Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

YAFP (Yet Another Flash Patch)

Published: 2016-04-06
Last Updated: 2016-04-06 17:56:55 UTC
by Bojan Zdrnja (Version: 1)
10 comment(s)

Adobe issued a security advisory yesterday about a critical vulnerability (CVE-2016-1019) in Adobe Flash Player and earlier. The vulnerability affects all OSes (Windows, Mac, Linux and Chrome OS).

As Adobe says, it “could cause a crash and potentially allow an attacker to take control of the affected system”. Well, strike that “potentially” since it is being actively exploited in the wild.
The good news is that the current version of Flash Player ( at the moment prevents exploitation of the vulnerability (at least with exploits that are currently circulating).

In any case, Adobe should release the patch tomorrow (7.4.) so patch as soon as you can to be sure that the vulnerability has been completely mitigated (and of course, use an addon such as NoScript).

Adobe offers a handy web page to check which version you have currently installed at, while the original advisory is available at


Keywords: 0day flash
10 comment(s)
April OUCH! Newsletter: I'm Hacked, Now What? -
ISC Stormcast For Wednesday, April 6th 2016
Diary Archives