Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Using Ubuntu's package it even provides security updates through the standard OS method[1].

But is Flash confined on Ubuntu, i.e. using AppArmor?

Because if Ubuntu doesn't provide any confinement, it's less protected than on Windows :(.

[1] Instead of Adobe code that tricks you into installing Chrome or Google toolbar or something, deterring you from installing necessary security updates.

Note this is specific to Ubuntu. Debian don't provide an automatic updater, <facepalm>. OTOH Debian doesn't make it as easy to install in the first place.

  • 3
    The better way to fight against Flash vulnerabilities is to stop using flash altogether, as advised by some websites encouraging people to try to disable the module and see. It all depends upon personal requirements of course, but the usual need to access media streaming websites (whether it is online radio or video streaming) can be natively fulfilled by newer browsers (HTML 5 support and so on). Flash is then just a bad habit to be forgotten and the world will be better... Jul 18, 2015 at 8:12
  • UK -> BBC iPlayer. They have some questionable tech decisions :(.
    – sourcejedi
    Jul 18, 2015 at 11:07
  • Yes, that's why the article mentions that Alex Stamos asked Adobe to set an end-of-life date or Flash. Jul 18, 2015 at 12:44
  • It was the same story before with Java web plugins: they were used to play media, add animations, interactivity, etc. to websites but also brought a lot of insecurity as a side effect. Now we managed to nearly get rid of this (AFAIK Java web plugins are mostly limited to some specific corporate web applications), next step will be to get rid of Flash the same way... Jul 18, 2015 at 12:47

3 Answers 3


Usually Flash exploits need to be specifically targeted at an OS (Linux v.s. Windows v.s. whatever). An attacker can choose to shove as many into one exploit, which would likely cause suspicion if my exploit crashes while exploiting, or make something reliable, I can use and re-use. This means the law of averages: "How many people use Windows, and how many use Linux. Where would my exploit yield better results?" If I am not specifically targeting you per-se.

Flash is usually used to deliver another payload. Whether or not the payload is specifically aimed at Windows, is what is relevant. Most Flash based exploits on their own (non payload deliverable) still need to be specifically targeted at you. Let's look at an advisory:


Adobe Flash Player before and 14.x and 15.x before on Windows and OS X and before on Linux, Adobe AIR before, Adobe AIR SDK before, and Adobe AIR SDK & Compiler before allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8440.

If I as an attacker tried to make an exploit to send to you, there are multiple ways to get it to you. But here are the hurdles I would face trying to exploit you.

  • Step 1) create shellcode to do the harm I need to do
  • Step 2) obfuscate this shellcode so it is not detected by AV

Before I even do this, I have an altogether different choice... Pick my target to exploit: Will I focus on Linux, or Windows?!? Because each is a different operating system, my payloads will differ.

IOW you're confusing how attackers use Flash to exploit an operating system. Flash is usually nothing more than a vehicle to deliver something more malicious.


Imagine if you can a country named Chickenphobia where everyone is allergic to chickens. If anyone comes in contact with a chicken, they will become sick. Now imagine a bus, airplane, boat or truck delivering Chickens (with the intentions of making people in Chickenphobia sick) to the wrong town. The vehicles (bus, truck, boat, train, plain) are Flash. It is nothing more than a delivery mechanism.


  • Feel free to provide question edits to make it less over-broad. You're not wrong (though pushing this as a reason to switch, as ubuntu.com does, is I think questionable). But if you admin systems - which I do - you're a higher-value target and the math changes. There's a judgement, and there's the facts. The main question I was looking up here was the facts.
    – sourcejedi
    Dec 19, 2014 at 23:03
  • 1
    Those are facts: Using Flash on Ubuntu does not equate to being any more exploitable than it would on Windows. If you admin systems, you would have proper patch management procedures in place, with defense in depth to worry even less about Flash on Linux.
    – munkeyoto
    Dec 19, 2014 at 23:07
  • Just because I admin systems doesn't mean I'm perfect! A friend does commercial webdev - i.e. he has admin access to websites. His workstation's on Firefox/Ubuntu; there's not any extra security. I don't think it's a high risk. But there's obviously some point where it'd become a problem. So where's the line between the two? If you don't consider those judgements, you won't find the lines.
    – sourcejedi
    Dec 19, 2014 at 23:25
  • IOW. Those are nice buzzwords. Someone defined them from first principles. If I can't follow their working out, I can't assess new claims (ex. from marketing of alleged security solutions).
    – sourcejedi
    Dec 19, 2014 at 23:39

Ubuntu Linux makes it easy to install Flash as soon as you encounter it.

Things have changed since. Nowadays, even when it is installed, Flash is disabled by default. If you are talking only about Flash player plugin and security then you need to know it is no longer recommended (Facebook calls for end to Flash as Firefox blocks it over hacking holes). HTML5 is the recommended technology instead (Comparison of HTML5 and Flash)

  • I'm not sure I was right that "Ubuntu makes it easy to install Flash", which was the initial premise for my concern. But to nitpick - is there really a system that disables Flash by default?! I think you're thinking of "known-vulnerable" versions being blacklisted in Firefox. Once you have an up-to-date version with security fixes, it's enabled by default.
    – sourcejedi
    Sep 17, 2015 at 9:54
  • 1
    Yes, I am running Ubuntu and Kali Linux: both of them are disabling Flash by default because the browsers vendors decided so @sourcejedi
    – user45139
    Sep 17, 2015 at 9:58
  • Firefox decided to disable Flash? What's the enable method? I would have assumed what you're seeing is that Flash isn't installed by default. Which is generally true for both Linux and Windows installs of Firefox, including Ubuntu of any version. As I say, my concern mainly arose from how easy Flash was install - which I'm no longer so sure about.
    – sourcejedi
    Sep 18, 2015 at 21:09

Yes. Flash is unconfined on Ubuntu (by default).


Also Flash NPAPI on Linux is a maintenance release. It's hard to tell whether it's getting backports for every new security feature.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .