Summary: | <www-plugins/adobe-flash-10.0.42.34: APSB09-19 vulnerabilities (CVE-2009-{3794,3796,3797,3798,3799,3800}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Greg Hasseler <hasselg> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | hasselg, lack, pacho |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.adobe.com/support/security/bulletins/apsb09-19.html | ||
Whiteboard: | A2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Greg Hasseler
2009-12-10 15:02:05 UTC
Lack, can we stabilize 10.0.42.34? CVE-2009-3794 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3794): Heap-based buffer overflow in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via crafted dimensions of JPEG data in an SWF file. CVE-2009-3796 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3796): Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors, related to a "data injection vulnerability." CVE-2009-3797 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3797): Adobe Flash Player 10.x before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption. CVE-2009-3798 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3798): Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption. CVE-2009-3799 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3799): Integer overflow in the Verifier::parseExceptionHandlers function in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via an SWF file with a large exception_count value that triggers memory corruption, related to "generation of ActionScript exception handlers." CVE-2009-3800 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3800): Multiple unspecified vulnerabilities in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allow attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. (In reply to comment #1) > Lack, can we stabilize 10.0.42.34? Yes, by all means! I don't think adobe-flash has ever waited a full 30 days since normally their releases plug security holes. Maybe I should just start stable-bumping when they make their next release ;) Arches, please test and mark stable: =www-plugins/adobe-flash-10.0.42.34 Target keywords : "amd64 x86" amd64 stable (it's also much less crashy than current stable in my case ;-)) x86 stable All arches stable, and I have now removed the vulnerable =www-plugins/adobe-flash/adobe-flash-10.0.32.18 from the tree. GLSA request was already filed. GLSA 201001-02 |