Detections
Analytics

FreeBSD : Adobe Flash Player -- critical vulnerabilities (3364d497-e4e6-11e4-a265-c485083ca99c)

critical Nessus Plugin ID 82890

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Adobe reports :

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations to the latest versions.

- These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).

- These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-0356).

- These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).

- These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).

- These updates resolve double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).

- These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).

- These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).

Solution

Update the affected packages.

See Also

https://helpx.adobe.com/security/products/flash-player/apsb15-06.html

http://www.nessus.org/u?f830ac3e

Plugin Details

Severity: Critical

ID: 82890

File Name: freebsd_pkg_3364d497e4e611e4a265c485083ca99c.nasl

Version: 1.17

Type: local

Published: 4/20/2015

Updated: 3/8/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:linux-f10-flashplugin, cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:linux-c6-flashplugin

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/17/2015

Vulnerability Publication Date: 4/14/2015

CISA Known Exploited Vulnerability Due Dates: 3/24/2022

Exploitable With

Core Impact

Metasploit (Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow)

Reference Information

CVE: CVE-2015-0346, CVE-2015-0347, CVE-2015-0348, CVE-2015-0349, CVE-2015-0350, CVE-2015-0351, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0356, CVE-2015-0357, CVE-2015-0358, CVE-2015-0359, CVE-2015-0360, CVE-2015-3038, CVE-2015-3039, CVE-2015-3040, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043, CVE-2015-3044