flash-player was updated to fix 35 security issues.

These security issues were fixed :

  - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer     overflow vulnerabilities that could lead to code     execution (bsc#937339).

  - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130,     CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory     corruption vulnerabilities that could lead to code     execution (bsc#937339).

  - CVE-2015-3126, CVE-2015-4429: NULL pointer dereference     issues (bsc#937339).

  - CVE-2015-3114: A security bypass vulnerability that     could lead to information disclosure (bsc#937339).

  - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121,     CVE-2015-3122, CVE-2015-4433: Type confusion     vulnerabilities that could lead to code execution     (bsc#937339).

  - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117,     CVE-2015-3127, CVE-2015-3128, CVE-2015-3129,     CVE-2015-3131, CVE-2015-3132, CVE-2015-3136,     CVE-2015-3137, CVE-2015-4428, CVE-2015-4430,     CVE-2015-5119: Use-after-free vulnerabilities that could     lead to code execution (bsc#937339).

  - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116,     CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could     be exploited to bypass the same-origin-policy and lead     to information disclosure (bsc#937339).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

flash-player was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-5119: Unspecified vulnerability allowing remote     attackers to take over the system (bsc#937339).

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:1214 advisory.

    The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash     Player web browser plug-in.

    This update fixes multiple vulnerabilities in Adobe Flash Player. These     vulnerabilities are detailed in the Adobe Security Bulletin APSB15-16     listed in the References section.

    Multiple flaws were found in the way flash-plugin displayed certain SWF     content. An attacker could use these flaws to create a specially crafted     SWF file that would cause flash-plugin to crash or, potentially, execute     arbitrary code when the victim loaded a page containing the malicious SWF     content. (CVE-2015-3117, CVE-2015-3118, CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-3123, CVE-2015-3124, CVE-2015-3126,     CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3130, CVE-2015-3131,     CVE-2015-3132, CVE-2015-3133, CVE-2015-3134, CVE-2015-3135, CVE-2015-3136,     CVE-2015-3137, CVE-2015-4428, CVE-2015-4429, CVE-2015-4430, CVE-2015-4431,     CVE-2015-4432, CVE-2015-4433, CVE-2015-5117, CVE-2015-5118, CVE-2015-5119)

    Multiple security bypass flaws were found in flash-plugin that could lead     to the disclosure of sensitive information. (CVE-2014-0578, CVE-2015-3114,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116)

    All users of Adobe Flash Player should install this updated package, which     upgrades Flash Player to version 11.2.202.481.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 18.0.0.194. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

The version of Google Chrome installed on the remote Mac OS X host is prior to 43.0.2357.132. It is, therefore, affected by multiple vulnerabilities in the bundled version of Adobe Flash :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
84663	SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1214-1) (Underminer)	Nessus	SuSE Local Security Checks	2015/7/13	2022/3/8	critical
84629	openSUSE Security Update : flash-player (openSUSE-2015-473) (Underminer)	Nessus	SuSE Local Security Checks	2015/7/9	2022/3/8	critical
84631	RHEL 5 / 6 : flash-plugin (RHSA-2015:1214)	Nessus	Red Hat Local Security Checks	2015/7/9	2025/3/21	critical
84642	Adobe Flash Player <= 18.0.0.194 Multiple Vulnerabilities (APSB15-16)	Nessus	Windows	2015/7/9	2022/4/11	critical
84668	Google Chrome < 43.0.2357.132 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/7/10	2022/3/8	critical

検出

プラグインの検索

critical

critical

critical

critical

critical