Adobe patches Flash against targeted exploits

Adobe has issued an emergency update to its widely used Flash Player in light of reports that the software suffers from two vulnerabilities that are being publicly exploited.

The update for Flash for Windows and Macintosh, Linux, and Android closes an ActiveX bug (CVE-2013-0633) that is being used in phishing attacks by which victims are tricked in to opening a bogus Microsoft Word document that contains a malicious Flash file.

Adobe is also plugging a hole (CVE-2013-0634) predominantly leveraged to infect users' machines when they visit malicious websites in Firefox or Safari from their Mac.

Attackers are taking advantage of this flaw by duping Windows users into clicking on fake attachments masquerading as Word documents.

Users are encouraged to update to Flash version 11.5.502.149 for Windows or Mac, 11.2.202.262 for Linux, 11.1.115.37 for Android 4.x and 11.1.111.32 for Android 3.x and 2.x.

Details of how to update to the latest iterations can be found by visiting the security bulletin.

This release is out-of-cycle with Adobe's normal schedule. It typically updates Flash to coincide with Microsoft's Patch Tuesday updates, which ship on the second Tuesday of every month.

This article originally appeared at scmagazineus.com