Another new version of Google’s web browser was announced today. Version 23.0.1271.64 contains some new features, as well as several bug and security fixes. A new version of Adobe Flash for Chrome, containing several security fixes, is also included.
Released yesterday, version 11.4.402.287 addresses security, performance and stability issues in the previous versions of Flash. Users are encouraged to install the new Flash as soon as possible.
Note that at the time of this post, the Flash Player Update Announcement on Adobe’s site shows the wrong version in the first paragraph. It should show the new version as 11.4.402.287 but instead shows it as 11.4.402.278.
There’s another new version of Google’s Chrome web browser. Version 22.0.1229.92 addresses several security holes and includes a new version of Flash. The full details are available in the update announcement.
Version 11.4.402.278 of Flash for Internet Explorer and other major Windows web browsers was released on September 18 with little or no fanfare. No release notes are yet available, so it’s unclear what changes were made in the new version. Additional information will be posted here as it becomes available.
Update 2012Sep22: A Security Advisory published yesterday by Microsoft announced the availability of a patch for Flash in Internet Explorer 10. A related post on the Microsoft Security Response Center blog explains how security updates for Flash in Internet Explorer will be handled in the future. Anyone using Internet Explorer 10 or Windows 8 should install the Flash update as soon as possible.
Update 2012Sep11: Given the negative reaction to Microsoft’s previous announcement that recent Flash vulnerabilities would not be fixed in Internet Explorer 10 until after Windows 8 is released, today’s announcement is perhaps not much of a surprise. Microsoft is now saying that the Flash holes in IE10 will be plugged much sooner than originally announced. However, there will still be an easily-exploited delay between the launch of Windows 8 and the point at which all Windows 8 systems are patched.
Recently, Google switched to an integrated version of Flash in the Chrome web browser. They did this to simplify the update process: Chrome users no longer have to worry about keeping their browser’s Flash plugin up to date.
Microsoft has apparently done something similar with Internet Explorer 10, which is included with Windows 8. Unfortunately, the recent Flash vulnerabilities were not addressed in Internet Explorer 10 when Windows 8 was finalized recently. Which means Windows 8 has at least two very serious security holes in its integrated web browser, out of the box.
Microsoft says that the Flash vulnerabilities in Windows 8’s IE10 will be fixed during the regular patch cycle, but it’s not known exactly when the updates will appear.
Nefarious hackers are no doubt preparing for a surge of new Windows 8 systems to appear on the Internet, all with these rather large holes, ready to exploit.
If you are using Windows 8 or plan to start using it soon, your options are:
- Stop using Internet Explorer. This isn’t really a viable option, since the browser is integrated into the O/S.
- Disable Flash in Internet Explorer 10, assuming this is even possible.
- Avoid all Flash content while using Internet Explorer 10. This is increasingly difficult to accomplish, given the prevalence of Flash content on the web.
Yesterday, in yet another attempt to finally get it right, Adobe announced a new minor release of its ubiquitous (and problematic) Flash player for all platforms. The new release takes us from the 10.3 series to 10.4.
Additional details are available in the in the related Security Bulletin.
As usual, the new version addresses security issues that could lead to attacks on systems running older versions. It also includes a few new features; the release notes cover all the changes.
Windows and Mac users should update to the new version (11.4.402.265) as soon as possible. Attacks based on this vulnerability are spreading fast on the Internet.
Apparently some Google employees decided to test Adobe Reader after they found several security-related bugs in the PDF reader code used in Google Chrome. They found sixty issues that cause crashes, about forty of which could provide attack vectors.
Bugs, crashes and security issues in Adobe software are nothing new. But given the frequency and number of updates for Reader, one might assume that Adobe had a handle on these issues. The ongoing crashing problems with Flash on Windows 7 indicate otherwise, as does this new revelation from Google.
Adobe issued several new bulletins today.
First up is Adobe Acrobat and Acrobat Reader. Adobe security bulletin APSB12-16 announces Reader and Acrobat versions 10.1.4 and 9.5.2, which address a specific crashing problem that could allow an attacker to gain control of affected computers.
Next is Adobe security bulletin APSB12-17. This bulletin announces version 18.104.22.1686 of Shockwave. Once again, the new version addresses a security issue.
Finally, a new version of the Flash player is announced in Adobe security bulletin APSB12-18. The new version is 11.3.300.271, and it addresses yet another crash-leading-to-possible-exploit security problem. As mentioned previously here, Google Chrome users will receive the new version of Flash for Chrome with the latest version of that browser. It remains to be seen whether this latest fix will resolve the long-standing crashing problems with the Flash player on Windows 7 systems.
Google really pushes out a lot of updates for Chrome, don’t they? The latest update takes the browser to version 21.0.1180.79. The only change is a security fix for Adobe Flash, with the modified code being provided by Adobe. New versions of the Flash plugin for browsers were also released by Adobe today.