Adobe releases 23 critical updates to fix Flash Player flaws

Adobe has issued 23 security updates to fix critical vulnerabilities in its Flash Player which, if left unchecked, could leave computer systems open to attack from hackers.

The updates, which affect Windows, ChromeOS, Mac and Linux systems, address numerous bugs that could "potentially allow an attacker to take control of the affected system", according to the Adobe advisory.

The security flaws affect multiple versions of Flash, including 18.0.0.232 and earlier in Flash Player Desktop Runtime, Flash Extended Support Release, Google Chrome, Microsoft Edge, and Internet Explorer (IE) 10/11.

Versions 18.0.0.199 and earlier in AIR Desktop Runtime, SDK and AIR for Android are also affected by some of the flaws.

Adobe advises users of Flash on all platforms to update the software to the latest version in order to stay safe from malicious attack.

The updates solve a slew of issues including buffer overflow vulnerabilities, memory corruption, malware validation checks, memory leaks and even information disclosure.

Google's Project Zero, HP's Zero Day Initiative and Alibaba Security Research Team are all credited with helping to find the vulnerabilities.

According to security expert Graham Cluley, even with a lack of in-the-wild exploits users should patch immediately.

"It doesn't make sense to rest on your laurels and take no action. In the past, malicious hackers have used recently-issued security patches as a blueprint to help them identify flaws and develop methods to take advantage of them on unprotected computers," he warned.

However security researcher Brian Krebs has even more bad news for Adobe users, highlighting a number of ongoing problems with Adobe Shockwave Player.

"The version of Shockwave released just two weeks ago bundles the Flash runtime 16.0.0.305, a version of Flash that Adobe released in February 2015," he said.

"[Shockwave] lacks fixes for a whopping 155 vulnerabilities in Flash that can be used to backdoor virtually any computer running it. Included in those missing fixes are patches for a half-dozen Flash flaws that were being actively exploited at the time they were fixed in Flash Player."

Meanwhile, a number of major technology firms have stopped using Flash Player altogether, with Amazon, Google and Mozilla all limiting use of the platform due to ongoing security concerns.

http://www.v3.co.uk