Description
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | flash-plugin | 10.0.22.87-1.el5 | RHSA-2009:0332 |
| RHEL 4 | flash-plugin | 9.0.159.0-1.el4 | RHSA-2009:0334 |
| RHEL 3 | flash-plugin | 9.0.159.0-1.el3.with.oss | RHSA-2009:0334 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Adobe Flash Player 9/10 - Invalid Object Reference Remote Code Execution EDB-32811 · remote · Feb 24, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2009:0334 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:0332 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://isc.sans.org/diary.html?storyid=5929
- http://support.apple.com/kb/HT3549
- RHSA-2009:0332 vendor-advisory
- 20090224 Adobe Flash Player Invalid Object Reference Vulnerability third-party-advisory
- 35074 third-party-advisory
- 34226 third-party-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- oval:org.mitre.oval:def:6593 vdb-entry signature
- flash-invalid-object-bo(48887) vdb-entry
- ADV-2009-0743 vdb-entry
- http://www.adobe.com/support/security/bulletins/apsb09-01.html
- ADV-2009-0513 vdb-entry
- GLSA-200903-23 vendor-advisory
- TA09-133A third-party-advisory
- oval:org.mitre.oval:def:16057 vdb-entry signature
- ADV-2009-1297 vdb-entry
- 33880 vdb-entry
- 1021750 vdb-entry
- 34293 third-party-advisory
- 254909 vendor-advisory
- RHSA-2009:0334 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=487142
- 34012 third-party-advisory