Arch Linux Security Advisory ASA-201509-8
========================================
Severity: Critical
Date    : 2015-09-22
CVE-ID  : CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571
          CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575
          CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579
          CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584
          CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677
          CVE-2015-6678 CVE-2015-6679 CVE-2015-6682
Package : flashplugin
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package flashplugin before version 11.2.202.521-1 is vulnerable to
multiple issues including but not limited to arbitrary code execution,
denial of service and information disclosure.

Resolution
=========
Upgrade to 11.2.202.521-1.

# pacman -Syu "flashplugin>=11.2.202.521-1"

The problem has been fixed upstream in version 11.2.202.521.

Workaround
=========
None.

Description
==========
- CVE-2015-5573 (arbitrary code execution)

These updates resolve a type confusion vulnerability that could lead to
code execution.

- CVE-2015-5570 CVE-2015-5574 CVE-2015-5581 CVE-2015-5584 CVE-2015-6682
  (arbitrary code execution)

These updates resolve use-after-free vulnerabilities that could lead to
code execution.

- CVE-2015-6676 CVE-2015-6678 (arbitrary code execution)

These updates resolve buffer overflow vulnerabilities that could lead
to code execution.

- CVE-2015-5575 CVE-2015-5577 CVE-2015-5578 CVE-2015-5580 CVE-2015-5582
  CVE-2015-5588 CVE-2015-6677 (arbitrary code execution)

These updates resolve memory corruption vulnerabilities that could lead
to code execution.

- CVE-2015-5571 (insufficient validation)

These updates include additional validation checks to ensure that Flash
Player rejects malicious content from vulnerable JSONP callback APIs.

- CVE-2015-5576 (denial of service)

These updates resolve a memory leak vulnerability.

- CVE-2015-5568 (denial of service)

These updates include further hardening to a mitigation to defend
against vector length corruptions.

- CVE-2015-5567 CVE-2015-5579 (arbitrary code execution)

These updates resolve stack corruption vulnerabilities that could lead
to code execution.

- CVE-2015-5587 (arbitrary code execution)

These updates resolve a stack overflow vulnerability that could lead to
code execution.

- CVE-2015-5572 (information disclosure)

These updates resolve a security bypass vulnerability that could lead to
information disclosure.

- CVE-2015-6679 (information disclosure)

These updates resolve a vulnerability that could be exploited to bypass
the same-origin-policy and lead to information disclosure.

Impact
=====
A remote attacker is able to execute arbitrary code, obtain sensitive
information or perform a denial of service attack via various vectors.

References
=========
https://helpx.adobe.com/support/programs/support-options-free-discontinued-apps-services.html
https://access.redhat.com/security/cve/CVE-2015-5567
https://access.redhat.com/security/cve/CVE-2015-5570
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5571
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5572
https://access.redhat.com/security/cve/CVE-2015-5573
https://access.redhat.com/security/cve/CVE-2015-5574
https://access.redhat.com/security/cve/CVE-2015-5575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5576
https://access.redhat.com/security/cve/CVE-2015-5577
https://access.redhat.com/security/cve/CVE-2015-5578
https://access.redhat.com/security/cve/CVE-2015-5579
https://access.redhat.com/security/cve/CVE-2015-5580
https://access.redhat.com/security/cve/CVE-2015-5581
https://access.redhat.com/security/cve/CVE-2015-5582
https://access.redhat.com/security/cve/CVE-2015-5584
https://access.redhat.com/security/cve/CVE-2015-5587
https://access.redhat.com/security/cve/CVE-2015-5588
https://access.redhat.com/security/cve/CVE-2015-6676
https://access.redhat.com/security/cve/CVE-2015-6677
https://access.redhat.com/security/cve/CVE-2015-6678
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6679
https://access.redhat.com/security/cve/CVE-2015-6682

