Original URL: https://www.theregister.com/2012/10/24/adobe_shockwave_update/

Adobe plugs up buffer overflow holes in Shockwave update

Nobody using them yet - but they will be now

By John Leyden

Posted in Security, 24th October 2012 12:27 GMT

Adobe released a patch for its Shockwave Player software on Tuesday, addressing six security vulnerabilities that might easily lend themselves to malware-pushing exploits.

Shockwave Player 11.6.7.637 and earlier versions on both Windows and Mac need updating to the latest version: Shockwave Player 11.6.8.638.

Adobe said it was not aware of any exploits in the wild, so there's no need for panic, but since vulnerabilities in Adobe software applications have become a major target for the bad guys over the last two or three years, dismissing the update as unimportant would be equally unwise.

Adobe credited security researchers at Fortinet's FortiGuard Labs and CERT for help in discovering the security bugs in its software. A security advisory from Adobe explains that the security bugs in Shockwave involve a mix of buffer overflow vulnerabilities as well as an "array out of bounds" security bug, all of which could result in code execution on systems running the vulnerable software. ®