flash-player was updated to fix 35 security issues.

These security issues were fixed :

  - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer     overflow vulnerabilities that could lead to code     execution (bsc#937339).

  - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130,     CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory     corruption vulnerabilities that could lead to code     execution (bsc#937339).

  - CVE-2015-3126, CVE-2015-4429: NULL pointer dereference     issues (bsc#937339).

  - CVE-2015-3114: A security bypass vulnerability that     could lead to information disclosure (bsc#937339).

  - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121,     CVE-2015-3122, CVE-2015-4433: Type confusion     vulnerabilities that could lead to code execution     (bsc#937339).

  - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117,     CVE-2015-3127, CVE-2015-3128, CVE-2015-3129,     CVE-2015-3131, CVE-2015-3132, CVE-2015-3136,     CVE-2015-3137, CVE-2015-4428, CVE-2015-4430,     CVE-2015-5119: Use-after-free vulnerabilities that could     lead to code execution (bsc#937339).

  - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116,     CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could     be exploited to bypass the same-origin-policy and lead     to information disclosure (bsc#937339).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote Windows host is prior to 43.0.2357.132. It is, therefore, affected by multiple vulnerabilities in the bundled version of Adobe Flash :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201507-13 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

According to its version, the installation of Adobe AIR on the remote Mac OS X host is equal or prior to 18.0.0.144. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

ID	Name	Product	Family	Published	Updated	Severity
84662	SUSE SLED12 Security Update : flash-player (SUSE-SU-2015:1211-1) (Underminer)	Nessus	SuSE Local Security Checks	7/13/2015	3/8/2022	critical
84667	Google Chrome < 43.0.2357.132 Multiple Vulnerabilities	Nessus	Windows	7/10/2015	5/19/2026	critical
86083	GLSA-201507-13 : Adobe Flash Player: Multiple vulnerabilities (Underminer)	Nessus	Gentoo Local Security Checks	9/23/2015	4/22/2022	critical
84643	Adobe AIR for Mac <= 18.0.0.144 Multiple Vulnerabilities (APSB15-16)	Nessus	MacOS X Local Security Checks	7/9/2015	3/8/2022	critical
84663	SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1214-1) (Underminer)	Nessus	SuSE Local Security Checks	7/13/2015	3/8/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical