Critical: flash-plugin security update

Advisory:	RHSA-2010:0470-1
Type:	Security Advisory
Severity:	Critical
Issued on:	2010-06-14
Last updated on:	2010-06-14
Affected Products:	Red Hat Enterprise Linux Extras (v. 3) Red Hat Enterprise Linux Extras (v. 4) Red Hat Enterprise Linux Extras (v. 4.8.z)
CVEs (cve.mitre.org):	CVE-2008-4546 CVE-2009-3793 CVE-2010-1297 CVE-2010-2160 CVE-2010-2161 CVE-2010-2162 CVE-2010-2163 CVE-2010-2164 CVE-2010-2165 CVE-2010-2166 CVE-2010-2167 CVE-2010-2169 CVE-2010-2170 CVE-2010-2171 CVE-2010-2172 CVE-2010-2173 CVE-2010-2174 CVE-2010-2175 CVE-2010-2176 CVE-2010-2177 CVE-2010-2178 CVE-2010-2179 CVE-2010-2180 CVE-2010-2181 CVE-2010-2182 CVE-2010-2183 CVE-2010-2184 CVE-2010-2185 CVE-2010-2186 CVE-2010-2187 CVE-2010-2188

Details

An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 3 and 4 Extras.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.

This update fixes multiple vulnerabilities in Adobe Flash Player. These
vulnerabilities are detailed on the Adobe security page APSB10-14,
listed in the References section.

Multiple security flaws were found in the way flash-plugin displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
potentially, execute arbitrary code when the victim loaded a page
containing the specially-crafted SWF content. (CVE-2009-3793,
CVE-2010-2160, CVE-2010-2161, CVE-2010-2162, CVE-2010-2163, CVE-2010-2164,
CVE-2010-2165, CVE-2010-2166, CVE-2010-2167, CVE-2010-2169, CVE-2010-2170,
CVE-2010-2171, CVE-2010-2172, CVE-2010-2173, CVE-2010-2174, CVE-2010-2175,
CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2181,
CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185, CVE-2010-2186,
CVE-2010-2187, CVE-2010-2188)

An input sanitization flaw was found in the way flash-plugin processed
certain URLs. An attacker could use this flaw to conduct cross-site
scripting (XSS) attacks if a victim were tricked into visiting a
specially-crafted web page. (CVE-2010-2179)

All users of Adobe Flash Player should install this updated package,
which upgrades Flash Player to version 9.0.277.0.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Red Hat Enterprise Linux Extras (v. 3)

IA-32:
flash-plugin-9.0.277.0-1.el3.with.oss.i386.rpm File outdated by: RHSA-2010:0706	`MD5: a1c3ce2f3df3b61fb6379b7cadddc139 SHA-256: 5c7576feb5cb1eb37b9ad7d8d2144b2a153645fff2574a06cc79bd1911f162f8`

Red Hat Enterprise Linux Extras (v. 4)

IA-32:
flash-plugin-9.0.277.0-1.el4.i386.rpm File outdated by: RHSA-2011:0368	`MD5: e160f42e660845ee7a95e9137146f3b2 SHA-256: 2e8c07c72d6475bcdf3f501dade14282df8941fec51785564095c23c46ee7c5b`

Red Hat Enterprise Linux Extras (v. 4.8.z)

IA-32:
flash-plugin-9.0.277.0-1.el4.i386.rpm File outdated by: RHSA-2011:0368	`MD5: e160f42e660845ee7a95e9137146f3b2 SHA-256: 2e8c07c72d6475bcdf3f501dade14282df8941fec51785564095c23c46ee7c5b`

(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

602627 - CVE-2010-2172 flash-plugin: CVE-2010-0187 "possible player crash" affects also v9.x versions of Adobe Flash Player
602847 - flash-plugin: multiple security flaws (APSB10-14)

References

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package