More Adobe issues, back to the latest Shockwave player update now!

Started by Gary, Nov 03, 2010, 15:51:36

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Gary

Secunia Quote Description
"Krystian Kloskowski has discovered a vulnerability in Shockwave Player, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a use-after-free error in an automatically installed compatibility component as a function in an unloaded library may be called.

Successful exploitation allows execution of arbitrary code, but requires that a user is tricked into opening the "Shockwave Settings" window when viewing a web page.

The vulnerability is confirmed in version 11.5.9.615. Other versions may also be affected.

Solution
Do not open the "Shockwave Settings" window when viewing Shockwave content."

http://secunia.com/advisories/42112
Damned, if you do damned if you don't

Rik

Rik
--------------------

This post reflects my own views, opinions and experience, not those of IDNet.

Gary

Quote from: Rik on Nov 03, 2010, 15:58:18
Bring back plain old HTML. ;)
Adobe is getting to be like the seventh bridge, just as you thinks its all done you have to start again. They hope to have a patch out tomorrow according to their blog http://www.adobe.com/support/security/advisories/apsa10-05.html for Flash Player, the 9th for Android, not sure when it said for Adobe Reader, and now Shockwave which was patched last week needs patching again  :shake:
Damned, if you do damned if you don't

Rik

Rik
--------------------

This post reflects my own views, opinions and experience, not those of IDNet.

Gary

Quote from: Rik on Nov 03, 2010, 16:05:21
And again, and again. :sigh:
It seems to me you are safe just not using Adobe full stop. Thing is we need HTML5 to catch on a bit faster really, or Adobe to look at their code more closely  :(
Damned, if you do damned if you don't

Rik

Better yet, Adobe should get back to their core graphics products.
Rik
--------------------

This post reflects my own views, opinions and experience, not those of IDNet.