Action not permitted
Modal body text goes here.
cve-2010-3636
Vulnerability from cvelistv5
Published
2010-11-07 21:00
Modified
2024-08-07 03:18
Severity ?
EPSS score ?
Summary
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:18:53.106Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2011-0192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0192"
},
{
"name": "42183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42183"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.apple.com/kb/HT4435"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"name": "43026",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43026"
},
{
"name": "GLSA-201101-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"name": "ADV-2010-2918",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"name": "44691",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/44691"
},
{
"name": "APPLE-SA-2010-11-10-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"name": "JVNDB-2010-000054",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html"
},
{
"name": "RHSA-2010:0834",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0834.html"
},
{
"name": "SUSE-SA:2010:055",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"name": "42926",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42926"
},
{
"name": "SSRT100428",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2010-2903",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"name": "HPSBMA02663",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2011-0173",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"name": "JVN#48425028",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN48425028/index.html"
},
{
"name": "oval:org.mitre.oval:def:15913",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"name": "oval:org.mitre.oval:def:12142",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142"
},
{
"name": "ADV-2010-2906",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"name": "RHSA-2010:0867",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0867.html"
},
{
"name": "RHSA-2010:0829",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0829.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-11-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-18T12:57:01",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"name": "ADV-2011-0192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0192"
},
{
"name": "42183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42183"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.apple.com/kb/HT4435"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"name": "43026",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43026"
},
{
"name": "GLSA-201101-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"name": "ADV-2010-2918",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"name": "44691",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/44691"
},
{
"name": "APPLE-SA-2010-11-10-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"name": "JVNDB-2010-000054",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html"
},
{
"name": "RHSA-2010:0834",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0834.html"
},
{
"name": "SUSE-SA:2010:055",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"name": "42926",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42926"
},
{
"name": "SSRT100428",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2010-2903",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"name": "HPSBMA02663",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2011-0173",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"name": "JVN#48425028",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN48425028/index.html"
},
{
"name": "oval:org.mitre.oval:def:15913",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"name": "oval:org.mitre.oval:def:12142",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142"
},
{
"name": "ADV-2010-2906",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"name": "RHSA-2010:0867",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0867.html"
},
{
"name": "RHSA-2010:0829",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0829.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@adobe.com",
"ID": "CVE-2010-3636",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2011-0192",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0192"
},
{
"name": "42183",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42183"
},
{
"name": "http://support.apple.com/kb/HT4435",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT4435"
},
{
"name": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1",
"refsource": "CONFIRM",
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"name": "43026",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43026"
},
{
"name": "GLSA-201101-09",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"name": "ADV-2010-2918",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"name": "44691",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/44691"
},
{
"name": "APPLE-SA-2010-11-10-1",
"refsource": "APPLE",
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"name": "JVNDB-2010-000054",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html"
},
{
"name": "RHSA-2010:0834",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0834.html"
},
{
"name": "SUSE-SA:2010:055",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"name": "42926",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42926"
},
{
"name": "SSRT100428",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2010-2903",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"name": "HPSBMA02663",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2011-0173",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"name": "JVN#48425028",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN48425028/index.html"
},
{
"name": "oval:org.mitre.oval:def:15913",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913"
},
{
"name": "http://www.adobe.com/support/security/bulletins/apsb10-26.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"name": "oval:org.mitre.oval:def:12142",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142"
},
{
"name": "ADV-2010-2906",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"name": "RHSA-2010:0867",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0867.html"
},
{
"name": "RHSA-2010:0829",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0829.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2010-3636",
"datePublished": "2010-11-07T21:00:00",
"dateReserved": "2010-09-28T00:00:00",
"dateUpdated": "2024-08-07T03:18:53.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2010-3636\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2010-11-07T22:00:01.863\",\"lastModified\":\"2024-05-17T17:27:59.167\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.\"},{\"lang\":\"es\",\"value\":\"Adobe Flash Player anterior v9.0.289.0 y v10.x anterior a v10.1.102.64 en Windows, Mac OS X, Linux, y Solaris, y v10.1.95.1 en Android, no maneja adecuadamente codificaciones no especificadas durante el parseo de los ficheros de pol\u00edticas de cruce de dominios, lo que permite a servidores web remotos evitar las restricciones de acceso a trav\u00e9s de vectores no especificados.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":9.3},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0\",\"versionEndExcluding\":\"9.0.289.0\",\"matchCriteriaId\":\"537D901A-6065-4910-82F0-96ED52993190\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0\",\"versionEndExcluding\":\"10.1.102.64\",\"matchCriteriaId\":\"3D98F767-E239-4C7A-AE9A-48E4BCE2DFEE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4781BF1E-8A4E-4AFF-9540-23D523EE30DD\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:sun:solaris:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"76B8E33C-4346-4318-B461-3C9547372C67\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"10.1.95.1\",\"matchCriteriaId\":\"3C559189-78B4-4D65-B2C0-BE2A812B0FFE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26\"}]}]}],\"references\":[{\"url\":\"http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://jvn.jp/en/jp/JVN48425028/index.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/42183\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/42926\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/43026\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-201101-09.xml\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://support.apple.com/kb/HT4435\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.adobe.com/support/security/bulletins/apsb10-26.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0829.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0834.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0867.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/44691\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.vupen.com/english/advisories/2010/2903\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2010/2906\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2010/2918\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2011/0173\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2011/0192\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
rhsa-2010_0867
Vulnerability from csaf_redhat
Published
2010-11-10 19:00
Modified
2024-11-05 17:23
Summary
Red Hat Security Advisory: flash-plugin security update
Notes
Topic
An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 6 Supplementary.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.
This update fixes multiple vulnerabilities in Adobe Flash Player. These
vulnerabilities are detailed on the Adobe security page APSB10-26, listed
in the References section.
Multiple security flaws were found in the way flash-plugin displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
potentially, execute arbitrary code when the victim loaded a page
containing the specially-crafted SWF content. (CVE-2010-3639,
CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,
CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,
CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)
An input validation flaw was discovered in flash-plugin. Certain server
encodings could lead to a bypass of cross-domain policy file restrictions,
possibly leading to cross-domain information disclosure. (CVE-2010-3636)
During testing, it was discovered that there were regressions with Flash
Player on certain sites, such as fullscreen playback on YouTube. Despite
these regressions, we feel these security flaws are serious enough to
update the package with what Adobe has provided.
