54 replies to this topic

[Corrine]

Adobe recognizes the critical nature of updating third-party software.  As a result, this release of Flash Player contains a new background updater.  As explained by Peleus Uhley in An Update for the Flash Player Updater,

"If you read this September 2011 CSIS report, then you saw that 99.8 percent of malware installs through exploit kits are targeting out-of-date software installations. This point was reiterated recently in volume 11 of the Microsoft Security Intelligent Report. Also, attackers have been taking advantage of users trying to manually search for Flash Player updates by buying ads on search engines pretending to be legitimate Flash Player download sites. Improving the update process is probably the single most important challenge we can tackle for our customers at this time."

(See source for links to CSIS report & Microsoft SIR.)

After updating to Adobe Flash Player 11.2, the following update options will be available:

    Install updates automatically when available (recommended)
    Notify me when updates are available
    Never check for updates (not recommended)

Flash Player 11 (32-Bit)

    IE 32-Bit:  http://fpdownload.macromedia.com/get/flash...dc/11.2.202.228 /install_flash_player_ax_32bit.exe
    Non-IE 32-Bit (Opera, Firefox etc):  http://fpdownload.macromedia.com/get/flash...dc/11.2.202.228 /install_flash_player_32bit.exe

Flash Player 11 (64-Bit)

    IE 64-Bit:  http://fpdownload.macromedia.com/get/flash...dc/11.2.202.228 /install_flash_player_ax_64bit.exe
    Non-IE 64-Bit (Opera Firefox etc):  http://fpdownload.macromedia.com/get/flash...dc/11.2.202.228 /install_flash_player_64bit.exe

[LilBambi]

Glad to hear it.

[zlim]

Is version 11.2 out of beta?
I have not installed anything beyond 11.1.102.63 because everything beyond that was listed as a beta release and the 11.2 newest is called RC1.

[frapper]

FileHippo is still showing it as a Release Candidate.

Latest Version
Flash Player 11.2.202.221 RC 1 (IE)

[Corrine]

Yes, version 11.2 was released.  From the Security Advisory:

Adobe recommends users of Adobe Flash Player 11.1.102.63 and earlier versions for Windows, Macintosh and Linux update to Adobe Flash Player 11.2.202.228. Users of Adobe Flash Player 11.1.102.63 and earlier versions for Solaris should update to Adobe Flash Player 11.2.202.223. Users of Adobe Flash Player 11.1.111.7 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.8. Users of Adobe AIR 3.1.0.4880 for Windows, Macintosh and Android should update to Adobe AIR 3.2.0.2070.

This update resolves a memory corruption vulnerability related to URL security domain checking that could lead to code execution (ActiveX, Windows 7 or Vista only) (CVE-2012-0772).

This update resolves a memory corruption vulnerability in the NetStream class that could lead to code execution (CVE-2012-0773).

[Corrine]

The links in my original post were malformed (thanks, Aryeh).  Guess I should have just linked to my blog post.

Flash Player 11 (32-Bit)

    IE 32-Bit:  http://fpdownload.macromedia.com/get/flash...er_ax_32bit.exe
    Non-IE 32-Bit (Opera, Firefox etc):  http://fpdownload.macromedia.com/get/flash...layer_32bit.exe

Flash Player 11 (64-Bit)

    IE 64-Bit:  http://fpdownload.macromedia.com/get/flash...er_ax_64bit.exe
    Non-IE 64-Bit (Opera Firefox etc):  http://fpdownload.macromedia.com/get/flash...layer_64bit.exe

[zlim]

MajorGeeks has it marked as Final so all my XP and 7 computers have been patched.

[LilBambi]

Adobe's latest critical security update pushes scareware - Ed Bott Blog at ZDNet:

Summary: Adobe just released a critical Flash Player security update. Good news: it includes a new automatic updater for Windows. Bad news: Adobe’s download page pushes a misleading “system optimizer” designed to scare users into paying for unneeded repairs.

More in the article.

It mentions what Corrine was saying, but it also notes that Adobe now shows misleading ad for a so called system optimizer on the resultant page that opens to prove the Flash Player is installed properly.

Hopefully most will know to ignore crap like that, but un savvy friends and family may need to be made aware before they click on something they don't need.

[Corrine]

It isn't necessary to go to About Adobe Flash Player webpage.  Instead, right-click on content running (i.e., head to http://www.youtube.com) in Flash Player and select "About Adobe Flash Player" from the menu.

Edit Note:  I discovered that the right-click check for version works with Firefox but not IE9.

[Tushman]

FileHippo is still showing it as a Release Candidate.

Why rely on a 3rd party to tell what is the latest version when you can get it directly from the source?

[Temmu]

as corrine already noted, this stuff was quite a scare in the security community -
Adobe Flash Player Memory Corruption Vulnerability CVE-2012-0772
Adobe Flash Player FLV Parsing Memory Corruption Vulnerability CVE-2012-0773
Oracle Java SE Remote Java Runtime Environment Remote Code Execution Vulnerability CVE-2012-0507

[zlim]

File hippo doesn't include the junk that adobe does. I don't have to uncheck whatever av program or toolbar it adobe wants to include. 9McAfee now but I think it might have been Norton in the past and perhaps google toolbar too).
I download the IE and the non IE versions from filehippo, put it on a USB stick and install it on all my computers from the stick. I've been doing it this way for several years and prefer it to going to adobe's site. We all don't do things the same way.

[Corrine]

The FTP version available from Adobe doesn't include any extras.

[Tushman]

File hippo doesn't include the junk that adobe does. I don't have to uncheck whatever av program or toolbar it adobe wants to include. 9McAfee now but I think it might have been Norton in the past and perhaps google toolbar too).
I download the IE and the non IE versions from filehippo, put it on a USB stick and install it on all my computers from the stick. I've been doing it this way for several years and prefer it to going to adobe's site. We all don't do things the same way.

The point that i was making is that Adobe (the source of the software) is far more likely to have the latest [the most current] information on a final version release than a 3rd party hosting site.  If you use the download link that provided in my post above, you won't get any bundled software.  We've had this discussion in the past (or similar topics covering flash player).  There's always been links that members have provided for the full stand alone installer that didn't come with extra 'crap' software.  I see no reason to rely on FileHippo.

Edited by Tushman, 30 March 2012 - 10:52 PM.

[Temmu]

you have a good point, tushman, i would think that adobe would have an up-to-the-minute current version.

and, i like corrine's idea, ftp from adobe - 'cause i hate drive-by crap-ware.

[zlim]

According to an article posted here from ComputerWorld, flash got updated again today for a zero day exploit.
http://www.computerw... Computerworld)

So what is the ftp link?

[LilBambi]

Here ya go Liz: http://www.adobe.com...tribution3.html

Not the ftp link but the page to download all versions from one place.

EDIT: The .msi installer links on the page above are actually the FTP links!

Edited by LilBambi, 05 May 2012 - 11:16 AM.
noted about the .msi installer links being the ftp links

[LilBambi]

Corrine, are these links still the same from the March posting here for the FTP or slightly modified?

[Corrine]

I've had the information open since 9:00 AM this morning to write a blog post about the Adobe Flash update but got tied up with other tasks.

32-bit ActiveX for Internet Explorer:  http://fpdownload.ma...ive_x_32bit.exe
64-bit ActiveX for Internet Explorer:  http://fpdownload.ma...ive_x_64bit.exe

32-bit plug-in version for Firefox, Opera, Safari:  http://fpdownload.ma...lugin_32bit.exe
64-bit plug-in version for Firefox, Opera, Safari:  http://fpdownload.ma...lugin_64bit.exe

---

Reminder:  Just because you have a 64-bit OS, it does not mean you need the 64-bit version of Flash Player unless you are using a 64-bit browser.  For example, I have 64-bit Windows 7 but use the 32-bit version of IE & FF.  (Does FF even have a 64-bit version?)

[LilBambi]

Thanks Corrine!

My posting here on it: Adobe patches new Flash zero-day bug with emergency update – Computerworld

I was reading your other posting and didn't make the connection on Windows Live going away until you posted here: Good-bye Windows Live, Hello Microsoft Apps. Thanks for that, Corrine.

[Corrine]

Yes, its interesting about Windows Live.  In fact, following the branding change from Windows Live to Microsoft Apps, announced on the Building Windows 8 blog, concerns have been raised by bloggers who use Windows Live Writer.  

There is no mention of Windows Live Writer either in the discussion of the changes or the table included in the announcement.  If you are a blogger using Windows Live Writer, sign the petition and include your prefered solution number.

Quote

Proposed Solutions

Solution number 1: Release a metro style app that behaves in the same way as live writer, including its plugin architecture.

Solution number 2: Make Live Writer open source, this way the community themselves can keep Live Writer going and keep it fresh. There are no tie-ins with Windows Live ID anymore so no security problems should exist. This solution also keeps alove the huge collection of plugins that have been written for Live Writer which is one of the huge plus points of the software

Go to Save Windows Live Writer.

(Article on Computerworld by Greg Keizer:  Bloggers plead for Windows Live Writer's life)

[LilBambi]

I don't use it but that is weird. Why would they 'appear' to kill of one of the well used, apparently, programs from the Windows Life suite? And why no word either way when folks are concerned about it.

That makes no sense at all. I can understand why people are upset if they are using that program and gotten used to it all this time.

Sigh...

Maybe they will make Windows Live Writer Open Source... that would explain why they are holding off maybe...

Solution #2 would be best overall likely.

[zlim]

Thanks Corrine. I will bookmark the Adobe ftp sites.
I managed to grab what I needed last night at MajorGeeks and updated 4 computers running XP and 7.

There is a thread at the Adobe forum that I need to study about a hack to get updated flash on a windows 2000 computer.
Adobe supported up to 10.1.102.64 on 2K and yet I managed to install 11.1.102.55 on both computers.

I don't surf on my 2K computer but I do use it as a test before I update my husband's. I can't seem to wean him off the 2K one and get him to use the XP one attached by the KVM switch on his desk. It has more RAM and runs faster but he insists on firing up the old, slow one.

[goretsky]

Hello,

Just in case anyone needs MSI packages for deployment reasons, if you replace the .exe at the ends of those filenames with .msi, you'll download those, instead.

Regards,

Aryeh Goretsky

Corrine, on 04 May 2012 - 07:18 PM, said:

I've had the information open since 9:00 AM this morning to write a blog post about the Adobe Flash update but got tied up with other tasks.

32-bit ActiveX for Internet Explorer:  http://fpdownload.ma...ive_x_32bit.exe
64-bit ActiveX for Internet Explorer:  http://fpdownload.ma...ive_x_64bit.exe

32-bit plug-in version for Firefox, Opera, Safari:  http://fpdownload.ma...lugin_32bit.exe
64-bit plug-in version for Firefox, Opera, Safari:  http://fpdownload.ma...lugin_64bit.exe

---

Reminder:  Just because you have a 64-bit OS, it does not mean you need the 64-bit version of Flash Player unless you are using a 64-bit browser.  For example, I have 64-bit Windows 7 but use the 32-bit version of IE & FF.  (Does FF even have a 64-bit version?)

[securitybreach]

Thanks for the information, somehow I missed this post. Anyway, I guess I am up to date :

╔═ comhack@Cerberus 01:47 PM 
╚═══ ~-> pacman -Qi flashplugin | grep Version
Version		: 11.2.202.235-1