Adobe today patched Flash Player, the fifth time this year it's updated the vulnerability-plagued software.
Unlike two of the three updates last month, however, today's was part of Adobe's regularly-scheduled patch cadence.
[ Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to stop them in "Fight Today's Malware," InfoWorld's Shop Talk video. | Keep up with key security issues with InfoWorld's Security Adviser blog and Security Central newsletter. ]
Last November, Adobe announced it would pair its Flash security updates with the monthly Patch Tuesday releases by partner Microsoft. Adobe has fixed Flash flaws on the second Tuesday of each month since then.
The Flash update, designated APSB13-09, patched four critical vulnerabilities that included a use-after-free bug, integer and buffer overflows, and an unspecified memory corruption flaw. All could be used by attackers to execute malicious code, hack Flash and hijack a Windows PC or OS X-powered Mac.
Adobe said that none of the four vulnerabilities has been seen exploited in the wild.
Along with the update to the Flash Player browser plug-ins, Google and Microsoft issued their own patches, as they have integrated Flash with their respective Chrome and IE 10 (Internet Explorer 10) browsers.
Adobe did not patch the bug or bugs that a team from Vupen, a French vulnerability research and exploit-selling firm, used to hack Flash Player at last week's Pwn2Own contest. The Vupen team was awarded $70,000 for demonstrating their hack of Flash on IE9 running in Windows 7.
Pwn2Own's sponsor, HP TippingPoint's Zero Day Initiative (ZDI) bug-bounty program, collected the vulnerabilities and attack code used by all contestants, and has passed the information along to the vendors, including Adobe.
"No surprise," said Andrew Storms, director of security operations at nCircle Security, in an instant message today, when asked about Adobe omitting a fix for the Pwn2Own vulnerability. "If Microsoft couldn't get it done by today, I wouldn't think Adobe could."
Adobe confirmed today that it plans to patch the Vupen bug(s) next month as part of its April 9 update.
Microsoft, which also issued its Patch Tuesday updates today, was in the same boat: It did not include fixes for the multiple vulnerabilities in IE10 on Windows 8 that Vupen exploited at Pwn2Own. For their IE10 feat, the French researchers received $100,000.
Adobe credited today's vulnerability reports to Google -- whose engineers sussed out two of the four; an anonymous researcher who filed with iDefense, which like TippingPoint runs a bounty program; and Attila Suszter, who writes the Reversing on Windows blog.