Yesterday, Adobe announced a new version of Flash that includes fixes for several security holes in earlier versions. Anyone who uses Flash to view web-based video, which includes anyone who uses YouTube, should install the latest version of Flash as soon as possible.
The latest version of Flash for Windows is 11.5.502.110. Adobe also made available updates for older versions of Flash that address the same security vulnerabilities, but we recommend updating to the latest version.
A new version of Google Chrome, also announced yesterday, includes these security fixes. A similar patch for Internet Explorer 10 in Windows 8 was made available by Microsoft.
These updates resolve buffer overflow vulnerabilities that could lead to code execution, memory corruption vulnerabilities that could lead to code execution, and a security bypass vulnerability that could lead to code execution.
Those of you running Windows 8 already should head over to Microsoft Update and install a new out-of-cycle patch for Adobe Flash in Internet Explorer 10.
Released yesterday, version 11.4.402.287 addresses security, performance and stability issues in the previous versions of Flash. Users are encouraged to install the new Flash as soon as possible.
Note that at the time of this post, the Flash Player Update Announcement on Adobe’s site shows the wrong version in the first paragraph. It should show the new version as 11.4.402.287 but instead shows it as 11.4.402.278.
Updates for Internet Explorer 10 and Google Chrome, containing associated fixes for Adobe Flash, were also released yesterday.
Version 11.4.402.278 of Flash for Internet Explorer and other major Windows web browsers was released on September 18 with little or no fanfare. No release notes are yet available, so it’s unclear what changes were made in the new version. Additional information will be posted here as it becomes available.
About Flash Player.
Update 2012Sep22: A Security Advisory published yesterday by Microsoft announced the availability of a patch for Flash in Internet Explorer 10. A related post on the Microsoft Security Response Center blog explains how security updates for Flash in Internet Explorer will be handled in the future. Anyone using Internet Explorer 10 or Windows 8 should install the Flash update as soon as possible.
Update 2012Sep11: Given the negative reaction to Microsoft’s previous announcement that recent Flash vulnerabilities would not be fixed in Internet Explorer 10 until after Windows 8 is released, today’s announcement is perhaps not much of a surprise. Microsoft is now saying that the Flash holes in IE10 will be plugged much sooner than originally announced. However, there will still be an easily-exploited delay between the launch of Windows 8 and the point at which all Windows 8 systems are patched.
Recently, Google switched to an integrated version of Flash in the Chrome web browser. They did this to simplify the update process: Chrome users no longer have to worry about keeping their browser’s Flash plugin up to date.
Microsoft has apparently done something similar with Internet Explorer 10, which is included with Windows 8. Unfortunately, the recent Flash vulnerabilities were not addressed in Internet Explorer 10 when Windows 8 was finalized recently. Which means Windows 8 has at least two very serious security holes in its integrated web browser, out of the box.
Microsoft says that the Flash vulnerabilities in Windows 8’s IE10 will be fixed during the regular patch cycle, but it’s not known exactly when the updates will appear.
Nefarious hackers are no doubt preparing for a surge of new Windows 8 systems to appear on the Internet, all with these rather large holes, ready to exploit.
If you are using Windows 8 or plan to start using it soon, your options are:
- Stop using Internet Explorer. This isn’t really a viable option, since the browser is integrated into the O/S.
- Disable Flash in Internet Explorer 10, assuming this is even possible.
- Avoid all Flash content while using Internet Explorer 10. This is increasingly difficult to accomplish, given the prevalence of Flash content on the web.
Yesterday, in yet another attempt to finally get it right, Adobe announced a new minor release of its ubiquitous (and problematic) Flash player for all platforms. The new release takes us from the 10.3 series to 10.4.
Additional details are available in the in the related Security Bulletin.
As usual, the new version addresses security issues that could lead to attacks on systems running older versions. It also includes a few new features; the release notes cover all the changes.
Windows and Mac users should update to the new version (11.4.402.265) as soon as possible. Attacks based on this vulnerability are spreading fast on the Internet.
Apparently some Google employees decided to test Adobe Reader after they found several security-related bugs in the PDF reader code used in Google Chrome. They found sixty issues that cause crashes, about forty of which could provide attack vectors.
Bugs, crashes and security issues in Adobe software are nothing new. But given the frequency and number of updates for Reader, one might assume that Adobe had a handle on these issues. The ongoing crashing problems with Flash on Windows 7 indicate otherwise, as does this new revelation from Google.
Adobe issued several new bulletins today.
First up is Adobe Acrobat and Acrobat Reader. Adobe security bulletin APSB12-16 announces Reader and Acrobat versions 10.1.4 and 9.5.2, which address a specific crashing problem that could allow an attacker to gain control of affected computers.
Next is Adobe security bulletin APSB12-17. This bulletin announces version 18.104.22.1686 of Shockwave. Once again, the new version addresses a security issue.
Finally, a new version of the Flash player is announced in Adobe security bulletin APSB12-18. The new version is 11.3.300.271, and it addresses yet another crash-leading-to-possible-exploit security problem. As mentioned previously here, Google Chrome users will receive the new version of Flash for Chrome with the latest version of that browser. It remains to be seen whether this latest fix will resolve the long-standing crashing problems with the Flash player on Windows 7 systems.
According to Google’s Chromium blog, the most recent version of the Chrome web browser (21.0.1180.60) includes a new version of Flash that uses a more stable technology for integration into the browser.
According to Google:
Beyond the security benefits, PPAPI has allowed us to move plug-ins forward in numerous other ways. By eliminating the complexity and legacy code associated with NPAPI, we’ve reduced Flash crashes by about 20%.
That sounds promising. Given the massive, ongoing problems with Flash in all browsers, it’s encouraging to see any kind of progress. Of course, this only affects Chrome. Also, it would be nice to see crashes reduced by a number approaching 100%. Oh well.
If you use Adobe Flash Player on Windows (and who doesn’t, really?) you may have noticed that recent versions include an auto-update system. This software runs on your computer in the background, checks for new versions of Flash, and optionally updates Flash automatically. It’s called the Flash Player Update Service.
Yesterday, Adobe released an update for the Update Service to address a crashing problem in the service. The Flash player itself was not changed, and no other changes were made to the Update Service.
So, despite the fact that this update to the Update Service does not affect Flash itself, Adobe packaged the update in a ‘new’ version of Flash: 11.3.300.270. Confusingly, this ‘new’ version of Flash will not appear on the Product Download Center, although it will appear on various other pages on the Adobe web site. At the time of this posting, the Download Center still shows version 11.3.300.268. Apparently the Update Service crashing issue was so serious that Adobe didn’t have time to get everything right.
Note that this crashing problem is totally unrelated to the ongoing crashing problems of the Flash player itself. In the 11.3.300.270 announcement, Adobe refers to the Flash player crashing problem, asking users to provide crash reports to assist in diagnosing it. A previous Flash player update (11.3.300.268, released July 26, 2012) was Adobe’s most recent attempt to resolve the player’s crashing problems.