Adobe Flash Player 'Flash10h.ocx' Remote Memory Corruption Vulnerability

Bugtraq ID:	44690
Class:	Unknown
CVE:	CVE-2010-3637
Remote:	Yes
Local:	No
Published:	Nov 04 2010 12:00AM
Updated:	Mar 19 2015 09:35AM
Credit:	Xiaopeng Zhang of Fortinet's FortiGuard Labs
Vulnerable:	SuSE SUSE Linux Enterprise Desktop 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Desktop 11 SuSE openSUSE 11.3 Sun Solaris 11 Express Sun Solaris 11 Sun Solaris 10_x86 Sun Solaris 10_sparc S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 HP Systems Insight Manager 6.2 HP Systems Insight Manager 6.1 HP Systems Insight Manager 6.0.0.96 HP Systems Insight Manager 6.0 Adobe Flash Player 10.1.53 .64 Adobe Flash Player 10.1.51 .66 Adobe Flash Player 10.0.45 2 Adobe Flash Player 10.0.45 2 Adobe Flash Player 10.0.45 2 Adobe Flash Player 10.0.32 18 Adobe Flash Player 10.0.22 .87 Adobe Flash Player 10.0.15 .3 Adobe Flash Player 10.0.12 .36 Adobe Flash Player 10.0.12 .35 Adobe Flash Player 9.0.262 Adobe Flash Player 9.0.246 0 Adobe Flash Player 9.0.152 .0 Adobe Flash Player 9.0.151 .0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.280 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.277.0 Adobe Flash Player 9.0.260.0 Adobe Flash Player 9.0.246.0 Adobe Flash Player 9.0.159.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 10.1.95.2 Adobe Flash Player 10.1.95.1 Adobe Flash Player 10.1.92.10 Adobe Flash Player 10.1.92.10 Adobe Flash Player 10.1.85.3 Adobe Flash Player 10.1.82.76 Adobe Flash Player 10.1 Release Candida Adobe Flash Player 10.0.42.34 Adobe Flash Player 10.0.32.18 Adobe Flash Player 10 Adobe AIR 2.0.4 Adobe AIR 2.0.3 Adobe AIR 1.5.3 .9130 Adobe AIR 1.5.3 .9120 Adobe AIR 1.5.3 Adobe AIR 1.5.2 Adobe AIR 1.5.1 Adobe AIR 2.0.3 Adobe AIR 2.0.2.12610 Adobe AIR 2.0.2 Adobe AIR 1.5 Adobe AIR 1.1 Adobe AIR 1.01 Adobe AIR 1.0
Not Vulnerable:	HP Systems Insight Manager 6.3 Adobe Flash Player 9.0.289.0 Adobe Flash Player 10.1.105.6 Adobe Flash Player 10.1.102.64 Adobe AIR 2.5.1

Adobe Flash Player 'Flash10h.ocx' Remote Memory Corruption Vulnerability

Adobe Flash Player is prone to a remote memory-corruption vulnerability.

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious '.flv' video file.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application, typically Internet Explorer, using the
ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.

NOTE: This issue was previously discussed in BID 44669 (Adobe Flash Player APSB10-26 Multiple Remote Vulnerabilities), but has been given its own record to better document it.

Adobe Flash Player 'Flash10h.ocx' Remote Memory Corruption Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Flash Player 'Flash10h.ocx' Remote Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.1

• SuSE flash-player-10.1.102.64-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/flash-player-10.1.10 2.64-0.1.1.i586.rpm

S.u.S.E. openSUSE 11.3

• SuSE flash-player-10.1.102.64-0.2.1.i586.rpm
  http://download.opensuse.org/update/11.3/rpm/i586/flash-player-10.1.10 2.64-0.2.1.i586.rpm

S.u.S.E. openSUSE 11.2

• SuSE flash-player-10.1.102.64-0.2.1.i586.rpm
  http://download.opensuse.org/update/11.3/rpm/i586/flash-player-10.1.10 2.64-0.2.1.i586.rpm

Adobe Flash Player 'Flash10h.ocx' Remote Memory Corruption Vulnerability

References:

• Adobe Flash Homepage (Adobe)
  
• Multiple Vulnerabilities in Adobe Flash Player (Oracle)
  
• [FG-VD-10-020]Adobe Flash Player Remote Memory corruption Vulnerability (xpzhang )
  
• APSB10-26 Security update available for Adobe Flash Player (Adobe)