Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
archlinuxArchLinuxASA-201612-16
HistoryDec 15, 2016 - 12:00 a.m.

[ASA-201612-16] flashplugin: multiple issues

2016-12-1500:00:00
security.archlinux.org
497

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.036 Low

EPSS

Percentile

91.8%

JSON

Arch Linux Security Advisory ASA-201612-16

Severity: Critical
Date : 2016-12-15
CVE-ID : CVE-2016-7867 CVE-2016-7868 CVE-2016-7869 CVE-2016-7870
CVE-2016-7871 CVE-2016-7872 CVE-2016-7873 CVE-2016-7874
CVE-2016-7875 CVE-2016-7876 CVE-2016-7877 CVE-2016-7878
CVE-2016-7879 CVE-2016-7880 CVE-2016-7881 CVE-2016-7890
CVE-2016-7892
Package : flashplugin
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE

Summary

The package flashplugin before version 24.0.0.186-1 is vulnerable to
multiple issues including arbitrary code execution and access
restriction bypass.

Resolution

Upgrade to 24.0.0.186-1.

pacman -Syu “flashplugin>=24.0.0.186-1”

The problems have been fixed upstream in version 24.0.0.186.

Workaround

None.

Description

  • CVE-2016-7867 (arbitrary code execution)

A buffer overflow vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7868 (arbitrary code execution)

A buffer overflow vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7869 (arbitrary code execution)

A buffer overflow vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7870 (arbitrary code execution)

A buffer overflow vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7871 (arbitrary code execution)

A memory corruption vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7872 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7873 (arbitrary code execution)

A memory corruption vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7874 (arbitrary code execution)

A memory corruption vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7875 (arbitrary code execution)

A memory corruption vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7876 (arbitrary code execution)

A memory corruption vulnerability leading to code execution has been
found in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7877 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7878 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7879 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7880 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7881 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

  • CVE-2016-7890 (access restriction bypass)

A security bypass vulnerability has been found in Adobe Flash Player <
24.0.0.186.

  • CVE-2016-7892 (arbitrary code execution)

A use-after-free vulnerability leading to code execution has been found
in Adobe Flash Player < 24.0.0.186.

Impact

A remote attacker is able to bypass certain security restrictions and
execute arbitrary code on the affected host.

References

https://helpx.adobe.com/security/products/flash-player/apsb16-39.html
https://access.redhat.com/security/cve/CVE-2016-7867
https://access.redhat.com/security/cve/CVE-2016-7868
https://access.redhat.com/security/cve/CVE-2016-7869
https://access.redhat.com/security/cve/CVE-2016-7870
https://access.redhat.com/security/cve/CVE-2016-7871
https://access.redhat.com/security/cve/CVE-2016-7872
https://access.redhat.com/security/cve/CVE-2016-7873
https://access.redhat.com/security/cve/CVE-2016-7874
https://access.redhat.com/security/cve/CVE-2016-7875
https://access.redhat.com/security/cve/CVE-2016-7876
https://access.redhat.com/security/cve/CVE-2016-7877
https://access.redhat.com/security/cve/CVE-2016-7878
https://access.redhat.com/security/cve/CVE-2016-7879
https://access.redhat.com/security/cve/CVE-2016-7880
https://access.redhat.com/security/cve/CVE-2016-7881
https://access.redhat.com/security/cve/CVE-2016-7890
https://access.redhat.com/security/cve/CVE-2016-7892

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanyflashplugin< 24.0.0.186-1UNKNOWN

