It was reported privately by FortiGuard Labs and as far as we know, is not yet being exploited. The vulnerability, labeled CVE-2014-0505, is rated as Priority 2 (critical) by Adobe. more than a billion, according to Adobe’s statistics), but it’s still a significant installed base so quite a few systems are affected by this.

Fewer systems have Shockwave installed than have Adobe Flash (around 450 million vs. All the user would have to do is visit a web site that’s hosting a malicious Shockwave file, and both Windows and Mac OS X computers are vulnerable. The memory corruption vulnerability that it addresses could be used by attackers to remotely execute code and take over the system. That’s why we found ourselves with a new security update for Shockwave Player just two days after this month’s regular release of two Flash patches (which we’ll cover in our regular end-of-the-month third party patch roundup article). Of course, just like Microsoft, Adobe sometimes finds it necessary to release an “out of band” patch on an emergency basis when a zero day vulnerability poses a serious risk to its users. That’s not to say Adobe never releases fixes for other products on Patch Tuesday, but for products such as Shockwave Player and Photoshop, you never can tell. What you might not have realized, though, is that “officially” the second-Tuesday schedule only applies to Adobe Reader, Acrobat and Flash.

That makes it easier (at least in theory) for IT admins to apply them all on the same day, rather than having to do a patch here and another there. What? You thought we just celebrated Patch Tuesday a few days ago? For several years now, Adobe has been releasing patches for many of its most popular products on the second Tuesday of each month – the same day Microsoft releases their security updates.

Adobe shockwave updates