Adobe has patched a zero-day vulnerability used by the BlackOasis APT to plant surveillance software developed by Gamma International.
On Monday, researchers from Kaspersky Lab revealed the new, previously unknown vulnerability which has been actively used in the wild by advanced persistent threat (APT) group BlackOasis.
This security hole, tracked as CVE-2017-11292, has been described as a critical type confusion issue that could lead to remote code execution.
The vulnerability affects the Windows, Mac, Linux and Chrome OS versions of Flash Player, and it has been addressed with the release of versions 27.0.0.159, 27.0.0.130 and 27.0.0.170. Microsoft will likely release an update as well to patch the Flash Player components used by its products such as Windows 10.
The flaw was originally reported to Adobe by Anton Ivanov of Kaspersky Labs. The security firm revealed that the vulnerability has already been exploited by a Middle Eastern threat actor known as BlackOasis to deliver FinFisher spyware in the wild.
CVE-2017-11292 is the first Flash Player zero-day vulnerability patched by Adobe in 2017. Details of the patch can be found on the Adobe website here.
To patch your Adobe Flash, run windows update, and check the About Adobe Flash Player page here.