Another MASSIVE CRITICAL Adobe Flash / AIR Security Patch Plus Shockwave Patch!

--

Today ('Patch Tuesday') Adobe pushed out a MASSIVE security patch for Adobe Flash (v15.0.0.223) and AIR (v15.0.0.356). They also pushed out an update to Adobe Shockwave (v12.1.4.154). Whether the Shockwave update includes an update to its out-dated Flash support remains unknown. We can wish.

Here is Adobe's Security Bulletin:

http://helpx.adobe.com/security/products/flash-player/apsb14-24.html

The 18 CVE's patched:

CVE-2014-0573

CVE-2014-0574

CVE-2014-0576

CVE-2014-0577

CVE-2014-0581

CVE-2014-0582

CVE-2014-0583

CVE-2014-0584

CVE-2014-0585

CVE-2014-0586

CVE-2014-0588

CVE-2014-0589

CVE-2014-0590

CVE-2014-8437

CVE-2014-8438

CVE-2014-8440

CVE-2014-8441

CVE-2014-8442

Adobe's summary:

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). 

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). 

These updates resolve a double free vulnerability that could lead to code execution (CVE-2014-0574). 

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). 

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589).

These updates resolve an information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437).

These updates resolve a heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). 

These updates resolve a permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442).

Where to grab the updates:

https://get.adobe.com/flashplayer/
https://get.adobe.com/air/
https://get.adobe.com/shockwave/

Needless to say: 
Adobe freeware is some of the most DANGEROUS software you can install on your Mac. Just say NO unless you really need it. If you do need it, be happy that Apple has built into recent versions of OS X requirements that you update to the latest version. But to be extra safe, use a browser extension that keeps Flash and Shockwave content OFF until you personally approve it to run.

I am so sick of Adobe's security FAIL.
:-Q*****

--