Microsoft, Adobe apps poke holes in Mac OS X security

Stephen Withers
Thursday, 26 February 2009 08:10

Opinion and Analysis

Issue number three also involves Adobe, but this time the product is Flash Player.

Flash Player 10.0.12.36 and earlier (10.0.15.3 for the Linux version) contains a flaw that means a Shockwave Flash file may destroy an object without removing all references to it. If an attacker can the memory used to store objects, a reference to a deleted object can be used to trigger execution of arbitrary code.

Adobe recommends users update to Flash Player version 10.0.22.87, which corrects the issue. The company has also released Flash Player 9.0.159.0 for those who cannot upgrade to Flash Player 10.

The issue was originally disclosed to Adobe last October.

The "critical" update also addresses input validation, clickjacking and privilege escalation issues in Flash Player. Some of those issues are specific to Windows or Linux.

The latest version of Flash Player can be installed using the software's auto-update mechanism or by downloading it from Adobe's web site.

The company recommends that users check the version of Flash Player installed in each of the browsers they use.