The Adobe Flash Player was updated to version 7.0.70.0 for Novell Linux Desktop 9 and to version 9.0.48.0 on SUSE Linux Enterprise Desktop 10 to fix several security problems :

  - An input validation error has been identified in Flash     Player 9.0.45.0 and earlier versions that could lead to     the potential execution of arbitrary code. This     vulnerability could be accessed through content     delivered from a remote location via the user's web     browser, email client, or other applications that     include or reference the Flash Player. (CVE-2007-3456)

  - An issue with insufficient validation of the HTTP     Referer has been identified in Flash Player 8.0.34.0 and     earlier. This issue does not affect Flash Player 9. This     issue could potentially aid an attacker in executing a     cross-site request forgery attack. (CVE-2007-3457)

  - The Linux and Solaris updates for Flash Player 7     (7.0.70.0) address the issues with Flash Player and the     Opera and Konqueror browsers described in Security     Advisory APSA07-03. These issues do not impact Flash     Player 9 on Linux or Solaris. (CVE-2007-2022)

The affected webbrowsers Opera and konqueror have already been fixed independendly.

The remote host is affected by the vulnerability described in GLSA-200708-01 (Macromedia Flash Player: Remote arbitrary code execution)

    Mark Hills discovered some errors when interacting with a browser for     keystrokes handling (CVE-2007-2022). Stefano Di Paola and Giorgio Fedon     from Minded Security discovered a boundary error when processing FLV     files (CVE-2007-3456). An input validation error when processing HTTP     referrers has also been reported (CVE-2007-3457).
  Impact :

    A remote attacker could entice a user to open a specially crafted file,     possibly leading to the execution of arbitrary code with the privileges     of the user running the Macromedia Flash Player, or sensitive data     access.
  Workaround :

    There is no known workaround at this time.

According to its version number, the instance of Flash Player on the remote Windows host could allow for arbitrary code execution by means of a malicious SWF file. 

In addition, it may also fail to sufficiently validate the HTTP Referer header, which may aid in cross-site request forgery attacks. This issue does not, though, affect Flash Player 9.

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.11 or a version of Mac OS X 10.3 which does not have Security Update 2007-008 applied. 

This update contains several security fixes for the following programs :

 - Flash Player Plugin
 - AppleRAID
 - BIND
 - bzip2
 - CFFTP
 - CFNetwork
 - CoreFoundation
 - CoreText
 - Kerberos
 - Kernel
 - remote_cmds
 - Networking
 - NFS
 - NSURL
 - Safari
 - SecurityAgent
 - WebCore
 - WebKit

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Firefox-compatible Adobe Flash Player browser plug-in.

An input validation flaw was found in the way Flash Player displayed certain content. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious Adobe Flash file.
(CVE-2007-3456)

Users of Adobe Flash Player should upgrade to this updated package, which contains version 9.0.47.0. and is not vulnerable to this issue.

Adobe reports :

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities.

The Adobe Flash Player was updated to version 7.0.70.0 on SUSE Linux 10.0 and to version 9.0.48.0 on SUSE Linux 10.1 and openSUSE 10.2 to fix several security problems :

CVE-2007-3456: An input validation error has been identified in Flash Player 9.0.45.0 and earlier versions that could lead to the potential execution of arbitrary code. This vulnerability could be accessed through content delivered from a remote location via the user's web browser, email client, or other applications that include or reference the Flash Player.

CVE-2007-3457: An issue with insufficient validation of the HTTP Referer has been identified in Flash Player 8.0.34.0 and earlier. This issue does not affect Flash Player 9. This issue could potentially aid an attacker in executing a cross-site request forgery attack.

CVE-2007-2022: The Linux and Solaris updates for Flash Player 7 (7.0.70.0) address the issues with Flash Player and the Opera and Konqueror browsers described in Security Advisory APSA07-03. These issues do not impact Flash Player 9 on Linux or Solaris.

The affected webbrowsers Opera and konqueror have already been fixed independendly.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.11 or a version of Mac OS X 10.3 that does not have Security Update 2007-008 applied.  This update contains several security fixes for the following programs :


 - Flash Player Plugin
 - AppleRAID
 - BIND
 - bzip2
 - CFFTP
 - CFNetwork
 - CoreFoundation
 - CoreText
 - Kerberos
 - Kernel
 - remote_cmds
 - Networking
 - NFS
 - NSURL
 - Safari
 - SecurityAgent
 - WebCore
 - WebKit

ID	Name	Product	Family	Published	Updated	Severity
29434	SuSE 10 Security Update : flash-player (ZYPP Patch Number 3890)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	high
25866	GLSA-200708-01 : Macromedia Flash Player: Remote arbitrary code execution	Nessus	Gentoo Local Security Checks	8/13/2007	1/6/2021	high
25694	Flash Player Multiple Vulnerabilities (APSB07-12)	Nessus	Windows	7/11/2007	4/11/2022	high
28212	Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)	Nessus	MacOS X Local Security Checks	11/14/2007	7/14/2018	critical
40704	RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:0696)	Nessus	Red Hat Local Security Checks	8/24/2009	1/14/2021	high
25718	FreeBSD : linux-flashplugin -- critical vulnerabilities (b42e8c32-34f6-11dc-9bc9-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	7/18/2007	1/6/2021	high
27221	openSUSE 10 Security Update : flash-player (flash-player-3889)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
4284	Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)	Nessus Network Monitor	Operating System Detection	11/15/2007	3/6/2019	critical

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high

critical