Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.

Adobe Flash Player was updated to 11.2.202.270: (bnc#803485)

  - APSB13-05, CVE-2013-1372, CVE-2013-0645, CVE-2013-1373,     CVE-2013-1369, CVE-2013-1370, CVE-2013-1366,     CVE-2013-0649, CVE-2013-1365, CVE-2013-1374,     CVE-2013-1368, CVE-2013-0642, CVE-2013-0644,     CVE-2013-0647, CVE-2013-1367, CVE-2013-0639,     CVE-2013-0638, CVE-2013-0637

    More information can be found on:
    http://www.adobe.com/support/security/bulletins/apsb13-0     5.html

The remote host is affected by the vulnerability described in GLSA-201309-06 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple unspecified vulnerabilities have been discovered in Adobe Flash       Player. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open specially crafted SWF       content, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to bypass access restrictions.
  Workaround :

    There is no known workaround at this time.

This update for flash-player to version 11.2.202.270, tracked as ABSP13-05 <ttp://www.adobe.com/support/security/bulletins/apsb13-05.html> , contains fixes for the following security issues :

  - Several buffer overflow vulnerabilities that could lead     to code execution. (CVE-2013-0642 / CVE-2013-0645 /     CVE-2013-1365 / CVE-2013-1366 / CVE-2013-1367 /     CVE-2013-1368 / CVE-2013-1369 / CVE-2013-1370 /     CVE-2013-1372 / CVE-2013-1373)

  - Use-after-free vulnerabilities that could lead to code     execution. ( CVE-2013-0644 / CVE-2013-0649 /     CVE-2013-1374)

  - An integer overflow vulnerability that could lead to     code execution. (CVE-2013-0639)

  - Two memory corruption vulnerabilities that could lead to     code execution. (CVE-2013-0638 / CVE-2013-0647)

  - An information disclosure vulnerability. (CVE-2013-0637)

The remote host has Adobe Flash Player installed. 

Versions of Flash Player 11.x equal to or earlier than 11.5.502.149, or 10.x equal to or earlier than 10.3.183.51 are affected by multiple vulnerabilities:

  - Several unspecified issues exist that could lead to buffer overflows and arbitrary code execution. (CVE-2013-1372, CVE-2013-0645, CVE-2013-1373, CVE-2013-1369, CVE-2013-1370, CVE-2013-1366, CVE-2013-1365, CVE-2013-1368, CVE-2013-0642, CVE-2013-1367)

  - Several unspecified use-after-free vulnerabilities exist that could lead to remote code execution. (CVE-2013-0649, CVE-2013-1374, CVE-2013-0644)

  - Two unspecified issues exist that could lead to memory corruption and arbitrary code execution. (CVE-2013-0638, CVE-2013-0647)

  - An unspecified information disclosure vulnerability exists. (CVE-2013-0637)

  - An unspecified integer overflow vulnerability exists.(CVE-2013-0639)

An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes several vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB13-05, listed in the References section. Specially crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content.
(CVE-2013-0638, CVE-2013-0639, CVE-2013-0642, CVE-2013-0644, CVE-2013-0645, CVE-2013-0647, CVE-2013-0649, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, CVE-2013-1373, CVE-2013-1374)

A flaw in flash-plugin could allow an attacker to obtain sensitive information if a victim were tricked into visiting a specially crafted web page. (CVE-2013-0637)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.270.

The remote host is missing KB2805940.  The installed version of Adobe Flash ActiveX control is potentially affected by the following vulnerabilities :

  - Several unspecified issues exist that could lead to     buffer overflows and arbitrary code execution.
    (CVE-2013-1372, CVE-2013-0645, CVE-2013-1373,     CVE-2013-1369, CVE-2013-1370, CVE-2013-1366,     CVE-2013-1365, CVE-2013-1368, CVE-2013-0642,     CVE-2013-1367)

  - Several unspecified use-after-free vulnerabilities exist     that could lead to remote code execution. (CVE-2013-0649,     CVE-2013-1374, CVE-2013-0644)

  - Two unspecified issues exist that could lead to memory     corruption and arbitrary code execution. (CVE-2013-0638,     CVE-2013-0647)

  - An unspecified information disclosure vulnerability     exists. (CVE-2013-0637)

  - An unspecified integer overflow vulnerability exists.
    (CVE-2013-0639)

According to its version, the instance of Flash Player installed on the remote Mac OS X host is 11.x equal or prior to 11.5.502.149, or 10.x equal or prior to 10.3.183.51.  It is, therefore, potentially affected by the following vulnerabilities :

  - Several unspecified issues exist that could lead to     buffer overflows and arbitrary code execution.
    (CVE-2013-1372, CVE-2013-0645, CVE-2013-1373,     CVE-2013-1369, CVE-2013-1370, CVE-2013-1366,     CVE-2013-1365, CVE-2013-1368, CVE-2013-0642,     CVE-2013-1367)

  - Several unspecified use-after-free vulnerabilities     exist that could lead to remote code execution.
    (CVE-2013-0649, CVE-2013-1374, CVE-2013-0644)

