Adobe patched 23 security vulnerabilities in its Reader PDF viewer on Tuesday, most of them critical, including one that has been exploited by hackers for at least a month or possibly much longer.

Tuesday’s patch job set a record for 2010, and came close to last year’s biggest update, a 29-fix collection Adobe shipped in October 2009.

In September, Adobe promised to speed up the delivery of today’s patches, which were originally meant to ship next week, because attackers were already leveraging a bug in Reader’s and Acrobat’s font parsing.

“Adobe is hitting customers with a double whammy today,” Andrew Storms, director of security operations at nCircle Security, said via e-mail. “Adobe products continue to be at the top of the target list for malware writers.”

“They patched a zero-day flaw in Flash in late September, and today they are releasing their quarterly Acrobat update ahead of schedule because of another zero-day,” Storms said.

Tuesday’s Reader and Acrobat updates also included a patch released more than two weeks ago for Flash, Adobe’s media player. Both Reader and Acrobat include code to run Flash embedded in PDF documents.

Of the 23 bugs Adobe patched, the most notable was the one revealed Sept. 7 by Mila Parkour, an independent security researcher who reported the attack after discovering rigged PDFs attached to e-mail messages.

via Adobe hits Reader users with 23-patch ‘whammy’ – Computerworld.