Commenting on the Flash Player 2/14/2017 releases

[erpguy8c]

I've created this topic because I would like to make some comments about the Flash Player 24 release announcement made on Feb. 14. 2017:

2/14/2017 - Release - Flash Player 24

Microsoft has chosen not to release any security updates this February, and that includes any new Flash Player ActiveX updates for Windows 8.1 and Windows 10.  Therefore, there are no available Flash Player v24.0.0.221 ActiveX updates for Internet Explorer 11 & Microsoft Edge for Windows 8.1 and Windows 10 and the links to the downloads on the announcement page are incorrect.  In fact the Flash Player downloads for Windows 8.1 and Windows 10 actually download the previous version - v24.0.0.194 from KB3214628.

Read about Microsoft's announcement here:

February 2017 security update release – MSRC

Also the Adobe flash player security bulletin APSB17-04:

Adobe Security Bulletin

the bulletin links to a Microsoft security advisory for Windows 8.1 & 10 that does not even exist yet.

Please inform the Adobe security team to update the security bulletin about Microsoft's decision to not release any of their security patches, including the new Flash Player ActiveX updates for Windows 8.1 and Windows 10 which will not be released at this time.

[jeromiec83223024]

Thanks for pointing that out.  This stuff was prepared and staged well in advance of Microsoft's announcement. 

While we did our part in providing the bits described in the bulletin to Microsoft in a timely manner, they ultimately control the distribution pipeline for their operating system and browser. 

As Microsoft has chosen to cancel Patch Tuesday this month, those changes are currently not available for our mutual customers.  This is an unprecedented outcome (at least in the time that they've been distributing Flash Player), and we're sure that our counterparts at Microsoft are working diligently to get the best possible, most expedient resolution.

We do not have information at this time as to when Microsoft might push this update out on their platform.  I'll let the security team know that we should probably update these documents with a caveat about Microsoft's decision to not ship their Patch Tuesday release.

[erpguy8c]

thanks jeromiec83223024.

I've just found out today Feb. 21 from this Infoworld article that Microsoft may release the new Flash Player security updates for Windows 8.1 & Windows 10 later today:

Surprise! Microsoft issues Flash patches for Internet Explorer, Edge | InfoWorld

Let chris.campbell know about this also.

[chris.campbell]

Thank you for the updates!  The latest word is that this release should occur at or around 2pm PST today.  We'll update if we learn of any additional changes.

[erpguy8c]

Ok.  Microsoft has just published their security bulletin MS17-005 and MS support KB article 4010250 mentioning the newest Flash Player 24.0.0.221 security updates for Windows 8.1 and Windows 10.

Microsoft Security Bulletin MS17-005 - Critical

Tell the Adobe security team to modify Adobe security bulletin APSB17-04 to mention Microsoft's new security bulletin MS17-005.