Multiple vulnerabilities have been reported in Adobe Flash Player, which can be exploited by malicious people to conduct click-jacking attacks or compromise a user's system.

1) An error in the ActionScript Virtual Machine 1 (AVM1) when handling the "ActionPush" command can be exploited to corrupt memory.

2) Unspecified errors can be exploited to corrupt memory. No more information is currently available.

3) An unspecified error can be exploited to corrupt memory. No more information is currently available.

4) An error in the "connect" method exposed via ActionScript native object number 2200 can be exploited to corrupt memory by calling the method several times with differing strings.

5) An unspecified error can be exploited to corrupt memory. No more information is currently available.

Successful exploitation of vulnerabilities #1 through #5 may allow execution of arbitrary code.

6) A click-jacking error can be exploited to trick a user into performing unintended actions.

Solution
Update to a fixed version.
Further details available in Customer Area

Provided and/or discovered by
1) Will Dormann, CERT/CC.
2,3) The vendor credits Will Dormann, CERT/CC.
4) Damian Put, reported via ZDI.
5) The vendor credits Lenovo Security Technologies (Beijing).
6) The vendor credits Jöran Benker.

Original Advisory
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-16.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-149

US-CERT VU#660993:
http://www.kb.cert.org/vuls/id/660993

Deep Links
Links available in Customer Area