Google Chrome < 43.0.2357.134 Multiple RCE Vulnerabilities

high Nessus Network Monitor Plugin ID 8882

Synopsis

The remote host is utilizing a web browser that is affected by multiple vulnerabilities.

Description

The version of Google Chrome on the remote host is prior to 43.0.2357.134 and is affected by the following vulnerabilities in the Adobe Flash player component :

- A use-after-free error exists in the opaqueBackground class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5122)
- A use-after-free error exists in the BitmapData class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5123)

Solution

Update the Chrome browser to 43.0.2357.134 or later.

Plugin Details

Severity: High

ID: 8882

Family: Web Clients

Published: 9/25/2015

Updated: 3/6/2019

Nessus ID: 84733

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:google:chrome

Patch Publication Date: 7/14/2015

Vulnerability Publication Date: 7/10/2015

Exploitable With

Metasploit (Adobe Flash opaqueBackground Use After Free)

Reference Information

CVE: CVE-2015-5122

BID: 75710

Detections

Analytics