Yet Another Flash Patch Fixes Zero-Day Flaw

Summary: Adobe issued its third emergency Flash Player update in two weeks, version 16.0.0.305, to fix a critical zero-day bug (CVE-2015-0313) present in the version released on Jan. 27. Adobe said the flaw is being actively exploited in drive-by-download attacks against Internet Explorer and Firefox on Windows 8.1 and below, and the advisory credits Trend Micro and Microsoft with reporting it.
What you should know: Trend Micro had warned three days earlier that the flaw was being used in malvertising attacks and packaged into the Hanjuan Exploit Kit, a crimeware kit stitched into hacked websites - so the window between public warning and patch was measured in days, and the exploit was already in criminal hands.

Read the original at Krebs on Security ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2015-0313
Related: CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022
The Latest Flash UAF Vulnerabilities in Exploit Kits Cyber Risks ·
Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit Cyber Risks ·