Adobe has released an out-of-band security update that fixes 19 'critical' vulnerabilities found in Flash Player.
On Monday, the United States Computer Emergency Readiness Team (US-CERT) issued an
alert advising users and administrators alike to refer to
Adobe Security Bulletin APSB16-01.
In that bulletin, Adobe provides some context on the reasoning behind its emergency fixes:
"Adobe has released security updates for Adobe Flash Player," the bulletin begins. "These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system."
The bulletin goes on to explain that the updates resolve one type confusion vulnerability, 13 use-after-free vulnerabilities, and four memory corruption vulnerabilities, all of which an attacker could exploit for the purposes of code execution.
A fix is also included for CVE-2015-8651, an integer overflow vulnerability which was
detected by Kai Wang and Hunter Gao of the Chinese telecommunication company Huawei's IT security department.
The bulletin states that the bug is currently being leveraged in "limited, targeted attacks".
According to SecurityWeek, these attacks are limited to spear phishing campaigns only.
Users can verify the version of Adobe Flash Player installed on their machines by visiting
Adobe's About Flash Player page. They can then download the newest version by clicking
here.
However, some leading voices in the security industry, including
Brian Krebs, recommend dumping Adobe Flash Player altogether. This advice is partially motivated by the fact that Adobe
patched 79 'critical' vulnerabilities in Flash Player earlier this month. With this newest round of updates taken into consideration, that means that Flash averaged some 6.1 bug fixes a week at 316 total vulnerabilities discovered for 2015,
writes Michael Horowitz of
Computerworld. That's nearly one reported flaw a day.
It might be in the interest of some users to remove Flash from their computers. But if keeping Flash Player installed is absolutely essential, please read this
article on tips explaining how you can minimize the risks of having Flash installed.
