Cross-domain vulnerability in Adobe Flash Player before 10.0.45.2, Adobe AIR before 1.5.3.9130, and Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows remote attackers to bypass intended sandbox restrictions and make cross-domain requests via unspecified vectors.

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 and 4 Extras.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes a vulnerability in Adobe Flash Player. This vulnerability is summarized on the Adobe Security Advisory APSB10-06 page listed in the References section. If a victim loaded a web page containing specially crafted SWF content, it could cause Flash Player to perform unauthorized cross-domain requests, leading to the disclosure of sensitive data. (CVE-2010-0186)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.262.0.

An updated Adobe Flash Player package that fixes two security issues is now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes two vulnerabilities in Adobe Flash Player. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-06 page listed in the References section. If a victim loaded a web page containing specially crafted SWF content, it could cause Flash Player to perform unauthorized cross-domain requests, leading to the disclosure of sensitive data. (CVE-2010-0186, CVE-2010-0187)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.45.2.

The following bug has been fixed: Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187)

This update of acroread fixes :

  - Cross-domain request vulnerability CVE-2010-0188: CVSS     v2 Base Score: 6.8 An unspecified vulnerability that     possibly allowed remote code execution. (CVE-2010-0186:
    CVSS v2 Base Score: 5.8)

The remote host is affected by the vulnerability described in GLSA-201101-09 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Flash Player. For     further information please consult the CVE entries and the Adobe     Security Bulletins referenced below.
  Impact :

    A remote attacker could entice a user to open a specially crafted SWF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201009-05 (Adobe Reader: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Reader. For further     information please consult the CVE entries and the Adobe Security     Bulletins referenced below.
  Impact :

    A remote attacker might entice a user to open a specially crafted PDF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or bypass intended     sandbox restrictions, make cross-domain requests, inject arbitrary web     script or HTML, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

This update of acroread fixes :

  - Cross-domain request vulnerability. (CVE-2010-0186 :
    CVSS v2 Base Score: 5.8)

  - An unspecified vulnerability that possibly allowed     remote code execution. (CVE-2010-0188 : CVSS v2 Base     Score: 6.8)

This update of acroread fixes :

  - CVE-2010-0186: CVSS v2 Base Score: 5.8 Cross-domain     request vulnerability

  - CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified     vulnerability that possibly allowed remote code     execution.

Updated acroread packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Adobe Reader allows users to view and print documents in Portable Document Format (PDF).

This update fixes two vulnerabilities in Adobe Reader. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-07 page listed in the References section. A specially crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened.
(CVE-2010-0186, CVE-2010-0188)

This update also fixes a bug where, on some systems, attempting to install or upgrade the acroread packages failed due to a package dependency issue. (BZ#557506)

All Adobe Reader users should install these updated packages. They contain Adobe Reader version 9.3.1, which is not vulnerable to these issues and fixes this bug. All running instances of Adobe Reader must be restarted for the update to take effect.

The version of Adobe Reader installed on the remote host is earlier than 9.3.1 / 8.2.1.  As such, it is reportedly affected by multiple vulnerabilities :

  - An issue that could subvert the domain sandbox and make     unauthorized cross-domain requests. (CVE-2010-0186)

  - An unspecified vulnerability could cause the application     to crash or possibly lead to arbitrary code execution.
    (CVE-2010-0188)

The version of Adobe Acrobat installed on the remote host is earlier than 9.3.1 / 8.2.1.  Such versions are reportedly affected by multiple vulnerabilities :

  - An issue that could subvert the domain sandbox and make     unauthorized cross-domain requests. (CVE-2010-0186)

  - An unspecified vulnerability could cause the application     to crash or possibly lead to arbitrary code execution.
    (CVE-2010-0188)

The following bug has been fixed :

Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187)

Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition (CVE-2010-0187).

Adobe Product Security Incident Response Team reports :

A critical vulnerability has been identified in Adobe Flash Player version 10.0.42.34 and earlier. This vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. This update also resolves a potential Denial of Service issue (CVE-2010-0187).

The remote host contains a version of Adobe Flash Player that is earlier than 10.0.45.2. Such versions are potentially affected by multiple vulnerabilities : 

  - An issue which could subvert the domain sandbox and make unauthorized cross-domain requests. (CVE-2010-0186)
  - An unspecified denial of service. (CVE-2010-0187)

The remote Windows host contains a version of Adobe Flash Player that is earlier than 10.0.45.2.  Such versions are potentially affected by multiple vulnerabilities :

  - An issue that could subvert the domain sandbox and make     unauthorized cross-domain requests. (CVE-2010-0186)

  - An unspecified denial of service. (CVE-2010-0187)

The remote Windows host contains a version of Adobe AIR that is earlier than 1.5.3.9130 Such versions are potentially affected by multiple vulnerabilities :

  - An issue that could subvert the domain sandbox and make     unauthorized cross-domain requests. (CVE-2010-0186)

  - An unspecified denial of service. (CVE-2010-0187)

ID	Name	Product	Family	Severity
63918	RHEL 3 / 4 : flash-plugin (RHSA-2010:0103)	Nessus	Red Hat Local Security Checks	medium
63917	RHEL 5 : flash-plugin (RHSA-2010:0102)	Nessus	Red Hat Local Security Checks	medium
51735	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6845)	Nessus	SuSE Local Security Checks	medium
51734	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6844)	Nessus	SuSE Local Security Checks	medium
51698	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6881)	Nessus	SuSE Local Security Checks	high
51697	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6879)	Nessus	SuSE Local Security Checks	high
51658	GLSA-201101-09 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
49126	GLSA-201009-05 : Adobe Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
44984	SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 2065)	Nessus	SuSE Local Security Checks	high
44981	openSUSE Security Update : acroread (acroread-2068)	Nessus	SuSE Local Security Checks	high
44978	openSUSE Security Update : acroread (acroread-2068)	Nessus	SuSE Local Security Checks	high
44975	openSUSE Security Update : acroread (acroread-2068)	Nessus	SuSE Local Security Checks	high
44665	RHEL 4 / 5 : acroread (RHSA-2010:0114)	Nessus	Red Hat Local Security Checks	high
44644	Adobe Reader < 9.3.1 / 8.2.1 Multiple Vulnerabilities (APSB10-07)	Nessus	Windows	high
44643	Adobe Acrobat < 9.3.1 / 8.2.1 Multiple Vulnerabilities (APSB10-07)	Nessus	Windows	high
44639	SuSE 11 Security Update : flash-player (SAT Patch Number 1977)	Nessus	SuSE Local Security Checks	medium
44638	openSUSE Security Update : flash-player (flash-player-1970)	Nessus	SuSE Local Security Checks	medium
44637	openSUSE Security Update : flash-player (flash-player-1970)	Nessus	SuSE Local Security Checks	medium
44636	openSUSE Security Update : flash-player (flash-player-1970)	Nessus	SuSE Local Security Checks	medium
44602	FreeBSD : linux-flashplugin -- multiple vulnerabilities (ff6519ad-18e5-11df-9bdd-001b2134ef46)	Nessus	FreeBSD Local Security Checks	medium
5338	Flash Player < 10.0.45.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	low
44596	Flash Player < 10.0.45.2 Multiple Vulnerabilities (APSB10-06)	Nessus	Windows	medium
44595	Adobe AIR < 1.5.3.9130 Multiple Vulnerabilities (APSB10-06)	Nessus	Windows	medium

Detections

Analytics

CVE-2010-0186

high

Tenable Plugins

medium

medium

medium

medium

high

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium

low

medium

medium