Just Three days ago, Adobe released a new version of Flash to patch the zero-day vulnerability that was disclosed as part of the Hacking Team hack. Security experts at Trend Micro confirmed that the Adobe Flash vulnerability is being used in the wild. But, the Hacking Team archive is the wishing well for hackers, researchers at Trend Micro overnight have found another zero-day vulnerability affecting Adobe Flash that is a result of the Hacking Team attack.
Adobe gives credits to Dhanesh Kizhakkinan of FireEye for reporting CVE-2015-5122 and Peter Pi of TrendMicro for reporting CVE-2015-5123 and for working with Adobe to help protect our customers.
The malware researchers discovered that the new vulnerability is a Use-After-Free vulnerability involving the methods TextBlock.createTextLine() and TextBlock.recreateTextLine(textLine).
“Hot on the heels of the last zero-day vulnerability that was found from the Hacking Team data leak (i.e. CVE-2015-5119) comes yet another that may be as dangerous: CVE-2015-5122, a vulnerability in Adobe Flash Player. If exploited, it could result in a crash that would allow an attacker to take control of the vulnerable system. And yes, just like CVE-2015-5119, it affects all recent versions of Flash on Windows, Mac and Linux (i.e. 220.127.116.11).” states Trend Micro.
Trend Micro has already reported the unpatched flaw to Adobe that is hardly working to fix it asap. Fortunately at this time, the experts have not seen this new vulnerability exploited in the wild neither have detected any exploit kits including it. The experts have seen proof-of-concept (PoC) code that means the situation could escalate quickly in the next few days.
Adobe published out the security advisory for this vulnerability at 11:40 AM (GMT+8), waiting for a new update experts suggest to disable Flash.
(Security Affairs – Hacking Team, zero-day)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.