Rapid7 Vulnerability & Exploit Database

RHSA-2010:0829: flash-plugin security update

Back to Search

RHSA-2010:0829: flash-plugin security update

Severity
9
CVSS
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
Published
10/29/2010
Created
07/25/2018
Added
11/11/2010
Modified
07/04/2017

Description

The flash-plugin package contains a Mozilla Firefox compatible Adobe FlashPlayer web browser plug-in.This update fixes multiple vulnerabilities in Adobe Flash Player. Thesevulnerabilities are detailed on the Adobe security page APSB10-26, listedin the References section.Multiple security flaws were found in the way flash-plugin displayedcertain SWF content. An attacker could use these flaws to create aspecially-crafted SWF file that would cause flash-plugin to crash or,potentially, execute arbitrary code when the victim loaded a pagecontaining the specially-crafted SWF content. (CVE-2010-3639,CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)An input validation flaw was discovered in flash-plugin. Certain serverencodings could lead to a bypass of cross-domain policy file restrictions,possibly leading to cross-domain information disclosure. (CVE-2010-3636)During testing, it was discovered that there were regressions with FlashPlayer on certain sites, such as fullscreen playback on YouTube. Despitethese regressions, we feel these security flaws are serious enough toupdate the package with what Adobe has provided.All users of Adobe Flash Player should install this updated package, whichupgrades Flash Player to version 10.1.102.64.

Solution(s)

  • redhat-upgrade-flash-plugin

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;