RHSA-2010:0829: flash-plugin security update

Description

The flash-plugin package contains a Mozilla Firefox compatible Adobe FlashPlayer web browser plug-in.This update fixes multiple vulnerabilities in Adobe Flash Player. Thesevulnerabilities are detailed on the Adobe security page APSB10-26, listedin the References section.Multiple security flaws were found in the way flash-plugin displayedcertain SWF content. An attacker could use these flaws to create aspecially-crafted SWF file that would cause flash-plugin to crash or,potentially, execute arbitrary code when the victim loaded a pagecontaining the specially-crafted SWF content. (CVE-2010-3639,CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)An input validation flaw was discovered in flash-plugin. Certain serverencodings could lead to a bypass of cross-domain policy file restrictions,possibly leading to cross-domain information disclosure. (CVE-2010-3636)During testing, it was discovered that there were regressions with FlashPlayer on certain sites, such as fullscreen playback on YouTube. Despitethese regressions, we feel these security flaws are serious enough toupdate the package with what Adobe has provided.All users of Adobe Flash Player should install this updated package, whichupgrades Flash Player to version 10.1.102.64.