Flash Player Update Nixes Zero-Day Flaw

Summary: Adobe released a critical Flash Player update patching at least seven security holes, including a cross-site scripting flaw (CVE-2012-0767) reported by Google that was already being used in active, targeted email attacks. Adobe said the attack only works against Internet Explorer on Windows, and urged users on Flash Player 11.1.102.55 and earlier to move to 11.1.102.62, with separate version targets for Android 4.x and Android 3.x.
Key Takeaway: The flaw was already in the wild before the patch shipped, and because Flash must be installed separately for each browser, a Windows user running IE and another browser may need to apply the update twice or stay exposed.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2012-0767
Related: CVE-2012-0767: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability Known Exploited Vulnerabilities · Jun 08, 2022
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026