hello, adobe has released a critical patch to mitigate yet another vulnerability in its flash plugin, which is reportedly already exploited in the wild. https://helpx.adobe.com/security/products/flash-player/apsa15-01.html

please update to Adobe Flash Player version 16.0.0.296 as soon as possible, which you can download from http://www.adobe.com/products/flashplayer/distribution3.html (use the windows-exe for plugin-based browsers).

Thanks philipp,

That solved the issue, although I do want to mention a couple things for the benefit of other people searching about this issue,

as of this writing:

- The Update Now button on the firefox plugin check page takes you to the download for 16.0.0.287, not 16.0.0.296 (I don't know if that is a Firefox problem or a Adobe problem) Somebody somewhere needs to fix this crack that things are falling through.

- the download link in philipp's post takes you to a page which does not appear to have 16.0.0.296. Instead it has the heading "Flash Player 16.0.0.287 (Win and Mac)". But when you click on Windows Plugin-based browsers Download EXE Installer, it downloads .296, not .287 (and due to vague file naming you can't even know that till after you install it). Which is good, it's what you want, but anybody just reading the page would assume that they haven't found the correct version and probably wouldn't download it since it says it's the one they already have.

It's doing it again. Only this time the above solution doesn't work.

Firefox Plugin Check says that 16.0.0.296 is vulnerable and needs to be updated. But if you click Update Now it takes you to download the same version.

Also if you do the manual download process in the Chosen Solution above, it doesn't work this time, because this time that doesn't get you a newer version.

Why is FF able to tell me that Flash is not up to date but not able to help me update it? *confused*

unforunatley the result of the plugin-check page is correct, there has been yet another vulnerability found in adobe flash player 16.0.0.296 which is already exploited in the wild. see the security advisory: https://helpx.adobe.com/security/products/flash-player/apsa15-02.html

there is no fix for it released by adobe yet and the update button on the plugin check site will lead nowhere at the moment - so it's best to set the shockwave flash plugin to ask-to-activate in the firefox addons > plugins panel!

I submit that FF shouldn't offer an "update now" button if there is no actual update available. This is what leads to the described "infinite update loop," because people assume that if it offers "update now," then they're *out of date,* not just vulnerable.

Could FF instead grey out the "update now" unless/until there's a patch available? And, even better, give some indication of what action they should take instead while a patch is (hopefully) being developed, and alert people when the patch is then ready for download?

Respectfully, /Will Sadkin

Ah yes, I noticed that in another thread after posting that reply, sorry.

However, I can't help but say that It is not correct for it to strongly imply that the plugin is out of date when it's not.

edit: Right on Will

hi will, i fully agree with your suggestion - however the support forum isn't really set up to process feedback like this effectively. could you post this piece of feedback at https://input.mozilla.org/feedback instead? there it will be read and analysed by mozilla's staff... thanks!

Done.

How do i install adobe flash player for Firefox and it keeps telling me to quit Firefox when it is already closed? I tried with Firefox closed thru Google Chrome and I am still in the horrible loop of telling me to close Firefox. It says I am vulnerable when I go to the Add-ons and look to see if they are up to date. Just wanna get this fixed and move on. Suggestions anyone?