  -  Two unspecified issues exists that could lead to      memory corruption and arbitrary code execution.
     (CVE-2013-0638, CVE-2013-0647)

  - An unspecified information disclosure vulnerability exists.
    (CVE-2013-0637)

  - An unspecified integer overflow vulnerability exists.
    (CVE-2013-0639)

According to its version, the instance of Adobe AIR 3.x on the remote Mac OS X host is 3.5.0.1060 or earlier.  It is, therefore, reportedly affected by multiple vulnerabilities :

  - Several unspecified issues exist that could lead to     buffer overflows and arbitrary code execution.
    (CVE-2013-1372, CVE-2013-0645, CVE-2013-1373,     CVE-2013-1369, CVE-2013-1370, CVE-2013-1366,     CVE-2013-1365, CVE-2013-1368, CVE-2013-0642,     CVE-2013-1367)

  - Several unspecified use-after-free vulnerabilities exist     that could lead to remote code execution. (CVE-2013-0649,     CVE-2013-1374, CVE-2013-0644)

  - Two unspecified issues exist that could lead to memory     corruption and arbitrary code execution. (CVE-2013-0638,     CVE-2013-0647)

  - An unspecified information disclosure vulnerability     exists. (CVE-2013-0637)

  - An unspecified integer overflow vulnerability exists.
    (CVE-2013-0639)

According to its version, the instance of Flash Player installed on the remote Windows host is 11.x equal or prior to 11.5.502.149, or 10.x equal or prior to 10.3.183.51.  It is, therefore, potentially affected by the following vulnerabilities :

  - Several unspecified issues exist that could lead to     buffer overflows and arbitrary code execution.
    (CVE-2013-1372, CVE-2013-0645, CVE-2013-1373,     CVE-2013-1369, CVE-2013-1370, CVE-2013-1366,     CVE-2013-1365, CVE-2013-1368, CVE-2013-0642,     CVE-2013-1367)

  - Several unspecified use-after-free vulnerabilities exist     that could lead to remote code execution. (CVE-2013-0649,     CVE-2013-1374, CVE-2013-0644)

  - Two unspecified issues exist that could lead to memory     corruption and arbitrary code execution. (CVE-2013-0638,     CVE-2013-0647)

  - An unspecified information disclosure vulnerability     exists. (CVE-2013-0637)

  - An unspecified integer overflow vulnerability exists.
    (CVE-2013-0639)

According to its version, the instance of Adobe AIR 3.x on the remote Windows host is 3.5.0.1060 or earlier.  It is, therefore, potentially affected by the following vulnerabilities :

  - Several unspecified issues exist that could lead to     buffer overflows and arbitrary code execution.
    (CVE-2013-1372, CVE-2013-0645, CVE-2013-1373,     CVE-2013-1369, CVE-2013-1370, CVE-2013-1366,     CVE-2013-1365, CVE-2013-1368, CVE-2013-0642,     CVE-2013-1367)

  - Several unspecified use-after-free vulnerabilities exist     that could lead to remote code execution. (CVE-2013-0649,     CVE-2013-1374, CVE-2013-0644)

  - Two unspecified issues exist that could lead to memory     corruption and arbitrary code execution. (CVE-2013-0638,     CVE-2013-0647)

  - An unspecified information disclosure vulnerability     exists. (CVE-2013-0637)

  - An unspecified integer overflow vulnerability exists.
    (CVE-2013-0639)

ID	Name	Product	Family	Severity
74890	openSUSE Security Update : flash-player (openSUSE-SU-2013:0295-2)	Nessus	SuSE Local Security Checks	critical
69889	GLSA-201309-06 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
64637	SuSE 10 Security Update : flash-player (ZYPP Patch Number 8465)	Nessus	SuSE Local Security Checks	critical
64636	SuSE 11.2 Security Update : flash-player (SAT Patch Number 7338)	Nessus	SuSE Local Security Checks	critical
6688	Flash Player <= 10.3.183.51 / 11.5.502.149 Multiple Vulnerabilities (APSB13-05)	Nessus Network Monitor	Web Clients	high
64627	RHEL 5 / 6 : flash-plugin (RHSA-2013:0254)	Nessus	Red Hat Local Security Checks	critical
64587	MS KB2805940: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10	Nessus	Windows	critical
64586	Flash Player for Mac <= 10.3.183.51 / 11.5.502.149 Multiple Vulnerabilities (APSB13-05)	Nessus	MacOS X Local Security Checks	critical
64585	Adobe AIR for Mac 3.x <= 3.5.0.1060 Multiple Vulnerabilities (APSB13-05)	Nessus	MacOS X Local Security Checks	critical
64584	Flash Player <= 10.3.183.51 / 11.5.502.149 Multiple Vulnerabilities (APSB13-05)	Nessus	Windows	critical
64583	Adobe AIR 3.x <= 3.5.0.1060 Buffer Overflow (APSB13-05)	Nessus	Windows	critical

Detections

Analytics

CVE-2013-0645

high

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical