For me (using CS 4) it is not only the timing.

I've paid a lot of money not too long ago for this software. Now the vendor tells me that it has "critical vulnerabilities", i.e. I've paid for a product that is defective. And now I have to pay for fixing something I've already paid for?

Great customer service!

I don't think that I had to pay for a fix if my car loses it's wheels spontaneously. And I don't think that the car company would tell me "Buy a new car!"

I must say, I find the Security Bulletin strange, to say the least.  It starts out by saying the following, which sounds normal and reasonable.

Adobe released a security upgrade for Adobe Photoshop CS5 and earlier for Windows and Macintosh.

Then they hit you with this:

Adobe has released Adobe Photoshop CS6 (paid upgrade), which addresses these vulnerabilities.

Come to think of it, this may be a good business model... put some serious security vulnerabilities into the software on purpose, then charge people to buy the next version that fixes the problem...  

I agree this looks egregious and despicable.

Hohohoho!  They updated and revised that bulletin today, after this thread was started and the first five replies were posted, including my post calling for taking Adobe to court.  Just a happy coincidence, of course.

Revisions

May 11, 2012 - Added information on update to Adobe Photoshop CS5.x.
May 10, 2012 - Corrected last affected version number.
May 8, 2012 - Bulletin released.

You are right - when I read the security bulletin the last revision was the one stating "Corrected last affected version number".  Whatever the reason they added the new revision comment, it is the right thing to do for Adobe to release a security fix for CS5.

Adobe used to be a responsive company. As they have bought out or defeated their competition, their service has declined. I have had to get the better business bureau involved the last three orders due to inability to get response from the company. In none of the cases was the problem difficult to fix (shipment to wrong state, wrong version sent, etc), but Adobe has made it almost impossible to get any response other than a canned email reply that does not allow reply. Their phone callback system is a joke, generally getting a promise that is not kept.

They make some great products and I and my company have spent tens of thousands of dollars on their software. But they are getting smug.

that the update was scheduled, but since the corporate policy at Adobe is to never speak about unannounced software, no mention was done until it was ready...

I do not believe the policy of unannounced software applies to security fixes. Note that Adobe has announced the fix for CS5 even thought it is not released yet.

Given that the vulnerability affects CS5 and previous releases and one of the vulnerabilities is a buffer overflow, I suspect the fault is in "legacy" code. I wonder how hard it would be for Adobe to fix releases prior to CS5?  Would the CS5 fix be backward compatible, requiring not much more than recompiling the module for prior releases? And, of course, testing.

I understand  it is impractical for any software developer to support all back releases. But security updates are special. Adobe, and all software companies, have an interest in keeping the Web as safe as possible. All developers should make security fixes as widely applicable as possible. I would note that Microsoft still makes security fixes available for Windows XP and Office 2003, even though mainline support for those products ended. Both of those products are over a decade old.