All users of Adobe Flash Player should install this updated package, which
upgrades Flash Player to version 10.1.102.64.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated Adobe Flash Player package that fixes multiple security issues\nis now available for Red Hat Enterprise Linux 6 Supplementary.\n\nThe Red Hat Security Response Team has rated this update as having critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash\nPlayer web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player. These\nvulnerabilities are detailed on the Adobe security page APSB10-26, listed\nin the References section.\n\nMultiple security flaws were found in the way flash-plugin displayed\ncertain SWF content. An attacker could use these flaws to create a\nspecially-crafted SWF file that would cause flash-plugin to crash or,\npotentially, execute arbitrary code when the victim loaded a page\ncontaining the specially-crafted SWF content. (CVE-2010-3639,\nCVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,\nCVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,\nCVE-2010-3650, CVE-2010-3652, CVE-2010-3654)\n\nAn input validation flaw was discovered in flash-plugin. Certain server\nencodings could lead to a bypass of cross-domain policy file restrictions,\npossibly leading to cross-domain information disclosure. (CVE-2010-3636)\n\nDuring testing, it was discovered that there were regressions with Flash\nPlayer on certain sites, such as fullscreen playback on YouTube. Despite\nthese regressions, we feel these security flaws are serious enough to\nupdate the package with what Adobe has provided.\n\nAll users of Adobe Flash Player should install this updated package, which\nupgrades Flash Player to version 10.1.102.64.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2010:0867",
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "http://www.adobe.com/support/security/bulletins/apsb10-26.html",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"category": "external",
"summary": "647525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=647525"
},
{
"category": "external",
"summary": "649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0867.json"
}
],
"title": "Red Hat Security Advisory: flash-plugin security update",
"tracking": {
"current_release_date": "2024-11-05T17:23:36+00:00",
"generator": {
"date": "2024-11-05T17:23:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2010:0867",
"initial_release_date": "2010-11-10T19:00:00+00:00",
"revision_history": [
{
"date": "2010-11-10T19:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2010-11-09T14:00:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T17:23:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)",
"product_id": "6Client-Supplementary",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Supplementary (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server Supplementary (v. 6)",
"product_id": "6Server-Supplementary",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)",
"product_id": "6Workstation-Supplementary",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux Supplementary"
},
{
"branches": [
{
"category": "product_version",
"name": "flash-plugin-0:10.1.102.64-1.el6.i686",
"product": {
"name": "flash-plugin-0:10.1.102.64-1.el6.i686",
"product_id": "flash-plugin-0:10.1.102.64-1.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/flash-plugin@10.1.102.64-1.el6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:10.1.102.64-1.el6.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)",
"product_id": "6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
},
"product_reference": "flash-plugin-0:10.1.102.64-1.el6.i686",
"relates_to_product_reference": "6Client-Supplementary"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:10.1.102.64-1.el6.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)",
"product_id": "6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
},
"product_reference": "flash-plugin-0:10.1.102.64-1.el6.i686",
"relates_to_product_reference": "6Server-Supplementary"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:10.1.102.64-1.el6.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)",
"product_id": "6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
},
"product_reference": "flash-plugin-0:10.1.102.64-1.el6.i686",
"relates_to_product_reference": "6Workstation-Supplementary"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2010-3636",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3636"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3636",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3639",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3639"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3639"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3640",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3640"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3640",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3640"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3640",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3640"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3641",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3641"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3641",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3641"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3641",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3641"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3642",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3642"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3642",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3642"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3642",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3642"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3643",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3643"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3643",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3643"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3643",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3643"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3644",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3644"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3644",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3644"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3644",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3644"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3645",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3645"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3645",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3645"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3646",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3646"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3646",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3646"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3647",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3647"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3647",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3647"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3647",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3647"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3648",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3648"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3648",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3648"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3649",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3649"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3649",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3649"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3649",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3649"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3650",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3650"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3650",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3650"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3650",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3650"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3652",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3650.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3652"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3652",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3652"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3652",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3652"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3654",
"discovery_date": "2010-10-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "647525"
}
],
"notes": [
{
"category": "description",
"text": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3654"
},
{
"category": "external",
"summary": "RHBZ#647525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=647525"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3654",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3654"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3654",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3654"
}
],
"release_date": "2010-10-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-10T19:00:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0867"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Client-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Server-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686",
"6Workstation-Supplementary:flash-plugin-0:10.1.102.64-1.el6.i686"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)"
}
]
}
rhsa-2010_0834
Vulnerability from csaf_redhat
Published
2010-11-08 16:25
Modified
2024-11-05 17:21
Summary
Red Hat Security Advisory: flash-plugin security update
Notes
Topic
An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 4 Extras.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.
This update fixes multiple vulnerabilities in Adobe Flash Player. These
vulnerabilities are detailed on the Adobe security page APSB10-26, listed
in the References section.
Multiple security flaws were found in the way flash-plugin displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
potentially, execute arbitrary code when the victim loaded a page
containing the specially-crafted SWF content. (CVE-2010-3639,
CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,
CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,
CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)
An input validation flaw was discovered in flash-plugin. Certain server
encodings could lead to a bypass of cross-domain policy file restrictions,
possibly leading to cross-domain information disclosure. (CVE-2010-3636)
All users of Adobe Flash Player should install this updated package, which
upgrades Flash Player to version 9.0.289.0.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated Adobe Flash Player package that fixes multiple security issues\nis now available for Red Hat Enterprise Linux 4 Extras.\n\nThe Red Hat Security Response Team has rated this update as having critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash\nPlayer web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player. These\nvulnerabilities are detailed on the Adobe security page APSB10-26, listed\nin the References section.\n\nMultiple security flaws were found in the way flash-plugin displayed\ncertain SWF content. An attacker could use these flaws to create a\nspecially-crafted SWF file that would cause flash-plugin to crash or,\npotentially, execute arbitrary code when the victim loaded a page\ncontaining the specially-crafted SWF content. (CVE-2010-3639,\nCVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,\nCVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,\nCVE-2010-3650, CVE-2010-3652, CVE-2010-3654)\n\nAn input validation flaw was discovered in flash-plugin. Certain server\nencodings could lead to a bypass of cross-domain policy file restrictions,\npossibly leading to cross-domain information disclosure. (CVE-2010-3636)\n\nAll users of Adobe Flash Player should install this updated package, which\nupgrades Flash Player to version 9.0.289.0.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2010:0834",
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "http://www.adobe.com/support/security/bulletins/apsb10-26.html",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"category": "external",
"summary": "647525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=647525"
},
{
"category": "external",
"summary": "649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0834.json"
}
],
"title": "Red Hat Security Advisory: flash-plugin security update",
"tracking": {
"current_release_date": "2024-11-05T17:21:53+00:00",
"generator": {
"date": "2024-11-05T17:21:53+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2010:0834",
"initial_release_date": "2010-11-08T16:25:00+00:00",
"revision_history": [
{
"date": "2010-11-08T16:25:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2010-11-08T11:25:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T17:21:53+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4 Extras",
"product": {
"name": "Red Hat Enterprise Linux AS version 4 Extras",
"product_id": "4AS-LACD",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 4 Extras",
"product": {
"name": "Red Hat Desktop version 4 Extras",
"product_id": "4Desktop-LACD",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4 Extras",
"product": {
"name": "Red Hat Enterprise Linux ES version 4 Extras",
"product_id": "4ES-LACD",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:4"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4 Extras",
"product": {
"name": "Red Hat Enterprise Linux WS version 4 Extras",
"product_id": "4WS-LACD",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:4"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux Supplementary"
},
{
"branches": [
{
"category": "product_version",
"name": "flash-plugin-0:9.0.289.0-1.el4.i386",
"product": {
"name": "flash-plugin-0:9.0.289.0-1.el4.i386",
"product_id": "flash-plugin-0:9.0.289.0-1.el4.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/flash-plugin@9.0.289.0-1.el4?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:9.0.289.0-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras",
"product_id": "4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
},
"product_reference": "flash-plugin-0:9.0.289.0-1.el4.i386",
"relates_to_product_reference": "4AS-LACD"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:9.0.289.0-1.el4.i386 as a component of Red Hat Desktop version 4 Extras",
"product_id": "4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
},
"product_reference": "flash-plugin-0:9.0.289.0-1.el4.i386",
"relates_to_product_reference": "4Desktop-LACD"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:9.0.289.0-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras",
"product_id": "4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
},
"product_reference": "flash-plugin-0:9.0.289.0-1.el4.i386",
"relates_to_product_reference": "4ES-LACD"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:9.0.289.0-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras",
"product_id": "4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
},
"product_reference": "flash-plugin-0:9.0.289.0-1.el4.i386",
"relates_to_product_reference": "4WS-LACD"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2010-3636",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3636"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3636",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3639",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3639"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3639"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3640",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3640"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3640",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3640"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3640",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3640"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3641",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3641"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3641",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3641"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3641",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3641"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3642",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3642"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3642",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3642"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3642",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3642"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3643",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3643"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3643",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3643"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3643",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3643"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3644",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3644"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3644",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3644"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3644",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3644"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3645",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3645"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3645",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3645"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3646",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3646"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3646",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3646"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3647",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3647"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3647",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3647"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3647",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3647"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3648",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3648"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3648",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3648"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3649",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3649"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3649",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3649"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3649",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3649"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3650",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3650"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3650",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3650"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3650",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3650"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3652",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3650.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3652"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3652",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3652"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3652",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3652"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3654",
"discovery_date": "2010-10-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "647525"
}
],
"notes": [
{
"category": "description",
"text": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3654"
},
{
"category": "external",
"summary": "RHBZ#647525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=647525"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3654",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3654"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3654",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3654"
}
],
"release_date": "2010-10-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-08T16:25:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0834"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"4AS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4Desktop-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4ES-LACD:flash-plugin-0:9.0.289.0-1.el4.i386",
"4WS-LACD:flash-plugin-0:9.0.289.0-1.el4.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)"
}
]
}
rhsa-2010_0829
Vulnerability from csaf_redhat
Published
2010-11-06 00:38
Modified
2024-11-05 17:21
Summary
Red Hat Security Advisory: flash-plugin security update
Notes
Topic
An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 5 Supplementary.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.
This update fixes multiple vulnerabilities in Adobe Flash Player. These
vulnerabilities are detailed on the Adobe security page APSB10-26, listed
in the References section.
Multiple security flaws were found in the way flash-plugin displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
potentially, execute arbitrary code when the victim loaded a page
containing the specially-crafted SWF content. (CVE-2010-3639,
CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,
CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,
CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)
An input validation flaw was discovered in flash-plugin. Certain server
encodings could lead to a bypass of cross-domain policy file restrictions,
possibly leading to cross-domain information disclosure. (CVE-2010-3636)
During testing, it was discovered that there were regressions with Flash
Player on certain sites, such as fullscreen playback on YouTube. Despite
these regressions, we feel these security flaws are serious enough to
update the package with what Adobe has provided.
All users of Adobe Flash Player should install this updated package, which
upgrades Flash Player to version 10.1.102.64.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated Adobe Flash Player package that fixes multiple security issues\nis now available for Red Hat Enterprise Linux 5 Supplementary.\n\nThe Red Hat Security Response Team has rated this update as having critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash\nPlayer web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player. These\nvulnerabilities are detailed on the Adobe security page APSB10-26, listed\nin the References section.\n\nMultiple security flaws were found in the way flash-plugin displayed\ncertain SWF content. An attacker could use these flaws to create a\nspecially-crafted SWF file that would cause flash-plugin to crash or,\npotentially, execute arbitrary code when the victim loaded a page\ncontaining the specially-crafted SWF content. (CVE-2010-3639,\nCVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644,\nCVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,\nCVE-2010-3650, CVE-2010-3652, CVE-2010-3654)\n\nAn input validation flaw was discovered in flash-plugin. Certain server\nencodings could lead to a bypass of cross-domain policy file restrictions,\npossibly leading to cross-domain information disclosure. (CVE-2010-3636)\n\nDuring testing, it was discovered that there were regressions with Flash\nPlayer on certain sites, such as fullscreen playback on YouTube. Despite\nthese regressions, we feel these security flaws are serious enough to\nupdate the package with what Adobe has provided.\n\nAll users of Adobe Flash Player should install this updated package, which\nupgrades Flash Player to version 10.1.102.64.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2010:0829",
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "http://www.adobe.com/support/security/bulletins/apsb10-26.html",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"category": "external",
"summary": "647525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=647525"
},
{
"category": "external",
"summary": "649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0829.json"
}
],
"title": "Red Hat Security Advisory: flash-plugin security update",
"tracking": {
"current_release_date": "2024-11-05T17:21:47+00:00",
"generator": {
"date": "2024-11-05T17:21:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2010:0829",
"initial_release_date": "2010-11-06T00:38:00+00:00",
"revision_history": [
{
"date": "2010-11-06T00:38:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2010-11-05T20:42:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T17:21:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
"product_id": "5Client-Supplementary",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Supplementary (v. 5)",
"product": {
"name": "Red Hat Enterprise Linux Server Supplementary (v. 5)",
"product_id": "5Server-Supplementary",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_extras:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux Supplementary"
},
{
"branches": [
{
"category": "product_version",
"name": "flash-plugin-0:10.1.102.64-1.el5.i386",
"product": {
"name": "flash-plugin-0:10.1.102.64-1.el5.i386",
"product_id": "flash-plugin-0:10.1.102.64-1.el5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/flash-plugin@10.1.102.64-1.el5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:10.1.102.64-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
"product_id": "5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
},
"product_reference": "flash-plugin-0:10.1.102.64-1.el5.i386",
"relates_to_product_reference": "5Client-Supplementary"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "flash-plugin-0:10.1.102.64-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)",
"product_id": "5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
},
"product_reference": "flash-plugin-0:10.1.102.64-1.el5.i386",
"relates_to_product_reference": "5Server-Supplementary"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2010-3636",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3636"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3636",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3639",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3639"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3639"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3640",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3640"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3640",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3640"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3640",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3640"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3641",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3641"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3641",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3641"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3641",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3641"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3642",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3642"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3642",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3642"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3642",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3642"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3643",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3643"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3643",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3643"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3643",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3643"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3644",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3644"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3644",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3644"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3644",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3644"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3645",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3645"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3645",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3645"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3646",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3646"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3646",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3646"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3647",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3647"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3647",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3647"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3647",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3647"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3648",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3648"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3648",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3648"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3649",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3650, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3649"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3649",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3649"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3649",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3649"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3650",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3652.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3650"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3650",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3650"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3650",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3650"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3652",
"discovery_date": "2010-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "649938"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3650.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "flash-plugin: security bulletin APSB10-26",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3652"
},
{
"category": "external",
"summary": "RHBZ#649938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3652",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3652"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3652",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3652"
}
],
"release_date": "2010-11-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "flash-plugin: security bulletin APSB10-26"
},
{
"cve": "CVE-2010-3654",
"discovery_date": "2010-10-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "647525"
}
],
"notes": [
{
"category": "description",
"text": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2010-3654"
},
{
"category": "external",
"summary": "RHBZ#647525",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=647525"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2010-3654",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-3654"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-3654",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3654"
}
],
"release_date": "2010-10-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2010-11-06T00:38:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
"product_ids": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2010:0829"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"5Client-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386",
"5Server-Supplementary:flash-plugin-0:10.1.102.64-1.el5.i386"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)"
}
]
}
gsd-2010-3636
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2010-3636",
"description": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.",
"id": "GSD-2010-3636",
"references": [
"https://www.suse.com/security/cve/CVE-2010-3636.html",
"https://access.redhat.com/errata/RHSA-2010:0867",
"https://access.redhat.com/errata/RHSA-2010:0834",
"https://access.redhat.com/errata/RHSA-2010:0829"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2010-3636"
],
"details": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.",
"id": "GSD-2010-3636",
"modified": "2023-12-13T01:21:34.526486Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "psirt@adobe.com",
"ID": "CVE-2010-3636",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2011-0192",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0192"
},
{
"name": "42183",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42183"
},
{
"name": "http://support.apple.com/kb/HT4435",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT4435"
},
{
"name": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1",
"refsource": "CONFIRM",
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"name": "43026",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43026"
},
{
"name": "GLSA-201101-09",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"name": "ADV-2010-2918",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"name": "44691",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/44691"
},
{
"name": "APPLE-SA-2010-11-10-1",
"refsource": "APPLE",
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"name": "JVNDB-2010-000054",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html"
},
{
"name": "RHSA-2010:0834",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0834.html"
},
{
"name": "SUSE-SA:2010:055",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"name": "42926",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42926"
},
{
"name": "SSRT100428",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2010-2903",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"name": "HPSBMA02663",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "ADV-2011-0173",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"name": "JVN#48425028",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN48425028/index.html"
},
{
"name": "oval:org.mitre.oval:def:15913",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913"
},
{
"name": "http://www.adobe.com/support/security/bulletins/apsb10-26.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"name": "oval:org.mitre.oval:def:12142",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142"
},
{
"name": "ADV-2010-2906",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"name": "RHSA-2010:0867",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0867.html"
},
{
"name": "RHSA-2010:0829",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0829.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.0.289.0",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.1.102.64",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:linux:linux:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:sun:solaris:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.1.95.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "psirt@adobe.com",
"ID": "CVE-2010-3636"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.adobe.com/support/security/bulletins/apsb10-26.html",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"name": "http://support.apple.com/kb/HT4435",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "http://support.apple.com/kb/HT4435"
},
{
"name": "APPLE-SA-2010-11-10-1",
"refsource": "APPLE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"name": "44691",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/44691"
},
{
"name": "JVNDB-2010-000054",
"refsource": "JVNDB",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html"
},
{
"name": "ADV-2010-2918",
"refsource": "VUPEN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"name": "RHSA-2010:0834",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0834.html"
},
{
"name": "42183",
"refsource": "SECUNIA",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/42183"
},
{
"name": "RHSA-2010:0829",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0829.html"
},
{
"name": "ADV-2010-2903",
"refsource": "VUPEN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"name": "JVN#48425028",
"refsource": "JVN",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://jvn.jp/en/jp/JVN48425028/index.html"
},
{
"name": "ADV-2010-2906",
"refsource": "VUPEN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"name": "RHSA-2010:0867",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2010-0867.html"
},
{
"name": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1",
"refsource": "CONFIRM",
"tags": [
"Broken Link"
],
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"name": "42926",
"refsource": "SECUNIA",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/42926"
},
{
"name": "GLSA-201101-09",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"name": "ADV-2011-0173",
"refsource": "VUPEN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"name": "SUSE-SA:2010:055",
"refsource": "SUSE",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"name": "43026",
"refsource": "SECUNIA",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/43026"
},
{
"name": "ADV-2011-0192",
"refsource": "VUPEN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0192"
},
{
"name": "SSRT100428",
"refsource": "HP",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"name": "oval:org.mitre.oval:def:15913",
"refsource": "OVAL",
"tags": [
"Third Party Advisory"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913"
},
{
"name": "oval:org.mitre.oval:def:12142",
"refsource": "OVAL",
"tags": [
"Third Party Advisory"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2019-10-09T23:01Z",
"publishedDate": "2010-11-07T22:00Z"
}
}
}
ghsa-r3hm-9frm-fwcf
Vulnerability from github
Published
2022-05-13 01:39
Modified
2022-05-13 01:39
Details
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
{
"affected": [],
"aliases": [
"CVE-2010-3636"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-11-07T22:00:00Z",
"severity": "HIGH"
},
"details": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.",
"id": "GHSA-r3hm-9frm-fwcf",
"modified": "2022-05-13T01:39:32Z",
"published": "2022-05-13T01:39:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3636"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913"
},
{
"type": "WEB",
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN48425028/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42183"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42926"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43026"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4435"
},
{
"type": "WEB",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0829.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0834.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0867.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/44691"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0192"
}
],
"schema_version": "1.4.0",
"severity": []
}
var-201011-0229
Vulnerability from variot
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors. Flash Player contains an access restriction bypass vulnerability. When Flash Player references a different website than the site where Flash contents are hosted, the referenced site must be allowed access by the cross-domain policy file. Flash Player contains a vulnerability where access restrictions set by the cross-domain policy file may be bypassed.Cross-domain policy restrictions can be bypassed by using a specially crafted web page. This could result in unauthorized access to website data. An attacker can exploit this issue to bypass certain policy restrictions, which may aid in further attacks. NOTE: This issue was previously discussed in BID 44669 (Adobe Flash Player APSB10-26 Multiple Remote Vulnerabilities), but has been given its own record to better document it. Adobe Flash Player is a cross-platform, browser-based application that renders expressive applications, content, and video natively across screens and browsers. Remote web servers can bypass preset access restrictions with the help of unknown vectors. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c02738731 Version: 1
HPSBMA02663 SSRT100428 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Execution of Arbitrary Code, Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2011-04-19 Last Updated: 2011-04-19
Potential Security Impact: Remote cross site scripting (XSS), cross site request forgery (CSRF), execution of arbitrary code, Denial of Service (DoS)
Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows. The vulnerabilities could be exploited remotely resulting in cross site scripting (XSS), cross site request forgery (CSRF), execution of arbitrary code, and Denial of Service (DoS). HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows prior to v6.3
BACKGROUND
CVSS 2.0 Base Metrics
Reference Base Vector Base Score CVE-2010-3636 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3637 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3638 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2010-3639 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3640 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3641 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3642 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3643 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3644 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3645 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3646 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3647 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3648 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3649 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3650 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3652 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2010-3976 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2011-1542 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2011-1543 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002
RESOLUTION
HP has provided HP SIM v6.3 or subsequent to resolve the vulnerabilities.
HP SIM v6.3 for HP-UX, Linux, and Windows
HP SIM v6.3 for HP-UX, Linux, and Windows is available here: http://h18013.www1.hp.com/products/servers/management/hpsim/
HP SIM v6.3 for Windows on Insight Software DVD
In addition for Windows HP SIM v6.3 is available on DVD images. These are available for download here. http://h18013.www1.hp.com/products/servers/management/fpdownload.html
MANUAL ACTIONS: Yes - NonUpdate For HP-UX, install HP SIM v6.3 or subsequent
PRODUCT SPECIFIC INFORMATION
HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa
The following text is for use by the HP-UX Software Assistant.
AFFECTED VERSIONS
HP-UX B.11.23 HP-UX B.11.31 ============= SysMgmtServer.MX-CMS SysMgmtServer.MX-CORE SysMgmtServer.MX-CORE-ARCH SysMgmtServer.MX-CORE-ARCH SysMgmtServer.MX-PORTAL SysMgmtServer.MX-REPO SysMgmtServer.MX-TOOLS action: install HP SIM v6.3 or subsequent
END AFFECTED VERSIONS
HISTORY Version: 1 (rev.1) - 19 April 2011 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.
Support: For further information, contact normal HP Services support channel.
Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches -check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems -verify your operating system selections are checked and save.
To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.
To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do
- The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:
GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault
System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Copyright 2011 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk2t3CsACgkQ4B86/C0qfVnGsACfUBtF4ovPqqT+9fmlstfGZOEg Ys0AoM8ROq3gELhOLCPEYCca+qCkf+pn =x5Sc -----END PGP SIGNATURE----- .
