It usually takes a day or so after Adobe announces its own security updates that Microsoft also provides matching updates for IE10 and IE11. IE10 and IE11, of course, have integrated Flash, so customers can't just install Adobe's version – they have to wait for Microsoft to make one available.
Adobe decided a few years back that it follow Microsoft and use the second Tuesday of each month to schedule updates. This always adds to the complexity of Patch Tuesday. Yesterday, Adobe released security bulletin APSB15-06 describing a vulnerability in Flash. The exploit, CVE-2015-3043, already exists in the wild. Adobe's update covers the following platforms:
-
Users of the Adobe Flash Player desktop runtime for Windows and Macintosh should update to Adobe Flash Player 17.0.0.169.
-
Users of the Adobe Flash Player Extended Support Release should update to Adobe Flash Player 13.0.0.281.
-
Users of Adobe Flash Player for Linux should update to Adobe Flash Player 11.2.202.457.
-
Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, will automatically update to version 17.0.0.169 when available.
Instead of creating a new advisory each month, Microsoft just updates the one created in September of 2012. Microsoft Security Advisory 2755801 has now been updated to reflect the latest release:
On April 15, 2015, Microsoft released an update (3049508) for Internet Explorer 10 on Windows 8, Windows Server 2012, Windows RT, and for Internet Explorer 11 on Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows Technical Preview, and Windows Server Technical Preview. The update addresses the vulnerabilities described in Adobe Security bulletin APSB15-06. For more information about this update, including download links, see Microsoft Knowledge Base Article 3049508.
