Zahlenüberläufe in flash-player
ID: | TLSA-2007-36 |
Distribution: | TurboLinux |
Plattformen: | Turbolinux FUJI, TurboLinux wizpy |
Datum: | Mi, 25. Juli 2007, 03:50 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2022
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3456 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3457 |
Applikationen: | Flash Plugin for Browsers |
Originalnachricht |
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 -------------------------------------------------------------------------- Turbolinux Security Advisory TLSA-2007-36 http://www.turbolinux.co.jp/security/ security-team@turbolinux.co.jp -------------------------------------------------------------------------- Original released date: 24 Jul 2007 Last revised: 24 Jul 2007 Package: flash-player Summary: Three vulnerabilities discovered in flash-player More information: Adobe Flash Player for Mozilla and Mozilla compatible. - Flash Player allows remote attackers to obtain sensitive information (browser keystrokes), which are leaked to the Flash Player applet. - Integer overflow vulnerabilities have been discovered in Flash Playey. - Flash Player insufficiently validates HTTP Referer headers, which potentially allows remote attackers to conduct a CSRF attack via a crafted SWF file. Impact: This vulnerabilities may allow remote attackers to execute arbitrary code or to obtain sensitive information via Flash File. Affected Products: - Turbolinux Wizpy - Turbolinux FUJI |