-
Adobe Updates - 4.14.2015
FYI...
Flash v17.0.0.169 released
- https://helpx.adobe.com/security/pro...apsb15-06.html
April 14, 2015
CVE number: CVE-2015-0346, CVE-2015-0347, CVE-2015-0348, CVE-2015-0349, CVE-2015-0350, CVE-2015-0351, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0356, CVE-2015-0357, CVE-2015-0358, CVE-2015-0359, CVE-2015-0360, CVE-2015-3038, CVE-2015-3039, CVE-2015-3040, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043, CVE-2015-3044
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations to the latest versions:
- Users of the Adobe Flash Player desktop runtime for Windows and Macintosh should update to Adobe Flash Player 17.0.0.169.
- Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash Player 13.0.0.281.
- Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.457.
- Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, will automatically update to version 17.0.0.169 when available...
For IE:
- http://download.macromedia.com/get/f...7_active_x.exe
For Firefox and other Plugin-based browsers:
- http://download.macromedia.com/get/f..._17_plugin.exe
Flash test site: http://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1032105
CVE Reference: CVE-2015-0346, CVE-2015-0347, CVE-2015-0348, CVE-2015-0349, CVE-2015-0350, CVE-2015-0351, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355
Apr 14 2015
Impact: Disclosure of system information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 17.0.0.134 and prior, 13.0.0.277 and prior 13.x versions, 11.2.202.451 and prior 11.x versions...
Several memory corruption errors may occur [CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043].
Solution: The vendor has issued a fix (17.0.0.169, 13.0.0.281 ESR, 11.2.202.457 for Linux)...
- https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-3043 - 10.0 (HIGH)
Last revised: 04/15/2015 - "... as exploited in the wild in April 2015..."
___
Security Update: Hotfixes available for ColdFusion
- https://helpx.adobe.com/security/pro...apsb15-07.html
April 14, 2015
CVE numbers: CVE-2015-0345
Platform: All
Summary: Adobe has released security hotfixes for ColdFusion versions 11 and 10. These hotfixes address an input validation issue that could be used in a reflected cross-site scripting attack.
Affected software versions:
ColdFusion 11 and 10
Solution: Adobe recommends ColdFusion customers update their installation using the instructions provided in the relevant technote:
ColdFusion 11: http://helpx.adobe.com/coldfusion/kb...-update-5.html
ColdFusion 10: http://helpx.adobe.com/coldfusion/kb...update-16.html
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the ColdFusion 11 Lockdown Guide and ColdFusion 10 Lockdown Guide..."
- http://www.securitytracker.com/id/1032106
CVE Reference: CVE-2015-0345
Apr 14 2015
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10, 11
Solution: The vendor has issued hotfixes (10 Update 16, 11 Update 5)...
___
Security vulnerability in output of Adobe Flex ASdoc Tool
- https://helpx.adobe.com/security/pro...apsb15-08.html
April 14, 2015
CVE number: CVE-2015-1773
Platform: All Platforms
Summary: An important vulnerability has been identified in the JavaScript output of the ASDoc tool available in Adobe Flex 4.6 and earlier versions. This vulnerability could lead to reflected cross-site scripting. Adobe recommends users perform the actions referenced in the "Solutions" section below to remediate this vulnerability.
Affected software versions: Adobe Flex 4.6 and earlier versions
Solution: Adobe recommends users follow the steps below to remediate this issue:
- Download the index.html file available here:
> https://git-wip-us.apache.org/repos/.../heads/develop
- Apply any modifications to the existing index.html file (ex. update the page title)
- Deploy the results to the web site
- http://www.securitytracker.com/id/1032107
CVE Reference: CVE-2015-1773
Apr 14 2015
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information...
Version(s): 4.6 and prior...
Solution: The vendor has issued a fix...
:fear:
-
Prenotification - Security Updates for Adobe Reader and Acrobat
FYI...
- https://blogs.adobe.com/psirt/?p=1193
May 7, 2015
Prenotification Security Advisory for Adobe Reader
- https://helpx.adobe.com/security/pro...apsb15-10.html
May 7, 2015 - "Summary: Adobe is planning to release security updates on Tuesday, May 12, 2015 for Adobe Reader for Windows and Macintosh...
Affected software versions:
• Adobe Reader XI (11.0.10) and earlier 11.x versions
• Adobe Reader X (10.1.13) and earlier 10.x versions...
These updates address critical vulnerabilities in the software...
Prenotification Security Advisory for Adobe Acrobat
- https://helpx.adobe.com/security/pro...apsb15-10.html
May 7, 2015 - "Summary: Adobe is planning to release security updates on Tuesday, May 12, 2015 for Adobe Acrobat for Windows and Macintosh...
Affected software versions:
• Adobe Acrobat XI (11.0.10) and earlier versions
• Adobe Acrobat X (10.1.13) and earlier versions...
These updates address critical vulnerabilities in the software...
:fear::fear:
-
Adobe updates 5.12.2015
FYI...
Flash Player 17.0.0.188 released
- https://helpx.adobe.com/security/pro...apsb15-09.html
May 12, 2015
CVE number: CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of the Adobe Flash Player desktop runtime for Windows and Macintosh should update to Adobe Flash Player 17.0.0.188.
- Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash Player 13.0.0.289.
- Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.460.
- Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, will automatically update to version 17.0.0.188.
- Users of the Adobe AIR desktop runtime should update to version 17.0.0.172.
- Users of the Adobe AIR SDK and AIR SDK & Compiler should update to version 17.0.0.172...
For IE:
- http://download.macromedia.com/get/f...7_active_x.exe
For Firefox and other Plugin-based browsers:
- http://download.macromedia.com/get/f..._17_plugin.exe
Flash test site: http://www.adobe.com/software/flash/about/
AIR: http://get.adobe.com/air/
- http://www.securitytracker.com/id/1032285
CVE Reference: CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086
May 12 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 17.0.0.169 and prior; other versions affected...
Solution: The vendor has issued a fix (17.0.0.188; 13.0.0.289 ESR; 11.2.202.460 for Linux).
___
Adobe Reader 11.0.11 10.1.14, Acrobat 11.0.11 10.1.14 released
- https://helpx.adobe.com/security/pro...apsb15-10.html
May 12, 2015
CVE Numbers: CVE-2014-8452, CVE-2014-9160, CVE-2014-9161, CVE-2015-3046, CVE-2015-3047...
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of Adobe Reader XI (11.0.10) and earlier versions should update to version 11.0.11.
- Users of Adobe Reader X (10.1.13) and earlier versions should update to version 10.1.14.
- Users of Adobe Acrobat XI (11.0.10) and earlier versions should update to version 11.0.11.
- Users of Adobe Acrobat X (10.1.13) and earlier versions should update to version 10.1.14...
Solution: Adobe recommends users update their software installations by following the instructions below:
Adobe Reader: The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.
Adobe Reader users on Windows can find the appropriate update here:
- http://www.adobe.com/support/downloa...atform=Windows
Adobe Reader users on Macintosh can find the appropriate update here:
- http://www.adobe.com/support/downloa...form=Macintosh
Adobe Acrobat: The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.
Acrobat Standard and Pro users on Windows can find the appropriate update here:
- http://www.adobe.com/support/downloa...atform=Windows
Acrobat Pro users on Macintosh can find the appropriate update here:
- http://www.adobe.com/support/downloa...form=Macintosh
- http://www.securitytracker.com/id/1032284
CVE Reference: CVE-2014-9160, CVE-2014-9161, CVE-2015-3046, CVE-2015-3047, CVE-2015-3048, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3053, CVE-2015-3054, CVE-2015-3055, CVE-2015-3056, CVE-2015-3057, CVE-2015-3058, CVE-2015-3059, CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3070, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, CVE-2015-3074, CVE-2015-3075, CVE-2015-3076
May 12 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10.1.13 and prior 10.x versions, 11.0.10 and prior 11.x versions
Solution: The vendor has issued a fix (10.1.14, 11.0.11).
:fear::fear::fear:
-
Flash 18.0.0.160 released
FYI...
Flash 18.0.0.160 released
- https://helpx.adobe.com/security/pro...apsb15-11.html
June 9, 2015
CVE number: CVE-2015-3096, CVE-2015-3097, CVE-2015-3098, CVE-2015-3099, CVE-2015-3100, CVE-2015-3101, CVE-2015-3102, CVE-2015-3103, CVE-2015-3104, CVE-2015-3105, CVE-2015-3106, CVE-2015-3107, CVE-2015-3108
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:
- Users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh should update to Adobe Flash Player 18.0.0.160.
- Users of the Adobe Flash Player Extended Support Release for Windows and Macintosh should update to Adobe Flash Player 13.0.0.292. *
- Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.466.
- Adobe Flash Player installed with Google Chrome will automatically update to version 18.0.0.160 (Windows and Linux) and 18.0.0.161 (Macintosh).
- Adobe Flash Player installed with Internet Explorer on Windows 8.x will automatically update to version 18.0.0.160.
- Users of the Adobe AIR Desktop Runtime should update to version 18.0.0.143 (Macintosh) and 18.0.0.144 (Windows).
- Users of the Adobe AIR SDK and AIR SDK & Compiler should update to version 18.0.0.143 (Macintosh) and 18.0.0.144 (Windows).
- Users of Adobe AIR for Android should update to version 18.0.0.143...
For IE:
- http://download.macromedia.com/get/f...8_active_x.exe
For Firefox and other Plugin-based browsers:
- http://download.macromedia.com/get/f..._18_plugin.exe
Flash test site: http://www.adobe.com/software/flash/about/
AIR: http://get.adobe.com/air/
___
- http://www.securitytracker.com/id/1032519
CVE Reference: CVE-2015-3096, CVE-2015-3097, CVE-2015-3098, CVE-2015-3099, CVE-2015-3100, CVE-2015-3101, CVE-2015-3102, CVE-2015-3103, CVE-2015-3104, CVE-2015-3105, CVE-2015-3106, CVE-2015-3107, CVE-2015-3108
Jun 9 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 17.0.0.188 and prior...
Solution: The vendor has issued a fix (18.0.0.160 for Mac/Windows, 13.0.0.292 ESR, 11.2.202.466 for Linux).
:fear::fear:
-
Adobe Photoshop CC, Adobe Bridge CC updated
FYI...
Adobe Photoshop CC updated
- https://helpx.adobe.com/security/pro...apsb15-12.html
June 16, 2015
CVE number: CVE-2015-3109, CVE-2015-3110, CVE-2015-3111, CVE-2015-3112
Platform: Windows and Macintosh
Summary: Adobe has released an update for Photoshop CC for Windows and Macintosh. This update addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system.
Affected software versions
Adobe Photoshop CC 2014 (15.2.2) (2014.2.2) and earlier versions for Windows and Macintosh
Solution: Adobe recommends users update their software installation via the application's update mechanism by launching the application, navigating to the Help menu, and clicking "Updates". For more information, please reference this help page*:
* https://helpx.adobe.com/creative-clo...5-updates.html
Product Updated version Platform Priority rating
Adobe Photoshop CC 2015 16.0 (2015.0.0) Windows and Macintosh 3
These updates address a critical vulnerability in the software..."
- http://www.securitytracker.com/id/1032659
CVE Reference: CVE-2015-3109, CVE-2015-3110, CVE-2015-3111, CVE-2015-3112
Jun 19 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes...
Solution: The vendor has issued a fix (16.0 (2015.0.0)).
___
Adobe Bridge CC updated
- https://helpx.adobe.com/security/pro...apsb15-13.html
June 16, 2015
CVE number: CVE-2015-3110, CVE-2015-3111, CVE-2015-3112
Platform: Windows and Macintosh
Summary: Adobe has released an update for Adobe Bridge CC for Windows and Macintosh. This update addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system...
