erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: February 26, 2013

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Most can relax: Adobe Flash Player: Four 2013-2014 Zero-Days Added to KEV. Owners of legacy Windows, macOS or Linux machines, kiosks, lab images or industrial workstations that still have Flash Player installed and a browser or application that loads it.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

· Vulnerability · CVE-2013-0643, CVE-2013-0648

Adobe Flash Player: Four 2013-2014 Zero-Days Added to KEV

These are 2013-2014 zero-days in a plugin Adobe stopped supporting in 2020 and modern browsers no longer load; the only job left is to find and remove any Flash Player still installed on legacy machines.

Must act: Owners of legacy Windows, macOS or Linux machines, kiosks, lab images or industrial workstations that still have Flash Player installed and a browser or application that loads it.

Can relax: Anyone on a current browser with Flash Player already uninstalled; no supported browser runs Flash content, and every Flash build since February 2014 already contains these fixes.

  1. Inventory endpoints and golden images for any installed Flash Player, including standalone copies and plugins bundled with old browsers.
  2. On Windows 10 and Windows Server 2012-2019 builds that shipped Flash, install KB4577586 to remove the Windows-bundled copy.
  3. Uninstall every remaining standalone Flash Player; do not reinstall old builds to patch these CVEs.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.