Security updates available for Adobe Flash Player

Release date: July 10, 2015

Vulnerability identifier: APSA15-04

Priority: See table below

CVE number: CVE-2015-5122, CVE-2015-5123

Platform: Windows, Macintosh and Linux

Summary

Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified in Adobe Flash Player 18.0.0.204 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.  

Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly. Adobe expects to make updates available during the week of July 12, 2015.

UPDATE (July 14): Adobe recommends users update their product installations to the latest versions using the instructions provided in the "Solution" section in Security Bulletin APSB15-18.

Affected software versions

  • Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh 
  • Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome
  • Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh
  • Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux

To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system.   

Severity ratings

Adobe categorizes these issues as critical vulnerabilities

Acknowledgments

Adobe would like to thank the following individuals and organizations for reporting these issues and for working with Adobe to help protect our customers:

  • Dhanesh Kizhakkinan of FireEye as well as Peter Pi of TrendMicro (CVE-2015-5122)
  • Peter Pi of TrendMicro as well as slipstream/RoL (@TheWack0lian) (CVE-2015-5123)

Revisions

July 11, 2015: added information on CVE-2015-5123

July 12, 2015: added acknowledgement on CVE-2015-5123

July 14, 2015: added reference to security bulletin APSB15-18. 

August 10, 2015: added credit to TrendMicro for independently reporting CVE-2015-5122.