Description
Multiple heap-based buffer overflows in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors related to malformed (1) GIF or (2) JPEG data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | flash-plugin | 10.1-2.el5 | RHSA-2010:0464 |
| RHEL 4 | flash-plugin | 9.0.277.0-1.el4 | RHSA-2010:0470 |
| RHEL 3 | flash-plugin | 9.0.277.0-1.el3.with.oss | RHSA-2010:0470 |
Advisories 2
- RHSA-2010:0464 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0470 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- ADV-2011-0192 vdb-entry
- ADV-2010-1421 vdb-entry
- http://support.apple.com/kb/HT4435
- 40545 third-party-advisory
- oval:org.mitre.oval:def:7491 vdb-entry signature
- 20100616 VUPEN Security Research - Adobe Flash Player GIF/JPEG Data Parsing Heap Overflow Vulnerabilities (CVE-2010-2167) mailing-list
- RHSA-2010:0464 vendor-advisory
- ADV-2010-1793 vdb-entry
- 43026 third-party-advisory
- ADV-2010-1432 vdb-entry
- GLSA-201101-09 vendor-advisory
- TA10-162A third-party-advisory
- APPLE-SA-2010-11-10-1 vendor-advisory
- 40759 vdb-entry
- 1024085 vdb-entry
- SUSE-SR:2010:013 vendor-advisory
- 1024086 vdb-entry
- ADV-2010-1434 vdb-entry
- TLSA-2010-19 vendor-advisory
- SSRT100179 vendor-advisory
- SUSE-SA:2010:024 vendor-advisory
- http://www.adobe.com/support/security/bulletins/apsb10-14.html
- 40144 third-party-advisory
- oval:org.mitre.oval:def:15437 vdb-entry signature
- RHSA-2010:0470 vendor-advisory
- ADV-2010-1482 vdb-entry
- ADV-2010-1522 vdb-entry
- 40802 vdb-entry
- ADV-2010-1453 vdb-entry