Solution: Adobe recommends users update their software installation via the application's update mechanism by launching the application, navigating to the Help menu and clicking "Updates". For more information, please reference the following help page*:
* https://helpx.adobe.com/creative-clo...5-updates.html
Creative Cloud desktop app displays an Update All button or Update buttons next to installed apps. Clicking Update or Update All installs the latest versions of apps on your computer..."
Product Updated version Platform Priority rating
Adobe Bridge CC 6.1.1 Windows and Macintosh 3
These updates address a critical vulnerability in the software.
- http://www.securitytracker.com/id/1032658
CVE Reference: CVE-2015-3110, CVE-2015-3111, CVE-2015-3112
Jun 19 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes...
Solution: The vendor has issued a fix (6.1.1).
:fear::fear:
-
Flash 18.0.0.194 released
FYI...
Flash 18.0.0.194 released
- https://helpx.adobe.com/security/pro...apsb15-14.html
June 23, 2015
CVE number: https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-3113 / 10.0 (HIGH)
Last revised: 06/24/2015 - "... as exploited in the wild in June 2015."
Platform: Windows, Macintosh and Linux
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address a critical vulnerability (CVE-2015-3113) that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-3113 is being actively exploited in the wild via limited, targeted attacks. Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets.
Adobe recommends users update their product installations to the latest versions:
- Users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh should update to Adobe Flash Player 18.0.0.194.
- Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash Player 13.0.0.296.
- Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.468.
- Adobe Flash Player installed with Google Chrome and Adobe Flash Player installed with Internet Explorer on Windows 8.x will automatically update to version 18.0.0.194...
For IEv9:
- https://download.macromedia.com/get/...8_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._18_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
___
- https://community.qualys.com/blogs/l...or-adobe-flash
Jun 23, 2015 - "Adobe came out today with an out-of-band patch (APSB15-14) for their Flash Player, the fifth time that Flash has required an out-of-band fix for a 0-day. FireEye* had notified them of a critical vulnerability (CVE-2015-3113) that they discovered in use in Asia. They believe it was developed by the group called APT3 and used in targeted attacks against a number of industries. The vulnerability lies in the video decoding part of Flash and the exploit shows some signs of sophistication by introducing new techniques in their use of ROP. Patch as quickly as possible. 0-days once discovered this way tend to spread quickly to other cyber criminal groups. Adobe mentions that all known targets seem to use Windows 7 and Internet Explorer and Firefox on Windows XP... Users of IE10/11 and Google Chrome will get their patches through their browsers directly, everybody else will need to download directly from Adobe."
* https://www.fireeye.com/blog/threat-...-zero-day.html
June 23, 2015
- http://www.securitytracker.com/id/1032696
CVE Reference: https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-3113
Jun 23 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 18.0.0.161 and prior...
FireEye reported this vulnerability.
Impact: A remote user can create Flash content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (18.0.0.194; ESR 13.0.0.296; 11.2.202.468 for Linux)...
:fear::fear:
-
Flash Player Security Advisory - 2015.7.7
FYI...
Flash Player Security Advisory
- https://helpx.adobe.com/security/pro...apsa15-03.html
July 7, 2015
CVE number: CVE-2015-5119
Platform: Windows, Macintosh and Linux
Summary: A critical vulnerability (CVE-2015-5119) has been identified in Adobe Flash Player 18.0.0.194 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of reports that an exploit targeting this vulnerability has been published publicly. Adobe expects to make updates available on July 8, 2015.
Affected software versions:
- Adobe Flash Player 18.0.0.194 and earlier versions for Windows and Macintosh
- Adobe Flash Player Extended Support Release version 13.0.0.296 and earlier 13.x versions for Windows and Macintosh
- Adobe Flash Player 11.2.202.468 and earlier 11.x versions for Linux..."
___
Flash 0-day - Use-After-Free Vuln
- https://www.us-cert.gov/ncas/current...-Vulnerability
July 07, 2015
___
- http://arstechnica.com/security/2015...into-the-wild/
Jul 7, 2015 - "... Until a fix is installed, readers should consider -disabling- Flash, particularly when browsing websites they are unfamiliar with..."
Flash 0-Day Integrated Into Exploit Kits
- http://blog.trendmicro.com/trendlabs...-exploit-kits/
July 7, 2015 - "... one of the payloads being spread in this manner as CryptoWall 3.0, particularly by the Angler exploit kit..."
:fear::fear:
-
Flash 18.0.0.203 released
FYI...
Flash 18.0.0.203 released
- https://helpx.adobe.com/security/pro...apsb15-16.html
July 8, 2015
CVE number: CVE-2014-0578, CVE-2015-3097, CVE-2015-3114, CVE-2015-3115, CVE-2015-3116, CVE-2015-3117, CVE-2015-3118, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-3123, CVE-2015-3124, CVE-2015-3125, CVE-2015-3126, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3130, CVE-2015-3131, CVE-2015-3132, CVE-2015-3133, CVE-2015-3134, CVE-2015-3135, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4429, CVE-2015-4430, CVE-2015-4431, CVE-2015-4432, CVE-2015-4433, CVE-2015-5116, CVE-2015-5117, CVE-2015-5118, CVE-2015-5119
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 18.0.0.203 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release... update to version 13.0.0.302 by visiting:
> http://helpx.adobe.com/flash-player/...-versions.html
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.481 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 18.0.0.203 on Windows and Macintosh, and Flash Player 18.0.0.204 on Linux.
- Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 18.0.0.203...
For IEv9 and below:
- https://download.macromedia.com/get/...8_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._18_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
- https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-5119
Last revised: 07/10/2015 - "... as exploited in the wild in July 2015."
10.0 (HIGH)
___
- http://www.securitytracker.com/id/1032809
CVE Reference: CVE-2015-5119
Jul 8 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 18.0.0.194 and prior; ESR 13.0.0.296 and prior; 11.2.202.468 and prior 11.x versions for Linux...
Solution: The vendor has issued a fix (18.0.0.203, ESR 13.0.0.302, 11.2.202.481 for Linux).
- http://www.securitytracker.com/id/1032810
CVE Reference: CVE-2014-0578, CVE-2015-3097, CVE-2015-3114, CVE-2015-3115, CVE-2015-3116, CVE-2015-3117, CVE-2015-3118, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-3123, CVE-2015-3124, CVE-2015-3125, CVE-2015-3126, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3130, CVE-2015-3131, CVE-2015-3132, CVE-2015-3133, CVE-2015-3134, CVE-2015-3135, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4429, CVE-2015-4430, CVE-2015-4431, CVE-2015-4432, CVE-2015-4433, CVE-2015-5116, CVE-2015-5117, CVE-2015-5118
Jul 8 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 18.0.0.194 and prior; ESR 13.0.0.296 and prior; 11.2.202.468 and prior 11.x versions for Linux...
Solution: The vendor has issued a fix (18.0.0.203, ESR 13.0.0.302, 11.2.202.481 for Linux).
:fear::fear:
-
Flash, Shockwave, Acrobat, Reader - Critical updates released
FYI...
Flash 18.0.0.209 released
- https://helpx.adobe.com/security/pro...apsb15-18.html
July 14, 2015
CVE number: CVE-2015-5122, CVE-2015-5123
Platform: Windows, Macintosh and Linux
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 18.0.0.209 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release... update to version 13.0.0.305 by visiting http://helpx.adobe.com/flash-player/...-versions.html
- Adobe will provide an update for Flash Player for Linux during the week of July 12. The update will be available by visiting the Adobe Flash Player Download Center. Please continue to monitor the PSIRT blog for updates.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 18.0.0.209 on Windows, Macintosh and Linux.
- Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 18.0.0.209...
For IEv9 and below:
- https://download.macromedia.com/get/...8_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._18_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR: http://get.adobe.com/air/
> http://googleprojectzero.blogspot.co...ations_16.html
July 16, 2015
> http://blog.trendmicro.com/trendlabs...n-the-browser/
July 30, 2015
- http://www.securitytracker.com/id/1032890
CVE Reference: CVE-2015-5122, CVE-2015-5123
Jul 14 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes ...
Solution: The vendor has issued a fix (18.0.0.209, ESR 13.0.0.305 Windows/Mac).
___
Shockwave 12.1.9.159 released
- https://helpx.adobe.com/security/pro...apsb15-17.html
July 14, 2015
CVE number: CVE-2015-5120, CVE-2015-5121
Platform: Windows and Macintosh
Summary: Adobe has released a security update for Adobe Shockwave Player for Windows and Macintosh. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system.
- Adobe recommends users of Adobe Shockwave Player 12.1.8.158 and earlier versions for Windows and Macintosh update to Adobe Shockwave Player 12.1.9.159 by visiting the Adobe Shockwave Player Download Center*.
* https://get.adobe.com/shockwave/
- http://www.securitytracker.com/id/1032891
CVE Reference: CVE-2015-5120, CVE-2015-5121
Jul 14 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 12.1.8.158 and prior...
Solution: The vendor has issued a fix (12.1.9.159).
___
Adobe Acrobat/Reader 11.0.12/10.1.15 released
- https://helpx.adobe.com/security/pro...apsb15-15.html
July 14, 2015
CVE numbers: CVE-2014-0566, CVE-2014-8450, CVE-2015-3095, CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4443, CVE-2015-4444, CVE-2015-4445, CVE-2015-4446, CVE-2015-4447, CVE-2015-4448, CVE-2015-4449, CVE-2015-4450, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, CVE-2015-5086, CVE-2015-5087, CVE-2015-5088, CVE-2015-5089, CVE-2015-5090, CVE-2015-5091, CVE-2015-5092, CVE-2015-5093, CVE-2015-5094, CVE-2015-5095, CVE-2015-5096, CVE-2015-5097, CVE-2015-5098, CVE-2015-5099, CVE-2015-5100, CVE-2015-5101, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, CVE-2015-5105, CVE-2015-5106, CVE-2015-5107, CVE-2015-5108, CVE-2015-5109, CVE-2015-5110, CVE-2015-5111, CVE-2015-5113, CVE-2015-5114, CVE-2015-5115
Platforms: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations to the latest versions via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center:
> https://get.adobe.com/reader/
Acrobat Updates/Programs: https://www.adobe.com/support/downlo...atform=Windows
Reader Updates/Programs: https://www.adobe.com/support/downlo...atform=Windows
- http://www.securitytracker.com/id/1032892
CVE Reference: CVE-2014-0566, CVE-2014-8450, CVE-2015-3095, CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4443, CVE-2015-4444, CVE-2015-4445, CVE-2015-4446, CVE-2015-4447, CVE-2015-4448, CVE-2015-4449, CVE-2015-4450, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, CVE-2015-5086, CVE-2015-5087, CVE-2015-5088, CVE-2015-5089, CVE-2015-5090, CVE-2015-5091, CVE-2015-5092, CVE-2015-5093, CVE-2015-5094, CVE-2015-5095, CVE-2015-5096, CVE-2015-5097, CVE-2015-5098, CVE-2015-5099, CVE-2015-5100, CVE-2015-5101, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, CVE-2015-5105, CVE-2015-5106, CVE-2015-5107, CVE-2015-5108, CVE-2015-5109, CVE-2015-5110, CVE-2015-5111, CVE-2015-5113, CVE-2015-5114, CVE-2015-5115
Jul 14 2015
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10.1.14 and prior; 11.0.11 and prior...
Solution: The vendor has issued a fix (10.1.15, 11.0.12, DC 2015.008.20082).
:fear::fear:
-
Flash 18.0.0.232 released
FYI...
Flash 18.0.0.232 released
- https://helpx.adobe.com/security/pro...apsb15-19.html
Aug 11, 2015
APSB15-19
CVE number: CVE-2015-3107, CVE-2015-5124, CVE-2015-5125, CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe... recommends users update their installation to the newest version:
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 18.0.0.232 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release [2] update to version 18.0.0.232 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html.
- Adobe recommends users of the Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.508 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 18.0.0.232 on Windows and Macintosh, and version 18.0.0.233 for Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 18.0.0.232.
- Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.0 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 18.0.0.232.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 18.0.0.199 ...
2] https://blogs.adobe.com/flashplayer/...release-2.html
For IEv9 and below:
- https://download.macromedia.com/get/...8_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._18_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR: http://get.adobe.com/air/
Aug 12, 2015: Added a reference to CVE-2015-5565, a use-after-free issue similar to CVE-2015-3107. A fix for CVE-2015-3107 was introduced in APSB15-11, and has been strengthened in APSB15-19. Also, removed CVE-2015-5128, which was previously assessed to be a Type Confusion issue and has been re-classified as a non-exploitable crash due to a null pointer exception.
___
- http://www.securitytracker.com/id/1033235
CVE Reference: CVE-2015-5125, CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563
Aug 11 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 18.0.0.209 and prior...
Solution: The vendor has issued a fix (18.0.0.232, 11.2.202.508 for Linux)...
:fear:
-
Adobe Shockwave 12.2.0.162 released
FYI...
Adobe Shockwave 12.2.0.162 released
- https://helpx.adobe.com/security/pro...apsb15-22.html
Sep 8, 2015
CVE number: CVE-2015-6680, CVE-2015-6681
Platform: Windows
Summary: Adobe has released a security update for Adobe Shockwave Player. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of Adobe Shockwave Player 12.1.9.160 and earlier versions update to Adobe Shockwave Player 12.2.0.162 by visiting the Adobe Shockwave Player Download Center*...
* https://get.adobe.com/shockwave/
Vulnerability Details: This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2015-6680, CVE-2015-6681)...
___
- http://www.securitytracker.com/id/1033486
CVE Reference: CVE-2015-6680, CVE-2015-6681
Sep 8 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 12.1.9.160 and prior...
Solution: The vendor has issued a fix (12.2.0.162)...
:fear::fear:
-
Flash 19.0.0.185 released
FYI...
Flash 19.0.0.185 released
- https://helpx.adobe.com/security/pro...apsb15-23.html
Sep 21, 2015
CVE number: CVE-2015-5567, CVE-2015-5568, CVE-2015-5570, CVE-2015-5571, CVE-2015-5572, CVE-2015-5573, CVE-2015-5574, CVE-2015-5575, CVE-2015-5576, CVE-2015-5577, CVE-2015-5578, CVE-2015-5579, CVE-2015-5580, CVE-2015-5581, CVE-2015-5582, CVE-2015-5584, CVE-2015-5587, CVE-2015-5588, CVE-2015-6676, CVE-2015-6677, CVE-2015-6678, CVE-2015-6679, CVE-2015-6682
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 19.0.0.185 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release update to version 18.0.0.241 by visiting:
> http://helpx.adobe.com/flash-player/...-versions.html.
- Adobe recommends users of the Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.521 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 19.0.0.185 on Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.185.
- Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.0 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.185.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 19.0.0.190 by visiting the AIR download center or the AIR developer center.
Adobe recommends users of AIR for Android update to version 19.0.0.190 by visiting the Google Play Store...
For IEv9 and below:
- https://download.macromedia.com/get/...9_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._19_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR: http://get.adobe.com/air/
___
- http://www.securitytracker.com/id/1033629
CVE Reference: CVE-2015-5567, CVE-2015-5568, CVE-2015-5570, CVE-2015-5571, CVE-2015-5572, CVE-2015-5573, CVE-2015-5574, CVE-2015-5575, CVE-2015-5576, CVE-2015-5577, CVE-2015-5578, CVE-2015-5579, CVE-2015-5580, CVE-2015-5581, CVE-2015-5582, CVE-2015-5584, CVE-2015-5587, CVE-2015-5588, CVE-2015-6676, CVE-2015-6677, CVE-2015-6678, CVE-2015-6679, CVE-2015-6682
Sep 22 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 18.0.0.232 and prior...
Solution: The vendor has issued a fix (19.0.0.185 for Windows/Mac, 18.0.0.241 ESR for Windows/Mac, 11.2.202.521 for Linux).
:fear::fear:
-
Adobe PSIRT Advisory - Acrobat and Reader
FYI...
Prenotification Security Advisory for Adobe Acrobat and Reader
- https://helpx.adobe.com/security/pro...apsb15-24.html
Oct 8, 2015
Platform: Windows and Macintosh
Summary: Adobe is planning to release security updates on Tuesday, October 13, 2015 for Adobe Acrobat and Reader for Windows and Macintosh.
Users may monitor the latest information on the Adobe Product Security Incident Response Team (PSIRT) blog at https://blogs.adobe.com/psirt
(Note: This Security Advisory will be replaced with the Security Bulletin on October 13.)
:fear:
-
Flash 19.0.0.207, Acrobat/Reader 11.0.13/10.1.16 released
FYI...
>> https://helpx.adobe.com/security/pro...apsa15-05.html
Oct, 14, 2015 - "... A critical vulnerability (CVE-2015-7645) has been identified in Adobe Flash Player 19.0.0.207 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for this vulnerability is being used in limited, targeted attacks.
UPDATE: Adobe expects updates to be available as early as October 16."
___
Flash 19.0.0.207 released
- https://helpx.adobe.com/security/pro...apsb15-25.html
Oct 13, 2015
CVE number: CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631, CVE-2015-7632, CVE-2015-7633, CVE-2015-7634, CVE-2015-7643, CVE-2015-7644
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version...
Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 19.0.0.207 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted...
Adobe recommends users of the Adobe Flash Player Extended Support Release update to version 18.0.0.252 by visiting:
> http://helpx.adobe.com/flash-player/...-versions.html
Adobe recommends users of the Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.535 by visiting the Adobe Flash Player Download Center.
Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 19.0.0.207 on Windows, Macintosh, Linux and Chrome OS.
Adobe Flash Player installed with Microsoft Edge for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.207.
Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.0 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.207.
Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 19.0.0.213 by visiting the AIR download center or the AIR developer center...
For IEv9 and below:
- https://download.macromedia.com/get/...9_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._19_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR: http://get.adobe.com/air/
___
- http://www.securitytracker.com/id/1033797
CVE Reference: CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631, CVE-2015-7632, CVE-2015-7633, CVE-2015-7634, CVE-2015-7643, CVE-2015-7644
Oct 13 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 19.0.0.185 and prior ...
Solution: The vendor has issued a fix (18.0.0.252 ESR, 19.0.0.207 for Mac/Windows, 11.2.202.535 for Linux).
___
Adobe Acrobat/Reader 11.0.13/10.1.16 released
- https://helpx.adobe.com/security/pro...apsb15-24.html
Oct 13, 2015
CVE Numbers: CVE-2015-5583, CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6685, CVE-2015-6686, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-6692, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, CVE-2015-6696, CVE-2015-6697, CVE-2015-6698, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, CVE-2015-6704, CVE-2015-6705, CVE-2015-6706, CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7615, CVE-2015-7616, CVE-2015-7617, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, CVE-2015-7621, CVE-2015-7622, CVE-2015-7623, CVE-2015-7624
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below. The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat -Reader- installer can be downloaded from the Acrobat Reader Download Center:
> https://get.adobe.com/reader/
-or-
Windows/Mac: https://www.adobe.com/support/downloads/new.jsp
___
- http://www.securitytracker.com/id/1033796
CVE Reference: CVE-2015-5583, CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6685, CVE-2015-6686, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-6692, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, CVE-2015-6696, CVE-2015-6697, CVE-2015-6698, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, CVE-2015-6704, CVE-2015-6705, CVE-2015-6706, CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7615, CVE-2015-7616, CVE-2015-7617, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, CVE-2015-7621, CVE-2015-7622, CVE-2015-7623, CVE-2015-7624
Oct 13 2015
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10.1.15 and prior, 11.0.12 and prior ...
Solution: The vendor has issued a fix (10.1.16, 11.0.13)...
[-56- vulnerabilities]
:fear::fear:
-
Flash 19.0.0.226 released
FYI...
Flash 19.0.0.226 released
- https://helpx.adobe.com/security/pro...apsb15-27.html
Oct 16, 2015
CVE number: CVE-2015-7645, CVE-2015-7647, CVE-2015-7648
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-7645 is being used in limited, targeted attacks...
Solution: Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 19.0.0.226 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release update to version 18.0.0.255 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html.
- Adobe recommends users of the Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.540 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 19.0.0.226 on Windows, Macintosh and Linux, and 19.0.0.225 on Chrome OS.
- Adobe Flash Player installed with Microsoft Edge for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.226.
- Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.0 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.226...
For IEv9 and below:
- https://download.macromedia.com/get/...9_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._19_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
___
- http://www.securitytracker.com/id/1033850
CVE Reference: CVE-2015-7645, CVE-2015-7647, CVE-2015-7648
Oct 16 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 19.0.0.207 and prior...
Solution: The vendor has issued a fix (18.0.0.255 ESR, 19.0.0.226 for Windows and OS X, 11.2.202.540 for Linux.
:fear::fear:
-
Shockwave 12.2.1.171 released
FYI...
Shockwave 12.2.1.171 released
- https://helpx.adobe.com/security/pro...apsb15-26.html
Oct 27, 2015
CVE number: CVE-2015-7649
Platform: Windows and Macintosh
Summary: Adobe has released a security update for Adobe Shockwave Player. This update addresses a critical vulnerability that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of Adobe Shockwave Player 12.2.0.162 and earlier versions update to Adobe Shockwave Player 12.2.1.171 by visiting the Adobe Shockwave Player Download Center:
- https://get.adobe.com/shockwave/
Vulnerability Details: This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2015-7649)...
___
- http://www.securitytracker.com/id/1033990
CVE Reference: CVE-2015-7649
Oct 28 2015
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 12.2.0.162 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (12.2.1.171)...
:fear::fear:
-
Flash 19.0.0.245 released
FYI...
Flash 19.0.0.245 released
- https://helpx.adobe.com/security/pro...apsb15-28.html
Nov 10, 2015
CVE number: CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 19.0.0.245 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted....
- Adobe recommends users of the Adobe Flash Player Extended Support Release update to version 18.0.0.261 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html
- Adobe recommends users of the Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.548 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 19.0.0.245 on Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.245.
- Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.0 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 19.0.0.245.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 19.0.0.241 by visiting the AIR download center or the AIR developer center...
For IEv9 and below:
- https://download.macromedia.com/get/...9_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._19_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
Air 19.0.0.241: https://get.adobe.com/air/
___
- http://www.securitytracker.com/id/1034111
CVE Reference: CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046
Nov 10 2015
Impact: Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 19.0.0.226 and prior ...
Solution: The vendor has issued a fix (19.0.0.245 for Windows/Mac; 18.0.0.261 ESR; 11.2.202.548 for Linux).
:fear::fear:
-
ColdFusion - Hotfix available
FYI...
ColdFusion - Hotfix available
- https://helpx.adobe.com/security/pro...apsb15-29.html
Nov 17, 2015
CVE numbers: CVE-2015-8052, CVE-2015-8053, CVE-2015-5255
Platforms: All
Summary: Adobe has released a security hotfix for ColdFusion versions 11 and 10. This hotfix resolves two input validation issues that could be used in reflected cross-site scripting attacks. This hotfix also includes an updated version of BlazeDS that resolves an important Server-side request forgery vulnerability. Adobe recommends users apply the appropriate hotfix using the instructions provided in the "Solution" section...
Solution: Adobe recommends ColdFusion customers update their installation using the instructions provided in the relevant technote:
ColdFusion 11: http://helpx.adobe.com/coldfusion/kb...-update-7.html
ColdFusion 10: http://helpx.adobe.com/coldfusion/kb...update-18.html
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the ColdFusion 11 Lockdown Guide and ColdFusion 10 Lockdown Guide..."
