Adobe addresses a critical security flaw in Adobe Flash Player
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-9633 | Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edg Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. NVD description · AI analysis pending | 9.8 | 8% |
| — | ||
| CVE-2020-9746 | Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbit Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL. NVD description · AI analysis pending | 8.8 | 4% |
| — |
Full article322 words · extracted from securityaffairs.com · click to collapse
Adobe has released a security update to address a critical remote code execution flaw in Adobe Flash Player that could be easily exploited by hackers.
Adobe has released a security update to address a critical remote code execution flaw in Adobe Flash Player (CVE-2020-9746) that could be exploited by threat actors by tricking the victims into visiting a website.
Attackers could exploit this flaw by simply inserting malicious strings in HTTP responses while unaware users visit a website.
“Adobe has released security updates for Flash Player for Windows, macOS, Linux and Chrome OS. These updates address a critical vulnerability in Flash Player. Successful exploitation could lead to an exploitable crash, potentially resulting in arbitrary code execution in the context of the current user.” reads the security advisory.
“Exploitation of CVE-2020-9746 requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.”
The exploitation of the flaw could lead to a crash that allows the remote attacker to execute commands on a visitor’s device. These commands would be executed under the security context of the current user and would not have administrator privileges.
Adobe has addressed the flaw with the release of Flash Player 32.0.0.445, Adobe users have to install it as soon as possible.
Don’t forget that starting on December 31st, 2020, Adobe will no longer distribute or provide updates for its Flash Player.
Experts believe that the move will reduce the risk of web attacks through the users’ browsers. Across the years, threat actors exploited multiple vulnerabilities in the Flash Player.
In June, Adobe has released security updates to address a critical vulnerability in Flash Player for Windows, macOS, Linux, and Chrome OS.
The issue, tracked as CVE-2020-9633, is a user after free vulnerability that could lead to arbitrary code execution in the context of the current user.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Adobe)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/109448/hacking/adobe-flash-player-critical-flaw.html