The code for a zero-day vulnerability affecting Adobe Shockwave Player has been published and the software maker has not yet promised a patch date.
Adobe acknowledged the hole affecting Shockwave Player 11.5.8.612 and earlier versions on the Windows and Mac operating systems, after a researcher made the exploit code public.
If exploited, the flaw "could cause a crash and potentially allow an attacker to take control of the affected system," Adobe said.
"While details about the vulnerability have been disclosed publicly, Adobe is not aware of any attacks exploiting this vulnerability against Adobe Shockwave Player to date," the firm noted in a security advisory.
Adobe said it is currently working on getting a schedule together for an update to address the vulnerability in Shockwave Player.
The company shares information about this and other vulnerabilities through the Microsoft Active Protections Program, which it joined in July.
Sharing this information with partners in the security community enables them to "quickly develop detection and quarantine methods to protect users until a patch is available," Adobe assured.
"As always, Adobe recommends that users follow security best practices by keeping their anti-malware software and definitions up to date," the firm added.
IT PRO recently caught up with Brad Arkin, Adobe's director for product security and privacy, to talk about how the company tackles serious vulnerabilities such as the above.
-
What does modern security success look like for financial services?Sponsored As financial institutions grapple with evolving cyber threats, intensifying regulations, and the limitations of ageing IT infrastructure, the need for a resilient and forward-thinking security strategy has never been greater
-
Yes, legal AI. But what can you actually do with it? Let’s take a look…Sponsored Legal AI is a knowledge multiplier that can accelerate research, sharpen insights, and organize information, provided legal teams have confidence in its transparent and auditable application
-
Critical Dell Storage Manager flaws could let hackers access sensitive data – patch nowNews A trio of flaws in Dell Storage Manager has prompted a customer alert
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
-
Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
