RHEL 6 : flash-plugin (RHSA-2016:2947)

critical Nessus Plugin ID 95820
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 8.9

Synopsis

The remote Red Hat host is missing a security update.

Description

An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update upgrades Flash Player to version 24.0.0.186.

Security Fix(es) :

* This update fixes multiple vulnerabilities in Adobe Flash Player.
These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
(CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892)

Solution

Update the affected flash-plugin package.

See Also

https://helpx.adobe.com/security/products/flash-player/apsb16-39.html

https://access.redhat.com/errata/RHSA-2016:2947

https://access.redhat.com/security/cve/cve-2016-7867

https://access.redhat.com/security/cve/cve-2016-7868

https://access.redhat.com/security/cve/cve-2016-7869

https://access.redhat.com/security/cve/cve-2016-7870

https://access.redhat.com/security/cve/cve-2016-7871

https://access.redhat.com/security/cve/cve-2016-7872

https://access.redhat.com/security/cve/cve-2016-7873

https://access.redhat.com/security/cve/cve-2016-7874

https://access.redhat.com/security/cve/cve-2016-7875

https://access.redhat.com/security/cve/cve-2016-7876

https://access.redhat.com/security/cve/cve-2016-7877

https://access.redhat.com/security/cve/cve-2016-7878

https://access.redhat.com/security/cve/cve-2016-7879

https://access.redhat.com/security/cve/cve-2016-7880

https://access.redhat.com/security/cve/cve-2016-7881

https://access.redhat.com/security/cve/cve-2016-7890

https://access.redhat.com/security/cve/cve-2016-7892

Plugin Details

Severity: Critical

ID: 95820

File Name: redhat-RHSA-2016-2947.nasl

Version: 2.14

Type: local

Agent: unix

Published: 12/14/2016

Updated: 10/24/2019

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: Critical

VPR Score: 8.9

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:o:redhat:enterprise_linux:6:*:*:*:*:*:*:*, p-cpe:2.3:a:redhat:enterprise_linux:flash-plugin:*:*:*:*:*:*:*

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/14/2016

Vulnerability Publication Date: 12/15/2016

Reference Information

CVE: CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892

RHSA: 2016:2947