Author Topic: Patch your Flash! Version 18.0.0.203 (July 08, 2015) (Read 17492 times)

lanux128 · « **on:** July 09, 2015, 12:27 AM »

Adobe has released an update to patch a critical vulnerability, details in the link.

You can check your current version here and update if necessary.

• Update link: https://get.adobe.com/flashplayer/

Innuendo · « **Reply #1 on:** July 11, 2015, 02:54 PM »

Or if you don't want to abide by Adobe's goofy insistence on trying to bundle McAfee software and want to be able to install Adobe Flash while not connected to the internet, go here:

https://www.adobe.co...r/distribution3.html

TaoPhoenix · « **Reply #2 on:** July 11, 2015, 04:07 PM »

Or if you don't want to abide by Adobe's goofy insistence on trying to bundle McAfee software and want to be able to install Adobe Flash while not connected to the internet, go here:

https://www.adobe.co...r/distribution3.html
-Innuendo (July 11, 2015, 02:54 PM)

This kind of thing bothers me!

Even on your version of the page, you have to unclick "intall McAfee now". To my mind we're sorta stuck with Flash. McAfee provides no added value of any kind, except to Adobe's "partnership account".

(And why McAfee? Don't revenue-sharing guys just go for the top player? Isn't that how Facebook became essentially the "only social network"?)

MilesAhead · « **Reply #3 on:** July 11, 2015, 04:20 PM »

I wish they would patch using 28% CPU just to show video. Granted my GPU probably doesn't qualify for hw accel. but still. I have been trying to use Pepper Flash, and other alternatives but I can't get any of them to work on Windows except on Youtube. ESPN3 forget it. I'll be glad when Flash is cut out altogether.

TaoPhoenix · « **Reply #4 on:** July 12, 2015, 12:01 AM »

The prob shows up when people "wish X company's entire main revenue model goes away".

ewemoa · « **Reply #5 on:** July 12, 2015, 07:12 AM »

Unfortunately...

http://thehackernews...-player-exploit.html

On a side note, there's no security announcement sub-forum on dc, right?

Stoic Joker · « **Reply #6 on:** July 12, 2015, 11:40 AM »

I wish they would patch using 28% CPU just to show video. Granted my GPU probably doesn't qualify for hw accel. but still. I have been trying to use Pepper Flash, and other alternatives but I can't get any of them to work on Windows except on Youtube. ESPN3 forget it. I'll be glad when Flash is cut out altogether.
-MilesAhead (July 11, 2015, 04:20 PM)

Amen to that! Mine decided to just up and start doing the Green Screen lockups last week. Apparently it linked to the hardware acceleration setting...which was never a problem before. There are a bunch of people looking for the registry method of disabling hardware acceleration, but the only "help" from Adobe is a snarky note about the information not being stored in the registry.

The point of the exercise is that it is impossible to get to the right click settings option, because the (any...) page keeps locking up the browser. Unfortunately their "support staff" is to obtuse to grasp that people need the alternative file system level version of the how to disable hardware acceleration ... So they just keep regurgitating the - at this point idiotic - settings panel option.

As an aside: WTF did they do to flash that suddenly turned it into a seizure prone nightmare??

MilesAhead · « **Reply #7 on:** July 12, 2015, 12:32 PM »

As an aside: WTF did they do to flash that suddenly turned it into a seizure prone nightmare??
-Stoic Joker (July 12, 2015, 11:40 AM)

I don't know. One thing I did see weird is at times Windows 8 Task Manager itself seems to use 40% CPU. I brought up Avira free TM and it only shows itself using maybe 2.9%. At least the video seems to be working well in FF nightly. I was able to watch several Wimbledon matches on ESPN3 for free.

Speaking of which I have to see if the Men's Singles Final is still ongoing.

Stoic Joker · « **Reply #8 on:** July 12, 2015, 12:40 PM »

I'm in IE11 on 7pro x64 ... And after literally years -(like since 2007)- it just decided to up and pull the Green Screen crap on me. VCard is an ATI Radeon HD 4850 Driver v8.920.0.0 dated 11/9/2011 - Was running fine since the beginning...and just went locked up green on Flash Players.

