Fefes Blog

Fragen? Antworten! Siehe auch: Alternativlos

Fri Jun 11 2010

• [l] Adobe hat ihr Advisory zu Flash veröffentlicht. Das wäre normalerweise keine Erwähnung wert, weil da eh niemand Qualitätssoftware erwartet, aber das Ausmaß des Problems erinnert schon fast an BP. Ich würde sogar soweit gehen, dass das auf der Richter-Skala an Apple heranreicht. Ich zitiere mal:

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-1297).
  Note: There are reports that this issue is being actively exploited in the wild.

  This update resolves a memory exhaustion vulnerability that could lead to code execution (CVE-2009-3793).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2160).

  This update resolves an indexing vulnerability that could lead to code execution (CVE-2010-2161).

  This update resolves a heap corruption vulnerability that could lead to code execution(CVE-2010-2162).

  This update resolves multiple vulnerabilities that could lead to code execution (CVE-2010-2163).

  This update resolves a use after free vulnerability that could lead to code execution (CVE-2010-2164).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2165).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2166).

  This update resolves multiple heap overflow vulnerabilities that could lead to code execution (CVE-2010-2167).

  This update resolves a pointer memory corruption that could lead to code execution (CVE-2010-2169).

  This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2010-2170).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2171).

  This update resolves a denial of service issue on some UNIX platforms (Flash Player 9 only) (CVE-2010-2172).

  This update resolves an invalid pointer vulnerability that could lead to code execution (CVE-2010-2173).

  This update resolves an invalid pointer vulnerability that could lead to code execution (CVE-2010-2174).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2175).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2176).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2177).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2178).

  This update resolves a URL parsing vulnerability that could lead to cross-site scripting (Firefox and Chrome browsers only) (CVE-2010-2179).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2180).

  This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2010-2181).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2182).

  This update resolves a integer overflow vulnerability that could lead to code execution (CVE-2010-2183).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2184).

  This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2010-2185).

  This update resolves a denial of service vulnerability that can cause the application to crash. Arbitrary code execution has not been demonstrated, but may be possible. (CVE-2010-2186).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2187).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2188).

  This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2189).
  Note: This issue occurs only on VMWare systems with VMWare Tools enabled.

  This update resolves a denial of service issue (CVE-2008-4546).

  Ich habe "code execution" mal hervorgehoben, weil das die Totalschaden-Kategorie ist. Schon EIN Bug dieser Kategorie ist Totalschaden. Selbst Apple braucht mehr Pakete, um so viele Totalschaden-Bugs anzuhäufen. Ich komme aus dem Stand nur auf eine Firma, die jemals eine derartige Totalschaden-Dichte erreicht hat. Oracle.

  Update: Oh toll und 64-bit-Support haben sie offenbar heimlich, still und leise gecancelt. Tja, dann halt kein Flash mehr.