April 2019 Patch Tuesday – 74 Vulns, 16 Critical, 2 Actively Attacked, 1 PoC Exploit, Adobe Vulns

This month's Patch Tuesday addresses 74 vulnerabilities, with 16 labeled as Critical. Eight of the Critical vulns are for scripting engines and browser components, impacting Microsoft browsers and Office, along with another 5 Critical vulns in MSXML. Two Critical remote code execution RCE...

Adobe Fixes 24 Critical Flaws in Acrobat Reader, Flash, Shockwave Player

Adobe has fixed 24 critical arbitrary code execution vulnerabilities across multiple products, including Acrobat Reader, Adobe Flash, and Adobe Shockwave Player. Overall, Adobe issued fixes for 43 different CVE numbers across eight different products, Tuesday, as part of a regularly-scheduled...

Adobe Releases Security Patches for Flash, Acrobat Reader, Other Products

Good morning readers, it's Patch Tuesday again—the day of the month when Adobe and Microsoft release security patches for their software. Adobe just released its monthly security updates to address a total of 40 security vulnerabilities in several of its products, including Flash Player, Adobe...

Adobe Releases Security Patches for Flash, Acrobat Reader, Other Products

Good morning readers, it's Patch Tuesday again—the day of the month when Adobe and Microsoft release security patches for their software. Adobe just released its monthly security updates to address a total of 40 security vulnerabilities in several of its products, including Flash Player, Adobe...

KLA11468 Multiple Arbitrary code execution vulnerabilities in Adobe Shockwave Player

Multiple Memory Corruption vulnerabilities was found in Adobe Shockwave Player. Malicious users can exploit these vulnerabilities to execute arbitrary code. Original advisories APSB19-20 Related products Adobe-Shockwave-Player CVE list CVE-2019-7098 critical CVE-2019-7099 critical CVE-2019-7100...

APSB19-20 Security update available for Adobe Shockwave player

Adobe has released a security update for Adobe Shockwave Player for Windows. This update resolves multiple critical memory corruption vulnerabilities that could lead to arbitrary code execution in the context of the current user...

Adobe Releases Patches for Critical Flaws in Photoshop CC and Digital Edition

Adobe users would feel lighter this month, as Adobe has released patches for just two security vulnerability in its March Security Update. The company today released its monthly security updates to address two critical arbitrary code execution vulnerabilities—one in Adobe Photoshop CC and another...

UBUNTU-CVE-2019-7581

The parseSWFACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure, a different vulnerability than CVE-2018-7876...

Millions of PCs Found Running Outdated Versions of Popular Software

It is 2019, and millions of computers still either have at least one outdated application installed or run outdated operating systems, making themselves vulnerable to online threats and known security vulnerabilities/exploits. Security vendor Avast has released its PC Trends Report 2019 revealing...

libming 'getString' function null pointer dereference vulnerability

libming is a Flash SWF output library written in C for use in systems developed in PHP, Perl, etc. It can be used to output Flash SWF files to the system. A security vulnerability exists in the 'getString' function of the decompile.c file in libming version 0.4.8. A remote attacker can exploit th...

Blocks for Flash and others coming to Office 365

If you're a user of Microsoft Office products such as Word and Excel, you're probably aware that they've been used as inroads for malware for a long, long time. But what about malware attacks without Macros? Sure. Macro malware for Macs? That, too. Malicious documents and spying tools? Danger, Wi...

DEBIAN-CVE-2018-11516

The vlcdemuxchainedDelete function in input/demuxchained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service heap corruption and application crash or possibly have unspecified other impact via a crafted .swf file...

CVE-2018-4921

Adobe Connect versions 9.7 and earlier have an exploitable unrestricted SWF file upload vulnerability. Successful exploitation could lead to information disclosure...

UBUNTU-CVE-2018-9132

libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file...

Memory Misreference Vulnerability in libming 'decompileGETVARIABLE' Function

libming is a Flash SWF output library written in C for use in systems developed in PHP, Perl, etc. It can be used to output Flash SWF files to the system. A memory misreference vulnerability exists in the 'decompileGETVARIABLE' function of the decompile.c file in libming version 0.4.8. A remote...

UBUNTU-CVE-2018-8961

In libming 0.4.8, the decompilePUSHPARAM function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file...

UBUNTU-CVE-2018-8963

In libming 0.4.8, the decompileGETVARIABLE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file...

Adobe Shockwave Player Remote Memory Corruption Vulnerability (CNVD-2018-05011)

Adobe Shockwave Player is software that plays web content created using Macromedia and Adobe Director. A memory corruption vulnerability exists in versions prior to Adobe Shockwave Player 11.6.4.634, which could allow a remote attacker to execute arbitrary code or cause a denial of service...

The vulnerability of the multimedia platform Adobe Shockwave arises from an operation that goes beyond buffer boundaries in memory, allowing attackers to execute arbitrary code.

The vulnerability of the multimedia platform Adobe Shockwave arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Memory corruption

Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2012-0759...