----------------------------------------------------------------------

Did you know? Our assessment and impact rating along with detailed
information such as exploit code availability, or if an updated patch
is released by the vendor, is not part of this mailing-list?
        
Click here to learn more about our commercial solutions:
http://secunia.com/advisories/business_solutions/
        
Click here to trial our solutions:
http://secunia.com/advisories/try_vi/

----------------------------------------------------------------------

TITLE:
Adobe Flash Player Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA34012

VERIFY ADVISORY:
http://secunia.com/advisories/34012/

DESCRIPTION:
Some vulnerabilities have been reported in Adobe Flash Player, which
can be exploited by malicious, local users to disclose sensitive
information and potentially gain escalated privileges, and by
malicious people to bypass certain security restrictions, disclose
potentially sensitive information, and compromise a user's system.

1) An error when processing multiple references to an unspecified
object can be exploited to dereference freed memory via a specially
crafted SWF file.

Successful exploitation allows execution of arbitrary code.

2) An input validation error in the processing of SWF files can be
exploited to cause a crash and potentially execute arbitrary code.

3) An error when displaying the mouse pointer on Windows can be
exploited to potentially conduct "Clickjacking" attacks.

4) An error in the Linux Flash Player binary can be exploited to
disclose sensitive information and potentially gain escalated
privileges.

SOLUTION:
Apply vendor updates.

Flash Player 9.x:
Update to version 9.0.159.0.
http://www.adobe.com/go/kb406791

Flash Player 10.0.12.36 and prior:
Update to version 10.0.22.87.
http://www.adobe.com/go/getflash

Flash Player 10.0.12.36 and prior (network distribution):
Update to version 10.0.22.87.
http://www.adobe.com/licensing/distribution

Flash Player 10.0.15.3 and prior for Linux:
Update to version 10.0.22.87.
http://www.adobe.com/go/getflash

AIR 1.5:
Update to version 1.5.1.
http://get.adobe.com/air

Flash CS4 Professional:
Update to version 10.0.22.87.
http://www.adobe.com/support/flashplayer/downloads.html#fp10

Flash CS3 Professional:
Update to version 9.0.159.0.
http://www.adobe.com/support/flashplayer/downloads.html#fp9

Flex 3:
Update to version 10.0.22.87.
http://www.adobe.com/support/flashplayer/downloads.html#fp9

PROVIDED AND/OR DISCOVERED BY:
1) Javier Vicente Vallejo, reported via iDefense
2) The vendor credits Roee Hay from IBM Rational Application
Security.
3) The vendor credits Eduardo Vela.
4) The vendor credits Josh Bressers of Red Hat and Tavis Ormandy of
the Google Security Team.

ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb09-01.html

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------