Flash Player Vulnerabilities

I need an official announcement from Adobe that they have all
of the vulnerabilites fixed in the Flash Player. I will NOT allow
it's use on my credit union's network until I can be assured that
all of the past and future vulnerabilites have been fixed. It would
be irresponsible for anyone to allow it's use on their network (or
PCs containing secured data) until this is done. I find it
irresponsible of websites to base themselves on Flash while these
problems persist. I have explained this to far too many webmasters
to remain quiet about it any more.
Please, Adobe, give me the word so that I can let my people
go (to Flash-enabled websites, that is...)
Larry

I take it that no one is concerned about these
vulnerabilities?

Similar Messages

OS X Mavericks won't update Adobe Flash Player

Since I updated my MacBook Pro's OS Mountain Lion to OS X Mavericks I can't update all other third party software specially my Adobe Flash Player. Is there a way how to do it because the moment I click on the "Install Adobe Flash Player" it's just closes and nothing happens. The same ting with other third party softwares.

It would have helped if you had said what version of OS X you are running.
Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
On March 1 Apple again blocked Flash Player for Lion and Mountain Lion:
http://support.apple.com/kb/HT5660
The Adobe Flash patch can be found on Adobe’s website, and users can visit this page to check if their software is the most curent version.
You should uninstall any previous version first, and repair permissions after installing the new version.

"Flash Player quit unexpectedly." Why?

I get this all the time, especially when I have Facebook open, too. What can I do?
Thanks

Make sure you have the latest version.
Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
On March 1 Apple again blocked Flash Player for Lion and Mountain Lion:
http://support.apple.com/kb/HT5660
The Adobe Flash patch can be found on Adobe’s website, and users can visit this page to check if their software is the most curent version.
You should uninstall any previous version first, and repair permissions after installing the new version.
If you still get a ‘plug-ins blocked’ message:
http://support.apple.com/kb/HT5271

I updated my software and now, even though I installed an updated Flash player, I can't see videos with Safari. Help?

I updated my software and now I get the message blocked plug-in whenever I try to watch video in Safari. I installed the new Flash player but it still doesn't work. I've checked my plug-ins and uninstalled/reinstalled but nothing works. What can I do? Help

Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
On March 1 Apple again blocked Flash Player for Lion and Mountain Lion:
http://support.apple.com/kb/HT5660
The Adobe Flash patch can be found on Adobe’s website, and users can visit this page to check if their software is the most curent version.
You should uninstall any previous version first, and repair permissions after installing the new version.
If you still get a ‘plug-ins blocked’ message:
http://support.apple.com/kb/HT5271

Adobe Flash Player Help Please !!

Greetings,
Here is the story. I just bought a new iMac running 10.83. The problem I'm having is that I cannot watch any of the news site videos because they all ask for Adobe Flash Player. I have downloaded Adobe and am not getting any results. The video starts to run, but then either stops and/or looses the sound. Examples of sites are loacal news, CNN and Weather Channel. Nothing seems to work.
This has become really frustrated. Any help would be greatly appreciated. Just do not understand why I'm not able to get this up and going.
Thanks,
Ted

Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
On March 1 Apple again blocked Flash Player for Lion and Mountain Lion:
http://support.apple.com/kb/HT5660
The Adobe Flash patch can be found on Adobe’s website, and users can visit this page to check if their software is the most curent version.
You should uninstall any previous version first, and repair permissions after installing the new version.
If you still get a ‘plug-ins blocked’ message:
http://support.apple.com/kb/HT5271

I have a Mac version 10.5.8 with Safari and I can't watch video's... I can download flash player but it won't work.

I can't watch video on my Mac version 10.5.8 with Safari.

Could be Flash Player problem.
Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
The Adobe Flash patch can be found on the company's website, and users can visit this page to check if their software is the most curent version.

Adobe flash player wont work and wont reinstall can anyone help?

my adobe flash player quit working i uninstalled it and redown loaded it. several times but i keep getting this message [ blocked plug in ] what can be done?

