Lucene search

K
archlinuxArch LinuxASA-201609-11
HistorySep 15, 2016 - 12:00 a.m.

flashplugin: multiple issues

2016-09-1500:00:00
Arch Linux
lists.archlinux.org
12

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.806 High

EPSS

Percentile

98.0%

  • CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280,
    CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284,
    CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 (arbitrary code execution)

Multiple Memory corruption vulnerabilities that could lead to arbitrary
code execution have been found. These vulnerabilities were discovered by
Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero, willJ of
Tencent PC Manager, Yuki Chen of Qihoo 360 Vulcan Team,
<a href=“https://lists.archlinux.org/listinfo/arch-security”>b0nd at garage4hackers</a> working with Trend Micro’s Zero Day Initiative, and
Tao Yan (@Ga1ois) of Palo Alto Networks

  • CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923,
    CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929,
    CVE-2016-6930, CVE-2016-6931, CVE-2016-6932 (arbitrary code execution)

Multiple use-after-free vulnerabilities that could lead to arbitrary
code execution have been found. These vulnerabilities have been
discovered by, Mumei working with Trend Micro’s Zero Day Initiative,
Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium
Vulnerability Rewards Program, willJ of Tencent PC Manager, JieZeng of
Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards
Program, Nicolas Joly of Microsoft Vulnerability Research, and Yuki Chen
of Qihoo 360 Vulcan Team

  • CVE-2016-4287 (arbitrary code execution)

An integer overflow vulnerability that could lead to arbitrary code
execution has been found. This vulnerability has been discovered by Yuki
Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability
Rewards Program.

  • CVE-2016-4271, CVE-2016-4277, CVE-2016-4278 (information disclosure)

A Security bypass vulnerablity that could lead to information disclosure
has been found. These vulnerabilities have been found by Leone
Pontorieri, Soroush Dalili and Matthew Evans from NCC Group, and Nicolas
Joly of Microsoft Vulnerability Research

OSVersionArchitecturePackageVersionFilename
anyanyanyflashplugin< 11.2.202.635-1UNKNOWN

References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.806 High

EPSS

Percentile

98.0%