The version of Google Chrome installed on the remote Mac OS X host is prior to 43.0.2357.132. It is, therefore, affected by multiple vulnerabilities in the bundled version of Adobe Flash :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Adobe reports :

Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published.

According to its version, the installation of Adobe AIR on the remote Windows host is equal or prior to 18.0.0.144. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

The version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to version 18.0.0.194. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

The remote Windows host is missing KB3065823. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
84668	Google Chrome < 43.0.2357.132 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/7/10	2022/3/8	critical
84628	FreeBSD : Adobe Flash Player -- critical vulnerabilities (348bfa69-25a2-11e5-ade1-0011d823eebd) (Underminer)	Nessus	FreeBSD Local Security Checks	2015/7/9	2022/3/8	critical
84641	Adobe AIR <= 18.0.0.144 Multiple Vulnerabilities (APSB15-16)	Nessus	Windows	2015/7/9	2022/4/11	critical
84644	Adobe Flash Player <= 18.0.0.194 Multiple Vulnerabilities (APSB15-16) (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/7/9	2022/3/8	critical
84645	MS KB3065823: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	2015/7/9	2022/3/8	critical

検出

プラグインの検索

critical

critical

critical

critical

critical