Adobe Flash Player before 10.0.45.2 and Adobe AIR before 1.5.3.9130 allow remote attackers to cause a denial of service (application crash) via a modified SWF file.

An updated Adobe Flash Player package that fixes two security issues is now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes two vulnerabilities in Adobe Flash Player. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-06 page listed in the References section. If a victim loaded a web page containing specially crafted SWF content, it could cause Flash Player to perform unauthorized cross-domain requests, leading to the disclosure of sensitive data. (CVE-2010-0186, CVE-2010-0187)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.45.2.

The following bug has been fixed: Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187)

The remote host is affected by the vulnerability described in GLSA-201101-09 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Flash Player. For     further information please consult the CVE entries and the Adobe     Security Bulletins referenced below.
  Impact :

    A remote attacker could entice a user to open a specially crafted SWF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The following bug has been fixed :

Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187)

Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition (CVE-2010-0187).

Adobe Product Security Incident Response Team reports :

A critical vulnerability has been identified in Adobe Flash Player version 10.0.42.34 and earlier. This vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. This update also resolves a potential Denial of Service issue (CVE-2010-0187).

The remote host contains a version of Adobe Flash Player that is earlier than 10.0.45.2. Such versions are potentially affected by multiple vulnerabilities : 

  - An issue which could subvert the domain sandbox and make unauthorized cross-domain requests. (CVE-2010-0186)
  - An unspecified denial of service. (CVE-2010-0187)

The remote Windows host contains a version of Adobe Flash Player that is earlier than 10.0.45.2.  Such versions are potentially affected by multiple vulnerabilities :

  - An issue that could subvert the domain sandbox and make     unauthorized cross-domain requests. (CVE-2010-0186)

  - An unspecified denial of service. (CVE-2010-0187)

The remote Windows host contains a version of Adobe AIR that is earlier than 1.5.3.9130 Such versions are potentially affected by multiple vulnerabilities :

  - An issue that could subvert the domain sandbox and make     unauthorized cross-domain requests. (CVE-2010-0186)

  - An unspecified denial of service. (CVE-2010-0187)

ID	Name	Product	Family	Severity
63917	RHEL 5 : flash-plugin (RHSA-2010:0102)	Nessus	Red Hat Local Security Checks	medium
51735	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6845)	Nessus	SuSE Local Security Checks	medium
51734	SuSE 10 Security Update : flash-player (ZYPP Patch Number 6844)	Nessus	SuSE Local Security Checks	medium
51658	GLSA-201101-09 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
44639	SuSE 11 Security Update : flash-player (SAT Patch Number 1977)	Nessus	SuSE Local Security Checks	medium
44638	openSUSE Security Update : flash-player (flash-player-1970)	Nessus	SuSE Local Security Checks	medium
44637	openSUSE Security Update : flash-player (flash-player-1970)	Nessus	SuSE Local Security Checks	medium
44636	openSUSE Security Update : flash-player (flash-player-1970)	Nessus	SuSE Local Security Checks	medium
44602	FreeBSD : linux-flashplugin -- multiple vulnerabilities (ff6519ad-18e5-11df-9bdd-001b2134ef46)	Nessus	FreeBSD Local Security Checks	medium
5338	Flash Player < 10.0.45.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	low
44596	Flash Player < 10.0.45.2 Multiple Vulnerabilities (APSB10-06)	Nessus	Windows	medium
44595	Adobe AIR < 1.5.3.9130 Multiple Vulnerabilities (APSB10-06)	Nessus	Windows	medium

Detections

Analytics

CVE-2010-0187

medium

Tenable Plugins

medium

medium

medium

high

high

critical

high

high

medium

medium

medium

medium

medium

low

medium

medium