Flash security has gotten so bad that security analysts can fully disclose a vulnerability patched only 2 months ago. There's been ~5 0day events since then so...
There have been 10 Linux kernel CVEs issued in the last 2 months. That includes 4 code execution and/or privilege escalation vulnerabilities. That's not even counting any 0 day's that are (probably) sitting in someone's toolbox.
The point being that this isn't a Flash/Microsoft/pick your target problem, but it's an industry wide, software engineering problem.
Am I correct in saying that this bug is because the system library methods can be modified (and that the fix is to make them read-only)? If so, that seems like a huge oversight...
This somewhat reminds me of the quirk of old FORTRAN implementations which could cause the values of constants to be changed accidentally.
9 comments
[ 3.3 ms ] story [ 32.5 ms ] threadThe point being that this isn't a Flash/Microsoft/pick your target problem, but it's an industry wide, software engineering problem.
This somewhat reminds me of the quirk of old FORTRAN implementations which could cause the values of constants to be changed accidentally.
http://occupyflash.org/