First update to 10.6.8.
Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
On March 1 Apple again blocked Flash Player for Lion and Mountain Lion:
http://support.apple.com/kb/HT5660
The Adobe Flash patch can be found on Adobe’s website, and users can visit this page to check if their software is the most curent version.
You should uninstall any previous version first, and repair permissions after installing the new version.
If you still get a ‘plug-ins blocked’ message:
http://support.apple.com/kb/HT5271

Is Flash Player a security risk?

I got a message to update Flash Player and to download installation from the internet. Is this safe? I remember reading about Flash Player being a security risk a while ago.

Two bugs, one affecting Apple's Mac platform and another attacking Microsoft's Windows, exploit certain Flash player vulnerabilities to install malware onto users' systems, reports ArsTechnica. While users of other operating systems like Linux have yet to report attacks, Adobe's advisory notes the exploit affects all platforms.
Designated as CVE-2013-0634, the first vulnerability targets the Safari and Firefox Web browsers running on OS X, and is also being used as a trojan to deploy Microsoft Word documents containing malware. For Mac users, the flaw affects Adobe Flash Player version 11.5.502.146 or earlier.
On March 1, 2013 Apple again blocked Flash Player for Lion and Mountain Lion:
http://support.apple.com/kb/HT5660
The Adobe Flash patch can be found on Adobe’s website, and users can visit this page to check if their software is the most curent version.
You should uninstall any previous version first, and repair permissions after installing the new version.
If you still get a ‘plug-ins blocked’ message:
http://support.apple.com/kb/HT5271

Push out Flash Player updates?

I support a corporate network where all computers are connected to the Internet. On a weekly basis I see news of Flash Player vulnerabilities. I like to keep my systems as up-to-date as possible because we all know how end-users are... "click first, ask questions later". As wide-spread as the use of Flash content has become, I would think Adobe could come up with an easier way to update many computers with the most current version rather than visit each one and manually install the patches. Sure, the Adobe Updater works great... if every user has Administrator priviledges on their machines. But I, for one, would rather not unleash that beast onto my network.
I'd like to know how Adobe recommends fixing its flaws throughout a network environment as well as how some of you out there tackle this dilemma. Thanks for any input or suggestions you may have.

I updated as soon as the user got the message that Flash needed updating. I can't remember the exact dates, but it has been, no kidding, three times in the last two weeks. When I imaged the machines this past summer, I specifically told Flash to update automatically when I created the initial image. All to no avail.
When I subsequently had to update the laptops, again, when given the choice (and it was not consistent across all the laptops), I selected the option to "auto-update" the player. In every single case, I still had to update the laptops manually. I can tell you it's getting to the point that, I swear, if there is another update within the next week or so, I am going to tell faculty I will no longer support Flash and that they need to stop using websites that use Flash. We can't use Flash sites anyhow on our iPods or our iPads, might as well extend that ban to the laptops as well.
This is just inexcusable behavior from Adobe (an otherwise, fine company, it's as if Flash is made by a completely different company) to disable the ability to use Flash until it's updated.
I have read recently that Apple is disabling the ability to run JAVA until it's patched and I can understand that. After all, JAVA was supposed to be a security language - something about a "sandbox"??
If there was a way to push out updates across the network, that would be acceptable (in fact, I CAN do that with JAVA), but there is, evidently NO WAY to do that with Flash and Adobe tech support (and I use the term loosely) has NO CLUE what I'm even talking about when I call for help with this.
BTW, I should point out we are an ALL APPLE shop - I have ONE Windows laptop in the event of a Zombie Apocalypse. The "solutions" I've seen seem to apply only to a Windows shop.

Flash Player installation and update questions and answers

How do I verify that I have the latest version of Flash Player?
If you receive a message that tells you that Flash Player is out of date or a new version of Flash Player is available, you can verify this by visiting the Flash Player Help page with your browser.
Simply click the "Check Now" button and you'll be presented with a short message and detailed information regarding your Flash Player installation.
Where should I download the latest version of Flash Player?
Because malware authors will often employ misleading tactics to make malware look like something you should trust, it's important to get your Flash Player updates directly from Adobe.
Please verify that your Flash Player downloads and updates come from only the adobe.com or macromedia.com domains. You can always download the latest version of Flash Player directly from https://get.adobe.com/flashplayer
I've selected the automatic update option in Flash Player, why do I continue to get update notifications?
Periodically, users are presented with the Flash Player update dialog notifying them that a new version of Flash Player is available for download from adobe.com.
The automatic update mechanism is used for some updates, security patches that address zero-day vulnerabilities and when users, who have selected to be updated automatically, have not updated within 45 days after a regularly scheduled update release of Flash Player.
What should I expect when I receive notification that Flash Player has an update available?
When a major update to Flash Player becomes available you will be presented with a Flash Player update dialog
After reviewing new features, pressing the Download button will open your default browser and load the Install Adobe Flash Player page.
Clicking the "Update now" or "Install Now" button will then take you to the next page which will start the download process and give instructions for completing the Flash Player install.
Finally, once the installation is complete your browser will display a page confirming a successful installation.
If you encounter installation problems, we recommend you review our Windows and Mac OS installation help documents. Further questions and information can be found on the Flash Player installation forums.
Why does Adobe Flash Player installer include the option to download additional software?
Adobe offsets the ongoing development costs of Flash Player, which is made available for free, by offering users the option to download select software from Adobe partners.
What options do I have when installing or updating Flash Player?
You have a few different options available when updating Flash Player. We recommend that you choose "Allow Adobe to install updates (recommended)" when initially setting up Flash Player
or by going into the Flash Player control panel and choosing this option in the Advanced tab.
Once selected, most updates will occur in the background without requiring any interaction. For those regularly scheduled major update releases, you will be presented with an update notification dialog
If you decide not to update, you will receive an automatic update within 45 days if you have the "Allow Adobe to install updates" option selected. Please note that when this update occurs, only Flash Player will be installed.
If you want to be notified about every Flash Player update, select "Notify me to install updates" when initially installing Flash Player or from the Advanced tab in the Flash Player control panel.
Finally, if you'd prefer not to receive any updates, select "Never check for updates (not recommended)". We do not recommend this option as we believe keeping your system up to date improves both security and stability when using Flash Player.
For network Administrators we offer additional update options, including the ability to host your own internal Flash Player update server. Please see our Flash Player distribution page and Flash Player Administrator guide for details.

Sunil, I just want to verify you are pointing me to the link under "Progress bar hangs during download / Unable to connect to server / Unable to download metafile."
If yes, then that is the file I originally downloaded based on a March post I saw here.
I just tried it again, and it (by "it" I mean the Flash Player Plug-in (All other browsers from download.macromedia.com) installed 11.6.
After the installation process completed, the dialog box notified me it was version 11.6, and when I went back to, the "find version" page, 11.6 was confirmed.
I did not download the exe for Internet Explorer, as I almost never use that browser.

