Adobe patches two critical vulnerabilities in Shockwave Player

The flaws could allow attackers to execute malicious code on computers remotely

Adobe Systems released a security update for Shockwave Player in order to address two vulnerabilities that could allow attackers to remotely take control of affected systems.

The new Shockwave Player version released Tuesday is 12.0.9.149 and is available for Windows and Mac.

[ InfoWorld's expert contributors show you how to secure your Web browsers in a free PDF guide. Download it today! | Learn how to protect your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

The update fixes two memory corruption vulnerabilities identified as CVE-2014-0500 and CVE-2014-0501 that could lead to code execution, Adobe said in a security advisory. The vulnerabilities were reported to the company by researcher Liangliang Song of Fortinet's FortiGuard Labs.

The Shockwave Player update comes one week after Adobe broke out of its regular patching cycle to release an emergency update for Flash Player that addressed an actively exploited vulnerability. Unlike the Flash Player flaw, there are no reports that the Shockwave Player vulnerabilities are being exploited in attacks.

Shockwave Player is needed to display online content like games, product demonstrations, e-learning courses and simulations created with Adobe's Director software. It's not as widespread as Flash Player, but it is deployed on over 450 million desktop computers according to Adobe, which makes it a potential target for hackers.

Shockwave Player installs a plug-in in Web browsers which means it can be attacked with drive-by download exploits loaded from maliciously crafted or infected websites.