RETIRED: Adobe Flash Player APSB09-19 Multiple Remote Vulnerabilities

Bugtraq ID:	37199
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 03 2009 12:00AM
Updated:	Dec 09 2009 11:44PM
Credit:	Jim Cheng, Bing Liu, Damian Put, Will Dormann, Manuel Caballero, and an anonymous researcher.
Vulnerable:	Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux WS Extras 3 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux ES Extras 3 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS Extras 4 Redhat Enterprise Linux AS Extras 3 Redhat Desktop Extras 4 Redhat Desktop Extras 3 Adobe Flash Player 10.0.32 18 Adobe Flash Player 10.0.22 .87 Adobe Flash Player 10.0.15 .3 Adobe Flash Player 10.0.12 .36 Adobe Flash Player 10.0.12 .35 Adobe Flash Player 10 Adobe AIR 1.5.2 Adobe AIR 1.5.1 Adobe AIR 1.5 Adobe AIR 1.1 Adobe AIR 1.01 Adobe AIR 1.0
Not Vulnerable:	Adobe Flash Player 10.0.42.34 Adobe AIR 1.5.3

RETIRED: Adobe Flash Player APSB09-19 Multiple Remote Vulnerabilities

Adobe Flash Player is prone to multiple remote code-execution vulnerabilities, multiple denial-of-service vulnerabilities, and an information-disclosure vulnerability.

Attackers can exploit these issues to obtain sensitive information, crash an affected application, and execute arbitrary code in the context of the application. Other attacks may also be possible.

The following products are affected:

Adobe Flash Player 10.0.32.18 and prior
Adobe AIR 1.5.2 and prior

This BID is being retired. The following individual records exist to better document these issues:

37275 Adobe Flash Player and AIR (CVE-2009-3798) Unspecified Memory Corruption Vulnerability
37273 Adobe Flash Player and AIR (CVE-2009-3797) Unspecified Memory Corruption Vulnerability
37272 Adobe Flash Player ActiveX Control Information Disclosure Vulnerability
37269 Adobe Flash Player and AIR Multiple Unspecified Remote Code Execution Vulnerabilities
37270 Adobe Flash Player and AIR Data Injection Remote Code Execution Vulnerability
37267 Adobe Flash Player and AIR 'exception_count' Integer Overflow Vulnerability
37266 Adobe Flash Player and AIR JPEG File Parsing Heap Buffer Overflow Vulnerability

RETIRED: Adobe Flash Player APSB09-19 Multiple Remote Vulnerabilities

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Adobe Flash Player APSB09-19 Multiple Remote Vulnerabilities

Solution:
Updates are available. Please see the references for details.

RETIRED: Adobe Flash Player APSB09-19 Multiple Remote Vulnerabilities

References:

• Adobe Homepage (Adobe)
  
• Adobe Security Advisory APSB09-19 (Adobe)
  
• Pre-Notification - Security Update for Adobe Flash Player (Adobe)
  
• ZDI-09-092: Adobe Flash Player JPEG Parsing Heap Overflow Vulnerability (ZDI Disclosures )
  
• ZDI-09-093: Adobe Flash Player ActionScript Exception Handler Integer Overflow V (ZDI Disclosures )
  
• Adobe Flash Player ActionScript Exception Handler Integer Overflow Vulnerability (ZDI)
  
• Adobe Flash Player JPEG Parsing Heap Overflow Vulnerability (ZDI)