8/20/2014 - Beta - Flash Player 15.0.0.130

The latest Flash Player 15 beta builds are now available. Beta builds can be downloaded from labs.adobe.com.
New Features for Flash Player 15:
Relaxing Stage3D Render Target Clear
In previous versions of Stage3D, after switching the render texture through Context3D::setRenderToTexture, you were required to clear it before drawing. In this release, we're removing this limitation and optimizing the use of render textures. This change will allow you to further optimize and reuse depth and stencil buffers between different render textures.
Improved support for browser zoom levels - Windows 8
Flash Player now has improved support for browser zoom factors other than 100% on Internet Explorer on Windows 8.x. Devices, like the Microsoft Surface tablets, default to a zoom level of 150%. In the past, this could cause problems with Flash Player and some 3D content. With our new implementation, we can now scale the content and 3D buffers to keep everything aligned. In addition, Flash Player introduces an option to render to an increased Stage3D back buffer, rather than scaling, on browser zoom to keep the resolution of the rendered content high. This option allows to the stage3D buffer to change in size in synch with the change in the browser zoom factor. Developers are notified of this change with a new ZOOM_FACTOR_CHANGE event.
Flash Player Fullscreen Orientation Change - Windows
Flash Player will now detect and appropriately scale your content to fit best in a fullscreen display when your device orientation is changed. This change is specific to Windows and is implemented across all browsers. We're focusing on providing the best tablet experience possible. A resize event will fire when in fullscreen mode and the device orientation changes. Developers, if your content does not resize, you will need to handle the resize event appropriately. Additional details will be made available in a separate blog post.
Hardware video decoding on Chrome (PPAPI) for Windows
We're pleased to announce that hardware video decoding is now enabled by default for Chrome users on Windows. This feature will drastically reduce the CPU usage and improve performance on supported videos players. We're working closely with Google to bring this feature to OS X and will provide additional details when available.
Automatic software fall back with StageVideo
Flash Player 15 now supports a Software version of StageVideo that provides an automatic failover to the software version when hardware StageVideo is not available. To leverage this automatic failover, the swf apps need to be compiled for Flash Player 15 and above.
When the swfs are compiled for Flash Player 15 and above, and when hardware StageVideo is unavailable, the app will get a StageVideoAvailability event as earlier, but instead of being "Unavailable" it will ALWAYS be "available", and the reason will always be "noError". The app will no longer need to implement a Video object failover as the failover is automatic inside flash player. The apps can still choose to use Video object instead of StageVIdeo if needed.
Hardware StageVideo availability is dependent on a number of factors, including:
Browser hardware rendering support: If available, all wMode based apps will support hardware StageVideo. If not available, wMode=direct based apps will be the only ones that will support hardware StageVideo, unless there are other exceptions, like the ones mentioned below.
IE11: IE has an accelerated pipeline and the FlashPlayer is HW accelerated in all wmode, so StageVideo should always be available. Note that the decision to use the HW accelerate rendering pipeline reside in IE.
Firefox: There is currently no HW accelerated pipeline available in Firefox on windows and only wMode direct will have StageVideo available all other wMode should generate a unavailable event.
Chrome: Pepper has HW acceleration in all wMode, but some restrictions apply. For example Chrome will refuse to use HW acceleration on Windows XP and it has its own driver blacklisting mechanism. It is also possible for the user to disable the HW acceleration in the settings panel. Chrome exposes a somewhat useful page to allow one to see the status of its gpu acceleration: chrome://gpu/
On Mac:
Safari: All wMode should expose StageVideo
Firefox: All wModes should expose StageVideo
Chrome: All wMode should expose StageVideo, with the same limitations as the windows version.
Driver version: Certain older drivers may not support hardware StageVideo
User settings: If a user turns off hardware acceleration, then hardware StageVideo will not be available
Full Screen: Hardware StageVIdeo is always available in Full Screen mode.
When the hardware StageVideo fails because of browser support, wMode, driver version or user settings, starting with Flash Player 15, SW StageVideo will be used automatically without needing any configuration or code in the app.
Testing Focus:
Hardware Video Decoding is now on by default for Chrome users. If you experience playback or stability problems when watching Flash-based video, please report them to the Beta forums. Including the output of the DirectX Diagnostic Tool (dxdiag) would be especially helpful.
Fixed Issues
Corrects an issue introduced in Flash Player 15.0.0.100 beta. Videos now play as expected when "Enabled Hardware Acceleration" is unchecked on Mac (3796536)
Multiple Stability and Security Fixes
OpenSSL - Multiple Vulnerabilities - Upgrade to 1.0.1i (3804448 )
[External]RenderToTexture with RectangleTexture causes Runtime Error and presents black screen (3802486 )
[External][Stage3D]Indexing vertex constants will result in artifacts in rendered output(3801664 )
[External][IE protected only] FileReference.download leaves "Save as type" blank in IE11(3799099 )
[External][Windows Only][Non-Injection]: Firefox Window loses focus every time Flash plugin processes are re-launched (3746856 )
[External Bug][non injection]Sound.loadPCMFromByteArray produces a sound object with a length of 0(3709804 )
[External] User encountered FF crash on vista with protect mode on after a long time playing youtube and closing entire FF (3708003 )
About the Beta Channel
Beta Versions of Flash Player are available for automatic installation via our Background Update service. Please subscribe to automatically install or receive update availability notifications at runtime.
Message was edited by: Maria Vargas
Updated 'subscribe' link to correct location.

