ID CVE-2015-0327 Type cve Reporter cve@mitre.org Modified 2017-09-08T01:29:00
Description
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0323.
{"googleprojectzero": [{"lastseen": "2020-12-14T19:21:16", "bulletinFamily": "info", "cvelist": ["CVE-2013-0765", "CVE-2014-1705", "CVE-2014-8636", "CVE-2015-0305", "CVE-2015-0327", "CVE-2015-0349", "CVE-2015-3039", "CVE-2015-3077", "CVE-2015-3119", "CVE-2015-3120", "CVE-2015-5119", "CVE-2015-5122", "CVE-2015-5123"], "description": "Posted by Natalie Silvanovich = function () { return n; }\n\n \n\n\nECMAScript has a property where almost all functions and variables can be dynamically redefined. This can lead to vulnerabilities in situations where native code assumes a function or variable behaves a certain way when accessed or does not have certain side effects when it can in fact be redefined. Project Zero has discovered 24 vulnerabilities involving ECMAScript redefinition in Adobe Flash in the past few months and similar issues have also been discovered in the wild. This post describes how this class of bugs works, alongside some examples of interesting bugs that have been recently patched.\n\n# ECMAScript Redefinition\n\n \n\n\nBeing a dynamically typed language, ECMAScript allows all functions to be redefined. For example, the JavaScript below redefines the alert method.\n\n \n\n\n<script>\n\nfunction f(mystring){\n\ndocument.write(mystring);\n\n}\n\nalert = f;\n\nalert(\u201chello\u201d);\n\n</script>\n\n \n\n\nIn most browsers, this will cause the function document.write to be called instead of a native alert.\n\n \n\n\nWhile this example is fairly benign, in some situations this behaviour can be problematic and lead to bugs. In particular, if native code in the VM relies on an ECMAScript method having specific behavior, but it has been redefined, it can lead to many issues, especially type confusion, overflows and use-after-frees.\n\n# Past Redefinition Bugs\n\n \n\n\nMany security bugs involving redefinition have been discovered in the past. Some of the earliest bugs were bypasses of same-origin-policy in browsers, where redefining a JavaScript function could allow script from an insecure context to be executed. Issues of this type have been found as recently as [last year](<https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636>).\n\n \n\n\nIn the past couple of years, many memory corruption and use-after-free bugs of this type have been found in browsers, such as [CVE-2013-0765](<https://www.mozilla.org/en-US/security/advisories/mfsa2013-19/>) in Firefox and [CVE-2014-1705](<https://code.google.com/p/chromium/issues/detail?id=351787>) in Chrome.\n\n \n\n\nThe recent HackingTeam leak contained five Adobe Flash vulnerabilities, of which four involved redefinition ([CVE-2015-5119](<https://code.google.com/p/google-security-research/issues/detail?id=472&can=1&q=reporter%3Ame>), CVE-2015-5122, CVE-2015-5123 and [CVE-2015-0349](<http://www.zerodayinitiative.com/advisories/ZDI-15-134/>)). An analysis of CVE-2015-5119 is included below\n\n \n\n\nHow to Redefine an Object\n\n \n\n\nOne of the main challenges in finding and exploiting redefinition vulnerabilities is reachability. Many of these issues exist deep in code, and it is not always obvious how to trigger them. Moreover, not all ECMA-based languages support redefinition to the same degree, and it often varies based on the specific function and method being redefined. That said, ECMAScript supports many methods of gaining access to objects, so it is often possible to reach redefinition using less-used ECMAScript functionality.\n\n# Equality Operator\n\n \n\n\nThe equality operator is the simplest way to redefine an object or function and it works to some extent in most ECMAScript implementations. In ActionScript 2, it works without restriction so long as a field doesn\u2019t have a setter defined (although sometimes the code doesn\u2019t compile and needs to be written directly in bytecode). Even read-only properties in AS2 can be redefined with the equality operator by calling ASSetProps to remove the read-only flag first. In ActionScript 3, only classes that are declared as dynamic can have their methods redefined using equality. In browsers, most methods can be redefined using equality, although one host function cannot be set to another host function directly. For example, in the code at the beginning of this post, alert can be set to document.write, but it needs to wrapped in the function f first. Direct assignment will cause the script to fail to execute.\n\n## CVE-2015-3077\n\n \n\n\n[CVE-2015-3077](<https://code.google.com/p/google-security-research/issues/detail?id=254>) is an example of a vulnerability in Flash that occurs because a function can be redefined using equality. A sample of the code that causes the issue is below. Note that this code has been simplified for clarity, and does not compile. A compiling sample of the code can be found in the Project Zero [bug tracker](<https://code.google.com/p/google-security-research/issues/detail?id=254&q=button>). \n\n \n\n\nvar blur = new flash.filters.BlurFilter(100, 15, 5555);\n\nthis.filters = [blur]; //this is a Button\n\nflash.filters.BlurFilter = flash.filters.ConvolutionFilter;\n\nvar f = this.filters;\n\nvar conv = f[0];\n\nconv.matrix = [0,1,1,1,1,1,1,1,1,1,1,1,1,1];\n\n \n\n\nThis is a simple type confusion issue. When the Button.filters method is set, it creates a native array containing all the filters and stores it. When the Button.filters property is read, it creates ActionScript objects of the type of each filter by calling its ActionScript constructor (with the assumption it hasn\u2019t been redefined) and then setting its native backing object to the one stored in the array. If the constructor for a filter is redefined, it calls the constructor for the wrong filter type, but still sets the same native object. This leads to an AS object of one type being backed by a native object of another type, leading to type confusion.\n\n## CVE-2015-0305\n\n \n\n\n[CVE-2015-0305](<https://code.google.com/p/google-security-research/issues/detail?id=150>) is another example of a type confusion issue that occurs through redefinition via equality. \n\n \n\n\nvar b = flash.net;\n\nb.FileReference = q;\n\nfunction q(){\n\nthis.f = flash.display.BitmapData\n\nvar c = new this.f(1000, 1000, true, 1000)\n\n}\n\nvar file = new FileReferenceList();\n\n\u2026\n\nfile.browse();\n\n \n\n\nIt is fairly similar to the previous case. When FileReferenceList.browse is called, the browser spawns a dialog and the user selects files. Then, for each file, the browse method calls the FileReference constructor and creates an object for each file. In this bug, the constructor is overwritten with a constructor that initializes it as a BitmapData object. When the constructor is called, its type is set to FileReference, even though it is not the type that is returned. This leads to an object with an AS object type and native object type that are inconsistent, and therefore type confusion. The bug is that FileReferenceList.browse assumes the FileReference constructor will return a FileReference, even though this isn\u2019t guaranteed because the method can be redefined.\n\n# Proxy Objects\n\n \n\n\nProxy objects can be used in the place of regular objects. They allow functions that handle every property access and method call to be defined. They can sometimes be used to redefine a property where equality fails. They also have the benefit of being able to execute code every time a property is accessed, which can allow behaviour which isn\u2019t possibly when simply setting a property, such as returning a different value each time a property is accessed. ActionScript 3 and JavaScript support Proxy objects.