Description
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors related to improper length calculation and the (1) STSC, (2) STSZ, and (3) STCO atoms.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | flash-plugin | 10.1-2.el5 | RHSA-2010:0464 |
| RHEL 4 | flash-plugin | 9.0.277.0-1.el4 | RHSA-2010:0470 |
| RHEL 3 | flash-plugin | 9.0.277.0-1.el3.with.oss | RHSA-2010:0470 |
Advisories 2
- RHSA-2010:0464 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0470 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- ADV-2011-0192 vdb-entry
- ADV-2010-1421 vdb-entry
- http://support.apple.com/kb/HT4435
- 40545 third-party-advisory
- oval:org.mitre.oval:def:16345 vdb-entry signature
- oval:org.mitre.oval:def:7166 vdb-entry signature
- RHSA-2010:0464 vendor-advisory
- ADV-2010-1793 vdb-entry
- 43026 third-party-advisory
- ADV-2010-1432 vdb-entry
- GLSA-201101-09 vendor-advisory
- TA10-162A third-party-advisory
- APPLE-SA-2010-11-10-1 vendor-advisory
- 40759 vdb-entry
- 1024085 vdb-entry
- SUSE-SR:2010:013 vendor-advisory
- 1024086 vdb-entry
- ADV-2010-1434 vdb-entry
- TLSA-2010-19 vendor-advisory
- SSRT100179 vendor-advisory
- SUSE-SA:2010:024 vendor-advisory
- 40801 vdb-entry
- http://www.adobe.com/support/security/bulletins/apsb10-14.html
- http://www.zerodayinitiative.com/advisories/ZDI-10-109
- 40144 third-party-advisory
- RHSA-2010:0470 vendor-advisory
- ADV-2010-1482 vdb-entry
- 20100616 ZDI-10-109: Adobe Flash Player Multiple Atom MP4 Parsing Remote Code Execution Vulnerability mailing-list
- ADV-2010-1522 vdb-entry
- ADV-2010-1453 vdb-entry