Adobe patches Flash Player, plans out-of-band Reader fix

Flaw could lead to DoS attack.

Adobe has made available an update to its widely deployed Flash Player to resolve a single "critical" flaw.

"The vulnerability could subvert the domain sandbox and make unauthorised cross-domain requests" resulting in a potential denial-of-service condition, according to a security bulletin. A successful exploit also could lead to a cross-site request forgery (CSRF) attack, said Brad Arkin, Adobe's director of product security and privacy.

Adobe recommends users ditch Flash version 10.0.42.34 and install 10.0.45.2, which is available here or through the software's automatic prompting feature.

The company also announced plans to release an out-of-band update for its Reader and Acrobat software, according to a separate bulletin. The update for versions 9.3 and 8.2, scheduled for tomorrow, addresses a number of critical vulnerabilities and is meant for Windows, Mac and UNIX installations. One of the bugs remedied is the issue described in the Flash update.

Arkin told SCMagazineUS.com that the company was delivering the update "out of a preponderance of caution", adding that there are no known attacks targeting Reader and Acrobat.
Adobe's next scheduled quarterly update for Reader and Acrobat is April 13.

See original article on scmagazineus.com