Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 on Windows allows remote attackers to obtain the names of local files via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4820.

Specially crafted Flash (SWF) files can cause overflows in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-3794 / CVE-2009-3796 / CVE-2009-3797 / CVE-2009-3798 / CVE-2009-3799 / CVE-2009-3800 / CVE-2009-3951)

The remote host is running a version of Mac OS X 10.6 or 10.5 that does not have Security Update 2010-001 applied.

This security update contains fixes for the following products :

  - CoreAudio
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Image RAW
  - OpenSSL

Specially crafted Flash (SWF) files can cause overflows in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798,CVE-2009-3799, CVE-2009-3800, CVE-2009-3951)

flash-player was upgraded to version 10 to fix those problems.

Specially crafted Flash (SWF) files can cause overflows in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798,CVE-2009-3799, CVE-2009-3800, CVE-2009-3951)

Adobe Product Security Incident Response Team reports :

Critical vulnerabilities have been identified in Adobe Flash Player version 10.0.32.18 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

The remote Windows host contains a version of Adobe AIR player that is earlier than 1.5.3.  Such versions are reportedly affected by multiple vulnerabilities : 

  - A vulnerability in the parsing of JPEG data that could potentially lead to code execution. (CVE-2009-3794)

  - A data injection vulnerability that could potentially lead to code execution. (CVE-2009-3796)

  - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-3797)

  - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-3798)

  - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-3799)

  - Multiple crash vulnerabilities that could potentially lead to code execution. (CVE-2009-3800)

  - A Windows-only local file name access vulnerability in the Flash Player ActiveX control that could potentially lead to information disclosure. (CVE-2009-3951)

The remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.260 or 10.0.42.34.  Such versions are potentially affected by multiple vulnerabilities :

  - A vulnerability in the parsing of JPEG data could lead     to code execution. (CVE-2009-3794)

  - A data injection vulnerability could lead to code     execution. (CVE-2009-3796)

  - A memory corruption vulnerability could lead to code     execution. (CVE-2009-3797)

  - A memory corruption vulnerability could lead to code     execution. (CVE-2009-3798)

  - An integer overflow vulnerability could lead to code     execution. (CVE-2009-3799) 

  - Multiple crash vulnerabilities could lead to code     execution. (CVE-2009-3800)

  - A Windows-only local file name access vulnerability     could lead to information disclosure. (CVE-2009-3591)

ID	Name	Product	Family	Severity
51733	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6769)	Nessus	SuSE Local Security Checks	high
51732	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6766)	Nessus	SuSE Local Security Checks	high
44095	Mac OS X Multiple Vulnerabilities (Security Update 2010-001)	Nessus	MacOS X Local Security Checks	critical
43855	openSUSE Security Update : flash-player (flash-player-1769)	Nessus	SuSE Local Security Checks	high
43387	SuSE 11 Security Update : flash-player (SAT Patch Number 1698)	Nessus	SuSE Local Security Checks	high
43384	openSUSE Security Update : flash-player (flash-player-1707)	Nessus	SuSE Local Security Checks	high
43381	openSUSE Security Update : flash-player (flash-player-1707)	Nessus	SuSE Local Security Checks	high
43093	FreeBSD : linux-flashplugin -- multiple vulnerabilities (3c1a672e-e508-11de-9f4a-001b2134ef46)	Nessus	FreeBSD Local Security Checks	high
5256	Adobe AIR < 1.5.3 Multiple Vulnerabilities (APSB09-19)	Nessus Network Monitor	Web Clients	medium
43068	Flash Player < 9.0.260 / 10.0.42.34 Multiple Vulnerabilities (APSB09-19)	Nessus	Windows	high

Detections

Analytics

CVE-2009-3951

critical

Tenable Plugins

high

high

critical

high

high

high

high

high

medium

high