 11.2.202.378 for Linux).
The vendor's advisory is available at:
- http://helpx.adobe.com/security/products/flash-player/apsb14-16.html
Flash 14.0.0.145 released
- https://helpx.adobe.com/security/products/flash-player/apsb14-17.html
July 8, 2014
CVE number: CVE-2014-0537, CVE-2014-0539, CVE-2014-4671
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player [removed] and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.378 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Flash Player [removed] and earlier versions for Windows and Macintosh should update to Adobe Flash Player 14.0.0.145.
- Users of Adobe Flash Player 11.2.202.378 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.394.
- Adobe Flash Player [removed] installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 14.0.0.145 for Windows, Macintosh and Linux.
- Adobe Flash Player [removed] installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player 14.0.0.145 for Windows 8.0.
- Adobe Flash Player [removed] installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 14.0.0.145 for Windows 8.1.
- Users of the Adobe AIR [removed] SDK and earlier versions should update to the Adobe AIR [removed] SDK.
- Users of the Adobe AIR [removed] SDK & Compiler and earlier versions should update to the Adobe AIR [removed] SDK & Compiler.
- Users of Adobe AIR [removed] and earlier versions for Android should update to Adobe AIR 14.0.0.137…
___
- http://www.securitytracker.com/id/1030533
CVE Reference: CVE-2014-0537, CVE-2014-0539, CVE-2014-4671
Jul 8 2014
Impact: Disclosure of system information, Disclosure of user information, Modification of user information, Not specified, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 14.0.0.125 and prior (for Windows/Mac), 11.2.202.378 and prior (for Linux)…
Solution: The vendor has issued a fix (14.0.0.145 for Windows/Mac, 11.2.202.394 for Linux)…
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0538 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0540 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0541 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0542 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0543 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0544 - 10.0 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0545 - 10.0 (HIGH)
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player 14.0.0.145 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.394 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of the Adobe Flash Player Active X plugin for Internet Explorer version 14.0.0.145 and earlier should update to Adobe Flash Player 14.0.0.176.
- Users of the Adobe Flash Player Windows NPAPI plugin for Firefox version 14.0.0.145 and earlier should update to Adobe Flash Player 14.0.0.179.
- Users of the Adobe Flash Player version 14.0.0.145 and earlier for Macintosh should update to Adobe Flash Player [removed].
- Users of Adobe Flash Player 11.2.202.394 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.400.
- Adobe Flash Player 14.0.0.145 installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player [removed] for Windows, Macintosh and Linux.
- Adobe Flash Player 14.0.0.145 installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player [removed] for Windows 8.0.
- Adobe Flash Player 14.0.0.145 installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 14.0.0.176 for Windows 8.1.
- Users of Adobe AIR 14.0.0.110 and earlier versions for Windows and Macintosh should update to the Adobe AIR 14.0.0.178.
- Users of the Adobe AIR [removed] SDK and earlier versions should update to the Adobe AIR [removed] SDK.
- Users of the Adobe AIR [removed] SDK & Compiler and earlier versions should update to the Adobe AIR [removed] SDK & Compiler.
- Users of Adobe AIR [removed] and earlier versions for Android should update to Adobe AIR 14.0.0.179…
Reader/Acrobat 11.0.08 released
- https://helpx.adobe.com/security/products/reader/apsb14-19.html
Aug 12, 2014
CVE numbers: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0546 - 10.0 (HIGH)
Platform: Windows
Summary: Adobe has released security updates for Adobe Reader and Acrobat XI (11.0.07) and earlier versions for Windows. These updates address a vulnerability that could allow an attacker to circumvent sandbox protection on the Windows platform. Adobe Reader and Acrobat for Apple's OS X are not affected. Adobe is aware of evidence that indicates an exploit in the wild is being used in limited, isolated attacks targeting Adobe Reader users on Windows. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Reader XI (11.0.07) and earlier versions for Windows should update to version 11.0.08.
- For users of Adobe Reader X (10.1.10) and earlier versions for Windows, who cannot update to version 11.0.08, Adobe has made available version 10.1.11.
- Users of Adobe Acrobat XI (11.0.07) and earlier versions for Windows should update to version 11.0.08.
- For users of Adobe Acrobat X (10.1.10) and earlier versions for Windows, who cannot update to version 11.0.08, Adobe has made available version 10.1.11… Solution: Reader, Acrobat: Users can utilize the product's update mechanism… Update checks can be manually activated by choosing Help > Check for Updates…
___
- http://www.securitytracker.com/id/1030712
CVE Reference: CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545
Aug 12 2014
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 14.0.0.145 and prior (Windows/Mac); 11.2.202.394 and prior (Linux) …
Impact: A remote user can create content that, when loaded by the target user, will bypass security features and execute arbitrary code on the target user's system…
- http://www.securitytracker.com/id/1030711
CVE Reference: CVE-2014-0546
Aug 12 2014
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 11.0.07 and prior …
Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system…
___
- https://atlas.arbor.net/briefs/index#1185576709 Extreme Severity
14 Aug 2014 Analysis: At least one security issue patched this month (CVE-2014-0546) has already been exploited in limited targeted attacks. The flaw, affecting Windows versions of Reader and Acrobat, is a sandbox bypass vulnerability that could allow an attacker to run native code with escalated privileges. [ https://securelist.com/blog/research/65577/cve-2014-0546-used-in-targeted-attacks-adobe-reader-update/ ] Meanwhile, the update for Flash Player is rated as 'critical' and should also be applied as soon as possible. According to a report on attack trends of the first half of 2014, Adobe Flash is the primary browser plugin targeted by zero-day attacks. [ http://www.bromium.com/sites/default/files/bromium-h1-2014-threat_report.pdf ] As Flash is required by many web sites, users can take advantage of the 'click to play' feature found in Chrome, Firefox, and Opera web browsers as a security measure.
Prenotification Security Advisory for Adobe Reader and Acrobat
- https://helpx.adobe.com/security/products/reader/apsb14-20.html
Sep 5, 2014: Clarified the affected versions of Reader and Acrobat for the Windows and Macintosh platforms.
Sep 8, 2014: Updated the expected release date from September 9, 2014 to the week of September 15, 2014. The release was -delayed- to address issues identified during regression testing.
Adobe Reader / Acrobat 11.0.09 released
- https://helpx.adobe.com/security/products/reader/apsb14-20.html
Sep 16, 2014
CVE Numbers: CVE-2014-0560, CVE-2014-0561, CVE-2014-0562, CVE-2014-0563, CVE-2014-0565, CVE-2014-0566, CVE-2014-0567, CVE-2014-0568
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Reader XI (11.0.08) and earlier versions should update to version 11.0.09.
- For users of Adobe Reader X (10.1.11) and earlier versions who cannot update to version 11.0.09, Adobe has made available version 10.1.12.
- Users of Adobe Acrobat XI (11.0.08) and earlier versions should update to version 11.0.09.
- For users of Adobe Acrobat X (10.1.11) and earlier versions, who cannot update to version 11.0.09, Adobe has made available version 10.1.12…
The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates…
___
- http://www.securitytracker.com/id/1030853
CVE Reference: CVE-2014-0560, CVE-2014-0561, CVE-2014-0562, CVE-2014-0563, CVE-2014-0565, CVE-2014-0566, CVE-2014-0567, CVE-2014-0568
Sep 16 2014
Impact: Denial of service via network, Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10.1.11 and prior; 11.0.08 and prior…
Solution: The vendor has issued a fix (10.1.12, 11.0.09).
___
<_<