Background
The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. For further information please consult the CVE entries and the Adobe Security Bulletins referenced below.
Workaround
There is no known workaround at this time.
Resolution
All Adobe Flash Player users should upgrade to the latest stable version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=www-plugins/adobe-flash-10.1.102.64"
References
[ 1 ] APSB10-06 http://www.adobe.com/support/security/bulletins/apsb10-06.html [ 2 ] APSB10-14 http://www.adobe.com/support/security/bulletins/apsb10-14.html [ 3 ] APSB10-16 http://www.adobe.com/support/security/bulletins/apsb10-16.html [ 4 ] APSB10-22 http://www.adobe.com/support/security/bulletins/apsb10-22.html [ 5 ] APSB10-26 http://www.adobe.com/support/security/bulletins/apsb10-26.html [ 6 ] CVE-2008-4546 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4546 [ 7 ] CVE-2009-3793 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3793 [ 8 ] CVE-2010-0186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186 [ 9 ] CVE-2010-0187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0187 [ 10 ] CVE-2010-0209 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0209 [ 11 ] CVE-2010-1297 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297 [ 12 ] CVE-2010-2160 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2160 [ 13 ] CVE-2010-2161 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2161 [ 14 ] CVE-2010-2162 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2162 [ 15 ] CVE-2010-2163 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2163 [ 16 ] CVE-2010-2164 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2164 [ 17 ] CVE-2010-2165 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2165 [ 18 ] CVE-2010-2166 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2166 [ 19 ] CVE-2010-2167 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2167 [ 20 ] CVE-2010-2169 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2169 [ 21 ] CVE-2010-2170 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2170 [ 22 ] CVE-2010-2171 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2171 [ 23 ] CVE-2010-2172 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2172 [ 24 ] CVE-2010-2173 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2173 [ 25 ] CVE-2010-2174 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2174 [ 26 ] CVE-2010-2175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2175 [ 27 ] CVE-2010-2176 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2176 [ 28 ] CVE-2010-2177 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2177 [ 29 ] CVE-2010-2178 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2178 [ 30 ] CVE-2010-2179 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2179 [ 31 ] CVE-2010-2180 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2180 [ 32 ] CVE-2010-2181 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2181 [ 33 ] CVE-2010-2182 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2182 [ 34 ] CVE-2010-2183 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2183 [ 35 ] CVE-2010-2184 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2184 [ 36 ] CVE-2010-2185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2185 [ 37 ] CVE-2010-2186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2186 [ 38 ] CVE-2010-2187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2187 [ 39 ] CVE-2010-2188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2188 [ 40 ] CVE-2010-2189 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2189 [ 41 ] CVE-2010-2213 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2213 [ 42 ] CVE-2010-2214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2214 [ 43 ] CVE-2010-2215 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2215 [ 44 ] CVE-2010-2216 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2216 [ 45 ] CVE-2010-2884 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2884 [ 46 ] CVE-2010-3636 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3636 [ 47 ] CVE-2010-3639 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3639 [ 48 ] CVE-2010-3640 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3640 [ 49 ] CVE-2010-3641 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3641 [ 50 ] CVE-2010-3642 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3642 [ 51 ] CVE-2010-3643 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3643 [ 52 ] CVE-2010-3644 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3644 [ 53 ] CVE-2010-3645 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3645 [ 54 ] CVE-2010-3646 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3646 [ 55 ] CVE-2010-3647 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3647 [ 56 ] CVE-2010-3648 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3648 [ 57 ] CVE-2010-3649 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3649 [ 58 ] CVE-2010-3650 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3650 [ 59 ] CVE-2010-3652 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3652 [ 60 ] CVE-2010-3654 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3654 [ 61 ] CVE-2010-3976 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3976
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201101-09.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
.
For more information: SA38547 SA40026 SA40907 SA41434 SA41917
SOLUTION: Update to version "www-plugins/adobe-flash-10.1.102.64" or later. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM) Beta.
Join the beta: http://secunia.com/products/corporate/vim/
TITLE: Red Hat update for flash-plugin
SECUNIA ADVISORY ID: SA42183
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/42183/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=42183
RELEASE DATE: 2010-11-09
DISCUSS ADVISORY: http://secunia.com/advisories/42183/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/42183/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=42183
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Red Hat has issued an update for flash-plugin. This fixes multiple vulnerabilities, which can be exploited by malicious people to disclose sensitive information, bypass certain security restrictions, or compromise a user's system.
For more information: SA41917
SOLUTION: Updated packages are available via Red Hat Network.
Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
ORIGINAL ADVISORY: RHSA-2010:0829-1: https://rhn.redhat.com/errata/RHSA-2010-0829.html
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201011-0229",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "flash player",
"scope": "lt",
"trust": 1.0,
"vendor": "adobe",
"version": "9.0.289.0"
},
{
"model": "flash player",
"scope": "gte",
"trust": 1.0,
"vendor": "adobe",
"version": "10.0"
},
{
"model": "flash player",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "10.1.95.1"
},
{
"model": "flash player",
"scope": "gte",
"trust": 1.0,
"vendor": "adobe",
"version": "9.0"
},
{
"model": "flash player",
"scope": "lt",
"trust": 1.0,
"vendor": "adobe",
"version": "10.1.102.64"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.9,
"vendor": "adobe",
"version": "10.1.95.1"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.9,
"vendor": "adobe",
"version": "10.1.95.2"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.9,
"vendor": "adobe",
"version": "10.1.53.64"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.9,
"vendor": "adobe",
"version": "10.1.85.3"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.9,
"vendor": "adobe",
"version": "10.1.82.76"
},
{
"model": "flash player",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "10.1.85.3 for windows, macintosh, linux, and solaris"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "10.1.95.1 for android"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.8"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.6 through v10.6.4"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.8"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.6 through v10.6.4"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "10"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "oracle",
"version": "11 express"
},
{
"model": "enterprise linux extras",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 extras"
},
{
"model": "enterprise linux extras",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8.z extras"
},
{
"model": "enterprise linux server supplementary",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "enterprise linux workstation supplementary",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "rhel desktop supplementary",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (client)"
},
{
"model": "rhel desktop supplementary",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "rhel supplementary",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (server)"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "10.1.92.8"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "10.1.52.14.1"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "10.1.52.15"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "10.0.45.2"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.246.0"
},
{
"model": "air",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "2.5.1"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.12.35"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.115.0"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.280"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.5.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.1.51.66"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.0.2"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.1"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.2460"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "desktop extras",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.0.2.12610"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0.0.96"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "hat enterprise linux supplementary server",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "enterprise linux extras",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.0.4"
},
{
"model": "solaris express",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "11"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.262"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.5"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.28.0"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.260.0"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.32.18"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.277.0"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.5.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.12.36"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.01"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.3218"
},
{
"model": "linux enterprise desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.5.1"
},
{
"model": "enterprise linux es extras",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.5.3.9130"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "systems insight manager",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.5.3.9120"
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.5"
},
{
