遠端 Mac OS X 主機上安裝的 Google Chrome 版本比 43.0.2357.124 舊。因此會受到和 Adobe Flash 有關的多個弱點影響：

- 存在一個不明弱點，此弱點可允許攻擊者繞過 CVE-2014-5333 的修正。
 (CVE-2015-3096)

- 存在多個不明瑕疵，可允許遠端攻擊者繞過同源原則，導致敏感資訊洩漏。(CVE-2015-3098、CVE-2015-3099、CVE-2015-3102)

- 存在一個遠端程式碼執行弱點，這是因為不明的堆疊溢位瑕疵所導致。(CVE-2015-3100)

- 存在多個釋放後使用錯誤，會允許攻擊者執行任意程式碼。(CVE-2015-3103、CVE-2015-3106、CVE-2015-3107)

- 存在一個整數溢位情形，這是因為不當驗證使用者提供的輸入所導致。遠端攻擊者可惡意利用這點，執行任意程式碼。(CVE-2015-3104)

- 存在一個記憶體損毀瑕疵，是因為不當驗證使用者提供的輸入所導致。遠端攻擊者可惡意利用此瑕疵，透過特製的Flash 內容來損毀記憶體及執行任意程式碼。
 (CVE-2015-3105)

- 存在一個不明的記憶體洩漏問題，其可允許攻擊者繞過位址空間配置隨機化 (ASLR) 功能。(CVE-2015-3108)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

Adobe Flash Player 已更新至 11.2.202.466，以修正多個安全性問題。

下列弱點已修正：

CVE-2015-3096：繞過 CVE-2014-5333

CVE-2015-3098：可遭到惡意利用而繞過同源原則及導致資訊洩漏的弱點

CVE-2015-3099：可遭到惡意利用而繞過同源原則及導致資訊洩漏的弱點

CVE-2015-3100：可導致程式碼執行的堆疊溢位弱點

CVE-2015-3102：可遭到惡意利用而繞過同源原則及導致資訊洩漏的弱點

CVE-2015-3103：可導致程式碼執行的釋放後使用弱點

CVE-2015-3104：可導致程式碼執行的整數溢位弱點

CVE-2015-3105：可導致程式碼執行的記憶體損毀弱點

CVE-2015-3106：可導致程式碼執行的釋放後使用弱點

CVE-2015-3107：可導致程式碼執行的釋放後使用弱點

CVE-2015-3108：可能遭到利用來繞過 ASLR 的記憶體洩漏弱點

如需更多資訊，請參閱：<a href='https://helpx.adobe.com/security/products/flash-player/apsb15-11 .html'>https://helpx.adobe.com/security/products/flash-player/apsb15-1 1.html</a>

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The version of Google Chrome on the remote host is prior to 43.0.2357.124 and is affected by the following vulnerabilities in the Adobe Flash player component :

  - An unspecified vulnerability exists that allows an attacker to bypass the fix for CVE-2014-5333. (CVE-2015-3096)

  - An unspecified memory address randomization flaw exists on Windows 7 64-bit. (CVE-2015-3097)

  - Multiple unspecified flaws exist that allow a remote attacker to bypass the same-origin-policy, resulting in the disclosure of sensitive information. (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102)

  - A remote code execution vulnerability exists due to an unspecified stack overflow flaw. (CVE-2015-3100)

  - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107)

  - An integer overflow condition exists due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-3104)

  - A memory corruption flaw exists due to improper validation of user-supplied input. A remote attacker can exploit this flaw, via specially crafted flash content, to corrupt memory and execute arbitrary code. (CVE-2015-3105)

  - An unspecified memory leak exists that allows an attacker to bypass the Address Space Layout Randomization (ASLR) feature. (CVE-2015-3108)

Versions of Adobe Flash Player equal or prior to 17.0.0.188 are outdated and thus unpatched for the following vulnerabilities :

  - Multiple double-free errors exist that allow an attacker to execute arbitrary code (CVE-2015-0346, CVE-2015-0359).
  - Multiple memory corruption flaws exist due to improper validation of user-supplied input. A remote attacker can exploit these flaws, via specially crafted flash content, to corrupt memory and execute arbitrary code (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043, CVE-2015-3078, CVE-2015-3089, CVE-2015-3090, CVE-2015-3093, CVE-2015-3105).
  - An unspecified buffer overflow condition exists due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code (CVE-2015-0348).
  - Multiple unspecified use-after-free errors exist that allow an attacker to execute arbitrary code (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039, CVE-2015-3080, CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
  - Multiple unspecified memory leaks exist that allow an attacker to bypass the Address Space Layout Randomization (ASLR) feature (CVE-2015-0357, CVE-2015-3040, CVE-2015-3091, CVE-2015-3092, CVE-2015-3108).
  - Multiple unspecified type confusion flaws exist that allow an attacker to execute arbitrary code (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086, CVE-2015-0356).
  - Multiple unspecified security bypass flaws exist that allow a context-dependent attacker to disclose sensitive information (CVE-2015-3079, CVE-2015-3044).
  - An unspecified time-of-check time-of-use (TOCTOU) race condition exists that allows an attacker to bypass Protected Mode for Internet Explorer (CVE-2015-3081).
  - Multiple validation bypass vulnerabilities exists that allow an attacker to read or write arbitrary data to the file system (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
  - Multiple integer overflow conditions exist due to improper validation of user-supplied input. This allows a context-dependent attacker to execute arbitrary code (CVE-2015-3087, CVE-2015-3104).
  - A heap-based buffer overflow condition exists due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code (CVE-2015-3088).
  - An unspecified vulnerability exists that allows an attacker to bypass the fix for CVE-2014-5333 (CVE-2015-3096).
  - An unspecified memory address randomization flaw exists on Windows 7 64-bit (CVE-2015-3097).
  - Multiple unspecified flaws exist that allow a remote attacker to bypass the same-origin-policy, resulting in the disclosure of sensitive information (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
  - A remote code execution vulnerability exists due to an unspecified stack overflow flaw (CVE-2015-3100).

