Hacker News Reader

Comment by guiambros | Hacker News Reader

Note: under Windows, Chrome will install Flash by default, so it's not enough to uninstall the standalone Flash Player. The latest Chrome has Flash 16.0.0.287, which is vulnerable.

If you use Chrome, and want to be safe, go to about:plugins, and disable it manually.

Under Linux the latest is 15.0.0.223, which is not vulnerable (but I'm using Chrome 40.0.2214.10 beta, so YMMV).

View on HN

Do you know that Chrome is vulnerable, or are you just going by the version numbers?

Chrome sandboxes plugins in order to give an extra layer of protection against exactly these kind of exploits. The interesting question will be how it helps in this case. Do you have any info?

ADDED: initial reports suggest Chrome is NOT affected; whether its thanks to Chrome's sandboxing model or whether its because Chrome has patched it isn't clear: http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerab...

Flash is also sandboxed in Firefox and maybe IE. Different sandboxes, of course, but it is no panacea.

I thought that the latest Flash for Linux was 11.2. Where did you get v 15 from? Thanks.

I think it was the version bundled with Google's Chrome browser being referred to, and not the standalone Adobe Flash Player for Linux, which is quite old now.

It isn't actually very old – not much older than current releases on other supported platforms, because quite often security bugs affect it as well, and Adobe updates it as well.

Adobe has promised to support the NPAPI Linux plug-in for a few more years (IIRC till 2017). It doesn't get any new features, but security issues will be fixed, usually at the same time as on other platforms.

v15.0.0.223 is the latest version bundled with Chrome beta.

Reply on news.ycombinator.com