------------------------------------------------------------------------
Pardus Linux Security Advisory 2009-27            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2009-03-25
  Severity: 4
      Type: Remote
------------------------------------------------------------------------

Summary
=======

Some vulnerabilities have been reported in Adobe Flash Player, which can
be exploited by malicious, local users to disclose sensitive information
and potentially gain escalated privileges, and by malicious  people  to
bypass certain security restrictions,  disclose  potentially  sensitive
information, and compromise a user's system.


Description
===========

1) An error when processing multiple references to an unspecified object
can be exploited to dereference freed memory via a specially crafted SWF
file.



Successful exploitation allows execution of arbitrary code.



2) An input validation error in the processing  of  SWF  files  can  be
exploited to cause a crash and potentially execute arbitrary code.



3) An error when  displaying  the  mouse  pointer  on  Windows  can  be
exploited to potentially conduct "Clickjacking" attacks.



4) An error in the Linux  Flash  Player  binary  can  be  exploited  to
disclose  sensitive information   and   potentially   gain   escalated
privileges.


Affected packages:

  Pardus 2008:
    flashplugin, all before 10.0.22.87-21-6


Resolution
==========

There are update(s) for flashplugin. You can update  them  via  Package
Manager or with a single command from console:

    pisi up flashplugin

References
==========

  * http://bugs.pardus.org.tr/show_bug.cgi?id=9322
  * http://secunia.com/advisories/34012/