Bug 710981 (APSB11-13, CVE-2011-2107) - CVE-2011-2107 flash-plugin: Cross-site scripting vulnerability (APSB11-13)
Summary: CVE-2011-2107 flash-plugin: Cross-site scripting vulnerability (APSB11-13)
Keywords:
Status: CLOSED ERRATA
Alias: APSB11-13, CVE-2011-2107
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 710982 710983
Blocks: 712301 720636
TreeView+ depends on / blocked
 
Reported: 2011-06-06 04:30 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-09-29 12:45 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-11-14 23:22:24 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0850 0 normal SHIPPED_LIVE Important: flash-plugin security update 2011-06-06 14:48:38 UTC

Description Huzaifa S. Sidhpurwala 2011-06-06 04:30:22 UTC 
Adobe has released APSB11-13 [1] along with Flash Player 10.3.181.22 to correct
the following important flaw:

An important vulnerability has been identified in Adobe Flash Player 
10.3.181.16 and earlier versions for Windows, Macintosh, Linux and 
Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for 
Android.

This universal cross-site scripting vulnerability (CVE-2011-2107) 
could be used to take actions on a user's behalf on any website or 
webmail provider, if the user visits a malicious website. 
There are reports that this vulnerability is being exploited in the wild
in active targeted attacks designed to trick the user into 
clicking on a malicious link delivered in an email message.

[1] http://www.adobe.com/support/security/bulletins/apsb11-13.html
Comment 2 errata-xmlrpc 2011-06-06 14:48:45 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2011:0850 https://rhn.redhat.com/errata/RHSA-2011-0850.html
Comment 5 Huzaifa S. Sidhpurwala 2011-06-17 05:58:27 UTC 
According to Adobe, this issue also affects Adobe Reader for Linux. The support model of Adobe Reader for Linux was changed and upstream only plans to release updates twice a year.

Next update is planned for September 13, 2011.
http://blogs.adobe.com/asset/2011/06/notes-on-adobe-reader-and-acrobat-10-1.html
Comment 8 Vincent Danen 2011-11-14 23:22:24 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2011:1434 https://rhn.redhat.com/errata/RHSA-2011-1434.html
Comment 9 Tomas Hoger 2011-11-15 07:35:31 UTC 
Note: Adobe Reader 9.4.6 for Unix does not bundle Flash Player any more.  Hence future Flash flaws will not apply to it.
Note You need to log in before you can comment on or make changes to this bug.