Adobe's AIR 1.5 update addresses Flash Player vulnerabilities

Share this article:

Adobe on Monday released AIR 1.5 to address vulnerabilities that could allow an attacker to execute untrusted JavaScript code with elevated privileges, Adobe said in a security bulletin.

The vulnerability is triggered when an AIR application loads data from an malicious source.

Released in February 2008, Adobe AIR is a cross-operating system runtime that enables users to build and deploy rich internet applications to the desktop with existing HTML/AJAX, Flex, or Flash web development tools.

An earlier version, Adobe AIR 1.1, utilizes an old version of Flash Player that contains multiple security vulnerabilities. The AIR update includes Flash Player 10, Adobe's newest version of Flash Player that was issued last month. Flash Player 10 closed up vulnerabilities that left users open to clickjacking and a number of other exploits.

Because of the Flash Player vulnerabilities in AIR 1.1, Adobe listed the update as critical and recommended all AIR users update to version 1.5.

That upgrade also includes an improved encryption feature that enables users to more easily support large encrypted files, according to an Adobe Developer Center article posted yesterday.

Adobe was not available immediately Tuesday for comment.

US-CERT on Tuesday issued an alert also encouraging users to update.

As a testament to its popularity, AIR will be used for a news reader application for The New York Times, Michael Zimbalist, the Times' vice president of research and development announced on Monday at the Adobe MAX conference.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.