Zero-day Flash Fix Rolling Out Now for IE10 and IE11

Adobe Flash Player was caught with yet another zero-day flaw this week. Adobe released security fixes yesterday, providing a patch and releasing guidance for updating on affected systems. Affected systems include the usual gang including Windows, Mac, and Linux and any of the following software versions.

Affected software versions:

This patch is important because and attacker…

Starting with Windows 8 and Windows Server 2012, Microsoft started including embedded Flash Player support in IE10. And, as both operating systems were updated and IE11 was released, this continued. But, this means that when Adobe releases security updates for its Flash Player components, Microsoft has to follow up with a patch of its own to ensure IE10 and IE11 match the updated security.

To warn customers, Microsoft put up a Security Advisory shortly after Adobe released its patches. Security Advisory 2755801 is online to view here: Microsoft Security Advisory 2755801. Today, the update is already out the door and well on its way down the Windows Update wires. I received my update first thing this morning.

For those companies staging delivery of the update, Microsoft has made it available for download in the Support Center. It's available for both IE10 and IE11 running on Windows 8 for 32-bit Systems, Windows 8 for 64-bit Systems, Windows Server 2012, Windows RT, Windows 8.1 for 32-bit Systems, Windows 8.1 for 64-bit Systems, Windows Server 2012 R2, and Windows RT 8.1.

Incidentally Server Core for Windows Server 2012 and Windows Server 2012 R2 are not affected.

The downloads are available from here: Microsoft security advisory: Update for vulnerabilities in Adobe Flash Player in Internet Explorer: January 22, 2015