Adobe to Patch Two More Zero-Day Flaws in Flash
Adobe will patch its 37th and 38th CVE for the month of July, as fallout continues from the Hacking Team breach.Adobe just can't seem to get any respite from the seemingly endless onslaught of zero-day vulnerabilities being discovered in its much maligned Flash Player. Adobe is set to patch two new zero-day Flash vulnerabilities this week, both of which were discovered in the data dump from the breach of Italian security vendor Hacking Team. Hacking Team's breach was disclosed on June 5, with 400GB of information publicly released, including information on multiple zero-day exploits. The two new Flash zero-day exploits—CVE-2015-5122 and CVE-2015-5123—join the CVE-2015-5119 exploit that was also discovered in the Hacking Team breach. Adobe patched CVE-2015-5119 on July 8 as part of an update that provided fixes for 36 flaws in the company's Flash Player. The CVE-2015-5122 flaw was first discovered in the Hacking Team documents by security firm FireEye. "The CVE-2015-5122 PoC (Proof of Concept) is well written like the previous PoC for CVE-2015-5119 by the same author," Dhanesh Kizhakkinan, senior research scientist at FireEye, wrote in a blog post. "The vulnerability is triggered by freeing a TextLine object within the valueOf function of a custom class when setting the TextLine's opaqueBackground."
The discovery of the second new zero-day—CVE-2015-5123—being patched by Adobe is credited to security firm Trend Micro. "Based on our analysis, this vulnerability is also of valueOf trick bug," Peter Pi, threats analyst at Trend Micro, wrote in a blog post. "However, compared to the first two reported Flash zero-day exploits, it involves the BitmapData object and not the TextLine and ByteArray."