Thanks Clark for addressing my problem.
I was out of town, just returned today. Hence some delay in my reply.
The application being at an enterprise level and huge, I am not sure how to share a simplified source.
The complexity of the elements getting created in the application may also cause error in rendering at that zoom level.
Let me find out some way out of how to share more details on this.
I will be able to share the swf link with you after discussing the confidentiality terms with the concerned person.
I appreciate your patience.
Have a good day!
Best
Deepanjan

Flash player crashes after few secs/mins

Hello everyone for last 3 days im experiencing this annoying issue with flash player. Basically whenever i turn on the video/stream/even pages with adds the flash player crashes. I tried so many things past 3 days. Heres the list:
1st of all i tried to uninstall new version of flash with uninstaller->reset->disable firewall/ avast shield-> install flash again
downgraded flash to 10.3
downgraded ff 8 to 3.6.24
tried older,11.11;11.12whql;12.1 beta drivers for my ATI HD 3870 graphics
disabling/enabling hardware acceleration
Opera, IE, Firefox same for all, it just plays few secs sometimes mins and then crashes
The last thing i did yesterday was backup everything and installed new clear version of Windows 7 Ulti 32bit (before i had Win 7 Pro 32bit) and i'm still experiencing the issue, so far i only installed:
Ati Catalyst 11.12 WHQL
latest driver for my N650SLI-DS4L motherboard suggested from nvidia.com
Realtek HD driver
Logitech Set point for MX 518
CCleaner
Digsby
Avast Free ver.
Firefox 3.6.24 (tried Firefox 8 also)
Flash Player 10.3 (tried newest one also)
Computer specs:
Intel Core2 Duo CPU E8400 @ 3Ghz
4GB RAM DDR2
ATI Radeon HD 3870
Gigabyte MB N650SLI-DS4L
500W power supply
Thanks for help, i will give you any further information if needed Hypo`

hypo` wrote:
Hello everyone for last 3 days im experiencing this annoying issue with flash player. Basically whenever i turn on the video/stream/even pages with adds the flash player crashes. I tried so many things past 3 days. Heres the list:
1st of all i tried to uninstall new version of flash with uninstaller->reset->disable firewall/ avast shield-> install flash again
downgraded flash to 10.3
downgraded ff 8 to 3.6.24
tried older,11.11;11.12whql;12.1 beta drivers for my ATI HD 3870 graphics
disabling/enabling hardware acceleration
Opera, IE, Firefox same for all, it just plays few secs sometimes mins and then crashes
The last thing i did yesterday was backup everything and installed new clear version of Windows 7 Ulti 32bit (before i had Win 7 Pro 32bit) and i'm still experiencing the issue, so far i only installed:
Ati Catalyst 11.12 WHQL
latest driver for my N650SLI-DS4L motherboard suggested from nvidia.com
Realtek HD driver
Logitech Set point for MX 518
CCleaner
Digsby
Avast Free ver.
Firefox 3.6.24 (tried Firefox 8 also)
Flash Player 10.3 (tried newest one also)
Computer specs:
Intel Core2 Duo CPU E8400 @ 3Ghz
4GB RAM DDR2
ATI Radeon HD 3870
Gigabyte MB N650SLI-DS4L
500W power supply
Thanks for help, i will give you any further information if needed Hypo`
Firefox 3x was released in July 2008 and is no longer supported. You'll have to upgrade to a later version, preferably the current one which is 8.0.1. Be aware that if you choose to install an older version, then you'll be exposing your system to the exploits documented these release notes: http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox8
You can download Firefox 8.0.1 from here: http://www.mozilla.org/en-US/firefox/fx/
After you download that, could you please follow instructions in this thread to uninstall, then reinstall Flash as your issue may be due to file corruption if you didn't disable your security app before installing Flash: http://forums.adobe.com/message/4081633#4081633

