Cascading Stylesheets are only considered malicious when they invoke the JavaScript engine,” says a description on the OWASP site. “The term ‘malicious code’ in regards to web applications usually mean JavaScript. AntiSamy is an API that checks user content supplied in HTML/CSS, such as profile information or comments, for malicious code. The additional OWASP tools include features from the organization’s AntiSamy Project. “Administrators will now find it even easier to lock down their environments.” “Overall, this latest iteration of the platform increases flexibility for developers, while enhancing security,” said lead security strategist Peleus Uhley in a statement. This hole doesn't affect ColdFusion 10.Adobe said the enhancements give developers more security controls that can be integrated into applications.Īdobe said the enhancements give developers more security controls that can be integrated into applications. Those include a new set of OWASP tools integrated into the platform, additional Secure Profile controls that were originally introduced in ColdFusion 10, and new crypto enhancements to existing APIs.

Security hole CVE-2013-3349 in ColdFusion versions 9.0, 9.0.1 and 9.0.2 that run on JRun could trigger Denial-of-Service (DoS) scenarios. In ColdFusion 10 for Windows, Mac OS X and Linux, security hole CVE-2013-3350 enables attackers to 'invoke public methods on ColdFusion Components using WebSockets'. Windows and Mac OS X users can fix their players by updating to version 12.0.3.133.Ī total of two vulnerabilities that can now be hotfixed have been lurking in Adobe's ColdFusion. The security hole in Adobe's Shockwave also enables attackers to execute malicious code on a system. Older versions of Android such as 3.x and 2.x should be updated to version 11.1.111.64 of Flash Player (Adobe unsupported archive download ). Recent Android 4.x systems can be made current by updating to 11.1.115.69 (Adobe unsupported archive download ). The versions of Flash Player for Google Chrome (11.8.800.97) and for Internet Explorer 10 (11.8.800.94) should update automatically. An update to version 11.2.202.297 is available for Linux. Windows and Mac users should update to version 11.8.800.94.

The patches for Flash Player fix security holes that allowed potential attackers to trigger crashes and take control of affected systems. Of the holes in ColdFusion, one is 'Critical', while the other is 'important'. The updates close critical vulnerabilities.

Adobe has released security updates for its Flash Player and Shockwave Player products as well as hotfixes for ColdFusion.

Adobe coldfusion 11 new features