Shocking Delay in Fixing Adobe Shockwave Bug
Summary: US-CERT warned that Adobe Shockwave Player installs Xtras signed by Adobe or Macromedia automatically without user interaction, and because the download location is stored in the Shockwave movie itself, an attacker can host old, vulnerable Xtras that execute arbitrary code with the user's privileges. Adobe confirmed US-CERT alerted it to the flaw in October 2010 but said the fix will not ship until the next major Shockwave release, scheduled for February 2013, and that it is not aware of active exploits.
Key Takeaway: A remotely exploitable code-execution hole reported in October 2010 was left open for roughly two and a half years, and the trigger is as ordinary as a crafted web page or HTML email attachment.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026