# MA-491.072015: MyCERT Advisory - Security Updates for Adobe Flash Player

**Date:** 12 Jul 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-491.072015  
**Advisory ID:** MA-491.072015

---

#### **1.0 Introduction**
Adobe Flash Player contains critical vulnerabilities within the ActionScript 3 opaqueBackground and BitmapData classes. Exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code on a vulnerable system.
Users and administrators are encouraged to review Adobe Security Advisory APSA15-04, as well as Vulnerability Notes VU#338736 and VU#918568 for workaround information. No patch is currently available.
**2.0 Impact**
These updates address vulnerabilities that could potentially allow a remote attacker to execute arbitrary code in the context of the user running Flash Player. Attacks typically involve enticing a user to visit a web site containing specially crafted Flash content, or to open a specially crafted Microsoft Office document.
**3.0 Affected Products**
The detail lists of the affected products are as below:
- Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh
- Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome
- Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh
- Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux.
**4.0 Recommendation**
As of the writing of this advisory, Adobe has not released any security patches for this vulnerability. However, users can consider the following workarounds as temporary steps:
4.1 Do not run untrusted Flash content
- Disable Flash in your browser or enable Click-to-Play features.
<http://www.howtogeek.com/188059/how-to-enable-click-to-play-plugins-in-every-web-browser>
- Instructions for how to uninstall Flash on:
Windows platforms
<https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html>
Mac platforms
<https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-mac-os.html>
4.2 Use the Microsoft Enhanced Mitigation Experience Toolkit (EMET)
- Step by step on how to add the EMET support for specific application can be found in our Protecting Your Windows Computer with Enhanced Mitigation Experience Toolkit (EMET) tutorial at the following URL:
[https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f
)
- To disable Active Script support in the browser and to configure the Enhanced Security Configuration, please refer to the following URL: <https://www.mycert.org.my/portal/advisory?id=MA-347.052013>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#c4a7bda6a1b6fdfdfd84a7bda6a1b6b7a1a7b1b6adb0bdeaa9bd) or [[email protected]](/cdn-cgi/l/email-protection#e38e9a80869197a38e9a80869197cd8c9184cd8e9a) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Workarounds for Adobe Flash AS3 opaqueBackground and BitmapData Use-After-Free Vulnerabilities
<https://www.us-cert.gov/ncas/current-activity/2015/07/11/Adobe-Flash-ActionScript-3-opaqueBackground-Use-After-Free>
- Adobe Security Bulletin
<https://helpx.adobe.com/security/products/flash-player/apsa15-04.html>
- Vulnerability Note VU#338736
<http://www.kb.cert.org/vuls/id/338736>
- Vulnerability Note VU#918568
<http://www.kb.cert.org/vuls/id/918568>