Adobe's AIR 1.5 update addresses Flash Player vulnerabilities

Share this article:

Adobe on Monday released AIR 1.5 to address vulnerabilities that could allow an attacker to execute untrusted JavaScript code with elevated privileges, Adobe said in a security bulletin.

The vulnerability is triggered when an AIR application loads data from an malicious source.

Released in February 2008, Adobe AIR is a cross-operating system runtime that enables users to build and deploy rich internet applications to the desktop with existing HTML/AJAX, Flex, or Flash web development tools.

An earlier version, Adobe AIR 1.1, utilizes an old version of Flash Player that contains multiple security vulnerabilities. The AIR update includes Flash Player 10, Adobe's newest version of Flash Player that was issued last month. Flash Player 10 closed up vulnerabilities that left users open to clickjacking and a number of other exploits.

Because of the Flash Player vulnerabilities in AIR 1.1, Adobe listed the update as critical and recommended all AIR users update to version 1.5.

That upgrade also includes an improved encryption feature that enables users to more easily support large encrypted files, according to an Adobe Developer Center article posted yesterday.

Adobe was not available immediately Tuesday for comment.

US-CERT on Tuesday issued an alert also encouraging users to update.

As a testament to its popularity, AIR will be used for a news reader application for The New York Times, Michael Zimbalist, the Times' vice president of research and development announced on Monday at the Adobe MAX conference.

Share this article:

Sign up to our newsletters

More in News

Cyber Command tests gov't collaboration in wake of attacks

The two-week exercise, "Cyber Guard 14-1," was completed this month.

Text message spammer settles charges filed by FTC

Text message spammer settles charges filed by FTC

Rishab Verma and his company agreed to settle charges filed by the FTC that Verma sent millions of spam text messages that deceitfully promised free merchandise.

Rhode Island hospital to pay $150K for past data breach

More than 12,000 patients' personal and health information was compromised in a breach at The Women & Infants Hospital of Rhode Island.