Adobe released an out-of-band security update to fix multiple vulnerabilities rated as critical in Flash Player.
Adobe said the vulnerabilities affect all platforms and could allow an attacker to take control of an affected system.
Adobe provided the following details on the vulnerabilities in a security bulletin:
• These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-8644).
• These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-8651).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).
• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).
Adobe did not provide details of the ongoing attacks exploiting CVE-2015-8651, other than describing them as “limited, targeted attacks”.
Users should update their products to the latest version using the instructions referenced in the security bulletin.