# MA-418.102014: MyCERT Advisory - Security Updates for Adobe ColdFusion and Flash Player

**Date:** 16 Oct 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-418.102014  
**Advisory ID:** MA-418.102014

---

**1.0     Introduction**
Adobe has released security updates in ColdFusion and Flash Player for Windows, Macintosh and Linux. Adobe recommends users update their product installations to the latest versions.
**2.0     Impact**
These updates address vulnerabilities that could potentially allow an attacker to take control of the vulnerable system.
**3.0 Affected Products**
Listed below are the affected products:
- Adobe Flash Player 15.0.0.167 and earlier versions
- Adobe Flash Player 13.0.0.244 and earlier 13.x versions
- Adobe Flash Player 11.2.202.406 and earlier versions for Linux
- Adobe AIR desktop runtime 15.0.0.249 and earlier versions
- Adobe AIR SDK 15.0.0.249 and earlier versions
- Adobe AIR SDK & Compiler 15.0.0.249 and earlier versions
- Adobe AIR 15.0.0.252 and earlier versions for Android
- ColdFusion 11, 10, 9.0.2, 9.0.1 and 9.0 for all platforms.
**4.0 Recommendation**
Adobe recommends users to update their software by following either of these instructions below:
4.1 Adobe Flash Player Desktop Runtime for Windows and Macintosh, should update to version 15.0.0.189 via:
- [Flash Player Download Center](http://get.adobe.com/flashplayer/) or via the update mechanism within the product when prompted
4.2 Adobe Flash Player Extended Support Release should update to version 13.0.0.250, via:
- [Extended Support](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html)
4.3 Adobe Flash Player for Linux update to version 11.2.202.411, via:
- [Flash Player Download Center](http://get.adobe.com/flashplayer/)
4.4 Adobe Flash Player installed with Internet Explorer 10 and Internet Explorer 11 will be automatically updated to version 15.0.0.189, please refer:
- [Microsoft Security Advisory](https://technet.microsoft.com/library/security/2755801)
4.5 Adobe AIR Desktop Runtime should update to version 15.0.0.293, via:
- [AIR Download Center](http://get.adobe.com/air/)
4.6 Adobe Flash Player installed with Google Chrome will be automatically updated to version 15.0.0.189, via:
- [Google Chrome Releases](http://googlechromereleases.blogspot.com/)
4.7 Adobe AIR SDK should update to version 15.0.0.302, via:
- [AIR SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.8 Adobe AIR SDK & Compiler should update to version 15.0.0.302, via:
- [AIR SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.9 Adobe AIR for Android should update to Adobe AIR 15.0.0.293, which can be downloaded at:
- [Google Play store](https://play.google.com/store/apps/details?id=com.adobe.air)
4.10 These Adobe Flash Player updates resolve:
- Memory corruption vulnerabilities that could lead to code execution (CVE-2014-0564, CVE-2014-0558).
- an integer overflow vulnerability that could lead to code execution (CVE-2014-0569).
4.11 To patch the ColdFusion vulnerabilities, users should upgrade to the appropriate hotfix version that provided in the technote located here: <http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb14-23.html>
4.12 Users should also apply the security configuration settings as outlined on the [ColdFusion Security](http://help.adobe.com/en_US/ColdFusion/10.0/Admin/WSc3ff6d0ea77859461172e0811cbf364104-7ff2.html) page as well as review the [ColdFusion 11 Lockdown Guide](http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf), [ColdFusion 10 Lockdown Guide](http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion-enterprise/pdf/cf10-lockdown-guide.pdf) and  [ColdFusion 9 Lockdown Guide](http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf).
Users can verify the version of Adobe Flash Player that browser has installed via [this link](http://www.adobe.com/software/flash/about/).
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#abc8d2c9ced9929292ebc8d2c9ced9d8cec8ded9c2dfd285c6d2) or [[email protected]](/cdn-cgi/l/email-protection#84e9fde7e1f6f0c4e9fde7e1f6f0aaebf6e3aae9fd)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
**5.0     References**
- Adobe Releases Security Updates for ColdFusion and Flash Player
<https://www.us-cert.gov/ncas/current-activity/2014/10/14/Adobe-Releases-Security-Updates-ColdFusion-and-Flash-Player>
- Security Update: Hotfixes available for ColdFusion
<http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html>
- Security updates available for Adobe Flash Player
<http://helpx.adobe.com/security/products/flash-player/apsb14-22.html>
- Adobe patches Flash Player and ColdFusion
<http://www.zdnet.com/adobe-patches-flash-player-and-coldfusion-7000034655/>