# MA-415.092014: MyCERT Advisory - Security Updates for Adobe Flash Player

**Date:** 15 Sep 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-415.092014  
**Advisory ID:** MA-415.092014

---

#### **1.0 Introduction**
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. Adobe recommends users update their product installations to the latest versions.
**2.0 Impact**
These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.
**3.0 Affected Products**
Listed below are the affected products:
- Adobe Flash Player 14.0.0.179 and earlier versions
- Adobe Flash Player 13.0.0.241 and earlier 13.x versions
- Adobe Flash Player 11.2.202.400 and earlier versions for Linux
- Adobe AIR desktop runtime 14.0.0.178 and earlier versions
- Adobe AIR SDK 14.0.0.178 and earlier versions
- Adobe AIR SDK & Compiler 14.0.0.178 and earlier versions
- Adobe AIR 14.0.0.179 and earlier versions for Android
**4.0 Recommendation**
Adobe recommends users to update their software by following either of these instructions below:
4.1 Adobe Flash Player Desktop Runtime for Windows and Macintosh, should update to version 15.0.0.152 via:
- [Flash Player Download Center](http://get.adobe.com/flashplayer/) or via the update mechanism within the product when prompted
4.2 Adobe Flash Player Extended Support Release should update to version 13.0.0.244, via:
- [Extended Support](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html)
4.3 Adobe Flash Player for Linux update to version 11.2.202.406, via:
- [Flash Player Download Center](http://get.adobe.com/flashplayer/)
4.4 Adobe Flash Player installed with Internet Explorer 10 and Internet Explorer 11 will be automatically updated to version 15.0.0.152, please refer:
- [Microsoft Security Advisory](https://technet.microsoft.com/library/security/2755801)
4.4 Adobe AIR Desktop Runtime should update to version 15.0.0.249, via:
- [AIR Download Center](http://get.adobe.com/air/)
4.5 Adobe Flash Player installed with Google Chrome will be automatically updated to version 15.0.0.152, via:
- [Google Chrome Releases](http://googlechromereleases.blogspot.com/)
4.6 Adobe AIR SDK should update to version 15.0.0.249, via:
- [AIR SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.7 Adobe AIR SDK & Compiler should update to version 15.0.0.249, via:
- [AIR SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.8 Adobe AIR for Android should update to Adobe AIR 15.0.0.252, which can be downloaded at:
- [Google Play store](https://play.google.com/store/apps/details?id=com.adobe.air)
4.9 These updates resolve:
- memory leakage vulnerabilities that could be used to bypass memory address randomization (CVE-2014-0557).
- a security bypass vulnerability (CVE-2014-0554)
- a use-after-free vulnerability that could lead to code execution (CVE-2014-0553)
- memory corruption vulnerabilities that could lead to code execution (CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0555)
- a vulnerability that could be used to bypass the same origin policy (CVE-2014-0548)
- a heap buffer overflow vulnerability that could lead to code execution (CVE-2014-0556, CVE-2014-0559)
Users can verify the version of Adobe Flash Player that browser has installed via [this link](http://www.adobe.com/software/flash/about/).
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2014/09/09/Adobe-Releases-Security-Updates-Flash-Player-and-Air>
- <http://helpx.adobe.com/security/products/flash-player/apsb14-21.html>
- <http://krebsonsecurity.com/2014/09/critical-fixes-for-adobe-microsoft-software/>