Flash Player Unspecified Code Execution Vulnerabilities - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Flash Player Unspecified Code Execution Vulnerabilities

Secunia Advisory:	SA19218
Release Date:	2006-03-15
Last Update:	2006-05-09

Critical:	Highly critical
Impact:	System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Macromedia Breeze / Acrobat Connect Professional 5.x Macromedia Breeze 4.x Macromedia Breeze Meeting Add-In Macromedia Flash 8.x Macromedia Flash MX 2004 Macromedia Flash MX Professional 2004 Macromedia Flash Player 7.x Macromedia Flash Player 8.x Macromedia Flex 1.x Shockwave Player 10.x

CVE reference:	CVE-2006-0024 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Some vulnerabilities have been reported in Flash Player, which can be exploited by malicious people to compromise a user's system. The vulnerabilities are caused due to unspecified boundary errors and can be exploited to execute arbitrary code on a user's system when a malicious SWF file is loaded. Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector. Solution: Install updated versions. Flash Player 8.0.22.0 and earlier: Update to version 8.0.24.0 or 7.0.63.0. http://www.macromedia.com/go/getflash Flash Player 8.0.22.0 and earlier - network distribution: Update to version 8.0.24.0 or 7.0.63.0. http://www.macromedia.com/licensing/distribution Flash Professional 8, Flash Basic: Update to version 8.0.24.0. http://www.macromedia.com/support/flash/downloads.html Flash MX 2004: Update to version 7.0.63.0. http://www.macromedia.com/support/flash/downloads.html Flex 1.5: Update to version 8.0.24.0. http://www.macromedia.com/go/3d2855d6 Breeze Meeting Add-In: Update to version 7.0.55.331 (Win) or 7.0.55.118 (Mac). http://adobe.breezecentral.com/common/help/en/support/downloads.htm Shockwave Player: Update to version 10.1.1. http://www.macromedia.com/shockwave/download/ Provided and/or discovered by: The vendor credits Microsoft for reporting the vulnerabilities. Changelog: 2006-03-17: Added link to US-CERT vulnerability note. 2006-05-09: Updated link to vendor advisory. Added additional details. Original Advisory: Adobe Systems (formerly Macromedia): http://www.adobe.com/devnet/security/security_zone/apsb06-03.html Microsoft: http://www.microsoft.com/technet/security/advisory/916208.mspx Other References: US-CERT VU#945060: http://www.kb.cert.org/vuls/id/945060



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

14 Related Secunia Security Advisories, displaying 10

1. Adobe Flash FLA File Parsing Vulnerabilities

2. Adobe Flash Player Multiple Vulnerabilities

3. Adobe Flash Player Multiple Vulnerabilities

4. Adobe Flash Player CRLF Injection Vulnerabilities

5. Macromedia Breeze URL Parsing Information Disclosure

6. Adobe Flash Player Multiple Vulnerabilities

7. Flash Player Unspecified Vulnerability and "addRequestHeader()" Bypass

8. Macromedia ShockWave Player ActiveX Installer Buffer Overflow

9. Macromedia Breeze Communication Server/Live Server Denial of Service

10. Macromedia Flash Player SWF File Handling Arbitrary Code Execution

Show all related advisories

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	OpenBSD BIND Query Port DNS Cache Poisoning

2.	Apple Safari Cross-Domain Cookie Injection Vulnerability

3.	Linux Kernel LDT Buffer Size Handling Vulnerability

4.	Debian update for clamav

5.	dnsmasq Denial of Service and DNS Cache Poisoning

6.	Drupal Session Fixation Vulnerability

7.	Red Hat update for thunderbird

8.	Ubuntu update for php

9.	Red Hat update for kernel

10.	Asterisk Two Denial of Service Vulnerabilities