Liu Die Yu

The issue is related to a potential Clickjacking variant, allowing remote attackers to trick a user into visiting an arbitrary URL via unknown vectors.

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 9.0.124.0 and earlier Description: The issue allows remote attackers to cause victims to unknowingly click on a link or dialog via access control dialogs disguised as normal graphical elements. This can be used to hijack the camera or microphone and is related to "clickjacking." Recommendations: For Adobe Flash Player versions 9.0.124.0 and earlier, update to a version later than 9.0.124.0 to resolve the issue.

The issue allows remote attackers to bypass domain restrictions and execute arbitrary code. This can be demonstrated on Internet Explorer using script in a compiled help (CHM) file that references specific protocol handlers, such as `ms-its`, `ms-itss`, `its`, or `mk:@MSITStore`.

The issue allows remote attackers to manipulate drag and drop behaviors and other mouse click actions by calling the `window.moveBy` method. This enables attackers to direct these actions to other windows.

The issue allows remote attackers to bypass zone restrictions and execute Javascript. This is achieved by setting the window's `href` to the malicious Javascript, then calling `execCommand("Refresh")` to refresh the page.

The issue allows remote attackers to bypass zone restrictions and read arbitrary files. This can be achieved by modifying the `createTextRange` method and using `CreateLink`, or by modifying the `createRange` method and using the FIND dialog to select text.

The issue allows remote attackers to bypass zone restrictions. This can be achieved through several methods, including using the NavigateAndFind method to load a file: URL containing Javascript, utilizing the window.open method to load a file: URL containing Javascript, setting the href property in the base tag for the search window, loading the search window into an Iframe, or caching a javascript: URL in the browser history and then accessing that URL in the same frame as the target domain.

The issue concerns the download function, which allows remote attackers to obtain the cache directory name. This is achieved through an HTTP response with an invalid ContentType and a .htm file. As a result, security mechanisms that rely on random names could be bypassed.

The issue allows remote attackers to manipulate drag and drop behaviors and other mouse click actions by accessing the window.moveBy method through method caching (SaveRef). This can be exploited to direct actions to other windows.