# MA-426.112014: MyCERT Advisory - Adobe Releases Security Updates for Flash Player

**Date:** 13 Nov 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-426.112014  
**Advisory ID:** MA-426.112014

---

**1.0     Introduction**
Adobe has released security updates to address multiple vulnerabilities in Flash Player. Adobe recommends users and administrators to review Adobe Security Bulletin APSB 14-24 and apply the necessary updates.
**2.0     Impact**
These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.
**3.0 Affected Products**
Listed below are the affected products:
- Adobe Flash Player 15.0.0.189 and earlier versions
- Adobe Flash Player 13.0.0.250 and earlier 13.x versions
- Adobe Flash Player 11.2.202.411 and earlier versions for Linux
- Adobe AIR desktop runtime 15.0.0.293 and earlier versions
- Adobe AIR SDK 15.0.0.302 and earlier versions
- Adobe AIR SDK & Compiler 15.0.0.302 and earlier versions
- Adobe AIR 15.0.0.293 and earlier versions for Android
**4.0 Recommendation**
Adobe recommends users to update their software by following either of these instructions below:
4.1 Adobe Flash Player Desktop Runtime for Windows and Macintosh, should update to version 15.0.0.223, via:
- [Flash Player Download Center](http://www.adobe.com/go/getflash) or via the update mechanism within the product when prompted
4.2 Adobe Flash Player Extended Support Release should update to version 13.0.0.252, via:
- [Extended Support](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html)
4.3 Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.418, via:
- [Flash Player Download Center](http://www.adobe.com/go/getflash)
4.4 Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 15.0.0.223, please refer:
- [Google Chrome Releases](http://googlechromereleases.blogspot.com/)
4.5 Adobe Flash Player installed with Internet Explorer 10 and 11 for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 15.0.0.223, please refer:
- [Microsoft Security Advisory](http://go.microsoft.com/fwlink/?LinkId=264959)
4.6 Adobe AIR Desktop Runtime should update to version 15.0.0.356, via:
- [AIR Download Center](http://get.adobe.com/air/)
4.7 Adobe AIR SDK should update to version 15.0.0.356, via:
- [AIR SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.8 Adobe AIR SDK & Compiler should update to version 15.0.0.356, via:
- [AIR SDK Download](http://www.adobe.com/devnet/air/air-sdk-download.html)
4.9 Adobe AIR for Android should update to Adobe AIR 15.0.0.356, which can be downloaded at:
- [Google Play](https://play.google.com/store/apps/details?id=com.adobe.air)
4.10 These Adobe Flash Player updates resolve:
- memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441).
- use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438).
- a double free vulnerability that could lead to code execution (CVE-2014-0574).
- type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590).
- heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589).
- an information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437).
- a heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583).
- a permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442).
Users can verify the version of Adobe Flash Player that browser has installed via [this link](http://www.adobe.com/software/flash/about/).
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
- Adobe Releases Security Updates for Flash Player;
<https://www.us-cert.gov/ncas/current-activity/2014/11/11/Adobe-Releases-Security-Updates-Flash-Player>
- Security updates available for Adobe Flash Player;
<http://helpx.adobe.com/security/products/flash-player/apsb14-24.html>
- Adobe, Microsoft Issue Critical Security Fixes;
<http://krebsonsecurity.com/2014/11/adobe-microsoft-issue-critical-security-fixes-3/>
- ISC StormCast for Wednesday, November 12th 2014;
<https://isc.sans.edu/podcastdetail.html?id=4233>