Why You Should Ditch Adobe Shockwave
Summary: Adobe Shockwave Player bundles its own Flash runtime that, as of May 2014, lacked any Flash security fixes released since January 2013, a gap CERT's Will Dormann said he first reported to Adobe in 2010. Dormann noted that Shockwave's modules skip Windows exploit mitigations such as SafeSEH, which can make Flash vulnerabilities easier to exploit through Shockwave than through the standalone Flash plugin, and Adobe spokeswoman Heather Edell confirmed the findings.
Bottom line: Nearly 20 Flash security updates, including fixes for several zero-day vulnerabilities, never reached the Shockwave runtime sitting on user machines, and the missing SafeSEH mitigation means an attacker who finds one of those flaws has an easier path in.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026