\n\n## CVE-2015-0327\n\n \n\n\n[CVE-2015-0327](<https://code.google.com/p/google-security-research/issues/detail?id=223&can=1&q=stringify>) is an issue found by Ian Beer that can be triggered by calling the stringify method in AS3 on a Proxy object. \n\n \n\n\nwhile (index != 0) {\n\nownDynPropCount++;\n\nindex = value->nextNameIndex(index);\n\n}\n\n \n\n\nAutoDestructingAtomArray propNames(m_fixedmalloc, ownDynPropCount);\n\n\u2026 \n\nwhile (index != 0) {\n\nAtom name = value->nextName(index);\n\npropNames.m_atoms[propNamesIdx] = name;\n\npropNamesIdx++;\n\nindex = value->nextNameIndex(index);\n\n}\n\n \n\n\nThe code above is from the open-source AVM. It counts the elements in value, and then uses the length to allocate an array. The array is then set by enumerating the items in value. However, if value is a Proxy object, the number of elements in each enumeration is not necessarily consistent, which can lead to an overflow in the allocated buffer.\n\n# Conversion Operators\n\n \n\n\nConversion operators, such as toString, valueOf and toInt can often be called implicitly. For example, when calling a native method such as:\n\n \n\n\nvar b = new BitmapData(x, y, true, 0xff00ff);\n\n \n\n\nThis will usually call valueOf on x and y to convert them to integers if they are not already. Functions that take string input often display similar behavior with toString. This can be an avenue for executing scripts at unexpected times. Conversion operators can be redefined in both AS2 and AS3.\n\n## CVE-2015-3039\n\n \n\n\n[CVE-2015-3039](<https://code.google.com/p/google-security-research/issues/detail?id=244>) is a bug in AS2 where calls to conversion operator allows script to be executed unexpectedly during a native call.\n\n \n\n\nvar filter = new ConvolutionFilter(...);\n\nvar n = {};\n\nn.valueOf = ts;\n\nvar a = [];\n\nfor(var k = 0; k < 1; k++){\n\na[k] = n;\n\n}\n\nfilter.matrix = a;\n\nfunction ts(){\n\nfilter.matrix = a;\n\n}\n\n \n\n\nWhen the native matrix getter is called, it first deletes the existing matrix, then reallocates a new one and then sets its contents to the values in the provided matrix. When it fetches the values from the matrix, it calls valueOf to convert the contents of the array to members of the Number class. However, if the valueOf function also calls the matrix getter, it will delete the matrix array, and reallocate it, even though the previous call isn\u2019t complete, and will write to it after the second call returns. This leads to a use-after-free bug. \n\n \n\n\nCVE-2015-5119\n\n \n\n\n[CVE-2015-5119](<https://code.google.com/p/google-security-research/issues/detail?id=472>) is a bug discovered in the HackingTeam leaks which occurs because calls to a conversion operator can cause a buffer to be freed and reallocated before a write to the original buffer.\n\n \n\n\nvar b = new ByteArray();\n\nb.length = 12;\n\nvar n = new myba(b);\n\nb[0] = n;\n\n \n\n\nIn the myba class definition:\n\n \n\n\nprototype.valueOf = function()\n\n{\n\nb.length = 1000;\n\n}\n\n \n\n\nThis bug is in the AS3 interpreter unlike the AS2 interpreter for the issue above, so valueOf has to be redefined in a class definition as shown. The vulnerable code is part of the open source AVM, and is as follows:\n\n \n\n\nvoid ByteArrayObject::setUintProperty(uint32_t i, Atom value)\n\n{\n\nm_byteArray[i] = uint8_t(AvmCore::integer(value));\n\n}\n\n \n\n\nThe AvmCore::integer method calls the valueOf method defined for the object value, which corresponds to the variable n in the ActionScript above. This can then set the length of the byte array, which can cause it to be reallocated. However, the write occurs on the original buffer, leading to a use-after-free.\n\n# Watches\n\n \n\n\nWatches are another method that can be used to change a property of an object. They are supported generically in AS2 and JavaScript. Watches trigger whenever an object property without a custom setter is set. This can sometimes mean that when a native method sets a property, a watch will trigger, allowing a jump into script, and also the ability to change what the property is set to, as a watcher can return a value which supersedes the value that the caller is trying to set the watched field to.\n\n## CVE-2015-3120\n\n \n\n\n[CVE-2015-3120](<https://code.google.com/p/google-security-research/issues/detail?id=337>) is a type confusion issue that can be reached by setting a watch on a variable.\n\n \n\n\nvar fileRef:FileReferenceList = new FileReferenceList();\n\nfileRef.addListener(listener);\n\nfileRef[\"fileList\"] = \"asdf\";\n\nfileRef.watch(\"fileList\", func);\n\nfileRef.browse(allTypes);\n\n \n\n\nfunction func(){\n\nreturn 7777777;\n\n}\n\n \n\n\nSetting a watch on the variable fileList causes the function func to be triggered when the native browse function creates the fileList object and attempts to set it. The function then returns the value 7777777, which is a Number, replacing the object that is set. This leads to type confusion when the variable is used, assumed to be an ActionScript object and used as a pointer as opposed to a Number.\n\n## CVE-2015-3119\n\n \n\n\n[CVE-2015-3119](<https://code.google.com/p/google-security-research/issues/detail?id=336>) is a bug in AS2 that can be triggered by setting a watch on a variable:\n\n \n\n\nclass mysubclass extends NetConnection {\n\nfunction mysubclass(a){\n\nthis.uri = \"test\";\n\nsuper();\n\nthis.watch(\"uri\", func);\n\nvar n = {toString : func}\n\nvar s = super;\n\ntrace(y);\n\nthis.connect(y);\n\nvar f = ASnative(2101, 411); //setBufferTimeMax\n\nf.call(this, 1000);\n\nfunction func(a, b, c){\n\nvar f = ASnative(2101, 200); // newStream\n\nvar n = new NetConnection();\n\nn.connect(y);\n\nf(this, n);\n\n}\n\n}\n\n}\n\n \n\n\nA watch is set on the URL property of a NetConnection object, and when it attempts to set the URL, the function func is called. This function redefines the this object as a NetStream (as opposed to a NetConnection), which leads to type confusion. The watch makes this possible, as it occurs after type checking, otherwise the function would fail to execute if called as a NetStream.\n\n# Subclassing\n\n \n\n\nSometimes it is possible to redefine a method or property of a class by subclassing it, if you control the construction of the object. Classes in ActionScript and JavaScript can be subclassed using the extends keyword. In addition, classes can sometimes be dynamically extended using the __proto__ or prototype keyword.\n\n# Resolution Methods\n\n \n\n\nJavaScript and AS2 objects also support resolution methods. These are methods are called when resolution of a property or method fails, as a last resort. In ActionScript 2, __resolve is a resolution function that gets called if resolution of a property or method fails. In JavaScript, there are a series of __lookUp*__ methods, such as __lookUpGetter__ which serve the same purpose (the specific method that get calls depends exactly on what type of resolution fails). These functions can be used to redefine methods or properties to reach bugs, but are also useful in finding bugs. Calling a native method on an object with a resolution method set is a good way to figure out what properties of the object the method is accessing, which can then be modified further\n\n# Conclusion\n\nRedefining host methods and properties can often violate the assumptions made by ECMAScript VMs when they access them. This is a good avenue for finding bugs in this type of software. \n\n \n\n", "modified": "2015-08-17T00:00:00", "published": "2015-08-17T00:00:00", "id": "GOOGLEPROJECTZERO:58B8640C3716E8B2D608FF8EDD780806", "href": "https://googleprojectzero.blogspot.com/2015/08/attacking-ecmascript-engines-with.html", "type": "googleprojectzero", "title": "\nAttacking ECMAScript Engines with Redefinition\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2016-09-04T11:20:21", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "flash-player was updated to version 11.2.202.442 to fix 18 security issues.\n\n These security issues were fixed:\n - Use-after-free vulnerabilities that could lead to code execution\n (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).\n - Memory corruption vulnerabilities that could lead to code execution\n (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330).\n - Type confusion vulnerabilities that could lead to code execution\n (CVE-2015-0317, CVE-2015-0319).\n - Heap buffer overflow vulnerabilities that could lead to code execution\n (CVE-2015-0323, CVE-2015-0327).\n - Buffer overflow vulnerability that could lead to code execution\n (CVE-2015-0324).