LiveCycle Data Services
- https://helpx.adobe.com/security/pro...apsb15-30.html
Nov 17, 2015
> https://helpx.adobe.com/livecycle/kb...y-blazeDS.html
Adobe Premier Clip
- https://helpx.adobe.com/security/pro...apsb15-31.html
Nov 17, 2015
> https://itunes.apple.com/us/app/adob...ip/id919399401
___
- http://www.securitytracker.com/id/1034211
CVE Reference: CVE-2015-8052, CVE-2015-8053
Nov 20 2015
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10 Update 17 and prior, 11 Update 6 and prior ...
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Adobe ColdFusion software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution: The vendor has issued a fix (10 Update 18, 11 Update 7)...
___
- https://www.us-cert.gov/ncas/current...-Data-Services
Nov 17, 2015
:fear::fear:
-
Flash 20.0.0.228 / 20.0.0.235 released
FYI...
Flash 20.0.0.228 / 20.0.0.235 released
- https://helpx.adobe.com/security/pro...apsb15-32.html
Dec 8, 2015
CVE number: CVE-2015-8045, CVE-2015-8047, CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8051, CVE-2015-8052, CVE-2015-8053, CVE-2015-8054, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8060, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8407, CVE-2015-8408, CVE-2015-8409, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8415, CVE-2015-8416, CVE-2015-8417, CVE-2015-8419, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8438, CVE-2015-8439, CVE-2015-8440, CVE-2015-8441, CVE-2015-8442, CVE-2015-8443, CVE-2015-8444, CVE-2015-8445, CVE-2015-8446, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8451, CVE-2015-8452, CVE-2015-8453
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 20.0.0.228 (support for Internet Explorer) and 20.0.0.235 (support for Firefox and Safari) by visiting the Adobe Flash Player Download Center, or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.268 by visiting
> http://helpx.adobe.com/flash-player/...-versions.html
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.554 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 20.0.0.228 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.228.
- Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.228.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 20.0.0.204 by visiting the AIR download center or the AIR developer center.
- Please visit the Flash Player Help page for assistance in installing Flash Player...
For IEv9 and below:
- https://download.macromedia.com/get/...0_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._20_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR 20.0.0.204: https://get.adobe.com/air/
___
- http://www.securitytracker.com/id/1034318
CVE Reference: CVE-2015-8045, CVE-2015-8047, CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8051, CVE-2015-8052, CVE-2015-8053, CVE-2015-8054, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8060, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8407, CVE-2015-8408, CVE-2015-8409, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8415, CVE-2015-8416, CVE-2015-8417, CVE-2015-8419, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8438, CVE-2015-8439, CVE-2015-8440, CVE-2015-8441, CVE-2015-8442, CVE-2015-8443, CVE-2015-8444, CVE-2015-8445, CVE-2015-8446, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8451, CVE-2015-8452, CVE-2015-8453
Dec 8 2015
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (20.0.0.228 for Mac/Windows; 20.0.0.235 for Mac/Windows; ESR 18.0.0.268; 11.2.202.554 for Linux)...
:fear::fear:
-
Flash 20.0.0.267 released
FYI...
Flash 20.0.0.267 released
- https://helpx.adobe.com/security/pro...apsb16-01.html
Dec 28, 2015
CVE number: CVE-2015-8459, CVE-2015-8460, CVE-2015-8634, CVE-2015-8635, CVE-2015-8636, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8644, CVE-2015-8645, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650, CVE-2015-8651
Platform: All Platforms
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-8651* is being used in limited, targeted attacks...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 20.0.0.267 by visiting the Adobe Flash Player Download Center, or via the update mechanism within the product when prompted...
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.324 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.559 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 20.0.0.267 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.267.
- Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.267.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 20.0.0.233 by visiting the AIR download center or the AIR developer center...
* https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-8651
Last revised: 12/29/2015 - 9.3 (HIGH)
For IEv9 and below:
- https://download.macromedia.com/get/...0_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._20_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR 20.0.0.233: https://get.adobe.com/air/
- https://www.us-cert.gov/ncas/current...s-Flash-Player
Dec 28, 2015
___
- http://www.securitytracker.com/id/1034544
CVE Reference: CVE-2015-8459, CVE-2015-8460, CVE-2015-8634, CVE-2015-8635, CVE-2015-8636, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8644, CVE-2015-8645, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650, CVE-2015-8651
Dec 29 2015
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 20.0.0.235 and prior...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (20.0.0.267; ESR 18.0.0.324; 11.2.202.559 for Linux).
:fear::fear:
-
Adobe Acrobat/Reader 11.0.14 released
FYI...
Adobe Acrobat/Reader 11.0.14 released
- https://helpx.adobe.com/security/pro...apsb16-02.html
Jan 12, 2016
CVE numbers: CVE-2016-0931, CVE-2016-0932, CVE-2016-0933, CVE-2016-0934, CVE-2016-0935, CVE-2016-0936, CVE-2016-0937, CVE-2016-0938, CVE-2016-0939, CVE-2016-0940, CVE-2016-0941, CVE-2016-0942, CVE-2016-0943, CVE-2016-0944, CVE-2016-0945, CVE-2016-0946, CVE-2016-0947
Platform: Windows and Macintosh
Note: As outlined in this blog post*, Adobe Acrobat X and Adobe Reader X are no-longer-supported.
Adobe recommends users install Adobe Acrobat DC and Adobe Acrobat Reader DC for the latest features and security updates.
* https://blogs.adobe.com/documentclou...nd-of-support/
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below. The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically when updates are detected without requiring user intervention.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center**.
For IT administrators (managed environments):
- Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/ , or refer to the specific release note version for links to installers.
- Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on Macintosh, Apple Remote Desktop and SSH...
Acrobat for Windows: https://www.adobe.com/support/downlo...atform=Windows
1/12/2016
Adobe Reader for Windows: https://www.adobe.com/support/downlo...atform=Windows
1/12/2016
Acrobat for Macintosh: https://www.adobe.com/support/downlo...1&platform=Mac
1/12/2016
Adobe Reader for Macintosh: https://www.adobe.com/support/downlo...0&platform=Mac
1/12/2016
___
Also see "New Downloads":
- https://www.adobe.com/support/downloads/new.jsp
1/12/2016
Adobe Acrobat Reader DC
** https://get.adobe.com/reader/
___
- http://www.securitytracker.com/id/1034646
CVE Reference: CVE-2016-0931, CVE-2016-0932, CVE-2016-0933, CVE-2016-0934, CVE-2016-0935, CVE-2016-0936, CVE-2016-0937, CVE-2016-0938, CVE-2016-0939, CVE-2016-0940, CVE-2016-0941, CVE-2016-0942, CVE-2016-0943, CVE-2016-0944, CVE-2016-0945, CVE-2016-0946, CVE-2016-0947
Jan 12 2016
Fix Available: Yes Vendor Confirmed: Yes
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (11.0.14, 15.006.30119, 15.010.20056)...
:fear::fear:
-
Flash 20.0.0.306 released, Photoshop CC and Bridge CC, Experience Manager, Connect
FYI...
Flash 20.0.0.306 released
- https://helpx.adobe.com/security/pro...apsb16-04.html
Feb 9, 2016
CVE number: CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0971, CVE-2016-0972, CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, CVE-2016-0981, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984, CVE-2016-0985
Platform: Windows, Macintosh and Linux ...
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 20.0.0.306 via the update mechanism within the product when prompted... or by visiting the Adobe Flash Player Download Center.
Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.329 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html.
Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.569 by visiting the Adobe Flash Player Download Center.
Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 20.0.0.306 for Windows, Macintosh, Linux and Chrome OS.
Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.306.
Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 20.0.0.306.
Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 20.0.0.260 by visiting the AIR download center or the AIR developer center...
For IEv9 and below:
- https://download.macromedia.com/get/...0_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._20_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR 20.0.0.260: https://get.adobe.com/air/
- https://blog.qualys.com/laws-of-vuln...-february-2016
Feb 9, 2016 - "... The update for Adobe Flash (APSB16-04) contains fixes for -23- vulnerabilities, all of them rated as “critical”, i.e. capable of handing the attacker complete control over the target machine..."
- http://www.securitytracker.com/id/1034970
CVE Reference: CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0971, CVE-2016-0972, CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, CVE-2016-0981, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984, CVE-2016-0985
Feb 9 2016
Fix Available: Yes Vendor Confirmed: Yes ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (18.0.0.329, 20.0.0.306 for Windows and Mac; 11.2.202.569 for Linux)...
___
Adobe Photoshop CC and Bridge CC
- https://helpx.adobe.com/security/pro...apsb16-03.html
Feb 9, 2016
CVE number: CVE-2016-0951, CVE-2016-0952, CVE-2016-0953
Platform: Windows and Macintosh
Summary: Adobe has released updates for Photoshop CC and Bridge CC for Windows and Macintosh. These updates address critical security vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations via each application's update mechanism by launching each application, navigating to the Help menu, and clicking "Updates"...
Patches for Adobe Photoshop CC 2014 (15.2.4) are also available at the following locations:
Win (32-bit): https://www.adobe.com/support/downlo...jsp?ftpID=6015
Win (64-bit): https://www.adobe.com/support/downlo...jsp?ftpID=6016
Mac: https://www.adobe.com/support/downlo...jsp?ftpID=6017
Note: These updates will not show in the Applications & Updates section of the Creative Cloud Packager. Please download the patches directly from the links above, and use the option to “Add Offline Media” as described in the workflow documented here:
- https://helpx.adobe.com/creative-clo..._Offline_Media
___
Adobe Experience Manager
- https://helpx.adobe.com/security/pro...apsb16-05.html
Feb 9, 2016
CVE number: CVE-2016-0955, CVE-2016-0956, CVE-2016-0957, CVE-2016-0958
Platform: Windows, Unix, Linux and OS X
Summary: Adobe has released security hot fixes for Adobe Experience Manager. These hot fixes resolve important vulnerabilities that could potentially lead to information disclosure... customers should review and implement the steps outlined in the Security Checklists for versions 6.1, 6.0 or 5.6.1...
• Hot fix 8364 includes a Java deserialization issues mitigation agent (CVE-2016-0958).
> https://www.adobeaemcloud.com/conten...otfix-NPR-8364
• Hot fix 8651 resolves a cross-site scripting vulnerability that could lead to information disclosure (CVE-2016-0955).
> https://www.adobeaemcloud.com/conten....0-hotfix-8651
• Hot fix 6445 resolves an information disclosure vulnerability affecting Apache Sling Servlets Post 2.3.6 (CVE-2016-0956).
> https://www.adobeaemcloud.com/conten....0-hotfix-6445
• Dispatcher 4.1.5 and higher resolves a URL filter bypass vulnerability that could be used to circumvent dispatcher rules (CVE-2016-0957).
> https://docs.adobe.com/docs/en/dispatcher.html
...
___
Adobe Connect
- https://helpx.adobe.com/security/pro...apsb16-07.html
Feb 9, 2016
CVE number: CVE-2016-0948, CVE-2016-0949, CVE-2016-0950
Platform: Windows
Summary: Adobe has released a security update for Adobe Connect. This release resolves -important- input validation and content spoofing issues, and includes a feature to protect users from Cross-Site Request Forgery...
- https://helpx.adobe.com/adobe-connec...ase-notes.html
"... Adobe Connect 9.5.2 is a maintenance release and is available as a patch. It delivers fixes to a number of issues and includes a few improvements... Adobe Connect 9.5.2 will be rolled out in phases:
- On-premise: Adobe Connect 9.5.2 installer for customer on-premise deployments (all supported locales): Feb 11th, 2016
- Hosted: Adobe Connect 9.5.2 service hosted by Adobe: Starting Feb 7th, 2016
- Managed Services: Adobe managed customer specific cloud deployment of Adobe Connect: Update scheduled based on customer requirement. Please reach out to your Adobe Connect managed services representative to schedule your update..."
