CVE-2010-2179

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610. The flaw is triggered by unspecified URL parsing vectors that allow remote attackers to inject arbitrary web script or HTML when the Flash Player plugin is used in Firefox or Chrome [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that, when parsed by the affected Flash Player or AIR component in the context of a web page viewed in Firefox or Chrome, causes the injection and execution of attacker-controlled script or HTML. No special authentication is required; the attack can be carried out remotely by enticing a user to visit a specially crafted website or click a malicious link [1][2][3][4].

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML into the context of the victim's browser session. This can lead to data theft, session hijacking, defacement, or other actions that the compromised web application permits, affecting the confidentiality, integrity, and availability of user data [1][2][3][4].

Mitigation

Users should upgrade Adobe Flash Player to version 9.0.277.0 or later, or 10.1.53.64 or later, and Adobe AIR to version 2.0.2.12610 or later. Red Hat published advisories (RHSA-2010-0464 and RHSA-2010-0470) providing updated packages for affected Linux platforms [1][2]. This CVE has not been listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.