Feeds

Adobe's quarterly patch cycle to commence Tuesday

'Critical' fix for some, but not all

Internet Security Threat Report 2014

Adobe Software's new quarterly patch cycle will commence on Tuesday with an update that patches a severe vulnerability in some versions its Reader and Acrobat products.

The program is part of a push by Adobe to beef up security after complaints earlier this year that the software maker was too slow in plugging security holes in its software, which runs on the vast majority of machines running Windows, Mac OS X and Linux. The quarterly release, which will coincide with Microsoft's Patch Tuesday, is designed to life easier on people administering large fleets of computers.

Up to now, Adobe has issued security updates on an ad hoc basis that frequently fixed a critical vulnerability in one version but not others.

Tuesday's inauguration will include a patch for versions 7.x, 8.x and 9.x of Adobe Reader and Acrobat for Windows and Mac. Fixes for Unix versions of the programs will come later. This would appear to be at odds with an announcement made last month, in which Adobe promised to release patches for all major supported versions and platforms of Reader and Acrobat on the same day. Adobe's blog post announcing next Tuesday's patches didn't explain the discrepancy.

"Adobe considers this a critical update and recommends users be prepared to apply the update for their product installations," the advisory, posted to Adobe's product incident response team blog, stated.

The release means PC owners will have an even bigger patch burden to shoulder this Tuesday. Microsoft on Thursday announced a bumper crop of patches, six of which are rated critical, the company's highest severity level.

In addition to a regular patch releases, Adobe's new security initiative involves a new push to eradicate security bugs in existing products by combing through its existing code base for exploitable flaws. Previously, the company's Secure Development Lifecycle emphasized ways to build security into products that were under development. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.