Description
Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | flash-plugin | 10.0.12.36-2.el5 | RHSA-2008:0945 |
| RHEL 4 | flash-plugin | 9.0.151.0-1.el4 | RHSA-2008:0980 |
| RHEL 3 | flash-plugin | 9.0.151.0-1.el3.with.oss | RHSA-2008:0980 |
Advisories 2
- RHSA-2008:0980 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0945 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=834256&poid=
- 32129 vdb-entry
- 33390 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
- ADV-2008-3444 vdb-entry
- 32702 third-party-advisory
- TA08-350A third-party-advisory
- http://www.adobe.com/support/security/bulletins/apsb08-20.html
- 33179 third-party-advisory
- 34226 third-party-advisory
- 1021150 vdb-entry
- GLSA-200903-23 vendor-advisory
- http://support.apple.com/kb/HT3338
- RHSA-2008:0980 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm
- APPLE-SA-2008-12-15 vendor-advisory
- adobe-flash-domainpolicy-security-bypass(46535) vdb-entry
- 248586 vendor-advisory