Patch Flash now: Google Project Zero, Intel and pals school Adobe on security 101

9 remote-code execution holes to fix before hackers grab them

Hot on the heels of Microsoft's Patch Tuesday release, Adobe has published security fixes for its Flash Player browser plugin.

The March 12 update for the internet's screen door addresses 11 CVE-listed vulnerabilities. Adobe is listing the patch as a top deployment priority for Windows, OS X and Linux systems.

Among the flaws are nine remote-code execution holes, which could be exploited to install malware or take control of a vulnerable system. Adobe said it has not received any reports of the flaws being targeted in the wild thus far – but we all know hackers love seizing these bugs to catch out people who haven't updated.

The full list of the patched vulnerabilities is as follows:

• CVE-2014-0332 Remote code execution via memory corruption. Discovery credited to Chris Evans of Google Project Zero.
• CVE-2015-0333 Remote code execution via memory corruption. Discovery credited to Yuki Chen, Xiaoning Li and Haifei Li Of Intel/McAfee Labs.
• CVE-2015-0334 Remote code execution from type confusion. Discovery credited to Natalie Silvanovich at Google Project Zero.
• CVE-2015-0335 Remote code execution via memory corruption. Discovery credited to Chris Evans.
• CVE-2015-0336 Remote code execution from type confusion. Discovery credited to Natalie Silvanovich.
• CVE-2015-0337 A 'cross domain policy bypass' flaw. Discovery credited to Soroush Dalili of NCC Group.
• CVE-2015-0338 Remote code execution from integer overflow vulnerability. No discovery credit given.
• CVE-2015-0339 Remote code execution via memory corruption. Discovery credited to Mark Brand of Google Project Zero.
• CVE-2015-0340 File upload restriction bypass. Discovery credited to Soroush Dalili.
• CVE-2015-0341 Remote code execution from a 'use-after-free' vulnerability. Discovery credited to bilou from HP's Zero Day Initiative.
• CVE-2015-0342 Remote code execution from a 'use-after-free' vulnerability. Discovery credited to Jihui Lu of KeenTeam.

Users and administrators running Adobe Flash Player for Linux Chrome and Internet Explorer, Flash Player Extended Support Release and Flash Player Desktop Runtime are all advised to update their software to the most recent version in order to obtain the patch. El Reg advises uninstalling the plugin, or enabling 'click to play' in your browser. ®