Adobe's AIR 1.5 update addresses Flash Player vulnerabilities

Share this article:

Adobe on Monday released AIR 1.5 to address vulnerabilities that could allow an attacker to execute untrusted JavaScript code with elevated privileges, Adobe said in a security bulletin.

The vulnerability is triggered when an AIR application loads data from an malicious source.

Released in February 2008, Adobe AIR is a cross-operating system runtime that enables users to build and deploy rich internet applications to the desktop with existing HTML/AJAX, Flex, or Flash web development tools.

An earlier version, Adobe AIR 1.1, utilizes an old version of Flash Player that contains multiple security vulnerabilities. The AIR update includes Flash Player 10, Adobe's newest version of Flash Player that was issued last month. Flash Player 10 closed up vulnerabilities that left users open to clickjacking and a number of other exploits.

Because of the Flash Player vulnerabilities in AIR 1.1, Adobe listed the update as critical and recommended all AIR users update to version 1.5.

That upgrade also includes an improved encryption feature that enables users to more easily support large encrypted files, according to an Adobe Developer Center article posted yesterday.

Adobe was not available immediately Tuesday for comment.

US-CERT on Tuesday issued an alert also encouraging users to update.

As a testament to its popularity, AIR will be used for a news reader application for The New York Times, Michael Zimbalist, the Times' vice president of research and development announced on Monday at the Adobe MAX conference.

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.