*Shrug* Maybe I'm overdue on a new box.. $:-\$

MilesAhead · « **Reply #9 on:** July 12, 2015, 12:57 PM »

I'm in IE11 on 7pro x64 ... And after literally years -(like since 2007)- it just decided to up and pull the Green Screen crap on me. VCard is an ATI Radeon HD 4850 Driver v8.920.0.0 dated 11/9/2011 - Was running fine since the beginning...and just went locked up green on Flash Players.

*Shrug* Maybe I'm overdue on a new box.. $:-\$
-Stoic Joker (July 12, 2015, 12:40 PM)

As much video as I converted and messed with I still don't understand the stuff. I have a VLC Firefox Plugin. But it never seems to do anything. I have around 10 browers installed. I go to a site with video and click the link. Nothing happens. I keep bringing up browsers until one of them kicks it off. I don't remember things being quite this weird once Windows became NT based..

tomos · « **Reply #10 on:** July 12, 2015, 01:00 PM »

[off-topic]

Speaking of which I have to see if the Men's Singles [tennis] Final is still ongoing.
-MilesAhead (July 12, 2015, 12:32 PM)

you reminded me of it the other day

I'm watching (not live) via this YT channel. There's two sets up there so far...

MilesAhead · « **Reply #11 on:** July 12, 2015, 01:04 PM »

[off-topic]

Speaking of which I have to see if the Men's Singles [tennis] Final is still ongoing.
-MilesAhead (July 12, 2015, 12:32 PM)

you reminded me of it the other day
I'm watching (not live) via this YT channel. There's two sets up there so far...
-tomos (July 12, 2015, 01:00 PM)

If you are enjoying I won't spoil the men's match. I watched the Serena final yesterday. I bet Stephie Graf is sticking pins is wax effigies about now. If Serena wins the US Open singles she will tie Stephie at 22 major singles championships and also have the calendar slam. I don't know why anyone cares if you winn all 4 in the same calendar year. But they make a stat out of everything now.

ewemoa · « **Reply #12 on:** July 12, 2015, 07:21 PM »

Unfortunately...

http://thehackernews...-player-exploit.html
-ewemoa (July 12, 2015, 07:12 AM)

So according to:

https://helpx.adobe....layer/apsa15-04.html

Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified in Adobe Flash Player 18.0.0.204 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.

Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly. Adobe expects to make updates available during the week of July 12, 2015.

Haven't seen an additional update yet -- I guess that might help explain the following text from the first link:

Therefore, once again we advise everyone with Flash installed to remove or disable the software until the company patches the critical security bug.

Didn't figure out how to disable without uninstalling -- at least not system-wide -- any hints? Or may be "disable" above referred to changing settings in each individual browser and possibly other applications...

MilesAhead · « **Reply #13 on:** July 12, 2015, 07:39 PM »

Haven't seen an additional update yet
-ewemoa (July 12, 2015, 07:21 PM)

You would think they would backtrack to an old version without the vulnerability in the interim.. if there is one. And let us know what version it is.

If you select Never Activate in plugins settings for FF that should do it I would hope. Chrome may make it a bit harder to get at the setting. I think you have to enter "chrome://plugins/" in the address bar.

Mustang browser for Windows comes with PepperFlash 17.x OOTB. If it is vulnerable too I do not know.

ewemoa · « **Reply #14 on:** July 13, 2015, 12:09 AM »

With all of the different settings, perhaps uninstallation is simpler and safer.

FWIW according to:

https://helpx.adobe....robat/apsb15-15.html

Adobe is planning to release security updates on Tuesday, July 14, 2015 for Adobe Acrobat and Reader for Windows and Macintosh.

May be the latest issue will be addressed by this.

lanux128 · « **Reply #15 on:** July 14, 2015, 08:15 AM »

While waiting for Adobe to release its patch, Mozilla have disabled Flash plugin in Firefox. if you're using some other browsers, this article by How-To Geek should have you covered.

