----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Adobe Flash Player Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA37584

VERIFY ADVISORY:
http://secunia.com/advisories/37584/

DESCRIPTION:
Some vulnerabilities have been reported in Adobe Flash Player / AIR,
which can be exploited by malicious people to gain knowledge of
system information or compromise a user's system.

1) An error when parsing JPEG dimensions contained within an SWF file
can be exploited to cause a heap-based buffer overflow.

2) An unspecified error may allow injection of data and potentially
lead to execution of arbitrary code.

3) An unspecified error possibly related to "getProperty()" can be
exploited to corrupt memory and may allow execution of arbitrary
code.

4) An unspecified error can be exploited to corrupt memory and may
allow execution of arbitrary code.

5) An integer overflow error when generating ActionScript exception
handlers in Verifier::parseExceptionHandlers() can be exploited to
corrupt memory.

6) Various unspecified errors may potentially allow execution of
arbitrary code.

7) An error may disclose information about local file names.

The vulnerabilities are reported in Adobe Flash Player version
10.0.32.18 and prior and Adobe AIR version 1.5.2 and prior.

SOLUTION:
Update to Flash Player version 10.0.42.34 and AIR version 1.5.3.

PROVIDED AND/OR DISCOVERED BY:
1) An anonymous person via Zero Day Initiative.
2) The vendor credits Jim Cheng, EffectiveUI.
3-4) Bing Liu, Fortinet's FortiGuard Labs.
5) Damian Put via Zero Day Initiative.
6) The vendor credits Will Dormann, CERT.
7) The vendor credits Manuel Caballero and Microsoft Vulnerability
Research.

CHANGELOG:
2009-12-09: Added additional information provided by ZDI.

ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb09-19.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-092/
http://www.zerodayinitiative.com/advisories/ZDI-09-093/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------