If it seems like you’re being asked to install a new Flash Player update every few weeks, It's not just your imagination.
After a post-holiday lull, the Flash update machine kicked back into overdrive with a February 15 update, followed by another update 18 days later and yet another 23 days later. (I’ve got a complete list of Adobe's long history of Flash Player updates at the end of this post.)
In general, each of these releases is in response to a serious security issue. Flash-based attacks are still among the most popular ways to infect PCs. A Kaspersky study from August 2011 highlighted the unfortunate role of Flash Player in the malware ecosystem:
For the very first time in its history, the top 10 rating of vulnerabilities includes products from just two companies: Adobe and Oracle (Java), with seven of those 10 vulnerabilities being found in Adobe Flash Player alone. Microsoft products have disappeared from this ranking due to improvements in the automatic Windows update mechanism and the growing proportion of users who have Windows 7 installed on their PCs. [emphasis added]
This is why the automatic-updating feature that Adobe has included in the 188.8.131.52 update, released this week, is so important. If you allow people to decide whether they want to install updates or not, a nontrivial number will just say no, because it’s a hassle. They will ignore prompts and warnings. They will continue using outdated software for which one or more critical updates is available.
The only way to get consistently high update numbers is to deliver and install those updates automatically. Chrome has been very successful with auto-updates. Firefox has moved steadily in that direction as well, and Internet Explorer will begin automatic version updates this year (security updates are already delivered automatically through Windows Update).
Unless you have a foolproof alternative update strategy, you should install this update and enable this feature right away. If you want to check the current settings, open the Flash Player Settings Manager in Control Panel and go to the Advanced tab, as shown here.
(I had to click a UAC prompt to get to these settings, by the way. I recommend that you set up employees and family members with standard user accounts. If you do, they won’t be able to tinker with auto-updates.)
If you’re not confident about Adobe’s updater, there’s a worthy alternative in Ninite Updater, which also checks for updates (security and otherwise) in other products that are frequently attacked, including Oracle Java, Adobe Acrobat, iTunes, and QuickTime. (For more details, see “My seven favorite Windows 7 utilities.”)
Thanks to Ninite Updater ($10 per PC per yearI saw this message yesterday and was able to apply all three of Adobe’s latest updates with two clicks.
Flash Player 10 was released in October 2008. I can’t find any details about updates to the 10.0 release, so my census starts with version 10.1, which was released On June 10, 2010.The primary source is this list at adobe.com.
All of the following updates are for Windows; you’ll find minor variations in version numbers and release dates if you look at other platforms, although the general timeline is the same. In addition, Adobe is still releasing updates for Flash Player version 10, so there’s a corresponding 10.x update for each of the 11.x updates in the following list.
To repeat what I said last fall: Wow, that is indeed a lot of updates.
There have been 21 separate releases of the Flash Player for Windows in the past 22 months, since Flash Player 10.1 was officially released. There was a long gap between November 4, 2010 and February 8, 2011. Coincidentally, there was a nearly identical gap from November 10, 2011 to February 15, 2012. But the pace has picked back up.