# MA-356.092013: MyCERT Alert - Security Updates for Multiple Critical Vulnerabilities in Adobe Products

**Date:** 11 Sep 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-356.092013  
**Advisory ID:** MA-356.092013

---

**1.0 Introduction**
Adobe has released 3 security updates on September 10, 2013. The details are as below:
- Security update for Adobe Shockwave Player
- Security update for Adobe Reader and Acrobat
- Security update for Adobe Flash Player
**2.0 Impact**
This update addresses vulnerabilities that could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system and also address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
**3.0 Affected Products**
> **3.1 Adobe Shockwave Player**
>
> Adobe Shockwave Player 12.0.3.133 and earlier versions on the Windows and Macintosh operating systems.
>
> **3.2 Adobe Reader and Acrobat**
>
> - Adobe Reader XI (11.0.03) and earlier 11.x versions for Windows and Macintosh
> - Adobe Reader X (10.1.7) and earlier 10.x versions for Windows and Macintosh
> - Adobe Acrobat XI (11.0.03) and earlier 11.x versions for Windows and Macintosh
> - Adobe Acrobat X (10.1.7) and earlier 10.x versions for Windows and Macintosh
>
> **3.3 Adobe Flash Player**
>
> - Adobe Flash Player 11.8.800.94 and earlier versions for Windows and Macintosh
> - Adobe Flash Player 11.2.202.297  and earlier versions for Linux
> - Adobe Flash Player 11.1.115.69 and earlier versions for Android 4.x
> - Adobe Flash Player 11.1.111.64 and earlier versions for Android 3.x and 2.x
> - Adobe AIR 3.8.0.870 and earlier versions for Windows and Android
> - Adobe AIR 3.8.0.910 and earlier versions for Macintosh
> - Adobe AIR 3.8.0.870 SDK & Compiler and earlier versions for Windows
> - Adobe AIR 3.8.0.910 SDK & Compiler and earlier versions for Macintosh
**4.0 Recommendation**
MyCERT recommends users of Adobe to upgrade to the newest version of the affected softwares from:
> **4.1 Adobe Shockwave Player**
>
> Adobe recommends users of Adobe Shockwave Player 12.0.3.133 and earlier versions update to the newest version 12.0.4.144, available here:
>
> <http://get.adobe.com/shockwave/>
>
> **4.2 Adobe Reader and Acrobat**
>
> > **4.2.1 Adobe Reader**
> >
> > Users on Windows and Macintosh can utilize the product's update mechanism. The default configuration is set to run automatic update checks on a regular schedule.  Update checks can be manually activated by choosing Help > Check for Updates.
> >
> > Adobe Reader users on Windows can also find the appropriate update here:
> > <http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows>.
> >
> > Adobe Reader users on Macintosh can also find the appropriate update here:
> > <http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh>.
> >
> > **4.2.2 Adobe Acrobat**
> >
> > Users can utilize the product's update mechanism. The default configuration is set to run automatic update checks on a regular schedule.  Update checks can be manually activated by choosing Help > Check for Updates.
> >
> > Acrobat Standard and Pro users on Windows can also find the appropriate update here:
> > <http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows>.
> >
> > Acrobat Pro Extended users on Windows can also find the appropriate update here:
> > <http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows>.
> >
> > Acrobat Pro users on Macintosh can also find the appropriate update here:
> > <http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh>.
>
> **4.3 Adobe Flash Player**
>
> - Adobe recommends users of Adobe Flash Player 11.8.800.94 and earlier versions for Windows and Macintosh update to the newest version 11.8.800.168 by downloading it from the Adobe Flash Player Download Center, or via the update mechanism within the product when prompted.
> - Adobe recommends users of Adobe Flash Player 11.2.202.297 and earlier versions for Linux update to Adobe Flash Player 11.2.202.310 by downloading it from the Adobe Flash Player Download Center.
> - For users of Flash Player 10.3.183.90 and earlier versions for Windows and Macintosh, who cannot update to Flash Player 11.8.800.168, Adobe has made available the update Flash Player 11.7.700.242, which can be downloaded here.\Note:  Beginning July 9, 2013, Adobe Flash Player 11.7.x replaced version 10.3.x as the extended support version.  Adobe recommends users upgrade to version 11.7.x in order to continue to receive security updates.  See this blog post for further details.*
> - Adobe Flash Player 11.8.800.97 installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 11.8.800.170 for Windows, Macintosh and Linux.
> - Adobe Flash Player 11.8.800.94 installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player 11.8.800.168 for Windows 8.
> - Users of Adobe Flash Player 11.1.115.69 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.81\*.  \* Note: Applicable only for Android 4.x devices with Flash Player installed prior to August 15, 2012.
> - Users of Adobe Flash Player 11.1.111.64 and earlier versions for Android 3.x and 2.x should update to Flash Player 11.1.111.73\*.  \* Note: Applicable only for Android 3.x devices and earlier with Flash Player installed prior to August 15, 2012.
> - Users of Adobe AIR 3.8.0.870 and earlier versions for Windows should update to Adobe AIR 3.8.0.1430.
> - Users of Adobe AIR 3.8.0.910 and earlier versions for Macintosh should update to Adobe AIR 3.8.0.1430.
> - Users of the Adobe AIR 3.8.0.870 SDK & Compiler and earlier versions for Windows should update to the Adobe AIR 3.8.0.1430 SDK & Compiler.
> - Users of the Adobe AIR 3.8.0.910 SDK & Compiler and earlier versions for Macintosh should update to the Adobe AIR 3.8.0.1430 SDK & Compiler.
> - Users of the Adobe AIR 3.8.0.870 and earlier versions for Android should update to Adobe AIR 3.8.0.1430 by browsing to Google play or the Amazon Marketplace on an Android device.
MyCERT generally advise users to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL or .SWF file, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#a2cfdbc1c7d0d6e2cfdbc1c7d0d68ccdd0c58ccfdb)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.adobe.com/support/security/bulletins/apsb13-23.html>
- <http://www.adobe.com/support/security/bulletins/apsb13-22.html>
- <http://www.adobe.com/support/security/bulletins/apsb13-21.html>