FreeBSD : Adobe Flash Player -- critical vulnerabilities (3364d497-e4e6-11e4-a265-c485083ca99c)

Critical Nessus Plugin ID 82890


The remote FreeBSD host is missing one or more security-related updates.


Adobe reports :

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations to the latest versions.

- These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).

- These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-0356).

- These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).

- These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).

- These updates resolve double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).

- These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).

- These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).


Update the affected packages.

See Also

Plugin Details

Severity: Critical

ID: 82890

File Name: freebsd_pkg_3364d497e4e611e4a265c485083ca99c.nasl

Version: $Revision: 1.12 $

Type: local

Published: 2015/04/20

Modified: 2015/07/15

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:linux-c6-flashplugin, p-cpe:/a:freebsd:freebsd:linux-f10-flashplugin, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2015/04/17

Vulnerability Publication Date: 2015/04/14

Exploitable With

Core Impact

Metasploit (Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow)

Reference Information

CVE: CVE-2015-0346, CVE-2015-0347, CVE-2015-0348, CVE-2015-0349, CVE-2015-0350, CVE-2015-0351, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0356, CVE-2015-0357, CVE-2015-0358, CVE-2015-0359, CVE-2015-0360, CVE-2015-3038, CVE-2015-3039, CVE-2015-3040, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043, CVE-2015-3044