OS 10.6.5 updater and flash player

knowing that 10.6.5 updater brings flash player up to the latest available, I uninstalled the version of flash player I had installed (knowing Adobe recommends that you uninstall the old one before installing a newer version). So, I uninstalled it using hte provided adobe flash player uninstaller. I then ran the 10.6.5 updater and was surprised to find that it did not install flash player.
Can I assume that, in this the case, the 10.6.5 updater will not install (or update) flash player if it does not find it already there?

I am confusted, the notes in the 10.6.5 says it updates your flash player to the latest one...
Flash Player plug-in
http://support.apple.com/kb/HT4435
CVE-ID: CVE-2008-4546, CVE-2009-3793, CVE-2010-0209, CVE-2010-1297, CVE-2010-2160, CVE-2010-2161, CVE-2010-2162, CVE-2010-2163, CVE-2010-2164, CVE-2010-2165, CVE-2010-2166, CVE-2010-2167, CVE-2010-2169, CVE-2010-2170, CVE-2010-2171, CVE-2010-2172, CVE-2010-2173, CVE-2010-2174, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2179, CVE-2010-2180, CVE-2010-2181, CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185, CVE-2010-2186, CVE-2010-2187, CVE-2010-2189, CVE-2010-2188, CVE-2010-2213, CVE-2010-2214, CVE-2010-2215, CVE-2010-2216, CVE-2010-2884, CVE-2010-3636, CVE-2010-3638, CVE-2010-3639, CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, CVE-2010-3652, CVE-2010-3654, CVE-2010-3976
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6 through v10.6.4, Mac OS X Server v10.6 through v10.6.4
Impact: Multiple vulnerabilities in Adobe Flash Player plug-in
Description: Multiple issues exist in the Adobe Flash Player plug-in, the most serious of which may lead to arbitrary code execution. The issues are addressed by updating the Flash Player plug-in to version 10.1.102.64. Further information is available via the Adobe web site at http://www.adobe.com/support/security/
Message was edited by: powerbook1701
Message was edited by: powerbook1701

[ANNOUNCE] Flash Player 9.0.115.0 getURL("javascript:..") failure LIVE cross-domain

