# MA-384.042014: MyCERT Advisory - Security Updates for Adobe Flash Player

**Date:** 11 Apr 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-384.042014  
**Advisory ID:** MA-384.042014

---

**1.0 Introduction**
Adobe has released security updates to address important vulnerabilities in Adobe Flash Player 12.0.0.77 and earlier versions for Windows and Macintosh, and Adobe Flash Player 11.2.202.346 and earlier versions for Linux.
These updates resolve such as a use-after-free vulnerability that could result in arbitrary code execution (CVE-2014-0506), a buffer overflow vulnerability that could result in arbitrary code execution (CVE-2014-0507), a security bypass vulnerability that could lead to information disclosure (CVE-2014-0508) and a cross-site-scripting vulnerability (CVE-2014-0509).
Users are recommended to update their product installation to the latest versions.
**2.0 Impact**
These updates address a critical vulnerability that could potentially allow an attacker to take control of the affected system.
**3.0 Affected Products**
Adobe Flash Player security updates are available for the following versions:
- Adobe Flash Player 12.0.0.77 and earlier versions for Windows and Macintosh
- Adobe Flash Player 11.2.202.346 and earlier versions for Linux
- Adobe AIR 4.0.0.1628 and earlier versions for Android
- Adobe AIR 4.0.0.1628 SDK and earlier versions
- Adobe AIR 4.0.0.1628 SDK & Compiler and earlier versions
**4.0 Recommendation**
Adobe recommends users to update their software installations by following the instructions below:
4.1 Adobe Flash Player 12.0.0.77 and earlier versions for Windows and Macintosh should update to Adobe Flash Player 13.0.0.182 via:
- [Flash Player Download](http://get.adobe.com/flashplayer/) Center or via the update mechanism within the product when prompted
4.2 Adobe Flash Player 12.0.0.77 and earlier versions (network distribution), should update to the newest version 13.0.0.182, please refer:
- [Flash Player Licensing](http://www.adobe.com/licensing/distribution)
4.3 Adobe Flash Player 11.2.202.346 and earlier versions for Linux update to Adobe Flash Player 11.2.202.350 by downloading it via:
- [Flash Player Download Center](http://get.adobe.com/flashplayer/)
4.4 Flash Player 11.7.700.272 and earlier versions for Windows and Macintosh, who cannot update to Flash Player 13.0.0.182, Adobe has made available the update Flash Player 11.7.700.275\*, which can be downloaded from:
- [Archived Flash Player Versions](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html)
4.5 Adobe Flash Player 12.0.0.77 installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 13.0.0.182 for Windows, Macintosh and Linux please refer:
- [Google Chrome Releases](http://googlechromereleases.blogspot.com/)
4.6 Adobe Flash Player 12.0.0.77 installed with Internet Explorer 10 will automatically be updated to the latest Internet Explorer 10 version, which will include Adobe Flash Player 13.0.0.182 for Windows 8.0, please refer:
- [Microsoft Security Advisory](http://technet.microsoft.com/en-us/security/advisory/2755801)
4.7 Adobe Flash Player 12.0.0.77 installed with Internet Explorer 11 will automatically be updated to the latest Internet Explorer 11 version, which will include Adobe Flash Player 13.0.0.182 for Windows 8.1, please refer:
- [Microsoft Security Advisory](http://technet.microsoft.com/en-us/security/advisory/2755801)
4.8 Adobe AIR 4.0.0.1628 and earlier versions for Android should update to Adobe AIR 13.0.0.83 via:
- [Google Play](https://play.google.com/store/apps/details?id=com.adobe.air)
4.9 Adobe AIR 4.0.0.1628 SDK and earlier versions should update to the Adobe AIR 13.0.0.83 SDK via:
- [SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.10 Adobe AIR 4.0.0.1628 SDK & Compiler and earlier versions should update to the Adobe AIR 13.0.0.83 SDK & Compiler, via:
- [SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
Users can verify the version of Adobe Flash Player that browser has installed via [this link](http://www.adobe.com/software/flash/about/).
Beginning May 13, 2014, Adobe Flash Player 13 for Mac and Windows will replace version 11.7 as the extended support version. Adobe recommends users upgrade to version 13 to continue to receive security updates, please refer [this link](http://blogs.adobe.com/flashplayer/2014/03/upcoming-changes-to-flash-players-extended-support-release.html).
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#3b5842595e490202027b5842595e49485e584e49524f42155642) or [[email protected]](/cdn-cgi/l/email-protection#3f52465c5a4d4b7f52465c5a4d4b11504d58115246)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2014/04/09/Adobe-Releases-Security-Updates-Flash-Player-and-AIR>
- <http://helpx.adobe.com/security/products/flash-player/apsb14-09.html>
- <http://krebsonsecurity.com/2014/04/adobe-microsoft-push-critical-fixes/>