Lucene search

K
archlinuxArch LinuxASA-201501-22
HistoryJan 23, 2015 - 12:00 a.m.

flashplugin: multiple issues

2015-01-2300:00:00
Arch Linux
lists.archlinux.org
64

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

100.0%

  • CVE-2015-0311 (remote code execution)

Unspecified vulnerability allows remote attackers to execute arbitrary
code via unknown vectors, as exploited in the wild in January 2015.

  • CVE-2015-0309 (remote code execution)

Heap-based buffer overflow allows attackers to execute arbitrary code
via unspecified vectors, a different vulnerability than CVE-2015-0304.

  • CVE-2015-0308 (remote code execution)

Use-after-free vulnerability allows attackers to execute arbitrary code
via unspecified vectors.

  • CVE-2015-0307 (memory leaks, denial of service)

A vulnerability allows remote attackers to obtain sensitive information
from process memory or cause a denial of service (out-of-bounds read)
via unspecified vectors.

  • CVE-2015-0306 (remote code execution, denial of service)

A vulnerability allows attackers to execute arbitrary code or cause a
denial of service (memory corruption) via unspecified vectors, a
different vulnerability than CVE-2015-0303.

  • CVE-2015-0305 (remote code execution)

A vulnerability allows attackers to execute arbitrary code by leveraging
an unspecified "type confusion".

  • CVE-2015-0304 (remote code execution)

Heap-based buffer overflow allows attackers to execute arbitrary code
via unspecified vectors, a different vulnerability than CVE-2015-0309.

  • CVE-2015-0303 (remote code execution, denial of service)

A vulnerability allows attackers to execute arbitrary code or cause a
denial of service (memory corruption) via unspecified vectors, a
different vulnerability than CVE-2015-0306.

  • CVE-2015-0302 (keylogging)

A vulnerability allows attackers to obtain sensitive keystroke
information via unspecified vectors.

  • CVE-2015-0301 (file validation)

The flashplugin does not properly validate files, which has unspecified
impact and attack vectors.

OSVersionArchitecturePackageVersionFilename
anyanyanyflashplugin<ย 11.2.202.440-1UNKNOWN