Adobe Systems released fixes for Shockwave addressing two vulnerabilities that could allow attackers to remotely take control of affected systems.
The new Shockwave Player version released last week is 18.104.22.168 and is available for Windows and Mac.
The update fixes two memory corruption vulnerabilities identified as CVE-2014-0500 and CVE-2014-0501 that could lead to code execution, Adobe said in a security advisory. The vulnerabilities ended up reported to the company by researcher Liangliang Song of Fortinet’s FortiGuard Labs.
The Shockwave Player update comes one week after Adobe broke out of its regular patching cycle to release an emergency update for Flash Player that addressed an actively exploited vulnerability. Unlike the Flash Player flaw, there are no reports that the Shockwave Player vulnerabilities are suffering from active exploitation.
Shockwave Player displays online content like games, product demonstrations, e-learning courses and simulations created with Adobe’s Director software. It’s not as widespread as Flash Player, but it is on over 450 million desktop computers according to Adobe, which makes it a potential target for hackers.
Shockwave Player installs a plug-in in Web browsers which means it can suffer attack with drive-by download exploits loaded from maliciously crafted or infected websites.