101837

1039778

RHSA-2017:3222

https://helpx.adobe.com/security/products/flash-player/apsb17-33.html

GLSA-201711-13

Versions of Adobe Flash Player prior to 27.0.0.187 are unpatched, and therefore affected by multiple vulnerabilities :

 - An invalid (out-of-range) pointer vulnerability exists offset during access of internal data structure fields. A successful attack can lead to sensitive data exposure. (CVE-2017-3112, CVE-2017-3114, CVE-2017-11213)
 - The mismatch between an old and a new object can provide an attacker with unintended memory access potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution. (CVE-2017-11215, CVE-2017-11225)

This update for Chromium to version 65.0.3325.162 fixes the following issues :

  - CVE-2017-11215: Use after free in Flash

  - CVE-2017-11225: Use after free in Flash

  - CVE-2018-6060: Use after free in Blink

  - CVE-2018-6061: Race condition in V8

  - CVE-2018-6062: Heap buffer overflow in Skia

  - CVE-2018-6057: Incorrect permissions on shared memory

  - CVE-2018-6063: Incorrect permissions on shared memory

  - CVE-2018-6064: Type confusion in V8

  - CVE-2018-6065: Integer overflow in V8

  - CVE-2018-6066: Same Origin Bypass via canvas

  - CVE-2018-6067: Buffer overflow in Skia

  - CVE-2018-6068: Object lifecycle issues in Chrome Custom     Tab

  - CVE-2018-6069: Stack-based buffer overflow in Skia

  - CVE-2018-6070: CSP bypass through extensions

  - CVE-2018-6071: Heap bufffer overflow in Skia

  - CVE-2018-6072: Integer overflow in PDFium

  - CVE-2018-6073: Heap bufffer overflow in WebGL

  - CVE-2018-6074: Mark-of-the-Web bypass

  - CVE-2018-6075: Overly permissive cross origin downloads

  - CVE-2018-6076: Incorrect handling of URL fragment     identifiers in Blink

  - CVE-2018-6077: Timing attack using SVG filters

  - CVE-2018-6078: URL Spoof in OmniBox

  - CVE-2018-6079: Information disclosure via texture data     in WebGL

  - CVE-2018-6080: Information disclosure in IPC call

  - CVE-2018-6081: XSS in interstitials

  - CVE-2018-6082: Circumvention of port blocking

  - CVE-2018-6083: Incorrect processing of AppManifests

Google Chrome Releases reports :

45 security fixes in this release :

- [758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25

- [758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25

- [780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02

- [794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12

- [780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31

- [789959] High CVE-2018-6057: Incorrect permissions on shared memory.
Reported by Gal Beniamini of Google Project Zero on 2017-11-30

- [792900] High CVE-2018-6063: Incorrect permissions on shared memory.
Reported by Gal Beniamini of Google Project Zero on 2017-12-07

- [798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03

- [808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01

- [799477] Medium CVE-2018-6066: Same Origin Bypass via canvas.
Reported by Masato Kinugawa on 2018-01-05

- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30

- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30

- [799918] Medium CVE-2018-6069: Stack buffer overflow in Skia.
Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08

- [668645] Medium CVE-2018-6070: CSP bypass through extensions.
Reported by Rob Wu on 2016-11-25

- [777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia.
Reported by Anonymous on 2017-10-23

- [791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01

- [804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL.
Reported by Omair on 2018-01-20

- [809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06

- [608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03

- [758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24

- [778506] Medium CVE-2018-6077: Timing attack using SVG filters.
Reported by Khalil Zhani on 2017-10-26

- [793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10

- [788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24

- [792028] Medium CVE-2018-6080: Information disclosure in IPC call.
Reported by Gal Beniamini of Google Project Zero on 2017-12-05

- [797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24

- [767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21

- [771709] Low CVE-2018-6083: Incorrect processing of AppManifests.
Reported by Jun Kokatsu (@shhnjk) on 2017-10-04

The version of Google Chrome installed on the remote host is prior to 65.0.3325.146. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for March 6th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 65.0.3325.146. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for March 6th, 2018. Please refer to the release notes for additional information.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201711-13 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the referenced CVE identifiers and Adobe Security Bulletin       for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

Adobe reports :

- These updates resolve out-of-bounds read vulnerabilities that could lead to remote code execution (CVE-2017-3112, CVE-2017-3114, CVE-2017-11213).

- These updates resolve use after free vulnerabilities that could lead to remote code execution (CVE-2017-11215, CVE-2017-11225).

An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update upgrades Flash Player to version 27.0.0.187.

Security Fix(es) :

* This update fixes multiple vulnerabilities in Adobe Flash Player.
These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
(CVE-2017-3112, CVE-2017-3114, CVE-2017-11213, CVE-2017-11215, CVE-2017-11225)

The remote Windows host is missing security update KB4048951. It is, therefore, affected by multiple remote code execution vulnerabilities in Adobe Flash Player.

The version of Adobe Flash Player installed on the remote macOS or Mac OSX host is equal or prior to version 27.0.0.183.
It is therefore affected by multiple remote code execution vulnerabilities.

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 27.0.0.183. It is therefore affected by multiple remote code execution vulnerabilities.

ID	Name	Product	Family	Severity
700427	Flash Player < 27.0.0.187 Multiple Vulnerabilities (APSB17-33)	Nessus Network Monitor	Web Clients	critical
108436	openSUSE Security Update : Chromium (openSUSE-2018-264)	Nessus	SuSE Local Security Checks	critical
107243	FreeBSD : chromium -- vulnerability (555af074-22b9-11e8-9799-54ee754af08e)	Nessus	FreeBSD Local Security Checks	critical
107221	Google Chrome < 65.0.3325.146 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
107220	Google Chrome < 65.0.3325.146 Multiple Vulnerabilities	Nessus	Windows	critical
104694	GLSA-201711-13 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
104647	FreeBSD : Flash Player -- multiple vulnerabilities (52f10525-caff-11e7-b590-6451062f0f7a)	Nessus	FreeBSD Local Security Checks	critical
104622	RHEL 6 : flash-plugin (RHSA-2017:3222)	Nessus	Red Hat Local Security Checks	critical
104547	KB4048951: Security update for Adobe Flash Player (November 2017)	Nessus	Windows : Microsoft Bulletins	critical
104545	Adobe Flash Player for Mac <= 27.0.0.183 (APSB17-33)	Nessus	MacOS X Local Security Checks	critical
104544	Adobe Flash Player <= 27.0.0.183 (APSB17-33)	Nessus	Windows	critical

CVE-2017-11225

HIGH

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Configuration 3

Configuration 4

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical