远程 Windows 主机上安装的 Google Chrome 版本低于 43.0.2357.132。因而会受到 Adobe Flash 捆绑版本中多种漏洞的影响。

- 存在信息泄露漏洞，攻击者可利用此漏洞猜测 Flash 堆地址。(CVE-2015-3097)

- 存在多种基于堆的缓冲区溢出漏洞，可导致执行任意代码。
 （CVE-2015-3135、CVE-2015-4432、CVE-2015-5118）

- 存在多种内存损坏漏洞，可导致执行任意代码。（CVE-2015-3117、CVE-2015-3123、CVE-2015-3130、CVE-2015-3133、CVE-2015-3134、CVE-2015-4431）

- 存在多种空指针取消引用缺陷。
 （CVE-2015-3126、CVE-2015-4429）

- 存在一个安全绕过漏洞，可导致信息泄露。(CVE-2015-3114)

- 存在多种类型混淆漏洞，可导致执行任意代码。（CVE-2015-3119、CVE-2015-3120、CVE-2015-3121、CVE-2015-3122、CVE-2015-4433）

- 存在多种释放后使用错误，可导致执行任意代码。（CVE-2015-3118、CVE-2015-3124、CVE-2015-5117、CVE-2015-3127、CVE-2015-3128、CVE-2015-3129、CVE-2015-3131、CVE-2015-3132、CVE-2015-3136、CVE-2015-3137、CVE-2015-4428、CVE-2015-4430、CVE-2015-5119）

- 存在多种同源策略绕过漏洞，可导致信息泄露。（CVE-2014-0578、CVE-2015-3115、CVE-2015-3116、CVE-2015-3125、CVE-2015-5116）

- 由于对用户提供的输入验证不当，存在一个内存损坏问题。攻击者可利用此缺陷执行任意代码。(CVE-2015-5124)

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

远程主机受到 GLSA-201507-13 中所述漏洞的影响（Adobe Flash Player：多种漏洞）

已在 Adobe Flash Player 中发现多种漏洞。
 请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可能以进程的权限执行任意代码，造成拒绝服务的情况，获得敏感信息或者绕过安全限制。
 变通方案：

目前无任何已知的变通方案。

Versions of Adobe Flash Player prior to 18.0.0.203 are outdated and thus unpatched for the following vulnerabilities :

  - An information disclosure vulnerability exists that allows an attacker to guess the address for the Flash heap. (CVE-2015-3097)
  - Multiple heap-based buffer overflow vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)
  - Multiple memory corruption vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431)
  - Multiple NULL pointer dereference flaws exist. (CVE-2015-3126, CVE-2015-4429)
  - A security bypass vulnerability exists that results in an information disclosure. (CVE-2015-3114)
  - Multiple type confusion vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)
  - Multiple use-after-free errors exist that allow arbitrary code execution. (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119)
  - Multiple same-origin policy bypass vulnerabilities exist that allow information disclosure. (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116)
  - A memory corruption issue exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-5124)

The version of Google Chrome OS on the remote mobile host is prior to 43.0.2357.132 and thus unpatched for the following vulnerabilities :

 - A use-after-free error exists in the opaqueBackground class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5122) 
 - A use-after-free error exists in the BitmapData class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5123) 
 - A flaw exists due to user-supplied input not being properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-5124) 
 - An information disclosure vulnerability exists that allows an attacker to guess the address for the Flash heap. (CVE-2015-3097) 
 - Multiple heap-based buffer overflow vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118) 
 - Multiple memory corruption vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431) 
 - Multiple NULL pointer dereference flaws exist. (CVE-2015-3126, CVE-2015-4429) 
 - A security bypass vulnerability exists that results in an information disclosure. (CVE-2015-3114) 
 - Multiple type confusion vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433) 
 - Multiple use-after-free errors exist that allow arbitrary code execution. (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119) 
 - Multiple same-origin policy bypass vulnerabilities exist that allow information disclosure. (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116) 
 - A memory corruption issue exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-5124)

Versions of Adobe AIR prior to 18.0.0.180 are outdated and thus unpatched for the following vulnerabilities :

 - An information disclosure vulnerability exists that allows an attacker to guess the address for the Flash heap. (CVE-2015-3097)
 - Multiple heap-based buffer overflow vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)
 - Multiple memory corruption vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431)
 - Multiple NULL pointer dereference flaws exist. (CVE-2015-3126, CVE-2015-4429)
 - A security bypass vulnerability exists that results in an information disclosure. (CVE-2015-3114)
 - Multiple type confusion vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)
 - Multiple use-after-free errors exist that allow arbitrary code execution. (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119)
 - Multiple same-origin policy bypass vulnerabilities exist that allow information disclosure. (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116)
 - A memory corruption issue exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-5124)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
84667	Google Chrome < 43.0.2357.132 多种漏洞	Nessus	Windows	2015/7/10	2022/4/11	critical
86083	GLSA-201507-13：Adobe Flash Player：多种漏洞	Nessus	Gentoo Local Security Checks	2015/9/23	2022/4/22	critical
8821	Flash Player < 13.0.0.302 / 18.0.0.203 Multiple Vulnerabilities (APSB15-16)	Nessus Network Monitor	Web Clients	2015/7/24	2019/3/6	high
8886	Google Chrome OS < 43.0.2357.132 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2015/9/25	2019/3/6	critical
8858	Adobe AIR < 18.0.0.180 Multiple Vulnerabilities (APSB15-16)	Nessus Network Monitor	Web Clients	2015/9/11	2019/3/6	high

検出

プラグインの検索

critical

critical

high

critical

high