CVE-2010-3645

Vulnerability

An unspecified memory corruption vulnerability exists in Adobe Flash Player versions prior to 9.0.289.0 (9.x branch) and prior to 10.1.102.64 (10.x branch) on Windows, Mac OS X, Linux, and Solaris, and also prior to 10.1.95.1 on Android [1]. The vulnerability is triggered via unknown vectors, making it distinct from several other Flash Player CVEs disclosed at the same time [2].

Exploitation

An attacker can exploit this vulnerability remotely by enticing a user to open a specially crafted Flash file (e.g., via a web page or email attachment) [2]. No authentication is required, and successful exploitation relies on user interaction to load the malicious content in a browser or application that uses the vulnerable Flash Player version.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system with the privileges of the user running Flash Player, or to cause a denial of service (memory corruption) [2]. This can lead to full compromise of the affected machine, including data theft, malware installation, or system crash.

Mitigation

Adobe released the fixed versions: Flash Player 9.0.289.0, 10.1.102.64, and 10.1.95.1 for Android, as part of their regular update cycle. These updates were included in Red Hat Enterprise Linux advisories RHSA-2010:0829, RHSA-2010:0834, and RHSA-2010:0867 in November 2010 [2][3][4]. Users should immediately update to the patched version. No workarounds are documented; applying the update is the only mitigation.