• http://thenextweb.co...ath-knell-for-flash/
• http://www.bbc.com/n.../technology-33520935

MilesAhead · « **Reply #16 on:** July 14, 2015, 09:27 AM »

I installed the 18.0.0.209 released today for Firefox. Also my chrome updated automagically to the same version. I did not see the word "exploit" in the change log though.

tomos · « **Reply #17 on:** July 14, 2015, 03:01 PM »

While waiting for Adobe to release its patch, Mozilla have disabled Flash plugin in Firefox. if you're using some other browsers, this article by How-To Geek should have you covered.
-lanux128 (July 14, 2015, 08:15 AM)

odd,
it's impossible to actually uninstall from Firefox - no simple method anyways: uninstalling Flash in programmes list doesnt remove from FF; no option within FF to uninstall plugins (unlike addons).

Going though my old plugins,
I see there are even worse culprits (Silverlight says to uninstall old version before installing current version - again it is neither possible via browser ~~nor via uninstall programmes~~ EDIT// found it - named *Microsoft* Silverlight :-/ ).

Is it any wonder we have security issues...

MilesAhead · « **Reply #18 on:** July 14, 2015, 04:32 PM »

odd,
it's impossible to actually uninstall from Firefox - no simple method anyways: uninstalling Flash in programmes list doesnt remove from FF; no option within FF to uninstall plugins (unlike addons).
-tomos (July 14, 2015, 03:01 PM)

This page may shed some light on it.

I use FlashBlock extension. It may stop some sites from reacting(like ESPN3) but you can disable flashblock to use flash on those if you want.

An alternative is to run in a sandbox like ToolWiz TimeFreeze or Sandboxie.

Deozaan · « **Reply #19 on:** July 14, 2015, 05:53 PM »

Firefox has become pretty aggressive at blocking vulnerable Flash versions. So maybe it's not necessary to uninstall Flash?

tomos · « **Reply #20 on:** July 15, 2015, 05:26 AM »

Firefox has become pretty aggressive at blocking vulnerable Flash versions. So maybe it's not necessary to uninstall Flash?
-Deozaan (July 14, 2015, 05:53 PM)

yeah, I think you're right - there's also the option to "Never Activate".
I posted more because I was suprised that unlike addons, plugins cannot be uninstalled. (And there's a few here I didnt install e.g. "Primetime Content Decryption Module provided by Adobe Systems, Incorporated 11"). So yeah, it was a more general comment.

lanux128 · « **Reply #21 on:** July 15, 2015, 05:42 AM »

yeah, I think you're right - there's also the option to "Never Activate".
I posted more because I was suprised that unlike addons, plugins cannot be uninstalled. (And there's a few here I didnt install e.g. "Primetime Content Decryption Module provided by Adobe Systems, Incorporated 11"). So yeah, it was a more general comment.
-tomos (July 15, 2015, 05:26 AM)

To uninstall Firefox's Flash plugin you need to download an Uninstaller from Adobe's website.

shrugs $:-\$

MilesAhead · « **Reply #22 on:** July 15, 2015, 05:45 AM »

yeah, I think you're right - there's also the option to "Never Activate".
I posted more because I was suprised that unlike addons, plugins cannot be uninstalled. (And there's a few here I didnt install e.g. "Primetime Content Decryption Module provided by Adobe Systems, Incorporated 11"). So yeah, it was a more general comment.
-tomos (July 15, 2015, 05:26 AM)

To uninstall Firefox's Flash plugin you need to download an Uninstaller from Adobe's website.

shrugs $:-\$
-lanux128 (July 15, 2015, 05:42 AM)

Or for plugins generally in Firefox do
about:plugins
to see where they live and pick them off manually.

lanux128 · « **Reply #23 on:** July 15, 2015, 05:51 AM »

Or for plugins generally in Firefox do
about:plugins
to see where they live and pick them off manually.
-MilesAhead (July 15, 2015, 05:45 AM)

yup i got to the about:plugins page but like tomos, i was making a general statement on how convoluted the process is.

tomos · « **Reply #24 on:** July 15, 2015, 06:01 AM »

^Yeah, I saw it as a bit of a security risk.
But OTOH I guess if someone is going to go so far as to check the plugins page, they are going to be able to do a search on how to remove $:-\$