Adobe Patches Shockwave

Monday, February 17, 2014 @ 11:02 AM gHale


Adobe Systems released fixes for Shockwave addressing two vulnerabilities that could allow attackers to remotely take control of affected systems.

The new Shockwave Player version released last week is 12.0.9.149 and is available for Windows and Mac.

RELATED STORIES
IE Leads Patch Tuesday Fixes
Exploit for Patched Flash Bug
Big Network Time Protocol DDoS

The update fixes two memory corruption vulnerabilities identified as CVE-2014-0500 and CVE-2014-0501 that could lead to code execution, Adobe said in a security advisory. The vulnerabilities ended up reported to the company by researcher Liangliang Song of Fortinet’s FortiGuard Labs.

The Shockwave Player update comes one week after Adobe broke out of its regular patching cycle to release an emergency update for Flash Player that addressed an actively exploited vulnerability. Unlike the Flash Player flaw, there are no reports that the Shockwave Player vulnerabilities are suffering from active exploitation.

Shockwave Player displays online content like games, product demonstrations, e-learning courses and simulations created with Adobe’s Director software. It’s not as widespread as Flash Player, but it is on over 450 million desktop computers according to Adobe, which makes it a potential target for hackers.

Shockwave Player installs a plug-in in Web browsers which means it can suffer attack with drive-by download exploits loaded from maliciously crafted or infected websites.



Leave a Reply

You must be logged in to post a comment.