CVE-2009-1870MEDIUM
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to obtain sensitive information via vectors involving saving an SWF file to a hard drive, related to a "local sandbox vulnerability."
References
http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
http://secunia.com/advisories/36193
http://secunia.com/advisories/36374
http://secunia.com/advisories/36701
http://security.gentoo.org/glsa/glsa-200908-04.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
http://support.apple.com/kb/HT3864
http://support.apple.com/kb/HT3865
http://www.adobe.com/support/security/bulletins/apsb09-10.html
http://www.adobe.com/support/security/bulletins/apsb09-13.html
http://www.securityfocus.com/bid/35890
http://www.securityfocus.com/bid/35908
http://www.securitytracker.com/id?1022629
http://www.vupen.com/english/advisories/2009/2086
https://exchange.xforce.ibmcloud.com/vulnerabilities/52180
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15887
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6648
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:adobe:air:1.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:* versions up to 1.5.1 (inclusive)
cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.63:*:linux:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:basic:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:pro:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* versions up to 10.0.22.87 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 63887 | RHEL 3 / 4 : flash-plugin (RHSA-2009:1189) | Nessus | Red Hat Local Security Checks | high |
| 63886 | RHEL 5 : flash-plugin (RHSA-2009:1188) | Nessus | Red Hat Local Security Checks | high |
| 51731 | SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386) | Nessus | SuSE Local Security Checks | high |
| 42001 | openSUSE 10 Security Update : flash-player (flash-player-6387) | Nessus | SuSE Local Security Checks | high |
| 41392 | SuSE 11 Security Update : flash-player (SAT Patch Number 1149) | Nessus | SuSE Local Security Checks | high |
| 800786 | Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities | Log Correlation Engine | Operating System Detection | high |
| 5162 | Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities | Nessus Network Monitor | Generic | critical |
| 40946 | Mac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 40945 | Mac OS X Multiple Vulnerabilities (Security Update 2009-005) | Nessus | MacOS X Local Security Checks | critical |
| 40520 | GLSA-200908-04 : Adobe products: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 40489 | openSUSE Security Update : flash-player (flash-player-1148) | Nessus | SuSE Local Security Checks | high |
| 40488 | openSUSE Security Update : flash-player (flash-player-1148) | Nessus | SuSE Local Security Checks | high |
| 5109 | Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10) | Nessus Network Monitor | Web Clients | medium |
| 40447 | Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10) | Nessus | Windows | high |
| 40434 | Flash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10) | Nessus | Windows | high |