Adobe patches Flash Player, plans out-of-band Reader fix

Story updated on Friday, Feb. 12 at 1:00 p.m. EST

Adobe on Thursday made available an update to its widely deployed Flash Player to resolve a single "critical" flaw.

"The vulnerability could subvert the domain sandbox and make unauthorized cross-domain requests," resulting in a potential denial-of-service condition, according to a security bulletin. A successful exploit also could lead to a cross-site request forgery (CSRF) attack, Brad Arkin, Adobe's director of product security and privacy, said.

Adobe recommends users ditch Flash version 10.0.42.34 and install 10.0.45.2, which is available here or through the software's automatic prompting feature.

Also on Thursday, the company announced plans to release an out-of-band update for its Reader and Acrobat software, according to a separate bulletin. The update for versions 9.3 and 8.2, scheduled for Tuesday, addresses a number of critical vulnerabilities and is meant for Windows, Mac and UNIX installations. One of the bugs remedied is the issue described in the Flash update.

Arkin told SCMagazineUS.com on Friday that the company was delivering the update "out of a preponderance of caution," adding that there are no known attacks targeting Reader and Acrobat.

Adobe's next scheduled quarterly update for Reader and Acrobat is April 13.