Bug 819003 (CVE-2012-0779)

Summary: CVE-2012-0779 flash-plugin: arbitrary code execution via object confusion (APSB12-09)
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: ed.costello, emhuang, jlieskov, mmelanso, mtilburg, stransky
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-05-23 09:23:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 819004, 819005, 819006, 819007    
Bug Blocks: 819017    

Description Vincent Danen 2012-05-04 14:57:35 UTC 
Adobe security bulletin APSB12-09 describes a security flaw that can lead to arbitrary code execution when a malicious SWF file is opened in Adobe Flash Player:

These updates address an object confusion vulnerability (CVE-2012-0779) that could cause the application to crash and potentially allow an attacker to take control of the affected system. 
There are reports that the vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious file delivered in an email message. The exploit targets Flash Player on Internet Explorer for Windows only.

External References:

http://www.adobe.com/support/security/bulletins/apsb12-09.html
Comment 2 Vincent Danen 2012-05-14 22:02:48 UTC 
Adobe has not yet made 10.3.x versions for Linux/UNIX available for download as of yet.
Comment 3 errata-xmlrpc 2012-05-23 08:50:49 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:0688 https://rhn.redhat.com/errata/RHSA-2012-0688.html