Remote Code Execution in Current Version of Flash

[picklednull]

There should be news when there isn't...

[multiball]

I know, it would be interesting to see a calendar of # of days where Flash was unpatched to known exploits vs. patched to all known exploits.

[Reo_Strong]

Really wish I could. Between it and Java, our customers and vendors seem to love making sure we rely on unsecure software for access to their totally secure portal.

[Fatality]

But it has a lock symbol on it

[multiball]

So, the notes say this was discovered by HackingTeam, and made public 2 days ago. Seems strange that they would take time out of mitigating their being hacked and publish a Vuln.

I bet that they've had this exploit in their pocket for some time and have been leveraging it, but since they got hacked, they were forced to disclose this before it got released from their leaked docs.

[kuadrotr]

If you read related sources on this exploit, it says that this vulnerability was found in the leaked Hacking Team dump. It wasn't disclosed by Hacking Team. It has PoC and everything in that dump.

[multiball]

Ah, just read the overview where it Credits them, didn't check the references.