:fear::fear:
-
Acrobat/Reader 11.0.15, Digital Editions 4.5.1 released
FYI...
Acrobat/Reader 11.0.15 released
- https://helpx.adobe.com/security/pro...apsb16-09.html
March 8, 2016
CVE Numbers: CVE-2016-1007, CVE-2016-1008, CVE-2016-1009
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center:
> http://get.adobe.com/reader
Acrobat Reader DC Version 2015.010.20060
For IT administrators (managed environments):
- Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/ ... or refer to the specific release note version for links to installers.
- Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on Macintosh, Apple Remote Desktop and SSH.
> https://www.adobe.com/support/downloads/new.jsp
Adobe Acrobat 11.0.15
Adobe Reader 11.0.15
3/8/2016
- http://www.securitytracker.com/id/1035199
CVE Reference: CVE-2016-1007, CVE-2016-1008, CVE-2016-1009
Mar 8 2016
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (11.0.15, 15.006.30121, 15.010.20060)...
___
Adobe Digital Editions 4.5.1 released
- https://helpx.adobe.com/security/pro...apsb16-06.html
March 8, 2016
CVE Numbers: CVE-2016-0954
Platform: Windows, Macintosh, iOS and Android
Summary: Adobe has released a security update for Adobe Digital Editions 4.5.0 and earlier versions. This update resolves a critical memory corruption vulnerability that could lead to code execution...
Customers using Adobe Digital Editions 4.5.0 on Windows can download the update from the Adobe Digital Editions download page:
> https://www.adobe.com/solutions/eboo.../download.html
.. or utilize the product’s update mechanism when prompted. Customers using Digital Editions for iOS and Android can download the update from the respective app store.
For more information, please reference the release notes:
> http://www.adobe.com/solutions/ebook...ase-notes.html
- http://www.securitytracker.com/id/1035199
CVE Reference: CVE-2016-1007, CVE-2016-1008, CVE-2016-1009
Mar 8 2016
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (11.0.15, 15.006.30121, 15.010.20060)...
___
Known issues | Acrobat DC, Reader DC
- https://helpx.adobe.com/acrobat/kb/k...dc-reader.html
___
- http://krebsonsecurity.com/2016/03/a...tical-updates/
8 Mar 2016 - "... Adobe spokesperson: the company will be issuing a Flash Player update on Thursday morning."
:fear::fear:
-
Flash 21.0.0.182 released
FYI...
Flash 21.0.0.182 released
- https://helpx.adobe.com/security/pro...apsb16-08.html
March 10, 2016
CVE number: CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-1000, CVE-2016-1001, CVE-2016-1005, CVE-2016-1010
Platform: Windows, Macintosh and Linux
Summary: Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-1010 is being used in limited, targeted attacks...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 21.0.0.182 via the update mechanism within the product when prompted.. or by visiting the Adobe Flash Player Download Center.
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.333 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html.
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.577 by visiting the - Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 21.0.0.182 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.182.
- Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.182.
- Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 21.0.0.176 by visiting the AIR download center or the AIR developer center...
For IEv9 and below:
- https://download.macromedia.com/get/...1_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._21_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
AIR 21.0.0.176: https://get.adobe.com/air/
___
- http://www.securitytracker.com/id/1035251
CVE Reference: CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010
Mar 11 2016
Fix Available: Yes Vendor Confirmed: Yes
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (ESR 18.0.0.333; 21.0.0.182; 11.2.202.577 for Linux)...
___
Installation problems | Flash Player | Windows 7 and earlier
- https://helpx.adobe.com/flash-player...r-windows.html
:fear::fear:
-
Flash Player - CVE-2016-1019
FYI...
Flash Player - CVE-2016-1019
- https://helpx.adobe.com/security/pro...apsa16-01.html
April 5, 2016
CVE number: CVE-2016-1019
Platforms: Windows, Macintosh, Linux and Chrome OS
Summary: "A critical vulnerability (CVE-2016-1019) exists in Adobe Flash Player 21.0.0.197 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 7 and Windows XP with Flash Player version -20.0.0.306- and earlier. A mitigation introduced in Flash Player 21.0.0.182 currently -prevents- exploitation of this vulnerability, protecting users running Flash Player 21.0.0.182 and later. Adobe is planning to provide a security update to address this vulnerability as early as April 7..."
> https://blogs.adobe.com/psirt/?p=1330
April 5, 2016 - "... critical vulnerability (CVE-2016-1019) in Adobe Flash Player. UPDATE: Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 7 and Windows XP Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier..."
:fear::fear:
-
Flash 21.0.0.213 released
FYI...
Flash 21.0.0.213 released
- https://helpx.adobe.com/security/pro...apsb16-10.html
Apr 7, 2016
CVE number: CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033
Platform: Windows, Macintosh, Linux and ChromeOS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 21.0.0.213 via the update mechanism within the product when prompted.. or by visiting the Adobe Flash Player Download Center.
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.343 by visiting:
- http://helpx.adobe.com/flash-player/...-versions.html.
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.616 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 21.0.0.213 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.213.
- Adobe Flash Player installed with Internet Explorer for Windows 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.213.
- Please visit the Flash Player Help page for assistance in installing Flash Player...
For I/E - some versions get 'Automatic' updates:
- https://download.macromedia.com/get/...1_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._21_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
___
- http://www.securitytracker.com/id/1035509
CVE Reference: CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033
Apr 8 2016
Version(s): prior to 21.0.0.213 ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (21.0.0.213; ESR 18.0.0.343; 11.2.202.616 for Linux)...
___
- https://www.us-cert.gov/ncas/current...s-Flash-Player
April 08, 2016
Flash 0day (CVE-2016-1019) in the Wild; Exploit Kits Delivering Ransomware
- https://atlas.arbor.net/briefs/index#-169418222
Elevated Severity
April 07, 2016 21:52
- https://web.nvd.nist.gov/view/vuln/d...=CVE-2016-1019
Last revised: 04/11/2016 - "... as exploited in the wild in April 2016."
10.0 HIGH
:fear::fear:
-
Creative Cloud 3.6.0.244, RoboHelp Svr hotfix, AIR 21.0.0.198
FYI...
Creative Cloud 3.6.0.244 released
- https://helpx.adobe.com/security/pro...apsb16-11.html
April 12, 2016
CVE number: CVE-2016-1034
Platform: Windows and Macintosh
Solution: Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:
Creative Cloud Desktop Application - 3.6.0.244 - Windows and Macintosh ...
Creative Cloud users can apply the update via the application's update mechanism. For more details, visit:
- https://www.adobe.com/creativecloud/desktop-app.html
For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages as described in the workflow documented here:
- https://helpx.adobe.com/creative-clo...-licenses.html
Refer to this help page* for more information on the Creative Cloud Packager.
* https://helpx.adobe.com/creative-cloud/packager.html
Vulnerability Details: This update resolves a vulnerability in the JavaScript API for Creative Cloud Libraries that could be abused to remotely read and write files on the client’s file system (CVE-2016-1034)...
___
Security hotfix available for RoboHelp Server
- https://helpx.adobe.com/security/pro...apsb16-12.html
April 12, 2016
CVE number: CVE-2016-1035
Platform: Windows
Solution: ... Please refer to the Knowledge Base article available here* for instructions to download and apply the hotfix.
* https://helpx.adobe.com/content/help...ity-issue.html
Vulnerability Details: This hotfix resolves a vulnerability in the handling of SQL queries that could lead to information disclosure (CVE-2016-1035)...
___
Security updates available for Adobe Flash Player
- https://helpx.adobe.com/security/pro...apsb16-10.html
Last updated: April 12, 2016: Updated to reflect the availability of AIR updates for the CVEs referenced in this bulletin.
Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 21.0.0.198 by visiting the AIR download center* or the AIR developer center**.
* AIR: 21.0.0.198: http://get.adobe.com/air/
** http://www.adobe.com/devnet/air/air-sdk-download.html
___
- https://www.us-cert.gov/ncas/current...op-Application
April 12, 2016
:fear::fear:
-
Flash Player Advisory, Acrobat/Reader updates released, ColdFusion Hotfixes available
FYI...
Flash Player Advisory
- https://helpx.adobe.com/security/pro...apsa16-02.html
May 10, 2016
CVE number: CVE-2016-4117
Platforms: Windows, Macintosh, Linux and Chrome OS
Summary: A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild. Adobe will address this vulnerability in our monthly security update, which will be available as early as May 12. For the latest information, users may monitor the Adobe Product Security Incident Response Team blog:
> http://blogs.adobe.com/psirt/
> https://web.nvd.nist.gov/view/vuln/d...=CVE-2016-4117
Last revised: 05/10/2016 - "... as exploited in the wild in May 2016."
___
Acrobat, Reader 2015.016.20039, 11.0.16 released
- https://helpx.adobe.com/security/pro...apsb16-14.html
May 10, 2016
CVE Numbers: CVE-2016-1037, CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1043, CVE-2016-1044, CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1062, CVE-2016-1063, CVE-2016-1064, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1075, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1079, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1087, CVE-2016-1088, CVE-2016-1090, CVE-2016-1092, CVE-2016-1093, CVE-2016-1094, CVE-2016-1095, CVE-2016-1112, CVE-2016-1116, CVE-2016-1117, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1121, CVE-2016-1122, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4091, CVE-2016-4092, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4102, CVE-2016-4103, CVE-2016-4104, CVE-2016-4105, CVE-2016-4106, CVE-2016-4107
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.
For IT administrators (managed environments):
- Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/ or refer to the specific release note version for links to installers.
- Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on Macintosh, Apple Remote Desktop and SSH...
Acrobat:
> https://www.adobe.com/support/downlo...atform=Windows
5/10/2016
Reader:
> https://www.adobe.com/support/downlo...atform=Windows
5/10/2016
___
Hotfixes available for ColdFusion
- https://helpx.adobe.com/security/pro...apsb16-16.html
May 10, 2016
CVE numbers: CVE-2016-1113, CVE-2016-1114, CVE-2016-1115
Platforms: All
Summary: Adobe has released security hotfixes for ColdFusion versions 10, 11 and the 2016 release. These hotfixes resolve an input validation issue (CVE-2016-1113), a host name verification problem with wild card certificates (CVE-2016-1115) and include an updated version of Apache Commons Collections library to mitigate java deserialization (CVE-2016-1114)...
Adobe recommends ColdFusion customers update their installation using the instructions provided in the relevant technote:
ColdFusion (2016 release): http://helpx.adobe.com/coldfusion/kb...-update-1.html
ColdFusion 11: http://helpx.adobe.com/coldfusion/kb...-update-8.html
ColdFusion 10: http://helpx.adobe.com/coldfusion/kb...update-19.html
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the respective Lockdown guide.
ColdFusion (2016 release) Lockdown guide
> http://wwwimages.adobe.com/content/d...down-guide.pdf
ColdFusion 11 Lockdown Guide
> http://www.adobe.com/content/dam/Ado...down-guide.pdf
ColdFusion 10 Lockdown Guide
> http://wwwimages.adobe.com/www.adobe...down-guide.pdf
:fear::fear::fear:
-
Flash 21.0.0.242 released
FYI...
Flash 21.0.0.242 released
- https://helpx.adobe.com/security/pro...apsb16-15.html
May 12, 2016
CVE number: CVE-2016-1096, CVE-2016-1097, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1101, CVE-2016-1102, CVE-2016-1103, CVE-2016-1104, CVE-2016-1105, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4109, CVE-2016-4110, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4116, CVE-2016-4117
Platform: Windows, Macintosh, Linux and ChromeOS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild...