References

Related

kaspersky 1
nessus 10
suse 1
openvas 8
mscve 1
altlinux 2
archlinux 1
gentoo 1
redhat 1
mageia 1
threatpost 2
cve 17
ubuntucve 17
checkpoint_advisories 13
nvd 17
zdi 10
redhatcve 17
cvelist 17
prion 17
attackerkb 1
cisa_kev 1
kaspersky
kaspersky
KLA10911 Multiple vulnerabilities in Adobe Flash Player
2016-12-14 00:00:00
nessus
nessus
Flash Player < 24.0.0.186 Multiple Vulnerabilities (APSB16-39)
2016-12-16 00:00:00
MS16-154: Security Update for Adobe Flash Player (3209498)
2016-12-13 00:00:00
Adobe Flash Player <= 23.0.0.207 Multiple Vulnerabilities (APSB16-39)
2016-12-13 00:00:00
suse
suse
Security update for flash-player (critical)
2016-12-14 15:07:41
openvas
openvas
Adobe Flash Player Security Update (APSB16-39) - Mac OS X
2016-12-14 00:00:00
Adobe Flash Player Security Update (APSB16-39) - Linux
2016-12-14 00:00:00
Microsoft IE And Microsoft Edge Multiple Flash Player Vulnerabilities (3209498)
2017-03-17 00:00:00
mscve
mscve
December 2016 Adobe Flash Security Update
2016-12-13 08:00:00
altlinux
altlinux
Security fix for the ALT Linux 7 package adobe-flash-player version 3:24-alt0.M70P.1
2016-12-16 00:00:00
Security fix for the ALT Linux 6 package adobe-flash-player version 3:24-alt0.M70P.1
2016-12-16 00:00:00
archlinux
archlinux
[ASA-201612-17] lib32-flashplugin: multiple issues
2016-12-15 00:00:00
gentoo
gentoo
Adobe Flash Player: Multiple vulnerabilities
2017-01-10 00:00:00
redhat
redhat
(RHSA-2016:2947) Critical: flash-plugin security update
2016-12-14 12:51:12
mageia
mageia
Updated flash-player-plugin packages fix security vulnerabilities
2017-01-13 13:32:16
threatpost
threatpost
Flash Player Bug An Eavesdropper's Delight
2016-12-14 12:21:25
Adobe Patches 31 Vulnerabilities, Flash Zero-Day Under Attack
2016-12-13 13:00:42
cve
cve
CVE-2016-7892
2016-12-15 06:59:56
CVE-2016-7879
2016-12-15 06:59:43
CVE-2016-7880
2016-12-15 06:59:44
ubuntucve
ubuntucve
CVE-2016-7892
2016-12-15 00:00:00
CVE-2016-7881
2016-12-15 00:00:00
CVE-2016-7874
2016-12-15 00:00:00
checkpoint_advisories
checkpoint_advisories
Adobe Flash Player Use After Free Code Execution (APSB16-39: CVE-2016-7879)
2016-12-13 00:00:00
Adobe Flash Player Memory Corruption (APSB16-39: CVE-2016-7874)
2016-12-14 00:00:00
Adobe Flash Player Use After Free Code Execution (APSB16-39: CVE-2016-7892)
2016-12-13 00:00:00
nvd
nvd
CVE-2016-7879
2016-12-15 06:59:43
CVE-2016-7881
2016-12-15 06:59:45
CVE-2016-7874
2016-12-15 06:59:38
zdi
zdi
Adobe Flash NetConnection Use-After-Free Remote Code Execution Vulnerability
2016-12-13 00:00:00
Adobe Flash Player PSDKEventDispatcher Use-After-Free Remote Code Execution Vulnerability
2017-02-13 00:00:00
Adobe Flash PSDK Use-After-Free Remote Code Execution Vulnerability
2016-12-13 00:00:00
redhatcve
redhatcve
CVE-2016-7880
2016-12-13 15:28:28
CVE-2016-7877
2016-12-13 15:29:51
CVE-2016-7878
2016-12-13 15:29:28
cvelist
cvelist
CVE-2016-7878
2016-12-15 06:31:00
CVE-2016-7879
2016-12-15 06:31:00
CVE-2016-7880
2016-12-15 06:31:00
prion
prion
Memory corruption
2016-12-15 06:59:00
Memory corruption
2016-12-15 06:59:00
Design/Logic Flaw
2016-12-15 06:59:00
attackerkb
attackerkb
CVE-2016-7892
2016-12-15 00:00:00
cisa_kev
cisa_kev
Adobe Flash Player Use-After-Free Vulnerability
2022-03-25 00:00:00

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.036 Low

EPSS

Percentile

91.8%

JSON
Related for ASA-201612-16
kaspersky1nessus10suse1openvas8mscve1altlinux2archlinux1gentoo1redhat1mageia1threatpost2cve17ubuntucve17checkpoint_advisories13nvd17zdi10redhatcve17cvelist17prion17attackerkb1cisa_kev1