The following software versions are affected and should be updated as soon as possible: Adobe Flash Player 11.9.900.117 and earlier versions for Mac and Windows, as well as Adobe Flash Player 11.2.202.310 and earlier versions for Linux. Moreover, updates are also available for Adobe AIR 3.9.0.1030 and earlier versions for Windows and Macintosh.
Adobe’s security bulletin (APSB13-26) describes the bugs fixed in the Flash Player update as follows:
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2013-5329, CVE-2013-5330).
MORE: How to Tell if Adobe Flash Player Update is Valid
In addition to updating Flash Player, Adobe released a security hotfix for ColdFusion versions 10, 9.0.2, 9.0.1 and 9.0 for Macintosh, Windows and Linux. The hotfix addresses an important cross-site scripting vulnerability, as well as a critical remote read vulnerability.
The ColdFusion security bulletin (APSB13-27) describes the bugs fixed in this hotfix as follows:
Users of Adobe Flash Player 11.9.900.117 and earlier versions for Mac should install the 17.5 MB update to Adobe Flash Player 11.9.900.152. Adobe Flash Player 11.9.900.117 installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 11.9.900.152 for Windows, Macintosh and Linux.
Users of Adobe AIR 3.9.0.1030 and earlier versions for Mac and Windows should install the 26.2 MB update to Adobe AIR 3.9.0.1210.
Adobe recommends ColdFusion customers update their installation using the instructions provided in the technote located here. ColdFusion customers should also apply the security configuration settings as outlined on the ColdFusion Security page, and also review the ColdFusion 9 Lockdown Guide and ColdFusion 10 Lockdown Guide.
