Adobe issues update for Flash, warning for Reader

Adobe was busy this week -- releasing an update for a Flash flaw and posting news of a security vulnerability in Adobe Reader

Yesterday was sort of a busy day for Adobe security. Of course, that doesn't seem like such an uncommon occurrence these days. Adobe issued an update to address a security flaw in Flash, and followed up with a new security advisory about a vulnerability impacting Adobe Reader.

The Adobe security bulletin for the Flash vulnerability provides details about the issue. "Critical vulnerabilities have been identified in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.95.1 for Android. These vulnerabilities, including CVE-2010-3654 referenced in Security Advisory APSA10-05, could cause the application to crash and could potentially allow an attacker to take control of the affected system."

Adobe has developed an updated version of Flash -- version 10.1.102.64 -- to address the problem. All users of affected versions of Adobe Flash are urged to upgrade to the newest version. Adobe has also developed a patched version of Flash Player 9 -- version 9.0.289.0 -- for those who can't move up to Flash Player 10. There is no fix yet for Adobe Flash Player for Android, but Adobe expects to have that update available on November 9, 2010.

Adobe also published a blog post describing a potential security threat affecting Adobe Reader. "Adobe is aware of a potential issue in Adobe Reader posted publicly today on the Full Disclosure list. A proof-of-concept file demonstrating a Denial of Service was published. Arbitrary code execution has not been demonstrated, but may be possible. We are currently investigating this issue."

Adobe stresses that the issue does not affect Adobe Acrobat, and that it is not currently aware of any attacks exploiting the Adobe Reader issue. Still, pending an actual patch or update, Adobe provides guidance to use the JavaScript Blacklist Framework to protect vulnerable systems.

The JavaScript Blacklist Framework is a mechanism for blocking vulnerable APIs rather than disabling JavaScript altogether. The blacklist is maintained in the Windows registry and the Macintosh OS X FeatureLockdown file. The Adobe blog post about the Reader issue includes step by step instructions to use the framework.

Join the PC World newsletter!

Error: Please check your email address.

Tags online securityAdobe Systemssecurityflash

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?