"model": "flash player",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.289.0"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.124.0"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.152.0"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "flash player",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "10.1.105.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.22.87"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "11"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.452"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.0.3"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.159.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.151.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "air",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "1.0"
},
{
"model": "linux enterprise desktop sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.15.3"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9"
},
{
"model": "flash player",
"scope": "ne",
"trust": 0.3,
"vendor": "adobe",
"version": "10.1.102.64"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.31.0"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10"
},
{
"model": "hat enterprise linux desktop supplementary client",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.47.0"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.45.0"
},
{
"model": "enterprise linux ws extras",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.0.42.34"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.8"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "11.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.48.0"
},
{
"model": "enterprise linux as extras",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "flash player release candida",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "flash player",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "10.1.92.10"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
}
],
"sources": [
{
"db": "BID",
"id": "44691"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.0.289.0",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.1.102.64",
"versionStartIncluding": "10.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:linux:linux:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:sun:solaris:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10.1.95.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tokuji Akamine of Symantec Consulting Services Japan",
"sources": [
{
"db": "BID",
"id": "44691"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
}
],
"trust": 0.9
},
"cve": "CVE-2010-3636",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.6,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2010-000054",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46241",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2010-3636",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-3636",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2010-000054",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-201011-090",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46241",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2010-3636",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46241"
},
{
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors. Flash Player contains an access restriction bypass vulnerability. When Flash Player references a different website than the site where Flash contents are hosted, the referenced site must be allowed access by the cross-domain policy file. Flash Player contains a vulnerability where access restrictions set by the cross-domain policy file may be bypassed.Cross-domain policy restrictions can be bypassed by using a specially crafted web page. This could result in unauthorized access to website data. \nAn attacker can exploit this issue to bypass certain policy restrictions, which may aid in further attacks. \nNOTE: This issue was previously discussed in BID 44669 (Adobe Flash Player APSB10-26 Multiple Remote Vulnerabilities), but has been given its own record to better document it. Adobe Flash Player is a cross-platform, browser-based application that renders expressive applications, content, and video natively across screens and browsers. Remote web servers can bypass preset access restrictions with the help of unknown vectors. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c02738731\nVersion: 1\n\nHPSBMA02663 SSRT100428 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Execution of Arbitrary Code, Denial of Service (DoS)\n\nNOTICE: The information in this Security Bulletin should be acted upon as soon as possible. \n\nRelease Date: 2011-04-19\nLast Updated: 2011-04-19\n\nPotential Security Impact: Remote cross site scripting (XSS), cross site request forgery (CSRF), execution of arbitrary code, Denial of Service (DoS)\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential security vulnerabilities have been identified in HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows. The vulnerabilities could be exploited remotely resulting in cross site scripting (XSS), cross site request forgery (CSRF), execution of arbitrary code, and Denial of Service (DoS). \nHP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows prior to v6.3\n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n Reference Base Vector Base Score\nCVE-2010-3636 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3637 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3638 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3\nCVE-2010-3639 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3640 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3641 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3642 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3643 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3644 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3645 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3646 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3647 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3648 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3649 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3650 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3652 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2010-3976 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3\nCVE-2011-1542 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\nCVE-2011-1543 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3\n===========================================================\n Information on CVSS is documented\n in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHP has provided HP SIM v6.3 or subsequent to resolve the vulnerabilities. \n\nHP SIM v6.3 for HP-UX, Linux, and Windows\n\nHP SIM v6.3 for HP-UX, Linux, and Windows is available here:\nhttp://h18013.www1.hp.com/products/servers/management/hpsim/\n\nHP SIM v6.3 for Windows on Insight Software DVD\n\nIn addition for Windows HP SIM v6.3 is available on DVD images. These are available for download here. \nhttp://h18013.www1.hp.com/products/servers/management/fpdownload.html\n\nMANUAL ACTIONS: Yes - NonUpdate\nFor HP-UX, install HP SIM v6.3 or subsequent\n\nPRODUCT SPECIFIC INFORMATION\n\nHP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa\n\nThe following text is for use by the HP-UX Software Assistant. \n\nAFFECTED VERSIONS\n\nHP-UX B.11.23\nHP-UX B.11.31\n=============\nSysMgmtServer.MX-CMS\nSysMgmtServer.MX-CORE\nSysMgmtServer.MX-CORE-ARCH\nSysMgmtServer.MX-CORE-ARCH\nSysMgmtServer.MX-PORTAL\nSysMgmtServer.MX-REPO\nSysMgmtServer.MX-TOOLS\naction: install HP SIM v6.3 or subsequent\n\nEND AFFECTED VERSIONS\n\nHISTORY\nVersion: 1 (rev.1) - 19 April 2011 Initial release\n\nThird Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer\u0027s patch management policy. \n\nSupport: For further information, contact normal HP Services support channel. \n\nReport: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com\nIt is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. \nTo get the security-alert PGP key, please send an e-mail message as follows:\n To: security-alert@hp.com\n Subject: get key\nSubscribe: To initiate a subscription to receive future HP Security Bulletins via Email:\nhttp://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA\u0026langcode=USENG\u0026jumpid=in_SC-GEN__driverITRC\u0026topiccode=ITRC\nOn the web page: ITRC security bulletins and patch sign-up\nUnder Step1: your ITRC security bulletins and patches\n -check ALL categories for which alerts are required and continue. \nUnder Step2: your ITRC operating systems\n -verify your operating system selections are checked and save. \n\nTo update an existing subscription: http://h30046.www3.hp.com/subSignIn.php\nLog in on the web page: Subscriber\u0027s choice for Business: sign-in. \nOn the web page: Subscriber\u0027s Choice: your profile summary - use Edit Profile to update appropriate sections. \n\nTo review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do\n\n* The Software Product Category that this Security Bulletin\nrelates to is represented by the 5th and 6th characters\nof the Bulletin number in the title:\n\nGN = HP General SW\nMA = HP Management Agents\nMI = Misc. 3rd Party SW\nMP = HP MPE/iX\nNS = HP NonStop Servers\nOV = HP OpenVMS\nPI = HP Printing \u0026 Imaging\nST = HP Storage SW\nTL = HP Trusted Linux\nTU = HP Tru64 UNIX\nUX = HP-UX\nVV = HP VirtualVault\n\nSystem management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. \n\n\"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user\u0027s use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement.\"\n\nCopyright 2011 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided \"as is\" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.10 (GNU/Linux)\n\niEYEARECAAYFAk2t3CsACgkQ4B86/C0qfVnGsACfUBtF4ovPqqT+9fmlstfGZOEg\nYs0AoM8ROq3gELhOLCPEYCca+qCkf+pn\n=x5Sc\n-----END PGP SIGNATURE-----\n. \n\nBackground\n==========\n\nThe Adobe Flash Player is a renderer for the SWF file format, which is\ncommonly used to provide interactive websites. For\nfurther information please consult the CVE entries and the Adobe\nSecurity Bulletins referenced below. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Adobe Flash Player users should upgrade to the latest stable\nversion:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose\n\"\u003e=www-plugins/adobe-flash-10.1.102.64\"\n\nReferences\n==========\n\n [ 1 ] APSB10-06\n http://www.adobe.com/support/security/bulletins/apsb10-06.html\n [ 2 ] APSB10-14\n http://www.adobe.com/support/security/bulletins/apsb10-14.html\n [ 3 ] APSB10-16\n http://www.adobe.com/support/security/bulletins/apsb10-16.html\n [ 4 ] APSB10-22\n http://www.adobe.com/support/security/bulletins/apsb10-22.html\n [ 5 ] APSB10-26\n http://www.adobe.com/support/security/bulletins/apsb10-26.html\n [ 6 ] CVE-2008-4546\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4546\n [ 7 ] CVE-2009-3793\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3793\n [ 8 ] CVE-2010-0186\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186\n [ 9 ] CVE-2010-0187\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0187\n [ 10 ] CVE-2010-0209\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0209\n [ 11 ] CVE-2010-1297\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297\n [ 12 ] CVE-2010-2160\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2160\n [ 13 ] CVE-2010-2161\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2161\n [ 14 ] CVE-2010-2162\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2162\n [ 15 ] CVE-2010-2163\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2163\n [ 16 ] CVE-2010-2164\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2164\n [ 17 ] CVE-2010-2165\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2165\n [ 18 ] CVE-2010-2166\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2166\n [ 19 ] CVE-2010-2167\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2167\n [ 20 ] CVE-2010-2169\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2169\n [ 21 ] CVE-2010-2170\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2170\n [ 22 ] CVE-2010-2171\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2171\n [ 23 ] CVE-2010-2172\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2172\n [ 24 ] CVE-2010-2173\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2173\n [ 25 ] CVE-2010-2174\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2174\n [ 26 ] CVE-2010-2175\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2175\n [ 27 ] CVE-2010-2176\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2176\n [ 28 ] CVE-2010-2177\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2177\n [ 29 ] CVE-2010-2178\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2178\n [ 30 ] CVE-2010-2179\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2179\n [ 31 ] CVE-2010-2180\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2180\n [ 32 ] CVE-2010-2181\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2181\n [ 33 ] CVE-2010-2182\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2182\n [ 34 ] CVE-2010-2183\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2183\n [ 35 ] CVE-2010-2184\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2184\n [ 36 ] CVE-2010-2185\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2185\n [ 37 ] CVE-2010-2186\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2186\n [ 38 ] CVE-2010-2187\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2187\n [ 39 ] CVE-2010-2188\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2188\n [ 40 ] CVE-2010-2189\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2189\n [ 41 ] CVE-2010-2213\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2213\n [ 42 ] CVE-2010-2214\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2214\n [ 43 ] CVE-2010-2215\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2215\n [ 44 ] CVE-2010-2216\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2216\n [ 45 ] CVE-2010-2884\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2884\n [ 46 ] CVE-2010-3636\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3636\n [ 47 ] CVE-2010-3639\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3639\n [ 48 ] CVE-2010-3640\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3640\n [ 49 ] CVE-2010-3641\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3641\n [ 50 ] CVE-2010-3642\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3642\n [ 51 ] CVE-2010-3643\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3643\n [ 52 ] CVE-2010-3644\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3644\n [ 53 ] CVE-2010-3645\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3645\n [ 54 ] CVE-2010-3646\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3646\n [ 55 ] CVE-2010-3647\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3647\n [ 56 ] CVE-2010-3648\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3648\n [ 57 ] CVE-2010-3649\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3649\n [ 58 ] CVE-2010-3650\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3650\n [ 59 ] CVE-2010-3652\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3652\n [ 60 ] CVE-2010-3654\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3654\n [ 61 ] CVE-2010-3976\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3976\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201101-09.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2011 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n\n. \n\nFor more information:\nSA38547\nSA40026\nSA40907\nSA41434\nSA41917\n\nSOLUTION:\nUpdate to version \"www-plugins/adobe-flash-10.1.102.64\" or later. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM) Beta. \n\nJoin the beta: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRed Hat update for flash-plugin\n\nSECUNIA ADVISORY ID:\nSA42183\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/42183/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42183\n\nRELEASE DATE:\n2010-11-09\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/42183/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/42183/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42183\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nRed Hat has issued an update for flash-plugin. This fixes multiple\nvulnerabilities, which can be exploited by malicious people to\ndisclose sensitive information, bypass certain security restrictions,\nor compromise a user\u0027s system. \n\nFor more information:\nSA41917\n\nSOLUTION:\nUpdated packages are available via Red Hat Network. \n\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nORIGINAL ADVISORY:\nRHSA-2010:0829-1:\nhttps://rhn.redhat.com/errata/RHSA-2010-0829.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-3636"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "BID",
"id": "44691"
},
{
"db": "VULHUB",
"id": "VHN-46241"
},
{
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"db": "PACKETSTORM",
"id": "100630"
},
{
"db": "PACKETSTORM",
"id": "97654"
},
{
"db": "PACKETSTORM",
"id": "97735"
},
{
"db": "PACKETSTORM",
"id": "97788"
},
{
"db": "PACKETSTORM",
"id": "95657"
}
],
"trust": 2.52
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-46241",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46241"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-3636",
"trust": 3.1
},
{
"db": "BID",
"id": "44691",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "42183",
"trust": 2.7
},
{
"db": "VUPEN",
"id": "ADV-2010-2918",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2010-2906",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2010-2903",
"trust": 2.6
},
{
"db": "JVN",
"id": "JVN48425028",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054",
"trust": 2.6
},
{
"db": "SECUNIA",
"id": "42926",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "43026",
"trust": 1.9
},
{
"db": "VUPEN",
"id": "ADV-2011-0173",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2011-0192",
"trust": 1.8
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "100630",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-46241",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2010-3636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "97654",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "97735",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "97788",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "95657",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46241"
},
{
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"db": "BID",
"id": "44691"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "PACKETSTORM",
"id": "100630"
},
{
"db": "PACKETSTORM",
"id": "97654"
},
{
"db": "PACKETSTORM",
"id": "97735"
},
{
"db": "PACKETSTORM",
"id": "97788"
},
{
"db": "PACKETSTORM",
"id": "95657"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"id": "VAR-201011-0229",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46241"
}
],
"trust": 0.01
},
"last_update_date": "2024-05-18T19:41:06.082000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB10-26",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"title": "HT4435",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht4435"
},
{
"title": "RHSA-2010:0829",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0829.html"
},
{
"title": "RHSA-2010:0834",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0834.html"
},
{
"title": "RHSA-2010:0867",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0867.html"
},
{
"title": "multiple_vulnerabilities_in_adobe_flash1",
"trust": 0.8,
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"title": "flash-player-10.1.10 2.64-0.1.1.i586",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35063"
},
{
"title": "MacOSXUpdCombo10.6.5",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35062"
},
{
"title": "install_flash_player_10.1.102.64",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35061"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46241"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.securityfocus.com/bid/44691"
},
{
"trust": 2.6,
"url": "http://jvn.jp/en/jp/jvn48425028/index.html"
},
{
"trust": 2.6,
"url": "http://secunia.com/advisories/42183"
},
{
"trust": 2.6,
"url": "http://www.vupen.com/english/advisories/2010/2903"
},
{
"trust": 2.6,
"url": "http://www.vupen.com/english/advisories/2010/2906"
},
{
"trust": 2.6,
"url": "http://www.vupen.com/english/advisories/2010/2918"
},
{
"trust": 2.2,
"url": "http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1"
},
{
"trust": 2.2,
"url": "http://www.adobe.com/support/security/bulletins/apsb10-26.html"
},
{
"trust": 1.9,
"url": "http://security.gentoo.org/glsa/glsa-201101-09.xml"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2010//nov/msg00000.html"
},
{
"trust": 1.8,
"url": "http://support.apple.com/kb/ht4435"
},
{
"trust": 1.8,
"url": "http://jvndb.jvn.jp/ja/contents/2010/jvndb-2010-000054.html"
},
{
"trust": 1.8,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a12142"
},
{
"trust": 1.8,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a15913"
},
{
"trust": 1.8,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0829.html"
},
{
"trust": 1.8,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0834.html"
},
{
"trust": 1.8,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0867.html"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/42926"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/43026"
},
{
"trust": 1.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2011/0173"
},
{
"trust": 1.8,
"url": "http://www.vupen.com/english/advisories/2011/0192"
},
{
"trust": 1.7,
"url": "http://marc.info/?l=bugtraq\u0026m=130331642631603\u0026w=2"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3636"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu331391"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-3636"
},
{
"trust": 0.3,
"url": "http://www.adobe.com/products/flash/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=130331642631603\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/264.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://h18013.www1.hp.com/products/servers/management/fpdownload.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-3636"
},
{
"trust": 0.1,
"url": "http://www.itrc.hp.com/service/cki/secbullarchive.do"
},
{
"trust": 0.1,
"url": "http://h18013.www1.hp.com/products/servers/management/hpsim/"
},
{
"trust": 0.1,
"url": "http://h30046.www3.hp.com/driveralertprofile.php?regioncode=na\u0026langcode=useng\u0026jumpid=in_sc-gen__driveritrc\u0026topiccode=itrc"
},
{
"trust": 0.1,
"url": "https://www.hp.com/go/swa"
},
{
"trust": 0.1,