Solution:
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 21.0.0.242 via the update mechanism within the product when prompted... or by visiting the Adobe Flash Player Download Center:
> http://www.adobe.com/go/getflash
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.352 by visiting:
> http://helpx.adobe.com/flash-player/...-versions.html
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.621 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 21.0.0.242 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 21.0.0.242.
- Adobe recommends users of the AIR desktop runtime, AIR SDK* and AIR SDK & Compiler update to version 21.0.0.215 by visiting the AIR download center or the AIR developer center.
- Please visit the Flash Player Help page for assistance in installing Flash Player:
> https://helpx.adobe.com/flash-player.html
* Air 21.0: https://get.adobe.com/air/
Revisions:
May 13, 2016: Modified the affected versions of Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 and 8.1 from 21.0.0.213 and earlier to 21.0.0.241 and earlier.
May 19, 2016: Added CVE-2016-4120 and CVE-2016-4121, which were resolved in this release but inadvertently -omitted- from the original release of the bulletin.
June 3, 2016: Added CVE-2016-4160, CVE-2016-4161, CVE-2016-4162 and CVE-2016-4163, which were resolved in this release but inadvertently -omitted- from the original release of the bulletin.
___
> https://web.nvd.nist.gov/view/vuln/d...=CVE-2016-4117
Last revised: 05/13/2016 - "... as exploited in the wild in May 2016."
CVSS v2 Base Score: 10.0 HIGH
CVSS v3 Base Score: 9.8 Critical
For I/E - some versions get 'Automatic' updates:
- https://download.macromedia.com/get/...1_active_x.exe
For Firefox and other Plugin-based browsers:
- https://download.macromedia.com/get/..._21_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
:fear::fear:
-
Adobe updates - 2016.06.14
FYI...
Flash Player CVE-2016-4171 ...
- https://helpx.adobe.com/security/pro...apsa16-03.html
June 14, 2016
CVE number: https://cve.mitre.org/cgi-bin/cvenam...=CVE-2016-4171
Platforms: Windows, Macintosh, Linux and Chrome OS
Summary: A critical vulnerability (CVE-2016-4171) exists in Adobe Flash Player 21.0.0.242 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-4171 exists in the wild, and is being used in limited, targeted attacks. Adobe will address this vulnerability in our monthly security update, which will be available as early as June 16..."
>> https://web.nvd.nist.gov/view/vuln/d...=CVE-2016-4171
Last revised: 06/16/2016 - "... vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016..."
___
ColdFusion Hotfixes available
* https://helpx.adobe.com/security/pro...apsb16-22.html
June 14, 2016
CVE number: CVE-2016-4159
Platforms: All
Summary: Adobe has released security hotfixes for ColdFusion versions 10, 11 and the 2016 release. These hotfixes resolve an input validation issue that could be used in reflected XSS (cross-site scripting) attacks (CVE-2016-4159). Adobe recommends that customers apply the appropriate hotfix using the instructions provided in the "Solution" section...
Solution: Adobe categorizes this hotfix with the following priority rating and recommends users update their installations to the newest versions...
Adobe recommends ColdFusion customers update their installation using the instructions provided in the relevant technote:
- ColdFusion (2016 release): http://helpx.adobe.com/coldfusion/kb...-update-2.html
- ColdFusion 11: http://helpx.adobe.com/coldfusion/kb...-update-9.html
- ColdFusion 10: http://helpx.adobe.com/coldfusion/kb...update-20.html
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the respective Lockdown guide..."
- http://www.securitytracker.com/id/1036098
CVE Reference: CVE-2016-4159
Jun 14 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10, 11, 2016 ...
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Adobe ColdFusion software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution: The vendor has issued a fix (ColdFusion 10 Update 20, ColdFusion 11 Update 9, ColdFusion (2016 release) Update 2)...
___
- https://blogs.adobe.com/psirt/?p=1361
"Adobe has published security bulletins for the Adobe DNG SDK (APSB16-19), Adobe Brackets (APSB16-20), Adobe Creative Cloud Desktop Application (APSB16-21) and ColdFusion (APSB16-22*). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the relevant bulletin..."
Adobe DNG SDK: https://helpx.adobe.com/security/pro...apsb16-19.html
Adobe Brackets: https://helpx.adobe.com/security/pro...apsb16-20.html
Adobe Creative Cloud Desktop Application:
- https://helpx.adobe.com/security/pro...apsb16-21.html
:fear::fear:
-
Flash 22.0.0.192, AIR 22.0.0.153 released
FYI...
Flash 22.0.0.192 released
- https://helpx.adobe.com/security/pro...apsb16-18.html
June 16, 2016
CVE number: CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171
Platform: Windows, Macintosh, Linux and ChromeOS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-4171 exists in the wild, and is being used in limited, targeted attacks...
Solution: ...
• Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 22.0.0.192 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center.
• Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.360 by visiting http://helpx.adobe.com/flash-player/...-versions.html.
• Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.626 by visiting the Adobe Flash Player Download Center.
• Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 22.0.0.192 for Windows, Macintosh, Linux and Chrome OS.
• Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 22.0.0.192.
• Please visit the Flash Player Help page for assistance in installing Flash Player.
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/ge...2_active_x.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/ge..._22_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
___
Adobe AIR 22.0.0.153 released
- https://helpx.adobe.com/security/pro...apsb16-23.html
June 16, 2016
CVE number: CVE-2016-4126
Platform: Windows
Summary: Adobe has released a security update for Adobe AIR for Windows. This update addresses a vulnerability in the directory search path used by the AIR installer that could potentially allow an attacker to take control of the affected system...
Solution: ...Adobe recommends users of the AIR desktop runtime, AIR SDK and AIR SDK & Compiler update to version 22.0.0.153 by visiting the AIR download center* or the AIR developer center**...
* http://get.adobe.com/air/
** http://www.adobe.com/devnet/air/air-sdk-download.html
:fear::fear::fear:
-
Flash 22.0.0.209 released, Acrobat/Reader updates
FYI...
Flash 22.0.0.209 released
- https://helpx.adobe.com/security/pro...apsb16-25.html
July 12, 2016
CVE number: CVE-2016-4172, CVE-2016-4173, CVE-2016-4174, CVE-2016-4175, CVE-2016-4176, CVE-2016-4177, CVE-2016-4178, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4222, CVE-2016-4223, CVE-2016-4224, CVE-2016-4225, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4232, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246, CVE-2016-4247, CVE-2016-4248, CVE-2016-4249
Platform: Windows, Macintosh, Linux and ChromeOS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version...
• Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 22.0.0.209 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center.
• Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.366 by visiting:
> http://helpx.adobe.com/flash-player/...-versions.html.
• Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.632 by visiting the Adobe Flash Player Download Center.
• Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 22.0.0.209 for Windows, Macintosh, Linux and Chrome OS.
• Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 22.0.0.209.
Please visit the Flash Player Help page for assistance in installing Flash Player.
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/ge...2_active_x.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/ge..._22_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1036280
CVE Reference: CVE-2016-4172, CVE-2016-4173, CVE-2016-4174, CVE-2016-4175, CVE-2016-4176, CVE-2016-4177, CVE-2016-4178, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4222, CVE-2016-4223, CVE-2016-4224, CVE-2016-4225, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4232, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246, CVE-2016-4247, CVE-2016-4248, CVE-2016-4249
Jul 12 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 22.0.0.192 and prior ...
Impact: A remote user can execute arbitrary code on the target system.
A remote user can bypass security controls on the target system.
A remote user can obtain potentially sensitive information on the target system.
Solution: The vendor has issued a fix (22.0.0.209, ESR 18.0.0.366); 11.2.202.632 for Linux...
___
Adobe Acrobat/Reader 11.0.17, 15.017.20050, 15.006.30198 updates
- https://helpx.adobe.com/security/pro...apsb16-26.html
Last Updated: July 12, 2016
CVE numbers: CVE-2016-4189, CVE-2016-4190, CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4209, CVE-2016-4210, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4215, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
[See: 'Affected Versions'...]
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center:
> http://get.adobe.com/reader ...
Acrobat for Windows: https://www.adobe.com/support/downlo...atform=Windows
7/12/2016
Acrobat for Macintosh: https://www.adobe.com/support/downlo...1&platform=Mac
7/12/2016
- http://www.securitytracker.com/id/1036281
CVE Reference: CVE-2016-4189, CVE-2016-4190, CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4209, CVE-2016-4210, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4215, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252
Jul 12 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 15.016.20045 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (11.0.17 ,15.006.30198, 15.017.20050)...
___
Adobe XMP Toolkit for Java
- https://helpx.adobe.com/security/pro...apsb16-24.html
July 12, 2016
CVE number: CVE-2016-4216
Platform: All
Summary: Adobe has released a security update for the Adobe XMP Toolkit for Java. This update resolves an important vulnerability that could lead to information disclosure (CVE-2016-4216)...
Solution: Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version by following the instructions below:
Adobe XMP Toolkit for Java - 5.1.3 - All
Adobe XMP toolkit for Java users can download the updated version via the following download page:
> http://www.adobe.com/devnet/xmp.html ...
Adobe expects the updated version to be available during the week of July 11, 2016..."
___
> https://www.us-cert.gov/ncas/current...curity-Updates
July 12, 2016
:fear::fear:
-
Adobe ColdFusion Hotfixes
FYI...
Security Update: Hotfixes available for ColdFusion
- https://helpx.adobe.com/security/pro...apsb16-30.html
Aug 30, 2016
CVE number: CVE-2016-4264
Platforms: All
Summary: Adobe has released security hotfixes for ColdFusion versions 10 and 11. These hotfixes resolve a critical vulnerability that could lead to information disclosure (CVE-2016-4264). Adobe recommends that customers apply the appropriate hotfix using the instructions provided in the "Solution" section below.
Affected Versions / Platform
ColdFusion 11 Update 9 and earlier versions All
ColdFusion 10 Update 20 and earlier versions All
Note: The ColdFusion 2016 release is not affected by CVE-2016-4264.
Solution: Adobe categorizes this hotfix with the following priority rating and recommends users update their installations to the newest versions:
Product Hotfix Version Platform Priority rating Availability
ColdFusion 11 Update 10 All 2 Tech note: http://helpx.adobe.com/coldfusion/kb...update-10.html
ColdFusion 10 Update 21 All 2 Tech note: https://helpx.adobe.com/coldfusion/k...update-21.html
Adobe recommends ColdFusion customers update their installation using the instructions provided in the relevant technote:
ColdFusion 11: http://helpx.adobe.com/coldfusion/kb...update-10.html
ColdFusion 10: http://helpx.adobe.com/coldfusion/kb...update-21.html
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the respective Lockdown guide...
Revisions:
Sep 1, 2016: As of September 1, Adobe is aware of publicly available proof-of-concept code, and we have modified the priority of these hotfixes from Priority 2 to Priority 1.
___
- http://www.securitytracker.com/id/1036708
CVE Reference: CVE-2016-4264
Aug 31 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 10 Update 20 and prior, 11 Update 9 and prior ...
Impact: A remote user can obtain potentially sensitive information on the target system.
Solution: The vendor has issued a fix (10 Update 21, 11 Update 10)...
___
- https://www.us-cert.gov/ncas/current...tes-ColdFusion
Aug 30, 2016
:fear:
-
Flash 23.0.0.162, AIR 23.0.0.257, Digital Editions 4.5.2 released
FYI...
Flash 23.0.0.162 released
- https://helpx.adobe.com/security/pro...apsb16-29.html
Sep 13, 2016
CVE number: CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932
Platform: Windows, Macintosh, Linux and ChromeOS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ...
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 23.0.0.162 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center.
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.375 by visiting: http://helpx.adobe.com/flash-player/...-versions.html
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.635 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 23.0.0.162 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 23.0.0.162.