ArchLinux: 201509-8: flashplugin: multiple issues

September 22, 2015

Summary

- CVE-2015-5573 (arbitrary code execution) These updates resolve a type confusion vulnerability that could lead to code execution.
- CVE-2015-5570 CVE-2015-5574 CVE-2015-5581 CVE-2015-5584 CVE-2015-6682 (arbitrary code execution)
These updates resolve use-after-free vulnerabilities that could lead to code execution.
- CVE-2015-6676 CVE-2015-6678 (arbitrary code execution)
These updates resolve buffer overflow vulnerabilities that could lead to code execution.
- CVE-2015-5575 CVE-2015-5577 CVE-2015-5578 CVE-2015-5580 CVE-2015-5582 CVE-2015-5588 CVE-2015-6677 (arbitrary code execution)
These updates resolve memory corruption vulnerabilities that could lead to code execution.
- CVE-2015-5571 (insufficient validation)
These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs.
- CVE-2015-5576 (denial of service)
These updates resolve a memory leak vulnerability.
- CVE-2015-5568 (denial of service)
These updates include further hardening to a mitigation to defend against vector length corruptions.
- CVE-2015-5567 CVE-2015-5579 (arbitrary code execution)
These updates resolve stack corruption vulnerabilities that could lead to code execution.
- CVE-2015-5587 (arbitrary code execution)
These updates resolve a stack overflow vulnerability that could lead to code execution.
- CVE-2015-5572 (information disclosure)
These updates resolve a security bypass vulnerability that could lead to information disclosure.
- CVE-2015-6679 (information disclosure)
These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure.

Resolution

Upgrade to 11.2.202.521-1. # pacman -Syu "flashplugin>=11.2.202.521-1"
The problem has been fixed upstream in version 11.2.202.521.

References

https://helpx.adobe.com/support/programs/support-options-free-discontinued-apps-services.html https://access.redhat.com/security/cve/CVE-2015-5567 https://access.redhat.com/security/cve/CVE-2015-5570 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5571 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5572 https://access.redhat.com/security/cve/CVE-2015-5573 https://access.redhat.com/security/cve/CVE-2015-5574 https://access.redhat.com/security/cve/CVE-2015-5575 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5576 https://access.redhat.com/security/cve/CVE-2015-5577 https://access.redhat.com/security/cve/CVE-2015-5578 https://access.redhat.com/security/cve/CVE-2015-5579 https://access.redhat.com/security/cve/CVE-2015-5580 https://access.redhat.com/security/cve/CVE-2015-5581 https://access.redhat.com/security/cve/CVE-2015-5582 https://access.redhat.com/security/cve/CVE-2015-5584 https://access.redhat.com/security/cve/CVE-2015-5587 https://access.redhat.com/security/cve/CVE-2015-5588 https://access.redhat.com/security/cve/CVE-2015-6676 https://access.redhat.com/security/cve/CVE-2015-6677 https://access.redhat.com/security/cve/CVE-2015-6678 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6679 https://access.redhat.com/security/cve/CVE-2015-6682

Severity
CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575
CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579
CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584
CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677
CVE-2015-6678 CVE-2015-6679 CVE-2015-6682
Package : flashplugin
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/title/CVE

Workaround

None.

Related News

2.Motherboard Esm H320
2 - 3 min read
German software engineer Lennart Poettering recently presented run0 , a new tool in systemd v256 that aims to address the security concerns
22.Lock ScreenEffect Esm H320
2 - 3 min read
Red Hat recently released its newest enterprise Linux distro, Red Hat Enterprise Linux (RHEL) 9.4 , which introduces several features designed to
8.Locks HexConnections CodeGlobe Esm H320
1 - 2 min read
The latest release of Debian , one of the oldest and most trusted distributions within the Linux ecosystem, redefines security, stability, and
20.Lock AbstractDigital Circular Esm H320
1 - 2 min read
The Ubuntu security team has recently discovered and addressed multiple vulnerabilities in the Apache HTTP Server. The vulnerabilities affected
1.Penguin Landscape Esm H320
1 - 2 min read
A critical vulnerability was discovered in the Linux kernel's netfilter subsystem, specifically within the nf_tables component, posing potential
19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved