JPCERT-AT-2019-0014
JPCERT/CC
2019-04-10
Adobe Systems Incorporated
Updates available for Adobe Flash Player | APSB19-19
https://helpx.adobe.com/security/products/flash-player/apsb19-19.html
- Adobe Flash Player Desktop Runtime (32.0.0.156) and earlier
(Windows, macOS and Linux)
- Adobe Flash Player for Google Chrome (32.0.0.156) and earlier
(Windows, macOS, Linux and Chrome OS)
- Adobe Flash Player for Microsoft Edge and Internet Explorer 11 (32.0.0.156) and earlier
(Windows 10 and Windows 8.1)
Users can check the version of Adobe Flash Player that they are using at the following link:
Flash Player Help
https://helpx.adobe.com/flash-player.html
- Adobe Flash Player Desktop Runtime (32.0.0.171)
(Windows, macOS and Linux)
- Adobe Flash Player for Google Chrome (32.0.0.171)
(Windows, macOS, Linux and Chrome OS)
- Adobe Flash Player for Microsoft Edge and Internet Explorer 11 (32.0.0.171)
(Windows 10 and Windows 8.1)
Adobe Flash Player Download Center
https://get.adobe.com/flashplayer/
Please be aware of information provided by any distributors that include Adobe Flash Player in their products such as web browsers.As for the following products, update program for Adobe Flash Player is provided by distributor.
- Microsoft Windows 10
- Microsoft Windows 8.1
- Google Chrome
The latest version of Adobe Flash Player will be applied through Windows Update, etc.
ADV190011 | April 2019 Adobe Flash Security Update
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190011
In addition to web browsers, some softwares such as Microsoft Office use Adobe Flash Player. Please apply the security update even if Adobe Flash Player is not enabled on web browser.
- Limit the Flash content
Please disable Flash on your browser or enable Click-to-Play features.
In Microsoft Office, enable protected view to avoid the impacts.
Adobe Systems Incorporated
Updates available for Adobe Flash Player | APSB19-19
https://helpx.adobe.com/security/products/flash-player/apsb19-19.html
Adobe Systems Incorporated
Security Bulletins Posted
https://blogs.adobe.com/psirt/?p=1705
Microsoft Corporation
Enable/Disable Flash Player for Microsoft Edge (Japanese)
https://answers.microsoft.com/ja-jp/windows/wiki/apps_windows_10-msedge/microsoft-edge/248bf728-44f4-4b4a-ae50-8b66ee7a96ca
Microsoft Corporation
ADV190011 | April 2019 Adobe Flash Security Update
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190011
If you have any information regarding this alert, please contact JPCERT/CC.
JPCERT Coordination Center (JPCERT/CC)
MAIL: info@jpcert.or.jp
TEL: +81-3-6271-8901 FAX: +81-3-6271-8908
https://www.jpcert.or.jp/english/
JPCERT/CC
2019-04-10
I. Overview
Adobe Systems has released a security update to address vulnerabilities in Adobe Flash Player (APSB19-19). As a result, a remote attacker may execute arbitrary code or disclose information by convincing a user to open contents leveraging the vulnerabilities.For more information on the vulnerabilities, please refer to the information provided by Adobe.Adobe Systems Incorporated
Updates available for Adobe Flash Player | APSB19-19
https://helpx.adobe.com/security/products/flash-player/apsb19-19.html
II. Affected Products
The following versions are affected by this vulnerabilities:- Adobe Flash Player Desktop Runtime (32.0.0.156) and earlier
(Windows, macOS and Linux)
- Adobe Flash Player for Google Chrome (32.0.0.156) and earlier
(Windows, macOS, Linux and Chrome OS)
- Adobe Flash Player for Microsoft Edge and Internet Explorer 11 (32.0.0.156) and earlier
(Windows 10 and Windows 8.1)
Users can check the version of Adobe Flash Player that they are using at the following link:
Flash Player Help
https://helpx.adobe.com/flash-player.html
III. Solution
Please update Adobe Flash Player to the latest version listed below:- Adobe Flash Player Desktop Runtime (32.0.0.171)
(Windows, macOS and Linux)
- Adobe Flash Player for Google Chrome (32.0.0.171)
(Windows, macOS, Linux and Chrome OS)
- Adobe Flash Player for Microsoft Edge and Internet Explorer 11 (32.0.0.171)
(Windows 10 and Windows 8.1)
Adobe Flash Player Download Center
https://get.adobe.com/flashplayer/
Please be aware of information provided by any distributors that include Adobe Flash Player in their products such as web browsers.As for the following products, update program for Adobe Flash Player is provided by distributor.
- Microsoft Windows 10
- Microsoft Windows 8.1
- Google Chrome
The latest version of Adobe Flash Player will be applied through Windows Update, etc.
ADV190011 | April 2019 Adobe Flash Security Update
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190011
In addition to web browsers, some softwares such as Microsoft Office use Adobe Flash Player. Please apply the security update even if Adobe Flash Player is not enabled on web browser.
IV. Workaround
As a temporary countermeasure until security updates can be applied,please consider the following workaround such as disabling Flash on the browser or restricting display of contents using Flash to mitigate impacts of the vulnerabilities. In addition, applying these countermeasures may affect other applications. Please carefully consider and test any side effects prior to applying any of the workaround.- Limit the Flash content
Please disable Flash on your browser or enable Click-to-Play features.
In Microsoft Office, enable protected view to avoid the impacts.
V. References
Adobe Systems Incorporated
Updates available for Adobe Flash Player | APSB19-19
https://helpx.adobe.com/security/products/flash-player/apsb19-19.html
Adobe Systems Incorporated
Security Bulletins Posted
https://blogs.adobe.com/psirt/?p=1705
Microsoft Corporation
Enable/Disable Flash Player for Microsoft Edge (Japanese)
https://answers.microsoft.com/ja-jp/windows/wiki/apps_windows_10-msedge/microsoft-edge/248bf728-44f4-4b4a-ae50-8b66ee7a96ca
Microsoft Corporation
ADV190011 | April 2019 Adobe Flash Security Update
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190011
If you have any information regarding this alert, please contact JPCERT/CC.
JPCERT Coordination Center (JPCERT/CC)
MAIL: info@jpcert.or.jp
TEL: +81-3-6271-8901 FAX: +81-3-6271-8908
https://www.jpcert.or.jp/english/