Red Hat Security Advisory

RHSA-2008:0221

flash-plugin security update

Released 2008-04-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 3 Extras flash-plugin-9.0.124.0-1.el3.with.oss.i386
Red Hat Desktop version 4 Extras flash-plugin-9.0.124.0-1.el4.i386
Red Hat Enterprise Linux AS version 3 Extras flash-plugin-9.0.124.0-1.el3.with.oss.i386
Red Hat Enterprise Linux AS version 4 Extras flash-plugin-9.0.124.0-1.el4.i386
Red Hat Enterprise Linux Desktop Supplementary (v. 5) flash-plugin-9.0.124.0-1.el5.i386
Red Hat Enterprise Linux ES version 3 Extras flash-plugin-9.0.124.0-1.el3.with.oss.i386
Red Hat Enterprise Linux ES version 4 Extras flash-plugin-9.0.124.0-1.el4.i386
Red Hat Enterprise Linux Server Supplementary (v. 5) flash-plugin-9.0.124.0-1.el5.i386
Red Hat Enterprise Linux WS version 3 Extras flash-plugin-9.0.124.0-1.el3.with.oss.i386
Red Hat Enterprise Linux WS version 4 Extras flash-plugin-9.0.124.0-1.el4.i386

Fixes 8 records

TI-2007-00066 CVE-2007-0071 · GHSA-3c7g-3984-748r

Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier…

HIGH 83

Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed co…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.92501 Published 2008-04-09 Fixed CWE-189

TI-2007-05757 CVE-2007-6019 · GHSA-9g7g-pmg2-qx9r

Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote…

HIGH 74

Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.5977 Published 2008-04-09 Fixed

TI-2007-05958 CVE-2007-6243 · GHSA-5jf8-m2pq-674g

Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does…

MEDIUM 51

Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to co…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08467 Published 2007-12-20 Fixed CWE-264

TI-2008-03711 CVE-2008-3872 · GHSA-gm92-x63w-j26f

Adobe Flash Player 8.0.39.0 and earlier, and 9.x up to 9.0.115.0, allows remote attackers…

MEDIUM 47

Adobe Flash Player 8.0.39.0 and earlier, and 9.x up to 9.0.115.0, allows remote attackers to bypass the allowScriptAccess parameter setting via a crafted SWF file with unspecified "Filter evasion" manipulations.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04207 Published 2008-10-06 Fixed CWE-264

TI-2007-05080 CVE-2007-5275 · GHSA-pwqr-x6x9-wjxj

The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to…

LOW 32

The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP addre…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06153 Published 2007-10-08 Fixed CWE-20

TI-2008-01587 CVE-2008-1655 · GHSA-6443-g69m-2px6

Unspecified vulnerability in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and…

LOW 28

Unspecified vulnerability in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04903 Published 2008-04-09 Fixed CWE-79

TI-2008-01586 CVE-2008-1654 · GHSA-fm6f-cqv9-287v

Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP)…

LOW 28

Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to se…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04796 Published 2008-04-02 Fixed CWE-352

TI-2007-06333 CVE-2007-6637 · GHSA-qqg7-345x-wv56

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote…

LOW 28

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver C…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04891 Published 2008-01-04 Fixed CWE-79