ArchLinux: 201510-12: flashplugin: arbitrary code execution
Summary
Several critical type confusion vulnerabilities (CVE-2015-7645,
CVE-2015-7647, CVE-2015-7648) have been identified in Adobe Flash Player
11.2.202.535 and earlier 11.x versions for Linux. Successful
exploitation could cause a crash and potentially allow an attacker to
take control of the affected system.
Adobe is aware of a report that an exploit for the CVE-2015-7645
vulnerability is being used in limited, targeted attacks.
Resolution
Upgrade to 11.2.202.540-1.
# pacman -Syu "flashplugin>=11.2.202.540-1"
The problem has been fixed upstream in version 11.2.202.540.
References
https://helpx.adobe.com/support/programs/support-options-free-discontinued-apps-services.html https://helpx.adobe.com/support/programs/support-options-free-discontinued-apps-services.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7645
Workaround
None.