RETIRED: Adobe Flash Player and AIR Multiple Security Vulnerabilities
BID:35890
Info
RETIRED: Adobe Flash Player and AIR Multiple Security Vulnerabilities
| Bugtraq ID: | 35890 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 30 2009 12:00AM |
| Updated: | Jul 31 2009 06:14PM |
| Credit: | lakehu of Tencent Security Center, Mike Wroe, iDefense, Chen Chen of Venustech, Joran Benker, Roee Hay of IBM Rational Application Security, Microsoft Vulnerability Research Program (MSVR) |
| Vulnerable: |
Adobe Flash Player 10.0.22 .87 Adobe Flash Player 10.0.15 .3 Adobe Flash Player 10.0.12 .36 Adobe Flash Player 10.0.12 .35 Adobe Flash Player 9.0.152 .0 Adobe Flash Player 9.0.151 .0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.159.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 10 Adobe AIR 1.5.1 Adobe AIR 1.5 Adobe AIR 1.1 Adobe AIR 1.01 Adobe AIR 1.0 |
| Not Vulnerable: |
Adobe Flash Player 9.0.246 0 Adobe Flash Player 10.0.32.18 Adobe AIR 1.5.2 |
Discussion
RETIRED: Adobe Flash Player and AIR Multiple Security Vulnerabilities
Adobe Flash Player and Adobe AIR are prone to multiple security vulnerabilities.
Attackers can exploit these issues to obtain sensitive information, elevate privileges, execute arbitrary code in the context of the application, and launch other attacks.
These issues affect versions *prior to* the following:
Flash Player 10.0.32.18
AIR 1.5.2
NOTE: This BID is being retired; the following records now document these issues:
35900 Adobe Flash Player and AIR Unspecified Privilege Escalation Vulnerability
35901 Adobe Flash Player and AIR (CVE-2009-1866) Stack Buffer Overflow Vulnerability
35902 Adobe Flash Player and AIR URI Parsing Heap Buffer Overflow Vulnerability
35904 Adobe Flash Player and AIR Unspecified Heap Buffer Overflow Vulnerability
35905 Adobe Flash Player and AIR Unspecified Click Jacking Vulnerability
35906 Adobe Flash Player and AIR NULL Pointer Exception Remote Code Execution Vulnerability
35907 Adobe Flash Player and AIR Unspecified Integer Overflow Vulnerability
35908 Adobe Flash Player and AIR Sandbox Bypass Information Disclosure Vulnerability
Adobe Flash Player and Adobe AIR are prone to multiple security vulnerabilities.
Attackers can exploit these issues to obtain sensitive information, elevate privileges, execute arbitrary code in the context of the application, and launch other attacks.
These issues affect versions *prior to* the following:
Flash Player 10.0.32.18
AIR 1.5.2
NOTE: This BID is being retired; the following records now document these issues:
35900 Adobe Flash Player and AIR Unspecified Privilege Escalation Vulnerability
35901 Adobe Flash Player and AIR (CVE-2009-1866) Stack Buffer Overflow Vulnerability
35902 Adobe Flash Player and AIR URI Parsing Heap Buffer Overflow Vulnerability
35904 Adobe Flash Player and AIR Unspecified Heap Buffer Overflow Vulnerability
35905 Adobe Flash Player and AIR Unspecified Click Jacking Vulnerability
35906 Adobe Flash Player and AIR NULL Pointer Exception Remote Code Execution Vulnerability
35907 Adobe Flash Player and AIR Unspecified Integer Overflow Vulnerability
35908 Adobe Flash Player and AIR Sandbox Bypass Information Disclosure Vulnerability
Exploit / POC
RETIRED: Adobe Flash Player and AIR Multiple Security Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RETIRED: Adobe Flash Player and AIR Multiple Security Vulnerabilities
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Solution:
The vendor has released an advisory and updates. Please see the references for details.
References
RETIRED: Adobe Flash Player and AIR Multiple Security Vulnerabilities
References:
References:
- Adobe AIR homepage (Adobe)
- Adobe Flash Homepage (Adobe)
- APSB09-10 Security updates available for Adobe Flash Player (Adobe)