Security → Security update available for Adobe Flash Player

Security update available for Adobe Flash Player

• Release date: June 5, 2011
• Vulnerability identifier: APSB11-13
• CVE number: CVE-2011-2107
• Platform: All Platforms

quote:

---

An important vulnerability has been identified in Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for Android. This universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message.

Adobe recommends users of Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 10.3.181.22 (10.3.181.23 for ActiveX). Adobe expects to make available an update for Flash Player 10.3.185.22 for Android during the week of June 6, 2011.

Adobe is still investigating the impact to the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.2) and earlier 10.x and 9.x versions of Adobe Reader and Acrobat for Windows and Macintosh operating systems. Adobe is not aware of any attacks targeting Adobe Reader or Acrobat in the wild.

---

See how the Adobe Bulletin affects your situation.

Thank you.

You're welcome, Oregonian

Thank you siljaline .

I just updated Flash on IE6 and the update RESET the Flash Player Settings Manager settings to default. Maybe that only happens on IE but it sure is irritating. I don't like using the Settings Manager in the Control Panel because it doesn't display correctly so I had to do it at Adobe's site.

EDIT: I just tried to install it on a virtual machine running XP Pro and IE8. Windows blocked the installation saying the publisher could not be verified. Then I recalled that this happened with the last Flash update on IE 7 and 8 and we discussed it here and there was a workaround but I have forgotten what it is. Now I have to find that thread (ugh, I hate getting older and having a poor memory). Why can't Adobe fix this? AWFUL of them to be offering a download where the publisher cannot be verified.

Second edit: »Re: Adobe Flash Player 10.3 released (new Privacy Controls)

I guess I should have just lied on the Adobe forum registration page (they require your FULL NAME, ADDRESS, PHONE NUMBER AND A BUNCH OF NOSY QUESTIONS MUST BE ANSWERED RELATING TO IT PERSONS ONLY) so I could inform them of this problem on IE 7 and 8. I assume no one informed them as surely they would have fixed this by now! Surely they are not THAT irresponsible that they know about it and don't give a shit so have not fixed it.

Wow! On a Sunday? Must be an emergency release!

quote:

---

This universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website.

---

Now XSS is common & common knowledge with browsers.
Got to figure that this Flash exploit has existed ... forever?

Can't even see the CVE (yet), »secunia.com/advisories/c ··· 11-2107/.

Thanks. I noticed a minor difference in the version number between ActiveX and the plugin for Firefox. Active X is 10.1.181.23 and the plugin is 10.1.181.22. Maybe I just never noticed a difference in the past.

In general they have always been in sync.

The version for Chrome has been different.
And there was the update put out a few days ago that affected only IE.

That probably explains the difference between ActiveX and the plugin. Both of my flash versions needed an update.

quote:

---

I just updated Flash on IE6 and the update RESET the Flash Player Settings Manager settings to default.

---

Yea i always had problems auto updating it so i just took the OCX file and placed it in the macromed directory.. (Im using flash 9's OCX)

Apparently, so sez our buddy Brian Krebs - seriously, for Adobe to release such a thing on a weekend, is serious, antdude

Thanks siljaline got it.

Thanks much!

maybe it is something with my computer (an activex killbit? ) but after installing the new version of flashplayer, when i used the "settings manager", to adjust the settings, the settings manager's tabs wouldn't work, with IE 6.. the settings manager's tabs would work with "firefox"..

i was using the online version of the "settings manager", not the one in "control panel"..

so, i am wondering if anyone else is seeing the same thing, where the settings manager's tabs won't work when using IE 6?

I am new here, just registered, have been reading your site for a long time just never posted. Redwolfe_98, I also noticed the tabs in settings manager(online) do not work, but you can use the links on the left side of that page and go to each of the tabs, you just can not click on the tabs directly, hope that makes since. I would also like to ask I only have the active x and not the plug in one as shown above, is it because I only use IE9, is the plug in for other browsers? I signed up for a basic account is that why I do not see a way to post a photo?

I found how to post a photo, this is what I was asking about the plug-in version, would that be for browsers other than IE9?

Same exact scenario for me using IE8 on 3 XP computers.
(tabs on global settings manager not working for me either)

Same exact scenario for me with IE8 on 3 XP computers.

Per usual, a huge thank you for heads up. Wasn't on yesterday, so I didn't get it till today, but I did get it.

This would be under what O/S, MarkAW

You're welcome, jaykaykay

Thanks siljaline—got it.

@ sly53 and DrDemento. The Plug-in is for other Browsers such as mentioned in the picture and link provided! »www.adobe.com/software/f ··· h/about/

TH

Yes.

Windows 7 32/64bit and Vista 32bit.

Thanks siljaline!

Missed this yesterday,
Thank you siljaline

I found the problem to be the FIRST tab. Try the second or third tab first. Do it from the left side of the panel not from the icons on the Settings Manager window. It will work. Then you can try the first tab again and it works! I had this experience with Flash on both IE6 and IE8. I was using the online version of the Settings Manager.

The Adobe Control Panel Manager is flawed since I was not given the correct ActiveX control from the update, now fixed at 10.3.181.23 | This would be under Win XP Pro | IE8 I had to manually uninstall Flash to get what I needed for my situation.