[RHSA-2010:0464-01] Critical: flash-plugin security update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Critical: flash-plugin security update

Advisory ID: RHSA-2010:0464-01

Product: Red Hat Enterprise Linux Extras

Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0464.html

Issue date: 2010-06-11

CVE Names: CVE-2008-4546 CVE-2009-3793 CVE-2010-1297

CVE-2010-2160 CVE-2010-2161 CVE-2010-2162

CVE-2010-2163 CVE-2010-2164 CVE-2010-2165

CVE-2010-2166 CVE-2010-2167 CVE-2010-2169

CVE-2010-2170 CVE-2010-2171 CVE-2010-2173

CVE-2010-2174 CVE-2010-2175 CVE-2010-2176

CVE-2010-2177 CVE-2010-2178 CVE-2010-2179

CVE-2010-2180 CVE-2010-2181 CVE-2010-2182

CVE-2010-2183 CVE-2010-2184 CVE-2010-2185

CVE-2010-2186 CVE-2010-2187 CVE-2010-2188

=====================================================================

 

1. Summary:

 

An updated Adobe Flash Player package that fixes multiple security issues

is now available for Red Hat Enterprise Linux 5 Supplementary.

 

The Red Hat Security Response Team has rated this update as having critical

security impact. Common Vulnerability Scoring System (CVSS) base scores,

which give detailed severity ratings, are available for each vulnerability

from the CVE links in the References section.

 

2. Relevant releases/architectures:

 

RHEL Desktop Supplementary (v. 5 client) - i386, x86_64

RHEL Supplementary (v. 5 server) - i386, x86_64

 

3. Description:

 

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash

Player web browser plug-in.

 

This update fixes multiple vulnerabilities in Adobe Flash Player. These

vulnerabilities are detailed on the Adobe security pages APSA10-01 and

APSB10-14, listed in the References section.

 

Multiple security flaws were found in the way flash-plugin displayed

certain SWF content. An attacker could use these flaws to create a

specially-crafted SWF file that would cause flash-plugin to crash or,

potentially, execute arbitrary code when the victim loaded a page

containing the specially-crafted SWF content. (CVE-2009-3793,

CVE-2010-1297, CVE-2010-2160, CVE-2010-2161, CVE-2010-2162, CVE-2010-2163,

CVE-2010-2164, CVE-2010-2165, CVE-2010-2166, CVE-2010-2167, CVE-2010-2169,

CVE-2010-2170, CVE-2010-2171, CVE-2010-2173, CVE-2010-2174, CVE-2010-2175,

CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2181,

CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185, CVE-2010-2186,

CVE-2010-2187, CVE-2010-2188)

 

An input sanitization flaw was found in the way flash-plugin processed

certain URLs. An attacker could use this flaw to conduct cross-site

scripting (XSS) attacks if a victim were tricked into visiting a

specially-crafted web page. (CVE-2010-2179)

 

A denial of service flaw was found in the way flash-plugin processed

certain SWF content. An attacker could use this flaw to create a

specially-crafted SWF file that would cause flash-plugin to crash.

(CVE-2008-4546)

 

All users of Adobe Flash Player should install this updated package, which

upgrades Flash Player to version 10.1.53.64.

 

4. Solution:

 

Before applying this update, make sure all previously-released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to

use the Red Hat Network to apply this update are available at

http://kbase.redhat.com/faq/docs/DOC-11259

 

5. Bugs fixed (http://bugzilla.redhat.com/):

 

467082 - CVE-2008-4546 flash-plugin: crash caused by SWF files with different SWF versions obtained from the same URL

600692 - CVE-2010-1297 acroread, flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)

602847 - flash-plugin: multiple security flaws (APSB10-14)

 

6. Package List:

 

RHEL Desktop Supplementary (v. 5 client):

 

i386:

flash-plugin-10.1-2.el5.i386.rpm

 

x86_64:

flash-plugin-10.1-2.el5.i386.rpm

 

RHEL Supplementary (v. 5 server):

 

i386:

flash-plugin-10.1-2.el5.i386.rpm

 

x86_64:

flash-plugin-10.1-2.el5.i386.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://www.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2008-4546.html

https://www.redhat.com/security/data/cve/CVE-2009-3793.html

https://www.redhat.com/security/data/cve/CVE-2010-1297.html

https://www.redhat.com/security/data/cve/CVE-2010-2160.html

https://www.redhat.com/security/data/cve/CVE-2010-2161.html

https://www.redhat.com/security/data/cve/CVE-2010-2162.html

https://www.redhat.com/security/data/cve/CVE-2010-2163.html

https://www.redhat.com/security/data/cve/CVE-2010-2164.html

https://www.redhat.com/security/data/cve/CVE-2010-2165.html

https://www.redhat.com/security/data/cve/CVE-2010-2166.html

https://www.redhat.com/security/data/cve/CVE-2010-2167.html

https://www.redhat.com/security/data/cve/CVE-2010-2169.html

https://www.redhat.com/security/data/cve/CVE-2010-2170.html

https://www.redhat.com/security/data/cve/CVE-2010-2171.html

https://www.redhat.com/security/data/cve/CVE-2010-2173.html

https://www.redhat.com/security/data/cve/CVE-2010-2174.html

https://www.redhat.com/security/data/cve/CVE-2010-2175.html

https://www.redhat.com/security/data/cve/CVE-2010-2176.html

https://www.redhat.com/security/data/cve/CVE-2010-2177.html

https://www.redhat.com/security/data/cve/CVE-2010-2178.html

https://www.redhat.com/security/data/cve/CVE-2010-2179.html

https://www.redhat.com/security/data/cve/CVE-2010-2180.html

https://www.redhat.com/security/data/cve/CVE-2010-2181.html

https://www.redhat.com/security/data/cve/CVE-2010-2182.html

https://www.redhat.com/security/data/cve/CVE-2010-2183.html

https://www.redhat.com/security/data/cve/CVE-2010-2184.html

https://www.redhat.com/security/data/cve/CVE-2010-2185.html

https://www.redhat.com/security/data/cve/CVE-2010-2186.html

https://www.redhat.com/security/data/cve/CVE-2010-2187.html

https://www.redhat.com/security/data/cve/CVE-2010-2188.html

http://www.redhat.com/security/updates/classification/#critical

http://www.adobe.com/support/security/advisories/apsa10-01.html

http://www.adobe.com/support/security/bulletins/apsb10-14.html

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://www.redhat.com/security/team/contact/

 

Copyright 2010 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFMEmV+XlSAg2UNWIIRArxxAJkBfl/dOmFRIAqzficWGgtCi5PqyACgvT/Y

v+rUV7NqfnCTSGKYzhRoHiU=

=NS2W

-----END PGP SIGNATURE-----

 

 

--