Versions of Adobe AIR earlier than 14.0.0.178 are unpatched for vulnerabilities related to the flash-plugin's processing of certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or potentially execute arbitrary code when the SWF content is loaded. (CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545)

Additionally, insufficient input sanitation of data from the JSONP callback API could allow a context-dependent attacker to perform a cross-site request forgery (CSRF) attack, essentially forcing the victim to perform various actions supported by the affected website. (CVE-2014-5333, CVE-2015-3096)

Versions of Adobe Flash player prior to 13.0.0.292 / 18.0.0.160 are outdated and thus unpatched for the following vulnerabilities :

  - An unspecified vulnerability exists that allows an attacker to bypass the fix for CVE-2014-5333. (CVE-2015-3096)
  - An unspecified memory address randomization flaw exists on Windows 7 64-bit. (CVE-2015-3097)
  - Multiple unspecified flaws exist that allow a remote attacker to bypass the same-origin-policy, resulting in the disclosure of sensitive information. (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102)
  - A remote code execution vulnerability exists due to an unspecified stack overflow flaw. (CVE-2015-3100)
  - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107)
  - An integer overflow condition exists due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-3104)
  - A memory corruption flaw exists due to improper validation of user-supplied input. A remote attacker can exploit this flaw, via specially crafted flash content, to corrupt memory and execute arbitrary code. (CVE-2015-3105)
  - An unspecified memory leak exists that allows an attacker to bypass the Address Space Layout Randomization (ASLR) feature. (CVE-2015-3108)

Versions of Adobe AIR prior to 18.0.0.144 are outdated and thus unpatched for the following vulnerabilities :

 - An unspecified vulnerability exists that allows an attacker to bypass the fix for CVE-2014-5333. (CVE-2015-3096)
 - An unspecified memory address randomization flaw exists on Windows 7 64-bit. (CVE-2015-3097)
 - Multiple unspecified flaws exist that allow a remote attacker to bypass the same-origin-policy, resulting in the disclosure of sensitive information. (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102)
 - A remote code execution vulnerability exists due to an unspecified stack overflow flaw. (CVE-2015-3100)
 - A permission flaw exists in the Flash broker for IE that allows an attacker to perform a privilege escalation. (CVE-2015-3101)
 - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107)
 - An integer overflow condition exists due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-3104)
 - A memory corruption flaw exists due to improper validation of user-supplied input. A remote attacker can exploit this flaw, via specially crafted flash content, to corrupt memory and execute arbitrary code. (CVE-2015-3105)
 - An unspecified memory leak exists that allows an attacker to bypass the Address Space Layout Randomization (ASLR) feature. (CVE-2015-3108)

ID	Name	Product	Family	Published	Updated	Severity
84051	Google Chrome < 43.0.2357.124 多個弱點 (Mac OS X)	Nessus	MacOS X Local Security Checks	6/9/2015	11/22/2019	critical
84207	SUSE SLED11 安全性更新：flash-player (SUSE-SU-2015:1064-1)	Nessus	SuSE Local Security Checks	6/16/2015	1/6/2021	critical
8783	Google Chrome < 43.0.2357.124 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/16/2015	3/6/2019	high
8814	Flash Player < 17.0.0.189 (inferred) Multiple Vulnerabilities (APSB15-06 through 11)	Nessus Network Monitor	Web Clients	7/24/2015	3/6/2019	high
8358	Adobe AIR < 14.0.0.178 Multiple Vulnerabilities (APSB14-18)	Nessus Network Monitor	Web Clients	8/20/2014	3/6/2019	critical
8813	Flash Player < 13.0.0.292 / 18.0.0.160 Multiple Vulnerabilities (APSB15-11)	Nessus Network Monitor	Web Clients	7/24/2015	3/6/2019	high
8835	Adobe AIR < 18.0.0.144 Multiple Vulnerabilities (APSB15-11)	Nessus Network Monitor	Web Clients	7/24/2015	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

high

high

critical

high

high