Adobe to Patch Hacking Team’s Flash Zero-Day
Summary: Adobe said it would patch a critical zero-day in Flash Player (CVE-2015-5119) affecting version 18.0.0.194 and earlier on Windows, Macintosh and Linux, after the flaw was disclosed when hackers posted hundreds of gigabytes of stolen Hacking Team data online. Trend Micro reported evidence the Flash bug was being exploited in active attacks, and the fix arrived in Flash Player 18.0.0.203, marking the seventh emergency Flash zero-day update in as many months.
What you should know: The exploit came out of Hacking Team's stolen cache alongside other unpatched flaws, including an apparent Windows vulnerability that Google said could be paired with the Flash bug to evade Chrome's sandbox - so the tooling was already circulating before a patch existed.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-5119
- Related
- CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022