The code for a zero-day vulnerability affecting Adobe Shockwave Player has been published and the software maker has not yet promised a patch date.
Adobe acknowledged the hole affecting Shockwave Player 11.5.8.612 and earlier versions on the Windows and Mac operating systems, after a researcher made the exploit code public.
If exploited, the flaw "could cause a crash and potentially allow an attacker to take control of the affected system," Adobe said.
"While details about the vulnerability have been disclosed publicly, Adobe is not aware of any attacks exploiting this vulnerability against Adobe Shockwave Player to date," the firm noted in a security advisory.
Adobe said it is currently working on getting a schedule together for an update to address the vulnerability in Shockwave Player.
The company shares information about this and other vulnerabilities through the Microsoft Active Protections Program, which it joined in July.
Sharing this information with partners in the security community enables them to "quickly develop detection and quarantine methods to protect users until a patch is available," Adobe assured.
"As always, Adobe recommends that users follow security best practices by keeping their anti-malware software and definitions up to date," the firm added.
IT PRO recently caught up with Brad Arkin, Adobe's director for product security and privacy, to talk about how the company tackles serious vulnerabilities such as the above.
-
AI layoffs could spark a new wave of offshoringNews Analysts expect a wave of rehiring next year in the wake of AI layoffs. That may sound like good news for workers, but it'll probably involve offshoring or outsourcing.
-
Hackers are using these malicious npm packages to target developers Windows, macOS, and Linux systemsNews Security experts have issued a warning to developers after ten malicious npm packages were found to deliver infostealer malware across Windows, Linux, and macOS systems.
-
Critical Dell Storage Manager flaws could let hackers access sensitive data – patch nowNews A trio of flaws in Dell Storage Manager has prompted a customer alert
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
-
Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