\n - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n More information is available at\n <a rel=\"nofollow\" href=\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\">https://helpx.adobe.com/security/products/flash-player/apsb15-04.html</a>\n\n", "edition": 1, "modified": "2015-02-07T10:04:51", "published": "2015-02-07T10:04:51", "id": "SUSE-SU-2015:0236-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html", "title": "Security update for flash-player (critical)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:43:58", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "flash-player was updated to version 11.2.202.442 to fix 18 security issues.\n\n These security issues were fixed:\n - Use-after-free vulnerabilities that could lead to code execution\n (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).\n - Memory corruption vulnerabilities that could lead to code execution\n (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330).\n - Type confusion vulnerabilities that could lead to code execution\n (CVE-2015-0317, CVE-2015-0319).\n - Heap buffer overflow vulnerabilities that could lead to code execution\n (CVE-2015-0323, CVE-2015-0327).\n - Buffer overflow vulnerability that could lead to code execution\n (CVE-2015-0324).\n - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n More information is available at\n <a rel=\"nofollow\" href=\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\">https://helpx.adobe.com/security/products/flash-player/apsb15-04.html</a>\n\n", "edition": 1, "modified": "2015-02-07T14:04:53", "published": "2015-02-07T14:04:53", "id": "OPENSUSE-SU-2015:0238-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html", "title": "update for flash-player (critical)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:48:12", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "flash-player was updated to version 11.2.202.442 to fix 18 security issues.\n\n These security issues were fixed:\n - Use-after-free vulnerabilities that could lead to code execution\n (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).\n - Memory corruption vulnerabilities that could lead to code execution\n (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330).\n - Type confusion vulnerabilities that could lead to code execution\n (CVE-2015-0317, CVE-2015-0319).\n - Heap buffer overflow vulnerabilities that could lead to code execution\n (CVE-2015-0323, CVE-2015-0327).\n - Buffer overflow vulnerability that could lead to code execution\n (CVE-2015-0324).\n - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n More information is available at\n <a rel=\"nofollow\" href=\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\">https://helpx.adobe.com/security/products/flash-player/apsb15-04.html</a>\n\n", "edition": 1, "modified": "2015-02-07T10:05:06", "published": "2015-02-07T10:05:06", "id": "OPENSUSE-SU-2015:0237-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html", "title": "Security update for flash-player (critical)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:05:46", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "flash-player was updated to version 11.2.202.442 to fix 18 security issues.\n\n These security issues were fixed: - Use-after-free vulnerabilities that\n could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320,\n CVE-2015-0322). - Memory corruption vulnerabilities that could lead to\n code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318,\n CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion\n vulnerabilities that could lead to code execution (CVE-2015-0317,\n CVE-2015-0319). - Heap buffer\n overflow vulnerabilities that could lead to code execution (CVE-2015-0323,\n CVE-2015-0327). - Buffer overflow vulnerability that could lead to code\n execution (CVE-2015-0324). - Null pointer dereference issues\n (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328).\n\n More information is available at\n <a rel=\"nofollow\" href=\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\">https://helpx.adobe.com/security/products/flash-player/apsb15-04.html</a>\n\n Security Issues:\n\n * CVE-2015-0313\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0313\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0313</a>>\n * CVE-2015-0314\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0314\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0314</a>>\n * CVE-2015-0315\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0315\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0315</a>>\n * CVE-2015-0316\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0316\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0316</a>>\n * CVE-2015-0317\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0317\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0317</a>>\n * CVE-2015-0318\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0318\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0318</a>>\n * CVE-2015-0319\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0319\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0319</a>>\n * CVE-2015-0320\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0320\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0320</a>>\n * CVE-2015-0321\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0321\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0321</a>>\n * CVE-2015-0322\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0322\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0322</a>>\n * CVE-2015-0323\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0323\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0323</a>>\n * CVE-2015-0324\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0324\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0324</a>>\n * CVE-2015-0325\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0325\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0325</a>>\n * CVE-2015-0326\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0326\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0326</a>>\n * CVE-2015-0327\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0327\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0327</a>>\n * CVE-2015-0328\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0328\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0328</a>>\n * CVE-2015-0329\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0329\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0329</a>>\n * CVE-2015-0330\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0330\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0330</a>>\n\nContraindications:\n\n\n", "edition": 1, "modified": "2015-02-07T19:07:55", "published": "2015-02-07T19:07:55", "id": "SUSE-SU-2015:0239-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.html", "type": "suse", "title": "Security update for flash-player, flash-player-gnome, flash-player-kde4 (critical)", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2020-01-31T18:37:18", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310850957", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310850957", "type": "openvas", "title": "SUSE: Security Advisory for flash-player (SUSE-SU-2015:0236-1)", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.850957\");\n script_version(\"2020-01-31T07:58:03+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 07:58:03 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 15:00:43 +0200 (Fri, 16 Oct 2015)\");\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SUSE: Security Advisory for flash-player (SUSE-SU-2015:0236-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'flash-player'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"flash-player was updated to version 11.2.202.442 to fix 18 security issues.\n\n These security issues were fixed:\n\n - Use-after-free vulnerabilities that could lead to code execution\n (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).\n\n - Memory corruption vulnerabilities that could lead to code execution\n (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330).\n\n - Type confusion vulnerabilities that could lead to code execution\n (CVE-2015-0317, CVE-2015-0319).\n\n - Heap buffer overflow vulnerabilities that could lead to code execution\n (CVE-2015-0323, CVE-2015-0327).