An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869)

A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867)

A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.32.18.

Specially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

Specially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.1. 

Mac OS X 10.6.1 contains security fixes for the following product :

  - Flash Player plug-in

An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869)

A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867)

A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.246.0.

The remote Windows host contains a version of Adobe AIR Player that is earlier than 1.5.2. Such versions are reportedly affected by multiple vulnerabilities : 

  - A memory corruption vulnerability that could potentially     lead to code execution. (CVE-2009-1862) 

  - A privilege escalation vulnerability that could     potentially lead to code execution. (CVE-2009-1863) 

  - A heap overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1864) 

  - A NULL pointer vulnerability that could potentially     lead to code execution. (CVE-2009-1865) 

  - A stack overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1866) 

  - A clickjacking vulnerability that could allow an     attacker to lure a web browser user into unknowingly     clicking on a link or dialog. (CVE-2009-1867

  - A URL parsing heap overflow vulnerability that could     potentially lead to code execution. (CVE-2009-1868)

  - An integer overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1869) 

  - A local sandbox vulnerability that could potentially     lead to information disclosure when SWFs are saved to     the hard drive. CVE-2009-1870)

The remote host is affected by the vulnerability described in GLSA-200908-04 (Adobe products: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Adobe Flash Player:
    lakehu of Tencent Security Center reported an unspecified     memory corruption vulnerability (CVE-2009-1862).
    Mike Wroe     reported an unspecified vulnerability, related to 'privilege     escalation' (CVE-2009-1863).
    An anonymous researcher through     iDefense reported an unspecified heap-based buffer overflow     (CVE-2009-1864).
    Chen Chen of Venustech reported an     unspecified 'NULL pointer vulnerability' (CVE-2009-1865).
    Chen     Chen of Venustech reported an unspecified stack-based buffer overflow     (CVE-2009-1866).
    Joran Benker reported that Adobe Flash Player     facilitates 'clickjacking' attacks (CVE-2009-1867).
    Jun Mao of     iDefense reported a heap-based buffer overflow, related to URL parsing     (CVE-2009-1868).
    Roee Hay of IBM Rational Application Security     reported an unspecified integer overflow (CVE-2009-1869).
    Gareth Heyes and Microsoft Vulnerability Research reported that the     sandbox in Adobe Flash Player allows for information disclosure, when     'SWFs are saved to the hard drive' (CVE-2009-1870).
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF     file or website containing Adobe Flash (SWF) contents, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application, or a Denial of Service (application     crash). Furthermore, a remote attacker could trick a user into clicking     a button on a dialog by supplying a specially crafted SWF file and     disclose sensitive information by exploiting a sandbox issue.
  Workaround :

    There is no known workaround at this time.

The remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly affected by multiple vulnerabilities : 

  - A memory corruption vulnerability that could potentially     lead to code execution. (CVE-2009-1862) 

  - A vulnerability in the Microsoft Active Template Library     (ATL) which could allow an attacker who successfully     exploits the vulnerability to take control of the     affected system. (CVE-2009-0901, CVE-2009-2395,     CVE-2009-2493) 

  - A privilege escalation vulnerability that could     potentially lead to code execution. (CVE-2009-1863)

  - A heap overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1864) 

  - A NULL pointer vulnerability that could potentially     lead to code execution. (CVE-2009-1865) 

  - A stack overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1866) 

  - A clickjacking vulnerability that could allow an     attacker to lure a web browser user into unknowingly     clicking on a link or dialog. (CVE-2009-1867 

  - A URL parsing heap overflow vulnerability that could     potentially lead to code execution. (CVE-2009-1868)

  - An integer overflow vulnerability that could potentially     lead to code execution. (CVE-2009-1869) 

  - A local sandbox vulnerability that could potentially     lead to information disclosure when SWFs are saved to     the hard drive. CVE-2009-1870)

The remote Windows host contains a version of Adobe AIR Player that is earlier than 1.5.2. Such versions are reportedly affected by multiple vulnerabilities :

  - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862)

  - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863)

  - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864)

  - A null pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865)

  - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866)

  - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867)

  - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868)

  - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869)

  - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.1.  Mac OS X 10.6.1 contains security fixes for the following product : 

  - Flash Player plug-in

ID	Name	Product	Family	Published	Updated	Severity
63886	RHEL 5 : flash-plugin (RHSA-2009:1188)	Nessus	Red Hat Local Security Checks	1/24/2013	6/8/2022	high
40488	openSUSE Security Update : flash-player (flash-player-1148)	Nessus	SuSE Local Security Checks	8/5/2009	6/8/2022	high
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	9/11/2009	5/28/2024	critical
51731	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)	Nessus	SuSE Local Security Checks	1/27/2011	6/8/2022	high
40946	Mac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/11/2009	5/28/2024	high
63887	RHEL 3 / 4 : flash-plugin (RHSA-2009:1189)	Nessus	Red Hat Local Security Checks	1/24/2013	6/8/2022	high
40447	Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)	Nessus	Windows	7/31/2009	6/8/2022	high
40520	GLSA-200908-04 : Adobe products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/10/2009	6/8/2022	high
40489	openSUSE Security Update : flash-player (flash-player-1148)	Nessus	SuSE Local Security Checks	8/5/2009	6/8/2022	high
40434	Flash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)	Nessus	Windows	7/30/2009	6/8/2022	high
41392	SuSE 11 Security Update : flash-player (SAT Patch Number 1149)	Nessus	SuSE Local Security Checks	9/24/2009	6/8/2022	high
42001	openSUSE 10 Security Update : flash-player (flash-player-6387)	Nessus	SuSE Local Security Checks	10/6/2009	6/8/2022	high
5109	Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)	Nessus Network Monitor	Web Clients	7/31/2009	3/6/2019	medium
5162	Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities	Nessus Network Monitor	Generic	9/11/2009	3/6/2019	critical

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

high

high

high

high

high

high

medium

critical