[ra1d]

The security updates from Adobe include the following products: RoboHelp, Adobe Digital Editions, InDesign, Adobe Experience Manager, Adobe DNG Converter, ColdFusion Builder, Adobe Experience Manager Forms, Adobe Animate and Adobe Flash Player.

There is a 0-day exploit in Adobe Flash Player, and besides that there's a bunch of other vulnerabilities. Here are the unique CVE IDs:

Code

CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892

The update is for Windows, Linux, Mac and Chrome OS, so please do update!

Source: https://helpx.adobe.com/security.html

[Seifer]

Adobe products auto-update these days don't know? I am almost 100% sure flash player does xD

[ra1d]

Adobe products auto-update these days don't know? I am almost 100% sure flash player does xD

That is an option that users can toggle.
If they've toggled it off they just get a pop up.

[Account of the Gods]

how do i hack others with it if they dont patch?
pls tell free

[Soulmate～っ☆]

how do i hack others with it if they dont patch?
pls tell free

😠 whitehat only.

[ra1d]

how do i hack others with it if they dont patch?
pls tell free

If you're asking this question, I am afraid you wouldn't benefit from knowing it.

[Mr. Robot]

Wow thanks for the update mate, really really good timing too.

---

how do i hack others with it if they dont patch?
pls tell free

Here's an example from one CVE - don't worry I am sure they will add it into SEToolkit within the week and you can press 4 buttons to execute an attack on your public IP

How could an attacker exploit these vulnerabilities?
In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a specially crafted website that is designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit any of these vulnerabilities. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.

In a web-based attack scenario where the user is using Internet Explorer in the Windows 8-style UI, an attacker would first need to compromise a website already listed in the Compatibility View (CV) list. An attacker could then host a website that contains specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. For more information about Internet Explorer and the CV List, please see the MSDN Article, Developer Guidance for websites with content for Adobe Flash Player in Windows 8.

Really really great news for pentesting businesses and is going to be fucking amazing over the next couple weeks.

[Bαker]

Thanks for this raid! Always helping the kids of hf