Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.801084
Category:General
Title:Adobe Flash Player/Air Multiple Vulnerabilities - dec09 (Linux)
Summary:This host is installed with Adobe Flash Player/Air and is prone to; multiple vulnerabilities.
Description:Summary:
This host is installed with Adobe Flash Player/Air and is prone to
multiple vulnerabilities.

Vulnerability Insight:
Multiple flaws exist due to:

- An error occurred while parsing JPEG dimensions contained within an SWF file
can be exploited to cause a heap-based buffer overflow.

- An unspecified error may allow injection of data and potentially lead to
execution of arbitrary code.

- An unspecified error possibly related to 'getProperty()' can be exploited
to corrupt memory and may allow execution of arbitrary code.

- An unspecified error can be exploited to corrupt memory and may allow
execution of arbitrary code.

- An integer overflow error when generating ActionScript exception handlers
in 'Verifier::parseExceptionHandlers()' can be exploited to corrupt memory.

- Various unspecified errors may potentially allow execution of arbitrary code.

- An error may disclose information about local file names.

Vulnerability Impact:
Successful exploitation will allow remote attackers to execute arbitrary code,
gain elevated privileges, gain knowledge of certain information and conduct clickjacking attacks.

Affected Software/OS:
Adobe AIR version prior to 1.5.3
Adobe Flash Player 10 version prior to 10.0.42.34 on Linux

Solution:
Update to Adobe Air 1.5.3 or Adobe Flash Player 10.0.42.34.

CVSS Score:
9.3

CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: BugTraq ID: 37266
BugTraq ID: 37270
BugTraq ID: 37273
BugTraq ID: 37275
BugTraq ID: 37267
BugTraq ID: 37269
BugTraq ID: 37272
Common Vulnerability Exposure (CVE) ID: CVE-2009-3794
http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html
BugTraq ID: 37199
http://www.securityfocus.com/bid/37199
Bugtraq: 20091209 ZDI-09-092: Adobe Flash Player JPEG Parsing Heap Overflow Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/508336/100/0/threaded
Cert/CC Advisory: TA09-343A
http://www.us-cert.gov/cas/techalerts/TA09-343A.html
http://zerodayinitiative.com/advisories/ZDI-09-092/
http://osvdb.org/60885
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15948
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7465
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8686
http://www.redhat.com/support/errata/RHSA-2009-1657.html
http://www.redhat.com/support/errata/RHSA-2009-1658.html
http://securitytracker.com/id?1023306
http://securitytracker.com/id?1023307
http://secunia.com/advisories/37584
http://secunia.com/advisories/37902
http://secunia.com/advisories/38241
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021716.1-1
SuSE Security Announcement: SUSE-SA:2009:062 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html
http://www.vupen.com/english/advisories/2009/3456
http://www.vupen.com/english/advisories/2010/0173
XForce ISS Database: flash-air-jpeg-code-execution(54631)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54631
Common Vulnerability Exposure (CVE) ID: CVE-2009-3796
http://osvdb.org/60886
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16216
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7460
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7763
XForce ISS Database: flash-air-data-code-execution(54632)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54632
Common Vulnerability Exposure (CVE) ID: CVE-2009-3797
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15795
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7140
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8350
XForce ISS Database: flash-air-corruption-code-execution(54633)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54633
Common Vulnerability Exposure (CVE) ID: CVE-2009-3798
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16340
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6899
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7902
XForce ISS Database: flash-air-unspecified-code-execution(54634)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54634
Common Vulnerability Exposure (CVE) ID: CVE-2009-3799
Bugtraq: 20091209 ZDI-09-093: Adobe Flash Player ActionScript Exception Handler Integer Overflow Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/508334/100/0/threaded
http://zerodayinitiative.com/advisories/ZDI-09-093/
http://osvdb.org/60889
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16315
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7191
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8208
XForce ISS Database: flash-air-unspecified-overflow(54635)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54635
Common Vulnerability Exposure (CVE) ID: CVE-2009-3800
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16054
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6972
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8613
XForce ISS Database: flash-air-multiple-code-execution(54636)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54636
Common Vulnerability Exposure (CVE) ID: CVE-2009-3951
http://osvdb.org/60891
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6663
XForce ISS Database: flash-activex-information-disclosure(54637)
https://exchange.xforce.ibmcloud.com/vulnerabilities/54637
CopyrightCopyright (C) 2009 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.