Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

An updated Adobe Flash Player package that fixes security issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Firefox-compatible Adobe Flash Player browser plug-in.

Security issues were discovered in the Adobe Flash Player. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious Adobe Flash file. (CVE-2006-3311, CVE-2006-3587, CVE-2006-3588)

Users of Adobe Flash Player should upgrade to this updated package, which contains version 7.0.68 and is not vulnerable to this issue.

Red Hat would like to thank Adobe for notifying us of these issues.

Multiple input validation errors have been identified in Flash Player that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the user's web browser, email client, or other applications that include or reference the Flash Player.
(CVE-2006-3311 / CVE-2006-3587 / CVE-2006-3588)

These updates include changes to prevent circumvention of the 'allowScriptAccess' option. (CVE-2006-4640)

Multiple input validation errors have been identified in Flash Player that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the user's web browser, email client, or other applications that include or reference the Flash Player.
(CVE-2006-3311, CVE-2006-3587, CVE-2006-3588)

These updates include changes to prevent circumvention of the 'allowScriptAccess' option. (CVE-2006-4640)

The remote host is affected by the vulnerability described in GLSA-200610-02 (Adobe Flash Player: Arbitrary code execution)

    The Adobe Flash Player contains multiple unspecified vulnerabilities.
  Impact :

    An attacker could entice a user to view a malicious Flash file and     execute arbitrary code with the rights of the user running the player.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.8.  Mac OS X 10.4.8 contains several security fixes for the following programs :
 - CFNetwork
 - Flash Player
 - ImageIO
 - Kernel
 - LoginWindow
 - Preferences
 - QuickDraw Manager
 - SASL
 - WebCore
 - Workgroup Manager

The remote host is running a version of Mac OS X 10.3 which does not have the security update 2006-006 applied.

Security Update 2006-006 contains several security fixes for the following programs :

 - CFNetwork
 - Flash Player
 - QuickDraw Manager
 - SASL
 - WebCore

The remote host is running a version of Mac OS X 10.4.x that is prior to 10.4.8.

Mac OS X 10.4.8 contains several security fixes for the following programs :

 - CFNetwork
 - Flash Player
 - ImageIO
 - Kernel
 - LoginWindow
 - Preferences
 - QuickDraw Manager
 - SASL
 - WebCore
 - Workgroup Manager

Adobe reports :

Multiple input validation errors have been identified in Flash Player 8.0.24.0 and earlier versions that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the user?s web browser, email client, or other applications that include or reference the Flash Player. (CVE-2006-3311, CVE-2006-3587, CVE-2006-3588)

These updates include changes to prevent circumvention of the 'allowScriptAccess' option. (CVE-2006-4640)

According to its version number, the instance of Flash Player on the remote Windows host is affected by arbitrary code execution and denial of service issues.  By convincing a user to visit a site with a specially crafted SWF file, an attacker may be able to execute arbitrary code on the affected host or cause the web browser to crash.

ID	Name	Product	Family	Severity
63833	RHEL 3 / 4 : flash-plugin (RHSA-2006:0674)	Nessus	Red Hat Local Security Checks	medium
29432	SuSE 10 Security Update : flash-player (ZYPP Patch Number 2065)	Nessus	SuSE Local Security Checks	medium
27219	openSUSE 10 Security Update : flash-player (flash-player-2072)	Nessus	SuSE Local Security Checks	medium
22506	GLSA-200610-02 : Adobe Flash Player: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
3757	Mac OS X < 10.4.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
22479	Mac OS X Multiple Vulnerabilities (Security Update 2006-006)	Nessus	MacOS X Local Security Checks	critical
22476	Mac OS X 10.4.x < 10.4.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
22341	FreeBSD : linux-flashplugin7 -- arbitrary code execution vulnerabilities (7c75d48c-429b-11db-afae-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium
22056	Flash Player Multiple Vulnerabilities (APSB06-11)	Nessus	Windows	critical

Detections

Analytics

CVE-2006-3311

high

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

medium

critical