Flash Patch Targets Zero-Day Exploit
Summary: Adobe released a Flash Player security update fixing a vulnerability already being exploited in active attacks, bringing the player to version 16.0.0.287 on Mac and Windows and 11.2.202.438 on Linux. Adobe said it was investigating reports of a separate exploit for Flash Player 16.0.0.287 and earlier, and later confirmed the patch does not protect against all current active attacks, with a further update planned for the week of January 26.
What's compelling: The Angler Exploit Kit was already targeting the previously undocumented Flash flaw, and Adobe's own confirmation that a second exploit exists in the wild means updating to 16.0.0.287 did not close the exposure - a Qualys BrowserCheck on January 26 still flagged the installed 16.0.0.296 as having a known critical vulnerability with no vendor fix available.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-0310
- Related
- CVE-2015-0310: Adobe Flash Player ASLR Bypass Vulnerability Known Exploited Vulnerabilities · May 25, 2022Flash 0-day Exploited by Angler Exploit Kit Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026