Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Alex Legler (a3ligentoo.org)
Date: Thu Mar 12 2009 - 08:17:23 CDT
On Mi, 2009-03-11 at 10:30 -0700, Matthew Dempsky wrote:
> On Wed, Oct 1, 2008 at 5:46 PM, Matthew Dempsky <matthewmochimedia.com> wrote:
> > If a Flash 9 SWF loads two SWF files with different SWF version
> > numbers from two distinct HTTP requests to the exact same URL
> > (including query string arguments), then Adobe's Flash Player plug-in
> > will try to dereference a null pointer. This issue affects at least
> > versions 188.8.131.52, 184.108.40.206, 220.127.116.11, and 10.0.12.10 on Windows, OS
> > X, and Linux.
> As an update, this issue also affects 10.0.22.87 at least on Windows
> and OS X. I've seen some Linux distributions (e.g., ) claim that
> 10.0.22.87 fixes this bug (aka CVE-2008-4546), but I think this is
yes, indeed you are right. Both a user and me could repoduce the issue
with the version we mistakenly marked as not vulnerable.
> You can easily reproduce this bug (i.e., crash your browser) by
> visiting http://flashcrash.dempsky.org/. Be sure to tell your
> friends: it can be the next Rick Roll.
>  http://www.gentoo.org/security/en/glsa/glsa-200903-23.xml?style=printable
We have updated that GLSA to no longer reference this issue.
Thank you for the heads-up!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.10 (GNU/Linux)
-----END PGP SIGNATURE-----