\n\n - Buffer overflow vulnerability that could lead to code execution\n (CVE-2015-0324).\n\n - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n More information is available at the referenced vendor advisory.\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n\n script_tag(name:\"affected\", value:\"flash-player on SUSE Linux Enterprise Desktop 12\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"SUSE-SU\", value:\"2015:0236-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=SLED12\\.0SP0\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"SLED12.0SP0\") {\n if(!isnull(res = isrpmvuln(pkg:\"flash-player\", rpm:\"flash-player~11.2.202.442~67.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"flash-player-gnome\", rpm:\"flash-player-gnome~11.2.202.442~67.1\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-04T17:44:42", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "The remote host is missing an update for the ", "modified": "2020-06-03T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310851051", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851051", "type": "openvas", "title": "SUSE: Security Advisory for flash-player (SUSE-SU-2015:0239-1)", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851051\");\n script_version(\"2020-06-03T08:38:58+0000\");\n script_tag(name:\"last_modification\", value:\"2020-06-03 08:38:58 +0000 (Wed, 03 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 18:57:18 +0200 (Fri, 16 Oct 2015)\");\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SUSE: Security Advisory for flash-player (SUSE-SU-2015:0239-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'flash-player'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"flash-player was updated to version 11.2.202.442 to fix 18 security issues.\n\n These security issues were fixed: - Use-after-free vulnerabilities that\n could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320,\n CVE-2015-0322). - Memory corruption vulnerabilities that could lead to\n code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318,\n CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion\n vulnerabilities that could lead to code execution (CVE-2015-0317,\n CVE-2015-0319). - Heap buffer\n overflow vulnerabilities that could lead to code execution (CVE-2015-0323,\n CVE-2015-0327). - Buffer overflow vulnerability that could lead to code\n execution (CVE-2015-0324). - Null pointer dereference issues\n (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328).\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n\n script_tag(name:\"affected\", value:\"flash-player, on SUSE Linux Enterprise Desktop 11 SP3\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"SUSE-SU\", value:\"2015:0239-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=SLED11\\.0SP3\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"SLED11.0SP3\") {\n if(!isnull(res = isrpmvuln(pkg:\"flash-player\", rpm:\"flash-player~11.2.202.442~0.3.1\", rls:\"SLED11.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"flash-player-gnome\", rpm:\"flash-player-gnome~11.2.202.442~0.3.1\", rls:\"SLED11.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"flash-player-kde4\", rpm:\"flash-player-kde4~11.2.202.442~0.3.1\", rls:\"SLED11.0SP3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T22:13:54", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.", "modified": "2019-07-17T00:00:00", "published": "2015-02-03T00:00:00", "id": "OPENVAS:1361412562310805442", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310805442", "type": "openvas", "title": "Adobe Flash Player Unspecified Vulnerability - 01 Feb15 (Windows)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Adobe Flash Player Unspecified Vulnerability - 01 Feb15 (Windows)\n#\n# Authors:\n# Rinu <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:flash_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.805442\");\n script_version(\"2019-07-17T11:14:11+0000\");\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\",\n \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\",\n \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\",\n \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\",\n \"CVE-2015-0329\", \"CVE-2015-0330\", \"CVE-2015-0331\");\n script_bugtraq_id(72429, 72514);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 11:14:11 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-02-03 15:45:26 +0530 (Tue, 03 Feb 2015)\");\n script_name(\"Adobe Flash Player Unspecified Vulnerability - 01 Feb15 (Windows)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Multiple unspecified use-after-free errors.\n\n - Multiple unspecified errors due to improper validation of user-supplied input.\n\n - Multiple unspecified type confusion errors.\n\n - Multiple errors leading to overflow condition.\n\n - Multiple unspecified NULL pointer dereference errors.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to corrupt memory, dereference already freed memory, execute arbitrary\n code or have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Flash Player before version\n 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Flash Player version\n 13.0.0.269 or 16.0.0.305 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_adobe_flash_player_detect_win.nasl\");\n script_mandatory_keys(\"AdobeFlashPlayer/Win/Installed\");\n\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!playerVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:playerVer, test_version:\"13.0.0.269\"))\n{\n fix = \"13.0.0.269\";\n VULN = TRUE;\n}\n\nif(version_in_range(version:playerVer, test_version:\"14.0\", test_version2:\"16.0.0.304\"))\n{\n fix = \"16.0.0.305\";\n VULN = TRUE;\n}\n\nif(VULN)\n{\n report = 'Installed version: ' + playerVer + '\\n' +\n 'Fixed version: ' + fix + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T22:13:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.", "modified": "2019-07-17T00:00:00", "published": "2015-02-10T00:00:00", "id": "OPENVAS:1361412562310805270", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310805270", "type": "openvas", "title": "Adobe Flash Player Multiple Vulnerabilities-01 Feb15 (Linux)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Adobe Flash Player Multiple Vulnerabilities-01 Feb15 (Linux)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:flash_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.805270\");\n script_version(\"2019-07-17T11:14:11+0000\");\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\",\n \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\",\n \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\",\n \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\",\n \"CVE-2015-0329\", \"CVE-2015-0330\", \"CVE-2015-0331\");\n script_bugtraq_id(72429, 72514);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 11:14:11 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-02-10 11:05:20 +0530 (Tue, 10 Feb 2015)\");\n script_name(\"Adobe Flash Player Multiple Vulnerabilities-01 Feb15 (Linux)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Multiple unspecified use-after-free errors.\n\n - Multiple unspecified errors due to improper validation of user-supplied input.\n\n - Multiple unspecified type confusion errors.\n\n - Multiple errors leading to overflow condition.\n\n - Multiple unspecified NULL pointer dereference errors.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to corrupt memory, dereference already freed memory, execute arbitrary\n code or have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Flash Player before version\n 11.2.202.442 on Linux.