The remote Solaris system is missing necessary patches to address security updates :

  - Adobe Flash Player before 11.2.202.229 in Google Chrome     before 18.0.1025.151 allow attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via unknown vectors, a     different vulnerability than CVE-2012-0725.
    (CVE-2012-0724)

  - Adobe Flash Player before 11.2.202.229 in Google Chrome     before 18.0.1025.151 allow attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via unknown vectors, a     different vulnerability than CVE-2012-0724.
    (CVE-2012-0725)

  - The Matrix3D component in Adobe Flash Player before     10.3.183.16 and 11.x before 11.1.102.63 on Windows, Mac     OS X, Linux, and Solaris; before 11.1.111.7 on Android     2.x and 3.x; and before 11.1.115.7 on Android 4.x allows     attackers to execute arbitrary code or cause a denial of     service (memory corruption) via unspecified vectors.
    (CVE-2012-0768)

  - Adobe Flash Player before 10.3.183.16 and 11.x before     11.1.102.63 on Windows, Mac OS X, Linux, and Solaris;
    before 11.1.111.7 on Android 2.x and 3.x; and before     11.1.115.7 on Android 4.x does not properly handle     integers, which allows attackers to obtain sensitive     information via unspecified vectors. (CVE-2012-0769)

  - An unspecified ActiveX control in Adobe Flash Player     before 10.3.183.18 and 11.x before 11.2.202.228, and AIR     before 3.2.0.2070, on Windows does not properly perform     URL security domain checking, which allow attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via unknown vectors. (CVE-2012-0772)

  - The NetStream class in Adobe Flash Player before     10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac     OS X, and Linux; Flash Player before 10.3.183.18 and     11.x before 11.2.202.223 on Solaris; Flash Player before     11.1.111.8 on Android 2.x and 3.x; and AIR before     3.2.0.2070 allows attackers to execute arbitrary code or     cause a denial of service (memory corruption) via     unspecified vectors. (CVE-2012-0773)

Adobe reports :

Multiple Priority 2 vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

According to its version, the instance of Flash Player installed on the remote Windows host is 10.x equal to or earlier than 10.3.183.16 or 11.x equal to or earlier than 11.1.102.63.  It is, therefore, reportedly affected by several critical memory corruption vulnerabilities :

  - Memory corruption vulnerabilities related to URL     security domain checking. (CVE-2012-0772)

  - A flaw in the NetStream Class that could lead to remote     code execution. (CVE-2012-0773)

  - Two Flash Player memory corruption vulnerabilities     related to the Google Chrome interface.     (CVE-2012-0724, CVE-2012-0725)  

By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize these vulnerabilities to execute arbitrary code subject to the users' privileges.

According to its version, the instance of Adobe AIR 3.x on the remote Mac OS X host is 3.1.0.4880 or earlier and is reportedly affected by several critical memory corruption vulnerabilities :

  - Memory corruption vulnerabilities related to URL     security domain checking. (CVE-2012-0772)

  - A flaw in the NetStream Class that could lead to remote     code execution. (CVE-2012-0773)

By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize these vulnerabilities to execute arbitrary code subject to the users' privileges.

According to its version, the instance of Flash Player installed on the remote Mac OS X host is 10.x equal to or earlier than 10.3.183.16 or 11.x equal to or earlier than 11.1.102.63.  It is, therefore, reportedly affected by several critical memory corruption vulnerabilities :

  - Memory corruption vulnerabilities related to URL     security domain checking. (CVE-2012-0772)

  - A flaw in the NetStream Class that could lead to remote     code execution. (CVE-2012-0773)

By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize these vulnerabilities to execute arbitrary code subject to the users' privileges.

The version of Google Chrome installed on the remote host is earlier than 18.0.1025.142 and is, therefore, affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can     allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction     and 'EUC-JP'. This can lead to cross-site scripting     attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text     handling and text fragment handling. (CVE-2011-3059,     CVE-2011-3060)

  - A certificate checking error exists related to the     SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'.
    (CVE-2011-3062)

  - Navigation requests from the renderer are not validated     carefully enough.(CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping.
    (CVE-2011-3064)

  - An unspecified memory corruption error exists related     to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains     errors related to ActiveX and the NetStream class.
    These errors can allow memory corruption, denial of     service via application crashes and possibly code     execution. (CVE-2012-0772, CVE-2012-0773)

According to its version, the instance of Adobe AIR 3.x on the remote Windows host is 3.1.0.4880 or earlier and is reportedly affected by several critical memory corruption vulnerabilities :
 
  - Memory corruption vulnerabilities related to URL     security domain checking. (CVE-2012-0772)

  - A flaw in the NetStream Class that could lead to remote     code execution. (CVE-2012-0773)

By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize these vulnerabilities to execute arbitrary code subject to the users' privileges.

