Arch Linux Security Advisory ASA-201707-10

Severity: Critical
Date : 2017-07-11
CVE-ID : CVE-2017-3080 CVE-2017-3099 CVE-2017-3100
Package : flashplugin
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-344

Summary

The package flashplugin before version 26.0.0.137-1 is vulnerable to
multiple issues including arbitrary code execution and information
disclosure.

Resolution

Upgrade to 26.0.0.137-1.

pacman -Syu “flashplugin>=26.0.0.137-1”

The problems have been fixed upstream in version 26.0.0.137.

Workaround

None.

Description

• CVE-2017-3080 (information disclosure)

A security issue leading to information disclosure has been found in
Adobe Flash Player < 26.0.0.137.

• CVE-2017-3099 (arbitrary code execution)

A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.137.

• CVE-2017-3100 (information disclosure)

A memory corruption vulnerability leading to the disclosure of a memory
address has been found in Adobe Flash Player < 26.0.0.137. It could be
used to bypass some security protections like ASLR.

Impact

A remote attacker can execute arbitrary code on the affected host.

References

https://helpx.adobe.com/security/products/flash-player/apsb17-21.html
https://security.archlinux.org/CVE-2017-3080
https://security.archlinux.org/CVE-2017-3099
https://security.archlinux.org/CVE-2017-3100