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Flash Player version\n 11.2.202.442 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_adobe_flash_player_detect_lin.nasl\");\n script_mandatory_keys(\"AdobeFlashPlayer/Linux/Ver\");\n\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!playerVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:playerVer, test_version:\"11.2.202.442\"))\n{\n report = 'Installed version: ' + playerVer + '\\n' +\n 'Fixed version: ' + \"11.2.202.442\" + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T22:13:49", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.", "modified": "2019-07-17T00:00:00", "published": "2015-02-10T00:00:00", "id": "OPENVAS:1361412562310805443", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310805443", "type": "openvas", "title": "Adobe Flash Player Unspecified Vulnerability - 01 Feb15 (Mac OS X)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Adobe Flash Player Unspecified Vulnerability - 01 Feb15 (Mac OS X)\n#\n# Authors:\n# Rinu <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:flash_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.805443\");\n script_version(\"2019-07-17T11:14:11+0000\");\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\",\n \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\",\n \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\",\n \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\",\n \"CVE-2015-0329\", \"CVE-2015-0330\", \"CVE-2015-0331\");\n script_bugtraq_id(72429, 72514);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 11:14:11 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-02-10 11:38:12 +0530 (Tue, 10 Feb 2015)\");\n script_name(\"Adobe Flash Player Unspecified Vulnerability - 01 Feb15 (Mac OS X)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Multiple unspecified use-after-free errors.\n\n - Multiple unspecified errors due to improper validation of user-supplied input.\n\n - Multiple unspecified type confusion errors.\n\n - Multiple errors leading to overflow condition.\n\n - Multiple unspecified NULL pointer dereference errors.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to corrupt memory, dereference already freed memory, execute arbitrary\n code or have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Flash Player before version\n 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Mac OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Flash Player version\n 13.0.0.269 or 16.0.0.305 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"secpod_adobe_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Adobe/Flash/Player/MacOSX/Version\");\n\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!playerVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:playerVer, test_version:\"13.0.0.269\"))\n{\n fix = \"13.0.0.269\";\n VULN = TRUE;\n}\n\nif(version_in_range(version:playerVer, test_version:\"14.0\", test_version2:\"16.0.0.304\"))\n{\n fix = \"16.0.0.305\";\n VULN = TRUE;\n}\n\nif(VULN)\n{\n report = 'Installed version: ' + playerVer + '\\n' +\n 'Fixed version: ' + fix + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:03", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0303", "CVE-2015-0305", "CVE-2015-0304", "CVE-2015-0308", "CVE-2015-0330", "CVE-2015-0301", "CVE-2015-0309", "CVE-2015-0314", "CVE-2015-0302", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0311", "CVE-2015-0318", "CVE-2015-0307", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0306", "CVE-2015-0320", "CVE-2015-0310", "CVE-2015-0323"], "description": "Gentoo Linux Local Security Checks GLSA 201502-02", "modified": "2018-10-26T00:00:00", "published": "2015-09-29T00:00:00", "id": "OPENVAS:1361412562310121341", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121341", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201502-02", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa-201502-02.nasl 12128 2018-10-26 13:35:25Z cfischer $\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121341\");\n script_version(\"$Revision: 12128 $\");\n script_tag(name:\"creation_date\", value:\"2015-09-29 11:28:27 +0300 (Tue, 29 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 15:35:25 +0200 (Fri, 26 Oct 2018) $\");\n script_name(\"Gentoo Security Advisory GLSA 201502-02\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201502-02\");\n script_cve_id(\"CVE-2015-0301\", \"CVE-2015-0302\", \"CVE-2015-0303\", \"CVE-2015-0304\", \"CVE-2015-0305\", \"CVE-2015-0306\", \"CVE-2015-0307\", \"CVE-2015-0308\", \"CVE-2015-0309\", \"CVE-2015-0310\", \"CVE-2015-0311\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks GLSA 201502-02\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"www-plugins/adobe-flash\", unaffected: make_list(\"ge 11.2.202.442\"), vulnerable: make_list(\"lt 11.2.202.442\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:35", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "description": "- CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322\n\nUse-after-free vulnerabilities leading to arbitrary code execution.\n\n- (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\nCVE-2015-0329, CVE-2015-0330\n\nMemory corruption vulnerabilities leading to arbitrary code execution.\n\n- CVE-2015-0317, CVE-2015-0319\n\nType confusion vulnerabilities leading to arbitrary code execution.\n\n- CVE-2015-0323, CVE-2015-0327\n\nHeap overflow vulnerabilities leading to arbitrary code execution.\n\n- CVE-2015-0324\n\nBuffer overflow vulnerability leading to arbitrary code execution.\n\n- CVE-2015-0325, CVE-2015-0326, CVE-2015-0328\n\nNull-pointer dereference issues, possibly leading to denial of service\nor other unspecified impact.", "modified": "2015-02-06T00:00:00", "published": "2015-02-06T00:00:00", "id": "ASA-201502-2", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-February/000225.html", "type": "archlinux", "title": "flashplugin: remote code execution", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "redhat": [{"lastseen": "2019-12-11T13:32:14", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0314", "CVE-2015-0315", "CVE-2015-0316", "CVE-2015-0317", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0320", "CVE-2015-0321", "CVE-2015-0322", "CVE-2015-0323", "CVE-2015-0324", "CVE-2015-0325", "CVE-2015-0326", "CVE-2015-0327", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0330", "CVE-2015-0331"], "description": "The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash\nPlayer web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player. These\nvulnerabilities are detailed in the Adobe Security Bulletin APSB15-04\nlisted in the References section.\n\nMultiple flaws were found in the way flash-plugin displayed certain SWF\ncontent. An attacker could use these flaws to create a specially crafted\nSWF file that would cause flash-plugin to crash or, potentially, execute\narbitrary code when the victim loaded a page containing the malicious SWF\ncontent. (CVE-2015-0314, CVE-2015-0315, CVE-2015-0316, CVE-2015-0317,\nCVE-2015-0318, CVE-2015-0319, CVE-2015-0320, CVE-2015-0321, CVE-2015-0322,\nCVE-2015-0323, CVE-2015-0324, CVE-2015-0325, CVE-2015-0326, CVE-2015-0327,\nCVE-2015-0328, CVE-2015-0329, CVE-2015-0330)\n\nAll users of Adobe Flash Player should install this updated package, which\nupgrades Flash Player to version 11.2.202.442.\n", "modified": "2018-06-07T09:04:13", "published": "2015-02-06T05:00:00", "id": "RHSA-2015:0140", "href": "https://access.redhat.com/errata/RHSA-2015:0140", "type": "redhat", "title": "(RHSA-2015:0140) Critical: flash-plugin security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-01-01T05:05:15", "description": "An updated Adobe Flash Player package that fixes multiple security\nissues is now available for Red Hat Enterprise Linux 5 and 6\nSupplementary.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe flash-plugin package contains a Mozilla Firefox compatible Adobe\nFlash Player web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player.\nThese vulnerabilities are detailed in the Adobe Security Bulletin\nAPSB15-04 listed in the References section.\n\nMultiple flaws were found in the way flash-plugin displayed certain\nSWF content. An attacker could use these flaws to create a specially\ncrafted SWF file that would cause flash-plugin to crash or,\npotentially, execute arbitrary code when the victim loaded a page\ncontaining the malicious SWF content. (CVE-2015-0314, CVE-2015-0315,\nCVE-2015-0316, CVE-2015-0317, CVE-2015-0318, CVE-2015-0319,\nCVE-2015-0320, CVE-2015-0321, CVE-2015-0322, CVE-2015-0323,\nCVE-2015-0324, CVE-2015-0325, CVE-2015-0326, CVE-2015-0327,\nCVE-2015-0328, CVE-2015-0329, CVE-2015-0330)\n\nAll users of Adobe Flash Player should install this updated package,\nwhich upgrades Flash Player to version 11.2.202.442.", "edition": 28, "published": "2015-02-09T00:00:00", "title": "RHEL 5 / 6 : flash-plugin (RHSA-2015:0140)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "p-cpe:/a:redhat:enterprise_linux:flash-plugin", "cpe:/o:redhat:enterprise_linux:6.6", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2015-0140.NASL", "href": "https://www.tenable.com/plugins/nessus/81244", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:0140. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81244);\n script_version(\"1.23\");\n script_cvs_date(\"Date: 2019/10/24 15:35:39\");\n\n script_cve_id(\"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\", \"CVE-2015-0331\");\n script_bugtraq_id(72514);\n script_xref(name:\"RHSA\", value:\"2015:0140\");\n\n script_name(english:\"RHEL 5 / 6 : flash-plugin (RHSA-2015:0140)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated Adobe Flash Player package that fixes multiple security\nissues is now available for Red Hat Enterprise Linux 5 and 6\nSupplementary.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe flash-plugin package contains a Mozilla Firefox compatible Adobe\nFlash Player web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player.\nThese vulnerabilities are detailed in the Adobe Security Bulletin\nAPSB15-04 listed in the References section.\n\nMultiple flaws were found in the way flash-plugin displayed certain\nSWF content. An attacker could use these flaws to create a specially\ncrafted SWF file that would cause flash-plugin to crash or,\npotentially, execute arbitrary code when the victim loaded a page\ncontaining the malicious SWF content. (CVE-2015-0314, CVE-2015-0315,\nCVE-2015-0316, CVE-2015-0317, CVE-2015-0318, CVE-2015-0319,\nCVE-2015-0320, CVE-2015-0321, CVE-2015-0322, CVE-2015-0323,\nCVE-2015-0324, CVE-2015-0325, CVE-2015-0326, CVE-2015-0327,\nCVE-2015-0328, CVE-2015-0329, CVE-2015-0330)\n\nAll users of Adobe Flash Player should install this updated package,\nwhich upgrades Flash Player to version 11.2.202.442.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2015:0140\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0329\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0325\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0328\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0316\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0315\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0314\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0324\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0330\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0322\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0323\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0320\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0321\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0326\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0327\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0319\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0318\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-0331\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected flash-plugin package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:flash-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:0140\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL5\", reference:\"flash-plugin-11.2.202.442-1.el5\")) flag++;\n\n\n if (rpm_check(release:\"RHEL6\", reference:\"flash-plugin-11.2.202.442-1.el6\")) flag++;\n\n\n if (flag)\n {\n flash_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check only applies to RedHat released\\n' +\n 'versions of the flash-plugin package. This check does not apply to\\n' +\n 'Adobe released versions of the flash-plugin package, which are\\n' +\n 'versioned similarly and cause collisions in detection.\\n\\n' +\n\n 'If you are certain you are running the Adobe released package of\\n' +\n 'flash-plugin and are running a version of it equal or higher to the\\n' +\n 'RedHat version listed above then you can consider this a false\\n' +\n 'positive.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat() + flash_plugin_caveat\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"flash-plugin\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T14:17:17", "description": "flash-player was updated to version 11.2.202.442 to fix 18 security\nissues.\n\nThese security issues were fixed: - Use-after-free vulnerabilities\nthat could lead to code execution (CVE-2015-0313 / CVE-2015-0315 /\nCVE-2015-0320 / CVE-2015-0322). - Memory corruption vulnerabilities\nthat could lead to code execution (CVE-2015-0314 / CVE-2015-0316 /\nCVE-2015-0318 / CVE-2015-0321 / CVE-2015-0329 / CVE-2015-0330). - Type\nconfusion vulnerabilities that could lead to code execution\n(CVE-2015-0317 / CVE-2015-0319). - Heap buffer overflow\nvulnerabilities that could lead to code execution (CVE-2015-0323 /\nCVE-2015-0327). - Buffer overflow vulnerability that could lead to\ncode execution (CVE-2015-0324). - NULL pointer dereference issues.\n(CVE-2015-0325 / CVE-2015-0326 / CVE-2015-0328)\n\nMore information is available at\nhttps://helpx.adobe.com/security/products/flash-player/apsb15-04.html", "edition": 24, "published": "2015-02-09T00:00:00", "title": "SuSE 11.3 Security Update : flash-player, flash-player-gnome, flash-player-kde4 (SAT Patch Number 10287)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2015-02-09T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:11:flash-player-gnome", "p-cpe:/a:novell:suse_linux:11:flash-player-kde4", "cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:11:flash-player"], "id": "SUSE_11_FLASH-PLAYER-150206.NASL", "href": "https://www.tenable.com/plugins/nessus/81245", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from SuSE 11 update information. The text itself is\n# copyright (C) Novell, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81245);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\");\n\n script_name(english:\"SuSE 11.3 Security Update : flash-player, flash-player-gnome, flash-player-kde4 (SAT Patch Number 10287)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 11 host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"flash-player was updated to version 11.2.202.442 to fix 18 security\nissues.\n\nThese security issues were fixed: - Use-after-free vulnerabilities\nthat could lead to code execution (CVE-2015-0313 / CVE-2015-0315 /\nCVE-2015-0320 / CVE-2015-0322). - Memory corruption vulnerabilities\nthat could lead to code execution (CVE-2015-0314 / CVE-2015-0316 /\nCVE-2015-0318 / CVE-2015-0321 / CVE-2015-0329 / CVE-2015-0330). - Type\nconfusion vulnerabilities that could lead to code execution\n(CVE-2015-0317 / CVE-2015-0319). - Heap buffer overflow\nvulnerabilities that could lead to code execution (CVE-2015-0323 /\nCVE-2015-0327). - Buffer overflow vulnerability that could lead to\ncode execution (CVE-2015-0324). - NULL pointer dereference issues.\n(CVE-2015-0325 / CVE-2015-0326 / CVE-2015-0328)\n\nMore information is available at\nhttps://helpx.adobe.com/security/products/flash-player/apsb15-04.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=915918\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0313.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0314.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0315.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0316.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0317.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0318.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0319.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0320.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0321.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0322.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0323.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0324.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0325.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0326.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0327.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0328.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0329.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2015-0330.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply SAT patch number 10287.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:flash-player\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:flash-player-gnome\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:flash-player-kde4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)11\") audit(AUDIT_OS_NOT, \"SuSE 11\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SuSE 11\", cpu);\n\npl = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(pl) || int(pl) != 3) audit(AUDIT_OS_NOT, \"SuSE 11.3\");\n\n\nflag = 0;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"i586\", reference:\"flash-player-11.2.202.442-0.3.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"i586\", reference:\"flash-player-gnome-11.2.202.442-0.3.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"i586\", reference:\"flash-player-kde4-11.2.202.442-0.3.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"flash-player-11.2.202.442-0.3.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"flash-player-gnome-11.2.202.442-0.3.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"flash-player-kde4-11.2.202.442-0.3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T11:12:23", "description": "flash-player was updated to version 11.2.202.442 to fix 18 security\nissues.\n\nThese security issues were fixed :\n\n - Use-after-free vulnerabilities that could lead to code\n execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320,\n CVE-2015-0322). \n\n - Memory corruption vulnerabilities that could lead to\n code execution (CVE-2015-0314, CVE-2015-0316,\n CVE-2015-0318, CVE-2015-0321, CVE-2015-0329,\n CVE-2015-0330). \n\n - Type confusion vulnerabilities that could lead to code\n execution (CVE-2015-0317, CVE-2015-0319). \n\n - Heap buffer overflow vulnerabilities that could lead to\n code execution (CVE-2015-0323, CVE-2015-0327). \n\n - Buffer overflow vulnerability that could lead to code\n execution (CVE-2015-0324). \n\n - NULL pointer dereference issues (CVE-2015-0325,\n CVE-2015-0326, CVE-2015-0328).\n\nMore information is available at\nhttps://helpx.adobe.com/security/products/flash-player/apsb15-04.html", "edition": 16, "published": "2015-02-09T00:00:00", "title": "openSUSE Security Update : flash-player (openSUSE-2015-118)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2015-02-09T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:flash-player-kde4", "p-cpe:/a:novell:opensuse:flash-player-gnome", "cpe:/o:novell:opensuse:13.2", "p-cpe:/a:novell:opensuse:flash-player", "cpe:/o:novell:opensuse:13.1"], "id": "OPENSUSE-2015-118.NASL", "href": "https://www.tenable.com/plugins/nessus/81243", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2015-118.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81243);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/04\");\n\n script_cve_id(\"CVE-2015-0313\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\");\n\n script_name(english:\"openSUSE Security Update : flash-player (openSUSE-2015-118)\");\n script_summary(english:\"Check for the openSUSE-2015-118 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"flash-player was updated to version 11.2.202.442 to fix 18 security\nissues.\n\nThese security issues were fixed :\n\n - Use-after-free vulnerabilities that could lead to code\n execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320,\n CVE-2015-0322). \n\n - Memory corruption vulnerabilities that could lead to\n code execution (CVE-2015-0314, CVE-2015-0316,\n CVE-2015-0318, CVE-2015-0321, CVE-2015-0329,\n CVE-2015-0330). \n\n - Type confusion vulnerabilities that could lead to code\n execution (CVE-2015-0317, CVE-2015-0319). \n\n - Heap buffer overflow vulnerabilities that could lead to\n code execution (CVE-2015-0323, CVE-2015-0327). \n\n - Buffer overflow vulnerability that could lead to code\n execution (CVE-2015-0324). \n\n - NULL pointer dereference issues (CVE-2015-0325,\n CVE-2015-0326, CVE-2015-0328).\n\nMore information is available at\nhttps://helpx.adobe.com/security/products/flash-player/apsb15-04.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=915918\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected flash-player packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:flash-player\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:flash-player-gnome\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:flash-player-kde4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1|SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1 / 13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"flash-player-11.2.202.442-98.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"flash-player-gnome-11.2.202.442-98.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"flash-player-kde4-11.2.202.442-98.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"flash-player-11.2.202.442-2.33.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"flash-player-gnome-11.2.202.442-2.33.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"flash-player-kde4-11.2.202.442-2.33.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"flash-player / flash-player-gnome / flash-player-kde4\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T02:33:34", "description": "According to its version, the Adobe Flash Player installed on the\nremote Windows host is equal or prior to 16.0.0.296. It is, therefore,\naffected by the following vulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)", "edition": 26, "published": "2015-02-02T00:00:00", "title": "Flash Player <= 16.0.0.296 Unspecified Code Execution (APSA15-02 / APSB15-04)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:adobe:flash_player"], "id": "FLASH_PLAYER_APSA15-02.NASL", "href": "https://www.tenable.com/plugins/nessus/81127", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81127);\n script_version(\"1.21\");\n script_cvs_date(\"Date: 2019/11/25\");\n\n script_cve_id(\n \"CVE-2015-0313\",\n \"CVE-2015-0314\",\n \"CVE-2015-0315\",\n \"CVE-2015-0316\",\n \"CVE-2015-0317\",\n \"CVE-2015-0318\",\n \"CVE-2015-0319\",\n \"CVE-2015-0320\",\n \"CVE-2015-0321\",\n \"CVE-2015-0322\",\n \"CVE-2015-0323\",\n \"CVE-2015-0324\",\n \"CVE-2015-0325\",\n \"CVE-2015-0326\",\n \"CVE-2015-0327\",\n \"CVE-2015-0328\",\n \"CVE-2015-0329\",\n \"CVE-2015-0330\",\n \"CVE-2015-0331\"\n );\n script_bugtraq_id(72429, 72514, 72698);\n\n script_name(english:\"Flash Player <= 16.0.0.296 Unspecified Code Execution (APSA15-02 / APSB15-04)\");\n script_summary(english:\"Checks the version of Flash Player.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host has a browser plugin that is affected by\nmultiple code execution vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the Adobe Flash Player installed on the\nremote Windows host is equal or prior to 16.0.0.296. It is, therefore,\naffected by the following vulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsa15-02.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-15-047/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Adobe Flash Player version 16.0.0.305 or later.\n\nAlternatively, Adobe has made version 13.0.0.269 available for those\ninstallations that cannot be upgraded to 16.x.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-0331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:adobe:flash_player\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"flash_player_installed.nasl\");\n script_require_keys(\"SMB/Flash_Player/installed\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/Flash_Player/installed\");\n\n# Identify vulnerable versions.\ninfo = \"\";\n\n# we're checking for versions less than *or equal to* the cutoff!