Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving URL parsing.

An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869)

A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867)

A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.246.0.

An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869)

A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867)

A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.32.18.

Specially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)

Specially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.1.  Mac OS X 10.6.1 contains security fixes for the following product : 

  - Flash Player plug-in

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.1. 

Mac OS X 10.6.1 contains security fixes for the following product :

  - Flash Player plug-in

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

The remote host is affected by the vulnerability described in GLSA-200908-04 (Adobe products: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Adobe Flash Player:
    lakehu of Tencent Security Center reported an unspecified     memory corruption vulnerability (CVE-2009-1862).
    Mike Wroe     reported an unspecified vulnerability, related to 'privilege     escalation' (CVE-2009-1863).
    An anonymous researcher through     iDefense reported an unspecified heap-based buffer overflow     (CVE-2009-1864).
    Chen Chen of Venustech reported an     unspecified 'NULL pointer vulnerability' (CVE-2009-1865).
    Chen     Chen of Venustech reported an unspecified stack-based buffer overflow     (CVE-2009-1866).
    Joran Benker reported that Adobe Flash Player     facilitates 'clickjacking' attacks (CVE-2009-1867).
    Jun Mao of     iDefense reported a heap-based buffer overflow, related to URL parsing     (CVE-2009-1868).
    Roee Hay of IBM Rational Application Security     reported an unspecified integer overflow (CVE-2009-1869).
    Gareth Heyes and Microsoft Vulnerability Research reported that the     sandbox in Adobe Flash Player allows for information disclosure, when     'SWFs are saved to the hard drive' (CVE-2009-1870).
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF     file or website containing Adobe Flash (SWF) contents, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application, or a Denial of Service (application     crash). Furthermore, a remote attacker could trick a user into clicking     a button on a dialog by supplying a specially crafted SWF file and     disclose sensitive information by exploiting a sandbox issue.
  Workaround :

    There is no known workaround at this time.

The remote Windows host contains a version of Adobe AIR Player that is earlier than 1.5.2. Such versions are reportedly affected by multiple vulnerabilities :

  - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862)

  - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863)

  - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864)

  - A null pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865)

  - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866)

  - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867)

  - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868)

  - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869)

  - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)

The remote Windows host contains a version of Adobe AIR Player that is earlier than 1.5.2. Such versions are reportedly affected by multiple vulnerabilities : 

  - A memory corruption vulnerability that could potentially     lead to code execution. (CVE-2009-1862) 

  - A privilege escalation vulnerability that could     potentially lead to code execution. (CVE-2009-1863) 

  - A heap overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1864) 

  - A NULL pointer vulnerability that could potentially     lead to code execution. (CVE-2009-1865) 

  - A stack overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1866) 

  - A clickjacking vulnerability that could allow an     attacker to lure a web browser user into unknowingly     clicking on a link or dialog. (CVE-2009-1867

  - A URL parsing heap overflow vulnerability that could     potentially lead to code execution. (CVE-2009-1868)

  - An integer overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1869) 

  - A local sandbox vulnerability that could potentially     lead to information disclosure when SWFs are saved to     the hard drive. CVE-2009-1870)

The remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly affected by multiple vulnerabilities : 

  - A memory corruption vulnerability that could potentially     lead to code execution. (CVE-2009-1862) 

  - A vulnerability in the Microsoft Active Template Library     (ATL) which could allow an attacker who successfully     exploits the vulnerability to take control of the     affected system. (CVE-2009-0901, CVE-2009-2395,     CVE-2009-2493) 

  - A privilege escalation vulnerability that could     potentially lead to code execution. (CVE-2009-1863)

  - A heap overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1864) 

  - A NULL pointer vulnerability that could potentially     lead to code execution. (CVE-2009-1865) 

  - A stack overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1866) 

  - A clickjacking vulnerability that could allow an     attacker to lure a web browser user into unknowingly     clicking on a link or dialog. (CVE-2009-1867 

  - A URL parsing heap overflow vulnerability that could     potentially lead to code execution. (CVE-2009-1868)

  - An integer overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1869) 

  - A local sandbox vulnerability that could potentially     lead to information disclosure when SWFs are saved to     the hard drive. CVE-2009-1870)

ID	Name	Product	Family	Severity
63887	RHEL 3 / 4 : flash-plugin (RHSA-2009:1189)	Nessus	Red Hat Local Security Checks	high
63886	RHEL 5 : flash-plugin (RHSA-2009:1188)	Nessus	Red Hat Local Security Checks	high
51731	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)	Nessus	SuSE Local Security Checks	high
42001	openSUSE 10 Security Update : flash-player (flash-player-6387)	Nessus	SuSE Local Security Checks	high
41392	SuSE 11 Security Update : flash-player (SAT Patch Number 1149)	Nessus	SuSE Local Security Checks	high
5162	Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
40946	Mac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	critical
40520	GLSA-200908-04 : Adobe products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
40489	openSUSE Security Update : flash-player (flash-player-1148)	Nessus	SuSE Local Security Checks	high
40488	openSUSE Security Update : flash-player (flash-player-1148)	Nessus	SuSE Local Security Checks	high
5109	Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)	Nessus Network Monitor	Web Clients	medium
40447	Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)	Nessus	Windows	high
40434	Flash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)	Nessus	Windows	high

Detections

Analytics

CVE-2009-1868

critical

Tenable Plugins

high

high

high

high

high

critical

high

critical

high

high

high

medium

high

high