Out-of-band patch release from Adobe

Unscheduled update released by Adobe.

Adobe

has released an unscheduled patch for its

Reader

and

Acrobat

programs to address some critical flaws.

The software company’s fixes usually follow a quarterly release schedule, and last month saw a bumper crop, so none were expected to be published this month, but the vulnerabilities in

Reader

and

Acrobat

were sufficiently severe to warrant an out-of-cycle update.

The update addresses two critical vulnerabilities, the first of which could be used to subvert the domain sandbox and make unauthorized cross-domain requests, and the second of which could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Users are urged to upgrade to

Acrobat

version 9.3.1 and

Reader

version 9.3.1.

Adobe

has come under increasing fire for its record on vulnerabilities of late, with many experts predicting an increase in the growth of malware using PDF and

Flash

exploits over the coming year.

Adobe

‘s security bulletin can be found

here

. Comment on the release can be found at

The Register


here

.

Posted on 17 February 2010 by

Virus Bulletin