[PCWorks] Adobe Flash Player Multiple Vulnerabilities
- From: "Clint Hamilton-PCWorks Admin" <PCWorks@xxxxxxxxxxxxxxxxxxxxxxxx>
- To: "PCWorks@xxxxxxxxxxxxx" <pcworks@xxxxxxxxxxxxx>
- Date: Thu, 10 Dec 2009 08:35:35 -0600
TITLE:
Adobe Flash Player Multiple Vulnerabilities
Highly critical
Impact: Exposure of system information
System access
Where: From remote
SECUNIA ADVISORY ID:
SA37584
VERIFY ADVISORY:
http://secunia.com/advisories/37584/
DESCRIPTION:
Some vulnerabilities have been reported in Adobe Flash Player /
AIR,
which can be exploited by malicious people to gain knowledge of
system information or compromise a user's system.
1) An error when parsing JPEG dimensions contained within an
SWF file
can be exploited to cause a heap-based buffer overflow.
2) An unspecified error may allow injection of data and
potentially
lead to execution of arbitrary code.
3) An unspecified error possibly related to "getProperty()" can
be
exploited to corrupt memory and may allow execution of
arbitrary
code.
4) An unspecified error can be exploited to corrupt memory and
may
allow execution of arbitrary code.
5) An integer overflow error when generating ActionScript
exception
handlers in Verifier::parseExceptionHandlers() can be exploited
to
corrupt memory.
6) Various unspecified errors may potentially allow execution
of
arbitrary code.
7) An error may disclose information about local file names.
The vulnerabilities are reported in Adobe Flash Player version
10.0.32.18 and prior and Adobe AIR version 1.5.2 and prior.
SOLUTION:
Update to Flash Player version 10.0.42.34 and AIR version
1.5.3.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb09-19.html
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-092/
http://www.zerodayinitiative.com/advisories/ZDI-09-093/
=========================
The list's FAQ's can be seen by sending an email to
PCWorks-request@xxxxxxxxxxxxx with FAQ in the subject line.
To unsubscribe, subscribe, set Digest or Vacation to on or off, go to
//www.freelists.org/list/pcworks . You can also send an email to
PCWorks-request@xxxxxxxxxxxxx with Unsubscribe in the subject line. Your
member list settings can be found at
//www.freelists.org/cgi-bin/lsg2.cgi/l=pcworks . Once logged in, you have
access to numerous other email options.
The list archives are located at //www.freelists.org/archives/pcworks/ .
All email posted to the list will be placed there in the event anyone needs to
look for previous posts.
-zxdjhu-
Other related posts:
