Bug 710981 – CVE-2011-2107 flash-plugin: Cross-site scripting vulnerability (APSB11-13)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 710981 - (APSB11-13, CVE-2011-2107) CVE-2011-2107 flash-plugin: Cross-site scripting vulnerability (APSB11-13)

Summary:	CVE-2011-2107 flash-plugin: Cross-site scripting vulnerability (APSB11-13)

Status:	CLOSED ERRATA

Aliases:	APSB11-13, CVE-2011-2107

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20110605,repo...
Keywords:	Security

Depends On:	710982 710983
Blocks:	712301 720636
	Show dependency tree / graph

Reported:	2011-06-06 00:30 EDT by Huzaifa S. Sidhpurwala
Modified:	2016-03-04 06:42 EST (History)
CC List:	9 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2011-11-14 18:22:24 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0850	normal	SHIPPED_LIVE	Important: flash-plugin security update	2011-06-06 10:48:38 EDT

Groups: None (edit)

Description Huzaifa S. Sidhpurwala 2011-06-06 00:30:22 EDT

Adobe has released APSB11-13 [1] along with Flash Player 10.3.181.22 to correct
the following important flaw:

An important vulnerability has been identified in Adobe Flash Player 
10.3.181.16 and earlier versions for Windows, Macintosh, Linux and 
Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for 
Android.

This universal cross-site scripting vulnerability (CVE-2011-2107) 
could be used to take actions on a user's behalf on any website or 
webmail provider, if the user visits a malicious website. 
There are reports that this vulnerability is being exploited in the wild
in active targeted attacks designed to trick the user into 
clicking on a malicious link delivered in an email message.

[1] http://www.adobe.com/support/security/bulletins/apsb11-13.html

Comment 2 errata-xmlrpc 2011-06-06 10:48:45 EDT

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2011:0850 https://rhn.redhat.com/errata/RHSA-2011-0850.html

Comment 5 Huzaifa S. Sidhpurwala 2011-06-17 01:58:27 EDT

According to Adobe, this issue also affects Adobe Reader for Linux. The support model of Adobe Reader for Linux was changed and upstream only plans to release updates twice a year.

Next update is planned for September 13, 2011.
http://blogs.adobe.com/asset/2011/06/notes-on-adobe-reader-and-acrobat-10-1.html

Comment 8 Vincent Danen 2011-11-14 18:22:24 EST

This issue has been addressed in following products:

  Extras for RHEL 4
  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2011:1434 https://rhn.redhat.com/errata/RHSA-2011-1434.html

Comment 9 Tomas Hoger 2011-11-15 02:35:31 EST

Note: Adobe Reader 9.4.6 for Unix does not bundle Flash Player any more.  Hence future Flash flaws will not apply to it.

Note You need to log in before you can comment on or make changes to this bug.