Flash Player Security Update

Adobe has released updated version of their Flash Player. The new version fixes a bunch of vulnerabilities:
- a memory corruption vulnerability that could lead to code execution (CVE-2010-3654). More information

- an input validation issue vulnerability that could lead to a bypass of cross-domain policy file restrictions with certain server encodings (CVE-2010-3636).

- a memory corruption vulnerability that could lead to code execution (ActiveX only) (CVE-2010-3637).

- an information disclosure vulnerability (Macintosh platform, Safari browser only) (CVE-2010-3638).

- a Denial of Service vulnerability. Arbitrary code execution has not been demonstrated, but may be possible (CVE-2010-3639).

- multiple memory corruption vulnerabilities that could lead to code execution:
* (CVE-2010-3640)
* (CVE-2010-3641)
* (CVE-2010-3642)
* (CVE-2010-3643)
* (CVE-2010-3644)
* (CVE-2010-3645)
* (CVE-2010-3646)
* (CVE-2010-3647)
* (CVE-2010-3648)
* (CVE-2010-3649)
* (CVE-2010-3650)
* (CVE-2010-3652)

- a library-loading vulnerability that could lead to code execution (CVE-2010-3976)


Users of Adobe Flash Player 10.1.85.3 and earlier should update to Adobe Flash Player 10.1.102.64. More information can be read from Adobe's security bulletin.

Unpatched Vulnerability In Internet Explorer

Microsoft is investigating public report of new vulnerability in supported versions of Internet Explorer. "The vulnerability exists due to an invalid flag reference within Internet Explorer. It is possible under certain conditions for the invalid flag reference to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution." Microsoft states that they are aware of targeted attacks trying to exploit the vulnerability.

Information about workarounds and mitigations for the issue can be read from Microsoft's security advisory.

Mozilla Security Patch On Critical Vulnerability

Mozilla has released a new update to address a critical vulnerability present in their products.

Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Critical Unpatched Vulnerability In Adobe Shockwave Player

There has been found a critical vulnerability in Adobe Shockwave Player. The vulnerability (CVE-2010-3653) could cause a crash and potentially allow an attacker to take control of the vulnerable system. Details about the vulnerability have been disclosed publicly but Adobe states that they are not aware of any attacks exploiting the vulnerability at the moment.

Adobe's security advisory can be read here. Also, Secunia has an advisory available.

Google Patches Vulnerabilities In Chrome

Google has released a new version of their Chrome web browser. Version 7.0.517.43 fixes ten vulnerabilities (two affecting Linux only) of which one is categorized as critical, five as high, two as medium and two as low.

More information in Google Chrome Releases blog.

Mozilla Updates

Mozilla has released security bulletins related to found issues in some of their products. Five of the fixed vulnerabilities are categorized as critical, two as high, one as moderate and one as low.

Critical:
MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)
MFSA 2010-65 Buffer overflow and memory corruption using document.write
MFSA 2010-66 Use-after-free error in nsBarProp
MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter
MFSA 2010-71 Unsafe library loading vulnerabilities

High:
MFSA 2010-68 XSS in gopher parser when parsing hrefs
MFSA 2010-69 Cross-site information disclosure via modal calls

Moderate:
MFSA 2010-70 SSL wildcard certificate matching IP addresses

Low:
MFSA 2010-72 Insecure Diffie-Hellman key exchange


Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Security Updates For RealPlayer

RealNetworks has released updated version of their RealPlayer. New version contains fixes to seven vulnerabilities:

CVE-2010-2998
RealPlayer Malformed IVR Pointer Index Code Execution Vulnerability
Affected software: Windows RealPlayer SP 1.0.1 and prior.

CVE-2010-3747
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-3750
RealPlayer RJMDSections Remote Code Execution Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-2578
RealPlayer QCP parsing heap-based buffer overflow vulnerability.
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-3751
RealPlayer ActiveX Control Multiple Protocol Handlers Remote Code Execution Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior.

CVE-2010-3748
RealPlayer RichFX Component Stack Overflow Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-3749
RealPlayer Browser Extension RecordClip Parameter Injection Vulnerability
Affected software: Windows RealPlayer SP 1.1 and prior.


Users of affected versions are advised to update their RealPlayer to the latest one available. More information can be read from related security advisory.