The version of Adobe Reader installed on the remote Mac OS X host is prior to 10.1.3 or 9.5.1. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition exists that allows an     attacker to execute arbitrary code via a crafted True     Type Font (TFF). (CVE-2012-0774)

  - A memory corruption issue exists in JavaScript handling     that allows an attacker to execute arbitrary code.
    (CVE-2012-0775)

  - A security bypass vulnerability exists in the Adobe     Reader installer that allows an attacker to execute     arbitrary code. (CVE-2012-0776)

  - A memory corruption issue exists in the JavaScript API     that allows an attacker to execute arbitrary code or     cause a denial of service. (CVE-2012-0777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has Adobe Flash Player installed. 

Versions of Flash Player 10.x equal to or earlier than 10.3.183.16 or 11.x equal to or ealier than 11.1.102.63 are potentially affected by several critical memory corruption vulnerabilities : 

  - Memory corruption vulnerabilities related to URL security domain checking. (CVE-2012-0772)

  - A flaw in the NetStream Class that could lead to remote code execution. (CVE-2012-0773)

  - Two Flash Player memory corruption vulnerabilities related to the Google Chrome interface. (CVE-2012-0724, CVE-2012-0725)

By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize these vulnerabilities to execute arbitrary code subject to the users' privileges

Versions of Google Chrome earlier than 18.0.1025.142 are potentially affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction and 'EUC-JP'.  This can lead to cross-site scripting attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text handling and text fragment handling. (CVE-2011-3059, CVE-2011-3060)

  - A certificate checking error exists related to the SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'. (CVE-2011-3062)

  - Navigation requests from the renderer are not validated carefully enough. (CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping. (CVE-2011-3064)

  - An unspecified memory corruption error exists related to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains errors related to ActiveX and the NetStream class.  These errors can allow memory corruption, denial of service via application crashes and possibly code execution. (CVE-2012-0772, CVE-2012-0773)

ID	Name	Product	Family	Published	Updated	Severity
80612	Oracle Solaris Third-Party Patch Update : flash (multiple_vulnerabilities_in_adobe_flashplayer6)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	critical
58646	FreeBSD : linux-flashplugin -- multiple vulnerabilities (20923a0d-82ba-11e1-8d7b-003067b2972c)	Nessus	FreeBSD Local Security Checks	4/10/2012	1/6/2021	critical
58538	Flash Player <= 10.3.183.16 / 11.1.102.63 Multiple Memory Corruption Vulnerabilities (APSB12-07)	Nessus	Windows	3/30/2012	4/11/2022	critical
58539	Adobe AIR for Mac 3.x <= 3.1.0.4880 Multiple Memory Corruption Vulnerabilities (APSB12-07)	Nessus	MacOS X Local Security Checks	3/30/2012	7/16/2018	high
58540	Flash Player for Mac <= 10.3.183.16 / 11.1.102.63 Multiple Memory Corruption Vulnerabilities (APSB12-07)	Nessus	MacOS X Local Security Checks	3/30/2012	11/18/2021	critical
58536	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Nessus	Windows	3/30/2012	4/11/2022	high
58537	Adobe AIR 3.x <= 3.1.0.4880 Multiple Memory Corruption Vulnerabilities (APSB12-07)	Nessus	Windows	3/30/2012	4/11/2022	high
58684	Adobe Reader < 10.1.3 / 9.5.1 Multiple Vulnerabilities (APSB12-03, APSB12-05, APSB12-07, APSB12-08) (Mac OS X)	Nessus	MacOS X Local Security Checks	4/11/2012	6/8/2022	critical
6802	Flash Player <= 10.3.183.16 / 11.1.102.63 Multiple Memory Corruption Vulnerabilities (APSB12-07)	Nessus Network Monitor	Web Clients	5/8/2013	3/6/2019	high
800957	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	3/30/2012		high

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

high

high

critical

high

high