Adobe admits Google fuzzing report led to 80 'code changes' in Flash Player

15.08.2011
Adobe on Friday acknowledged that as many as 80 bugs in Flash Player were reported by a Google security engineer as it defended its decision not to spell out details of the vulnerabilities.

Google also cited the same number, apparently putting to rest the spat between the engineer, Tavis Ormandy, and Adobe.

In a pair of blog posts, Adobe and Google -- the former in more detail -- spelled out how the number "400" that Ormandy had cited ended up being cut by 80%.

"The initial run of the ongoing [Google] effort resulted in about 400 unique crash signatures, which were logged as 106 individual security bugs following the initial triage," said , Adobe's senior director of product security and privacy, in a blog post last week. "As these bugs were resolved, many were identified as duplicates that weren't caught during the initial triage. In the final analysis, the Flash Player update we shipped earlier this week contains about 80 code changes to fix these bugs."

, which was attributed to Chris Evans, Matt Moore and Ormandy -- all members of the company's security team -- used almost-identical language to describe the bug count culling. In the post, Google also said it had devoted 2,000 CPU cores over a four-week period to the massive "fuzzing" project directed at Flash.

Last week, Ormandy had questioned not only the bug total, but Adobe's decision not to in the security bulletin that accompanied the update.