Rapid7 Vulnerability & Exploit Database

RHSA-2010:0829: flash-plugin security update

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

RHSA-2010:0829: flash-plugin security update



The flash-plugin package contains a Mozilla Firefox compatible Adobe FlashPlayer web browser plug-in.This update fixes multiple vulnerabilities in Adobe Flash Player. Thesevulnerabilities are detailed on the Adobe security page APSB10-26, listedin the References section.Multiple security flaws were found in the way flash-plugin displayedcertain SWF content. An attacker could use these flaws to create aspecially-crafted SWF file that would cause flash-plugin to crash or,potentially, execute arbitrary code when the victim loaded a pagecontaining the specially-crafted SWF content. (CVE-2010-3639,CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)An input validation flaw was discovered in flash-plugin. Certain serverencodings could lead to a bypass of cross-domain policy file restrictions,possibly leading to cross-domain information disclosure. (CVE-2010-3636)During testing, it was discovered that there were regressions with FlashPlayer on certain sites, such as fullscreen playback on YouTube. Despitethese regressions, we feel these security flaws are serious enough toupdate the package with what Adobe has provided.All users of Adobe Flash Player should install this updated package, whichupgrades Flash Player to version


  • redhat-upgrade-flash-plugin

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center