Adobe's AIR 1.5 update addresses Flash Player vulnerabilities

Adobe on Monday released AIR 1.5 to address vulnerabilities that could allow an attacker to execute untrusted JavaScript code with elevated privileges, Adobe said in a security bulletin.

The vulnerability is triggered when an AIR application loads data from an malicious source.

Released in February 2008, Adobe AIR is a cross-operating system runtime that enables users to build and deploy rich internet applications to the desktop with existing HTML/AJAX, Flex, or Flash web development tools.

An earlier version, Adobe AIR 1.1, utilizes an old version of Flash Player that contains multiple security vulnerabilities. The AIR update includes Flash Player 10, Adobe's newest version of Flash Player that was issued last month. Flash Player 10 closed up vulnerabilities that left users open to clickjacking and a number of other exploits.

Because of the Flash Player vulnerabilities in AIR 1.1, Adobe listed the update as critical and recommended all AIR users update to version 1.5.

That upgrade also includes an improved encryption feature that enables users to more easily support large encrypted files, according to an Adobe Developer Center article posted yesterday.

Adobe was not available immediately Tuesday for comment.

US-CERT on Tuesday issued an alert also encouraging users to update.

As a testament to its popularity, AIR will be used for a news reader application for The New York Times, Michael Zimbalist, the Times' vice president of research and development announced on Monday at the Adobe MAX conference.