- Please visit the Flash Player Help page for assistance in installing Flash Player.
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/ge...3_active_x.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/ge..._23_plugin.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1036791
CVE Reference: CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932
Sep 13 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 22.0.0.211 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can obtain potentially sensitive information on the target system.
Solution: The vendor has issued a fix (23.0.0.162, ESR 18.0.0.375; 11.2.202.635 for Linux)...
___
AIR 23.0.0.257 released
- https://helpx.adobe.com/security/pro...apsb16-31.html
Sep 13, 2016
CVE number: CVE-2016-6936
Platform: Windows and Macintosh
Summary: Adobe has released a security update for Adobe AIR SDK & Compiler. This update adds support for secure transmission of runtime analytics for AIR applications on Android. Developers are encouraged to recompile captive runtime bundles after applying this update... recommends users update their installation to the newest version:
Adobe Air SDK & Compiler 23.0.0.257 Windows ...
AIR v23.0: https://get.adobe.com/air/
AIR Developer Center: https://www.adobe.com/devnet/air/air-sdk-download.html
- http://www.securitytracker.com/id/1036792
CVE Reference: CVE-2016-6936
Sep 13 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 22.0.0.153 and prior ...
Impact: A remote user can obtain potentially runtime analytic information communicated by target Android-based systems.
Solution: The vendor has issued a fix (23.0.0.257)...
___
Adobe Digital Editions 4.5.2 released
- https://helpx.adobe.com/security/pro...apsb16-28.html
Sep 13, 2016
CVE numbers: CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, CVE-2016-4261, CVE-2016-4262, CVE-2016-4263
Platform: Windows, Macintosh, iOS and Android
Summary: Adobe has released a security update for Adobe Digital Editions for Windows, Macintosh, iOS and Android. This update resolves critical memory corruption vulnerabilities that could lead to code execution.
Solution: Adobe categorizes this update with the following priority ratings and recommends users update their installation to the newest version:
Adobe Digital Editions 4.5.2
Windows: https://www.adobe.com/solutions/eboo.../download.html
Macintosh: https://www.adobe.com/solutions/eboo.../download.html
iOS: iTunes: https://itunes.apple.com/us/app/adob...952977781?mt=8
Playstore: https://play.google.com/store/apps/d...igitaleditions
- http://www.securitytracker.com/id/1036793
CVE Reference: CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, CVE-2016-4261, CVE-2016-4262, CVE-2016-4263
Sep 13 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 4.5.1 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (4.5.2)...
___
- https://www.us-cert.gov/ncas/current...curity-Updates
Sep 13, 2016
:fear::fear:
-
Adobe updates 2016.10.11
FYI...
Flash 23.0.0.185 released
- https://helpx.adobe.com/security/pro...apsb16-32.html
Oct 11, 2016
CVE number: CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992
Platform: Windows, Macintosh, Linux and ChromeOS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 23.0.0.185 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center.
- Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.382 by visiting http://helpx.adobe.com/flash-player/...-versions.html.
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.637 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 23.0.0.185 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer 11 for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 23.0.0.185.
- Please visit the Flash Player Help page for assistance in installing Flash Player:
- https://helpx.adobe.com/flash-player.html
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted.
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/pu..._player_ax.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/pu...ash_player.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1036985
CVE Reference: CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992
Oct 11 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 23.0.0.162 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (23.0.0.185; ESR 18.0.0.382; 11.2.202.637 for Linux)...
___
Acrobat / Reader 15.020.20039 released
- https://helpx.adobe.com/security/pro...apsb16-33.html
Oct 11, 2016
CVE numbers: CVE-2016-1089, CVE-2016-1091, CVE-2016-6939, CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6947, CVE-2016-6948, CVE-2016-6949, CVE-2016-6950, CVE-2016-6951, CVE-2016-6952, CVE-2016-6953, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6957, CVE-2016-6958, CVE-2016-6959, CVE-2016-6960, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6966, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6970, CVE-2016-6971, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6979, CVE-2016-6988, CVE-2016-6993, CVE-2016-6994, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-6999, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center:
> http://get.adobe.com/reader
For IT administrators (managed environments):
- Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/
or refer to the specific release note version for links to installers.
- Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on Macintosh, Apple Remote Desktop and SSH.
>> https://www.adobe.com/support/downloads/new.jsp
Acrobat for Windows: https://www.adobe.com/support/downlo...atform=Windows
Adobe Reader for Windows: https://www.adobe.com/support/downlo...atform=Windows
___
Creative Cloud 3.8.0.310 released
- https://helpx.adobe.com/security/pro...apsb16-34.html
Oct 11, 2016
CVE number: CVE-2016-6935
Platform: Windows
Summary: Adobe has released a security update for the Creative Cloud Desktop Application for Windows. This update resolves an unquoted search path vulnerability in the Creative Cloud Desktop Application...
Solution: Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:
Creative Cloud Desktop Application - Creative Cloud 3.8.0.310 - Windows
For more details, visit: https://www.adobe.com/creativecloud/desktop-app.html
For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages as described in the workflow documented here:
> https://helpx.adobe.com/creative-clo...-licenses.html
Refer to this help page* for more information on the Creative Cloud Packager.
* https://helpx.adobe.com/creative-cloud/packager.html
:fear::fear::fear:
-
Flash 23.0.0.205 released
FYI...
Flash 23.0.0.205 released
- https://helpx.adobe.com/security/pro...apsb16-36.html
Oct 26, 2016
CVE number: CVE-2016-7855
Platform: Windows, Macintosh, Linux and Chrome OS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address a critical vulnerability that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-7855 exists in the wild, and is being used in limited, targeted attacks against users running Windows versions 7, 8.1 and 10.
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 23.0.0.205 via the update mechanism within the product [1], or by visiting the Adobe Flash Player Download Center: http://www.adobe.com/go/getflash
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.643 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 23.0.0.205 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer 11 for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 23.0.0.205.
- Please visit the Flash Player Help page for assistance in installing Flash Player:
> https://helpx.adobe.com/flash-player.html
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted.
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/pu..._player_ax.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/pu...ash_player.exe
Flash test site: https://www.adobe.com/software/flash/about/
> The final release of the ESR occurred on October 11, 2016 and it is now discontinued.
___
- http://www.securitytracker.com/id/1037111
CVE Reference: https://cve.mitre.org/cgi-bin/cvenam...=CVE-2016-7855
Oct 26 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 23.0.0.185 and prior...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (23.0.0.205; 11.2.202.643 for Linux)...
___
- https://www.adobe.com/support/flashp...oads.html#fp15
10/26/2016 – Updated debugger and standalone versions of Flash Player. These versions contain fixes for critical vulnerabilities identified in Security Bulletin APSB 16-36. The latest versions are 23.0.0.205 (Win & Mac) and 11.2.202.643 (Linux). All users are encouraged to update to these latest versions.
:fear::fear::fear:
-
Flash 23.0.0.207, Connect 9.5.7 released
FYI...
Flash 23.0.0.207 released
- https://helpx.adobe.com/security/pro...apsb16-37.html
Nov 8, 2016
CVE number: CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864, CVE-2016-7865
Platform: Windows, Macintosh, Linux and Chrome OS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 23.0.0.207 via the update mechanism within the product [1] or by visiting the Adobe Flash Player Download Center: http://www.adobe.com/go/getflash
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.644 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 23.0.0.207 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer 11 for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 23.0.0.207.
-Please visit the Flash Player Help page* for assistance in installing Flash Player.
* https://helpx.adobe.com/flash-player.html
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/pu..._player_ax.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/pu...ash_player.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1037240
CVE Reference: CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864, CVE-2016-7865
Nov 8 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 23.0.0.205 and prior...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (23.0.0.207 for Windows and Mac, 11.2.202.644 for Linux)...
___
Adobe Connect 9.5.7 released
- https://helpx.adobe.com/security/pro...apsb16-35.html
Nov 8, 2016
CVE number: CVE-2016-7851
Platform: Windows
Summary: Adobe has released a security update for Adobe Connect for Windows. This update resolves an input validation vulnerability in the events registration module that could be used in cross-site scripting attacks. Adobe recommends users update their product installation using the instructions provided in the “Solution” Section below...
Solution: Adobe recommends customers update the Connect instance to the newest version by following the instructions below.
Note: This issue will be automatically resolved for Connect customers using Adobe's hosted services once the account is upgraded to Connect 9.5.7...
Release Notes: Adobe Connect 9.5.7 is a maintenance release and is available as a patch. It fixes several issues to make the user workflows smoother...
Adobe Connect Help: http://helpx.adobe.com/adobe-connect.html
Adobe Connect Support: http://www.adobe.com/support/connect...edsupport.html
- http://www.securitytracker.com/id/1037239
CVE Reference: CVE-2016-7851
Nov 8 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 9.5.6 and prior...
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Adobe Connect software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution: The vendor has issued a fix (9.5.7).
___
- https://www.us-cert.gov/ncas/current...curity-Updates
Nov 8, 2016
:fear::fear:
-
Adobe Updates - 2016.12.13
FYI...
Flash 24.0.0.186 released
- https://helpx.adobe.com/security/pro...apsb16-39.html
Dec 13, 2016
CVE number: CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892
Platform: Windows, Macintosh, Linux and Chrome OS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.
Adobe is aware of a report that an exploit for CVE-2016-7892 exists in the wild, and is being used in limited, targeted attacks against users running Internet Explorer (32-bit) on Windows...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 24.0.0.186 via the update mechanism within the product [1] or by visiting the Adobe Flash Player Download Center.
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 24.0.0.186 by visiting the Adobe Flash Player Download Center
- http://www.adobe.com/go/getflash
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 24.0.0.186 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer 11 for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 24.0.0.186.
- Please visit the Flash Player Help page for assistance in installing Flash Player:
> https://helpx.adobe.com/flash-player.html
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/pu..._player_ax.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/pu...ash_player.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1037442
CVE Reference: CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892
Dec 13 2016
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 23.0.0.207 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (24.0.0.186)...
___
Adobe Animate 16.0.0.112 realeased
- https://helpx.adobe.com/security/pro...apsb16-38.html
Dec 13, 2016
CVE number: CVE-2016-7866
Platform: Windows and Macintosh
Summary: Adobe has released a security update for Adobe Animate for Windows and Macintosh. This update resolves a critical memory corruption vulnerability...
> https://creative.adobe.com/products/download/animate
For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages. Refer to this help page for more information...
___
Adobe Experience Manager Forms
- https://helpx.adobe.com/security/pro...apsb16-40.html
Dec 13, 2016
CVE number: CVE-2016-6933, CVE-2016-6934
Platform: Windows, Linux, Solaris and AIX
Summary: Adobe has released security updates for Adobe Experience Manager (AEM) Forms on Windows, Linux, Solaris and AIX. These updates resolve two important input validation issues that could be used in cross-site scripting attacks...
Solution:... recommends customers with on premise deployments install the available updates referenced below with the help of Adobe Marketing Cloud Customer Care team:
> https://helpx.adobe.com/marketing-cl...t-support.html
___
Adobe DNG Converter 9.8
- https://helpx.adobe.com/security/pro...apsb16-41.html
Dec 13, 2016
CVE number: CVE-2016-7856
Platform: Windows and Macintosh
Summary: Adobe has released a security update for the Adobe DNG Converter for Windows and Macintosh. This update resolves a critical memory corruption vulnerability...
Solution: ... recommends users update their installation to the newest version...