2/21/08 Update:
There is a technote covering these two issues.
"getURL and navigateToURL issues with Flash Player 9.0.115.0
ActiveX control"
http://www.adobe.com/go/kb403072
As of today we have two open bugs specific to Flash Player
9.0.115.0 ActiveX control and the use of getURL("javascript:...")
syntax..
I will be writing a technote describing the workarounds today
or tomorrow, but I wanted to share some of my testing with the
community so you can see what the story is.
Issue one:
getURL("javascript:blah()") failing when the content is local
to a drive or cd or dvd. This is a legit bug, not a problem with
FlashPlayer trust.
This post does not describe issueone , but you -can- use the
source FLA's to test issue one.
Issue two:
getURL("javascript") failing with live content if the HTML
and SWF are in separate domains. IE6 and IE7 only.
ExternalInterface has been successful as a workaround for
that as well (in my tests at least...)
At this point I cannot provide an ETA on any fixes, though I
am pushing hard for these to be addressed in the next planned
update (no, i cannot tell you when that is, sorry).
OK now for my testing.
Each test uses the same SWF setup, but the javascript and
html change as necessary. The results of –my- testing are
below each link.
All my tests are with Flash Player 9.0.115.0. As most on the
thread surely know these bugs were injected in the 9.0.115.0
development process and do not appear in 9.0.47.0....
There are four tests in each version (top to bottom)
-- button 1: getURL
-- button 2: externalInterface passing a string via a
variable, which is caught by javascript in the HTML page
-- button 3: fscommand
-- button 4: externalInterface calling 'window.open' directly
with no in-page javascript
-- Buttons 1 through 3 (top to bottom) fire an alert, put
some text into the debug text box in the SWF and open a new window.
-- Button 4 only opens a new window, puts some text into the
debug text box, but no alert (because it’s a direct call to
window.open)
Scenario 1:
HTML and SWF in same domain, no frames
The original AS2 version:
http://www.bentimagemedia.com/escalations/cs3_getURL/getURL_AS2.html
FireFox OSX – all pass
FireFox XP – all pass
IE6 XP – all pass
IE7 Vista - all pass
The AS3 version:
http://www.bentimagemedia.com/escalations/cs3_getURL/getURL_AS3.html
FireFox OSX – all pass
FireFox XP – all pass
IE6 XP – all pass
IE7 Vista - all pass
Scenario 2:
HTML and SWF in same domain, frameset, calls going to same
frames – this setup has two horizontal frames with the AS2
version of the SWF in the top, the AS3 version in the bottom.
http://www.bentimagemedia.com/escalations/cs3_getURL/frames/getURL_frames.html
FireFox OSX – all pass
FireFox XP – all pass
IE6 XP – all pass
IE7 Vista - all pass
Scenario 3: (THIS IS ISSUE TWO ABOVE)
HTML and SWF on different domains, calls going to the same
frames – same swf’s, same setup with modified HTML. The
HTML lives on bentimagemedia, but the SWF’s are embedded from
supportflash.com
http://www.bentimagemedia.com/escalations/cs3_getURL/frames_crossdomain/getURL_frames_cros sdomain.html
FireFox OSX – all pass
FireFox XP - all pass
IE6 XP – Button 1 getURL("javascript"...) fires
function, but does not open new window.
- all other buttons pass
IE7 Vista - Button 1 getURL("javascript...) fires function,
no new window same as IE6.
-- all other buttons pass

We are currently using Adobe Flash player 9 on Windows XP operating system. We would like to know if Vulnerabilities in Adobe Flash Player 6 Provided in Windows XP, could Allow Remote Code Execution mentioned in Microsoft Security Advisory (979267), is resolved in Flash Player 9? For more details on vulnerability please refer "Microsoft Security Advisory (979267)". I have been wondering for the answers from a week and I have even logged the same in forum which fetch me no result. Could you let me know regarding this.
Since we have security related issue with this please consider this call at high priority.
~
Satu28

How to update flash player built into CS5

Hi
Does anyone know how to go about getting the Flash Player(s) that's built into the CS5 IDE updated? According to System.capabilities.version, it's running v10.1.52.14 which, according to this page on the Adobe site, says was a pre-release version of Flash Player and should not be used! It also seems to have an annoying bug where HTML tags are frequently shown as raw HTML, rather than being rendered, which makes testing stuff in the IDE a real pain.
Matt

Hi again..
8/10/2010 Updated debugger (aka debug players or
content debuggers) and standalone (aka projector) versions of Flash
Player 10.1 are available for Flash Builder 4, Flash Catalyst, Flash
Professional CS4, and Flash Professional CS5 users. These players
contain fixes for critical vulnerabilities identified in Security Bulletin APSB10-16. All users are encouraged to update to the new players. These new players are version 10.1.82.76.
The updated debugger version is here..
http://www.adobe.com/support/flashplayer/downloads.html#fp10
Get the content debugger version..
Best regards
Peter

Flash Player Vulnerabilities

Similar Messages

Maybe you are looking for