Description
CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | flash-plugin | 7.0.69-1.el4 | RHSA-2007:0009 |
| RHEL 3 | flash-plugin | 7.0.69-1.el3 | RHSA-2007:0009 |
Advisories 1
- RHSA-2007:0009 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://www.adobe.com/support/security/advisories/apsa06-01.html
- TA07-072A third-party-advisory
- 102932 vendor-advisory
- 22467 third-party-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- RHSA-2007:0009 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- 23324 third-party-advisory
- flashplayer-multiple-xsrf(29634) vdb-entry
- SUSE-SA:2006:077 vendor-advisory
- oval:org.mitre.oval:def:11405 vdb-entry signature
- 25467 third-party-advisory
- ADV-2006-4094 vdb-entry
- 29863 vdb-entry
- http://www.adobe.com/support/security/bulletins/apsb06-18.html
- http://www.rapid7.com/advisories/R7-0026.jsp
- 20592 vdb-entry
- ADV-2007-0930 vdb-entry
- 1737 third-party-advisory
- ADV-2007-1999 vdb-entry
- 23581 third-party-advisory
- 20061017 Rapid7 Advisory R7-0026: HTTP Header Injection Vulnerabilities in the Flash Player Plugin mailing-list
- 1017078 vdb-entry
- 24479 third-party-advisory