For more information, please reference the release notes:
- https://blogs.adobe.com/lightroomjou...available.html
___
Adobe Experience Manager
- https://helpx.adobe.com/security/pro...apsb16-42.html
Dec 13, 2016
CVE number: CVE-2016-7882, CVE-2016-7883, CVE-2016-7884, CVE-2016-7885
Platform: Windows, Unix, Linux and OS X
Summary: Adobe has released security updates for Adobe Experience Manager. These updates resolve three important input validation issues that could be used in cross-site scripting attacks (CVE-2016-7882, CVE-2016-7883 and CVE-2016-7884), and include an update to protect users from an important Cross-Site Request Forgery vulnerability (CVE-2016-7885)...
Solution: Adobe recommends customers with on-premise deployments install the available updates referenced below. Furthermore, customers should review and implement the steps outlined in the Security Checklists for versions 6.2, 6.1 or 6.0...
6.0: https://docs.adobe.com/docs/en/aem/6...checklist.html
6.1: https://docs.adobe.com/docs/en/aem/6...checklist.html
6.2: https://docs.adobe.com/docs/en/aem/6...checklist.html
___
Security updates available for InDesign
- https://helpx.adobe.com/security/pro...apsb16-43.html
Dec 13, 2016
CVE number: CVE-2016-7886
Platform: Windows and Macintosh
Summary: Adobe has released security updates for InDesign for Windows and Macintosh. These updates resolve a critical memory corruption vulnerability...
Solution: ... recommends users update their installation to the newest version:
InDesign 12.0.0 Windows and Macintosh:
Relase Notes: https://helpx.adobe.com/indesign/rel...n-cc-2017.html
InDesign Server 12.0.0 Windows and Macintosh
Release Notes: https://helpx.adobe.com/indesign/rel...ase-notes.html
___
ColdFusion Builder
- https://helpx.adobe.com/security/pro...apsb16-44.html
Dec 13, 2016
CVE number: CVE-2016-7887
Platforms: Windows, Linux and Macintosh
Summary: Adobe has released a security update for ColdFusion Builder for Windows, Linux, and Macintosh. This update resolves an important vulnerability that could lead to information disclosure (CVE-2016-7887)...
Solution: ... recommends users update their installations to the newest versions:
ColdFusion Builder 2016 Update 3 - Tech note:
> https://helpx.adobe.com/coldfusion/k...-update-3.html
ColdFusion Builder 3.0 3.0.3 Hotfix - Tech note:
> https://helpx.adobe.com/coldfusion/k...-3-update.html
___
Adobe Digital Editions 4.5.3
- https://helpx.adobe.com/security/pro...apsb16-45.html
Dec 13, 2016
CVE numbers: CVE-2016-7888, CVE-2016-7889
Platform: Windows, Macintosh and Android
Summary: Adobe has released a security update for Adobe Digital Editions for Windows, Macintosh and Android. This update resolves an important vulnerability that could result in a memory address leak, and an important XML parsing vulnerability that could lead to information disclosure...
Solution: Adobe categorizes this update with the following priority ratings and recommends users update their installation to the newest version 4.5.3 ...
Customers using Adobe Digital Editions 4.5.2 can download the update from the Adobe Digital Editions download page*, or utilize the product’s update mechanism when prompted.
* https://www.adobe.com/solutions/eboo.../download.html
For more information, please reference the release notes:
- http://www.adobe.com/solutions/ebook...ase-notes.html
___
Security update available for RoboHelp 2015.0.4
- https://helpx.adobe.com/security/pro...apsb16-46.html
Dec 13, 2016
CVE number: CVE-2016-7891
Platforms: Windows
Summary: Adobe has released a security update for RoboHelp for Windows. This update resolves an important input validation issue that could be used in cross-site scripting attacks...
Download: https://www.adobe.com/support/robohelp/downloads.html
Tech note: https://helpx.adobe.com/robohelp/kb/...erability.html
Release notes: https://www.adobe.com/robohelp/Adobe...0_1_ReadMe.pdf
KB article: https://helpx.adobe.com/robohelp/kb/...erability.html
:fear::fear::fear:
-
Adobe updates - 2017.01.10
FYI...
Adobe Flash 24.0.0.194 released
- https://helpx.adobe.com/security/pro...apsb17-02.html
Jan 10, 2017
CVE numbers: CVE-2017-2925, CVE-2017-2926, CVE-2017-2927, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931, CVE-2017-2932, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935, CVE-2017-2936, CVE-2017-2937, CVE-2017-2938
Platform: Windows, Macintosh, Linux and Chrome OS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows, Macintosh and Linux update to 24.0.0.194 via the update mechanism within the product [1] or by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 24.0.0.194 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer 11 for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 24.0.0.194.
- Please visit the Flash Player Help page for assistance in installing Flash Player:
> https://helpx.adobe.com/flash-player.html
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/pu..._player_ax.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/pu...ash_player.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1037570
CVE Reference: CVE-2017-2925, CVE-2017-2926, CVE-2017-2927, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931, CVE-2017-2932, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935, CVE-2017-2936, CVE-2017-2937, CVE-2017-2938
Jan 10 2017
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 24.0.0.186 and prior...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can obtain potentially sensitive information on the target system.
Solution: The vendor has issued a fix (24.0.0.194)...
___
Adobe Acrobat/Reader updates released
- https://helpx.adobe.com/security/pro...apsb17-01.html
Jan 10, 2017
CVE numbers: CVE-2017-2939, CVE-2017-2940, CVE-2017-2941, CVE-2017-2942, CVE-2017-2943, CVE-2017-2944, CVE-2017-2945, CVE-2017-2946, CVE-2017-2947, CVE-2017-2948, CVE-2017-2949, CVE-2017-2950, CVE-2017-2951, CVE-2017-2952, CVE-2017-2953, CVE-2017-2954, CVE-2017-2955, CVE-2017-2956, CVE-2017-2957, CVE-2017-2958, CVE-2017-2959, CVE-2017-2960, CVE-2017-2961, CVE-2017-2962, CVE-2017-2963, CVE-2017-2964, CVE-2017-2965, CVE-2017-2966, CVE-2017-2967
Platform: Windows and Macintosh
Summary: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: Adobe recommends users update their software installations to the latest versions by following the instructions below. The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center:
> http://get.adobe.com/reader
Updated Versions:
Acrobat DC/Reader DC: 15.023.20053
Acrobat DC Classic/Reader DC Classic: 15.006.30279
Acrobat XI Desktop/Reader XI Desktop: 11.0.19
Acrobat: https://www.adobe.com/support/downloads/new.jsp
Reader: https://www.adobe.com/support/downlo...atform=Windows
- http://www.securitytracker.com/id/1037574
CVE Reference: CVE-2016-6937, CVE-2017-2939, CVE-2017-2940, CVE-2017-2941, CVE-2017-2942, CVE-2017-2943, CVE-2017-2944, CVE-2017-2945, CVE-2017-2946, CVE-2017-2947, CVE-2017-2948, CVE-2017-2949, CVE-2017-2950, CVE-2017-2951, CVE-2017-2952, CVE-2017-2953, CVE-2017-2954, CVE-2017-2955, CVE-2017-2956, CVE-2017-2957, CVE-2017-2958, CVE-2017-2959, CVE-2017-2960, CVE-2017-2961, CVE-2017-2962, CVE-2017-2963, CVE-2017-2964, CVE-2017-2965, CVE-2017-2966, CVE-2017-2967
Jan 10 2017
Fix Available: Yes Vendor Confirmed: Yes
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass security controls on the target system.
Solution: The vendor has issued a fix (11.0.19, 15.006.30279)...
:fear::fear:
-
Adobe updates - 2017.02.14
FYI...
Flash 24.0.0.221 released
- https://helpx.adobe.com/security/pro...apsb17-04.html
Feb 14, 2017
CVE number: CVE-2017-2982,CVE-2017-2984, CVE-2017-2985, CVE-2017-2986, CVE-2017-2987, CVE-2017-2988,CVE-2017-2990, CVE-2017-2991, CVE-2017-2992, CVE-2017-2993, CVE-2017-2994, CVE-2017-2995, CVE-2017-2996
Platform: Windows, Macintosh, Linux and Chrome OS
Summary: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system...
Solution: ... Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows, Macintosh and Linux update to Adobe Flash Player 24.0.0.221 via the update mechanism within the product [1] or by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 24.0.0.221 for Windows, Macintosh, Linux and Chrome OS.
- Adobe Flash Player installed with Microsoft Edge and Internet Explorer 11 for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 24.0.0.221.
- Please visit the Flash Player Help page for assistance in installing Flash Player.
[1] Users of Flash Player 11.2.x or later for Windows, or Flash Player 11.3.x or later for Macintosh, who have selected the option to 'Allow Adobe to install updates' will receive the update automatically. Users who do not have the 'Allow Adobe to install updates' option enabled can install the update via the update mechanism within the product when prompted...
For I/E - some versions get 'Automatic' updates:
- https://fpdownload.macromedia.com/pu..._player_ax.exe
For Firefox and other Plugin-based browsers:
- https://fpdownload.macromedia.com/pu...ash_player.exe
For Chrome:
- https://fpdownload.macromedia.com/pu...ayer_ppapi.exe
Flash test site: https://www.adobe.com/software/flash/about/
- http://www.securitytracker.com/id/1037815
CVE Reference: CVE-2017-2982, CVE-2017-2984, CVE-2017-2985, CVE-2017-2986, CVE-2017-2987, CVE-2017-2988, CVE-2017-2990, CVE-2017-2991, CVE-2017-2992, CVE-2017-2993, CVE-2017-2994, CVE-2017-2995, CVE-2017-2996
Feb 14 2017
Fix Available: Yes Vendor Confirmed: Yes ...
Version(s): 24.0.0.194 and prior ...
Impact: A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution: The vendor has issued a fix (24.0.0.221)...
___
Adobe Digital Editions 4.5.4 released
- https://helpx.adobe.com/security/pro...apsb17-05.html
Feb 14, 2017
CVE numbers: CVE-2017-2973, CVE-2017-2974, CVE-2017-2975, CVE-2017-2976, CVE-2017-2977, CVE-2017-2978, CVE-2017-2979, CVE-2017-2980, CVE-2017-2981
Platform: Windows, Macintosh and Android
Summary: Adobe has released a security update for Adobe Digital Editions for Windows, Macintosh and Android. This update resolves a critical heap buffer overflow vulnerability that could lead to code execution and important buffer overflow vulnerabilities that could lead to a memory leak...
Customers using Adobe Digital Editions 4.5.3 can download the update from the Adobe Digital Editions download page*, or utilize the product’s update mechanism when prompted.
* https://www.adobe.com/solutions/eboo.../download.html
For more information, please reference the release notes**."
** http://www.adobe.com/solutions/ebook...ase-notes.html
___
Adobe Campaign updates released
- https://helpx.adobe.com/security/pro...apsb17-06.html
Feb 14, 2017
CVE number: CVE-2017-2968, CVE-2017-2969
Platform: Windows and Linux
Summary: Adobe has released a security update for Adobe Campaign v6.11 for Windows and Linux. This update resolves a moderate security bypass affecting the Adobe Campaign client console. An authenticated user with access to the client console could upload and execute a malicious file, potentially resulting in read and write access to the system (CVE-2017-2968). This update also resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969)...
Solution: Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version...
Release Notes: https://docs.campaign.adobe.com/doc/...n/RN.html#8757
- Customers may refer to the FAQ* for instructions on downloading the latest build.
* https://docs.campaign.adobe.com/doc/...hangelog%29%3F
For customers with Adobe Campaign 16.4 Build 8724 and earlier, please refer to the documentation page** for instructions to resolve CVE-2017-2968 by restricting uploads by file type.
** http://docs.campaign.adobe.com/doc/A...loadable_files
Please refer to this documentation page*** for assistance in upgrading Adobe Campaign server, and this documentation page for assistance in upgrading the Client Console.
*** https://docs.campaign.adobe.com/doc/...t_console.html
:fear::fear::fear: