Flash Player Update Fixes Zero-Day Flaws
Summary: Adobe released an emergency Flash Player update fixing three critical vulnerabilities, two of which (CVE-2013-0643 and CVE-2013-0648) the company says are being actively exploited against Firefox users through links that redirect to sites serving malicious Flash content. It was Adobe's third Flash security update in a month, following a February 12 patch for at least 17 holes and a February 7 fix for two other flaws already being exploited.
What you should know: Two of the three flaws were already in attackers' hands when the patch shipped, and the exploit reportedly includes a sandbox escape against protections Adobe and Mozilla had recently added for Firefox on Windows Vista, 7 and 8.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2013-0504CVE-2013-0643CVE-2013-0648
- Related
- CVE-2013-0643: Adobe Flash Player Incorrect Default Permissions Vulnerability Known Exploited Vulnerabilities · Sep 17, 2024CVE-2013-0648: Adobe Flash Player Code Execution Vulnerability Known Exploited Vulnerabilities · Sep 17, 2024Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026