"url": "http://h30046.www3.hp.com/subsignin.php"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42926/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42926"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42926/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2182"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3639"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2181"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2161"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0187"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2174"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3644"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2166"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2215"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb10-14.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2176"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2171"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2162"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2160"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2181"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-4546"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4546"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1297"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2163"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2180"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2171"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2180"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2176"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2164"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2179"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2169"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3648"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2164"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0187"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2163"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0209"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2173"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3654"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1297"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3793"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2177"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3645"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2179"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2165"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2172"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3976"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2216"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb10-16.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3647"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2173"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb10-06.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2172"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3793"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2160"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2213"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2186"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2184"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0186"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2167"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3646"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2169"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2175"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2214"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2178"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2165"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2188"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2189"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3643"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2161"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0186"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0209"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2166"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3641"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2185"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2174"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3650"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2183"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2178"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2170"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2177"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3652"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2162"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3640"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2170"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb10-22.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2175"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2187"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3649"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2167"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2182"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2884"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3642"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43026/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43026/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=43026"
},
{
"trust": 0.1,
"url": "http://www.gentoo.org/security/en/glsa/glsa-201101-09.xml"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42183"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42183/#comments"
},
{
"trust": 0.1,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0829.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42183/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46241"
},
{
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"db": "BID",
"id": "44691"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "PACKETSTORM",
"id": "100630"
},
{
"db": "PACKETSTORM",
"id": "97654"
},
{
"db": "PACKETSTORM",
"id": "97735"
},
{
"db": "PACKETSTORM",
"id": "97788"
},
{
"db": "PACKETSTORM",
"id": "95657"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-46241"
},
{
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"db": "BID",
"id": "44691"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"db": "PACKETSTORM",
"id": "100630"
},
{
"db": "PACKETSTORM",
"id": "97654"
},
{
"db": "PACKETSTORM",
"id": "97735"
},
{
"db": "PACKETSTORM",
"id": "97788"
},
{
"db": "PACKETSTORM",
"id": "95657"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-11-07T00:00:00",
"db": "VULHUB",
"id": "VHN-46241"
},
{
"date": "2010-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"date": "2010-11-04T00:00:00",
"db": "BID",
"id": "44691"
},
{
"date": "2010-11-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"date": "2011-04-20T23:50:05",
"db": "PACKETSTORM",
"id": "100630"
},
{
"date": "2011-01-19T04:51:35",
"db": "PACKETSTORM",
"id": "97654"
},
{
"date": "2011-01-21T21:15:05",
"db": "PACKETSTORM",
"id": "97735"
},
{
"date": "2011-01-24T07:05:29",
"db": "PACKETSTORM",
"id": "97788"
},
{
"date": "2010-11-09T02:06:41",
"db": "PACKETSTORM",
"id": "95657"
},
{
"date": "2010-11-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"date": "2010-11-07T22:00:01.863000",
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-46241"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2010-3636"
},
{
"date": "2013-06-20T09:39:00",
"db": "BID",
"id": "44691"
},
{
"date": "2011-02-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-000054"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201011-090"
},
{
"date": "2024-05-17T17:27:59.167000",
"db": "NVD",
"id": "CVE-2010-3636"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "97735"
},
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Flash Player access restriction bypass vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-000054"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201011-090"
}
],
"trust": 0.6
}
}
cve-2010-3636
Vulnerability from jvndb
Published
2010-11-09 19:59
Modified
2011-02-01 16:22
Summary
Flash Player access restriction bypass vulnerability
Details
Flash Player contains an access restriction bypass vulnerability.
When Flash Player references a different website than the site where Flash contents are hosted, the referenced site must be allowed access by the cross-domain policy file.
Flash Player contains a vulnerability where access restrictions set by the cross-domain policy file may be bypassed.
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000054.html",
"dc:date": "2011-02-01T16:22+09:00",
"dcterms:issued": "2010-11-09T19:59+09:00",
"dcterms:modified": "2011-02-01T16:22+09:00",
"description": "Flash Player contains an access restriction bypass vulnerability.\r\n\r\nWhen Flash Player references a different website than the site where Flash contents are hosted, the referenced site must be allowed access by the cross-domain policy file.\r\n\r\nFlash Player contains a vulnerability where access restrictions set by the cross-domain policy file may be bypassed.",
"link": "https://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000054.html",
"sec:cpe": [
{
"#text": "cpe:/a:adobe:flash_player",
"@product": "Adobe Flash Player",
"@vendor": "Adobe Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/a:redhat:enterprise_linux",
"@product": "Red Hat Enterprise Linux Extras",
"@vendor": "Red Hat, Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/a:redhat:rhel_desktop_supplementary",
"@product": "RHEL Desktop Supplementary",
"@vendor": "Red Hat, Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/a:redhat:rhel_server_supplementary",
"@product": "Red Hat Enterprise Linux Server Supplementary",
"@vendor": "Red Hat, Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/a:redhat:rhel_supplementary",
"@product": "RHEL Supplementary",
"@vendor": "Red Hat, Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/a:redhat:rhel_workstation_supplementary",
"@product": "Red Hat Enterprise Linux Workstation Supplementary",
"@vendor": "Red Hat, Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/o:apple:mac_os_x",
"@product": "Apple Mac OS X",
"@vendor": "Apple Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/o:apple:mac_os_x_server",
"@product": "Apple Mac OS X Server",
"@vendor": "Apple Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/o:oracle:solaris",
"@product": "Oracle Solaris",
"@vendor": "Oracle Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "2.6",
"@severity": "Low",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2010-000054",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN48425028/index.html",
"@id": "JVN#48425028",
"@source": "JVN"
},
{
"#text": "http://jvn.jp/cert/JVNVU331391",
"@id": "JVNVU#331391",
"@source": "JVN"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3636",
"@id": "CVE-2010-3636",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3636",
"@id": "CVE-2010-3636",
"@source": "NVD"
},
{
"#text": "http://secunia.com/advisories/42183",
"@id": "SA42183",
"@source": "SECUNIA"
},
{
"#text": "http://www.securityfocus.com/bid/44691",
"@id": "44691",
"@source": "BID"
},
{
"#text": "http://www.vupen.com/english/advisories/2010/2903",
"@id": "VUPEN/ADV-2010-2903",
"@source": "VUPEN"
},
{
"#text": "http://www.vupen.com/english/advisories/2010/2906",
"@id": "VUPEN/ADV-2010-2906",
"@source": "VUPEN"
},
{
"#text": "http://www.vupen.com/english/advisories/2010/2918",
"@id": "VUPEN/ADV-2010-2918",
"@source": "VUPEN"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-264",
"@title": "Permissions(CWE-264)"
}
],
"title": "Flash Player access restriction bypass vulnerability"
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.