\nforeach variant (make_list(\"Plugin\", \"ActiveX\", \"Chrome\", \"Chrome_Pepper\"))\n{\n vers = get_kb_list(\"SMB/Flash_Player/\"+variant+\"/Version/*\");\n files = get_kb_list(\"SMB/Flash_Player/\"+variant+\"/File/*\");\n if (!isnull(vers) && !isnull(files))\n {\n foreach key (keys(vers))\n {\n ver = vers[key];\n\n if (ver)\n {\n iver = split(ver, sep:'.', keep:FALSE);\n for (i=0; i<max_index(iver); i++)\n iver[i] = int(iver[i]);\n\n if (\n (\n # Chrome Flash <= 16.0.0.296\n variant == \"Chrome_Pepper\" &&\n (\n (iver[0] < 16) ||\n (iver[0] == 16 && iver[1] == 0 && iver[2] == 0 && iver[3] <= 296)\n )\n ) ||\n (variant != \"Chrome_Pepper\" &&\n (\n (\n # < 13\n (\n iver[0] < 13 ||\n # 13.0.0.x <= 13.0.0.264\n (\n iver[0] == 13 &&\n (\n iver[1] == 0 &&\n (\n iver[2] == 0 &&\n (\n iver[3] <= 264\n )\n )\n )\n )\n ) ||\n # 14.0.0.x <= 16.0.0.296\n (\n iver[0] == 14 ||\n (\n iver[0] == 15 ||\n (\n iver[0] == 16 &&\n (\n iver[1] == 0 &&\n (\n iver[2] == 0 &&\n (\n iver[3] <= 296\n )\n )\n )\n )\n )\n )\n )\n )\n )\n )\n {\n num = key - (\"SMB/Flash_Player/\"+variant+\"/Version/\");\n file = files[\"SMB/Flash_Player/\"+variant+\"/File/\"+num];\n if (variant == \"Plugin\")\n {\n info += '\\n Product : Browser Plugin (for Firefox / Netscape / Opera)';\n fix = \"16.0.0.305 / 13.0.0.269\";\n }\n else if (variant == \"ActiveX\")\n {\n info += '\\n Product : ActiveX control (for Internet Explorer)';\n fix = \"16.0.0.305 / 13.0.0.269\";\n }\n else if (\"Chrome\" >< variant)\n {\n info += '\\n Product : Browser Plugin (for Google Chrome)';\n }\n info += '\\n Path : ' + file +\n '\\n Installed version : ' + ver;\n if (variant == \"Chrome_Pepper\")\n info += '\\n Fixed version : 16.0.0.305 (Chrome PepperFlash)';\n else\n info += '\\n Fixed version : '+fix;\n info += '\\n';\n }\n }\n }\n }\n}\n\nif (info)\n{\n port = get_kb_item(\"SMB/transport\");\n if (!port) port = 445;\n\n if (report_verbosity > 0) security_hole(port:port, extra:info);\n else security_hole(port);\n}\nelse\n{\n if (thorough_tests)\n exit(0, 'No vulnerable versions of Adobe Flash Player were found.');\n else\n exit(1, 'Google Chrome\\'s built-in Flash Player may not have been detected because the \\'Perform thorough tests\\' setting was not enabled.');\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T05:43:08", "description": "The remote host is missing KB3021953. It is, therefore, affected by\nthe following vulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328)\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)", "edition": 28, "published": "2015-02-06T00:00:00", "title": "MS KB3021953: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:adobe:flash_player"], "id": "SMB_KB3021953.NASL", "href": "https://www.tenable.com/plugins/nessus/81209", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81209);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2019/11/25\");\n\n script_cve_id(\n \"CVE-2015-0313\",\n \"CVE-2015-0314\",\n \"CVE-2015-0315\",\n \"CVE-2015-0316\",\n \"CVE-2015-0317\",\n \"CVE-2015-0318\",\n \"CVE-2015-0319\",\n \"CVE-2015-0320\",\n \"CVE-2015-0321\",\n \"CVE-2015-0322\",\n \"CVE-2015-0323\",\n \"CVE-2015-0324\",\n \"CVE-2015-0325\",\n \"CVE-2015-0326\",\n \"CVE-2015-0327\",\n \"CVE-2015-0328\",\n \"CVE-2015-0329\",\n \"CVE-2015-0330\",\n \"CVE-2015-0331\"\n );\n script_bugtraq_id(72429, 72514, 72698);\n script_xref(name:\"MSKB\", value:\"3021953\");\n\n script_name(english:\"MS KB3021953: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer\");\n script_summary(english:\"Checks the version of the ActiveX control.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host has a browser plugin that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is missing KB3021953. It is, therefore, affected by\nthe following vulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328)\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/3021953/microsoft-security-advisory-update-for-vulnerabilities-in-adobe-flash\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-15-047/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Install Microsoft KB3021953.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-0331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:adobe:flash_player\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_hotfixes.nasl\");\n script_require_keys(\"SMB/Registry/Enumerated\", \"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_activex_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win8:'0', win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nif (activex_init() != ACX_OK) audit(AUDIT_FN_FAIL, \"activex_init()\");\n\n# Adobe Flash Player CLSID\nclsid = '{D27CDB6E-AE6D-11cf-96B8-444553540000}';\n\nfile = activex_get_filename(clsid:clsid);\nif (isnull(file))\n{\n activex_end();\n audit(AUDIT_FN_FAIL, \"activex_get_filename\", \"NULL\");\n}\nif (!file)\n{\n activex_end();\n audit(AUDIT_ACTIVEX_NOT_FOUND, clsid);\n}\n\n# Get its version.\nversion = activex_get_fileversion(clsid:clsid);\nif (!version)\n{\n activex_end();\n audit(AUDIT_VER_FAIL, file);\n}\n\ninfo = '';\n\niver = split(version, sep:'.', keep:FALSE);\nfor (i=0; i<max_index(iver); i++)\n iver[i] = int(iver[i]);\n\n# < 16.0.0.305\nif (\n (report_paranoia > 1 || activex_get_killbit(clsid:clsid) == 0) &&\n (\n iver[0] < 16 ||\n (\n iver[0] == 16 &&\n (\n (iver[1] == 0 && iver[2] == 0 && iver[3] < 305)\n )\n )\n )\n)\n{\n info = '\\n Path : ' + file +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 16.0.0.305' +\n '\\n';\n}\n\nport = kb_smb_transport();\n\nif (info != '')\n{\n if (report_verbosity > 0)\n {\n if (report_paranoia > 1)\n {\n report = info +\n '\\n' +\n 'Note, though, that Nessus did not check whether the kill bit was\\n' +\n \"set for the control's CLSID because of the Report Paranoia setting\" + '\\n' +\n 'in effect when this scan was run.\\n';\n }\n else\n {\n report = info +\n '\\n' +\n 'Moreover, its kill bit is not set so it is accessible via Internet\\n' +\n 'Explorer.\\n';\n }\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n}\nelse audit(AUDIT_HOST_NOT, 'affected');\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T03:29:47", "description": "According to its version, the Adobe Flash Player installed on the\nremote Mac OS X host is equal or prior to 16.0.0.296. It is,\ntherefore, affected by the following vulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)", "edition": 26, "published": "2015-02-02T00:00:00", "title": "Flash Player For Mac <= 16.0.0.296 Unspecified Code Execution (APSA15-02 / APSB15-04)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0330", "CVE-2015-0331", "CVE-2015-0314", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:adobe:flash_player"], "id": "MACOSX_FLASH_PLAYER_APSA15-02.NASL", "href": "https://www.tenable.com/plugins/nessus/81128", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81128);\n script_version(\"1.19\");\n script_cvs_date(\"Date: 2019/11/25\");\n\n script_cve_id(\n \"CVE-2015-0313\",\n \"CVE-2015-0314\",\n \"CVE-2015-0315\",\n \"CVE-2015-0316\",\n \"CVE-2015-0317\",\n \"CVE-2015-0318\",\n \"CVE-2015-0319\",\n \"CVE-2015-0320\",\n \"CVE-2015-0321\",\n \"CVE-2015-0322\",\n \"CVE-2015-0323\",\n \"CVE-2015-0324\",\n \"CVE-2015-0325\",\n \"CVE-2015-0326\",\n \"CVE-2015-0327\",\n \"CVE-2015-0328\",\n \"CVE-2015-0329\",\n \"CVE-2015-0330\",\n \"CVE-2015-0331\"\n );\n script_bugtraq_id(72429, 72514, 72698);\n\n script_name(english:\"Flash Player For Mac <= 16.0.0.296 Unspecified Code Execution (APSA15-02 / APSB15-04)\");\n script_summary(english:\"Checks the version of Flash Player.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Mac OS X host has a browser plugin that is affected by\nmultiple code execution vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the Adobe Flash Player installed on the\nremote Mac OS X host is equal or prior to 16.0.0.296. It is,\ntherefore, affected by the following vulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsa15-02.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-15-047/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Adobe Flash Player version 16.0.0.305 or later.\n\nAlternatively, Adobe has made version 13.0.0.269 available for those\ninstallations that cannot be upgraded to 16.x.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-0331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:adobe:flash_player\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_flash_player_installed.nasl\");\n script_require_keys(\"MacOSX/Flash_Player/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nversion = get_kb_item_or_exit(\"MacOSX/Flash_Player/Version\");\npath = get_kb_item_or_exit(\"MacOSX/Flash_Player/Path\");\n\nif (ver_compare(ver:version, fix:\"14.0.0.0\", strict:FALSE) >= 0)\n{\n cutoff_version = \"16.0.0.296\";\n fix = \"16.0.0.305\";\n}\nelse\n{\n cutoff_version = \"13.0.0.264\";\n fix = \"13.0.0.269\";\n}\n\n# nb: we're checking for versions less than *or equal to* the cutoff!\nif (ver_compare(ver:version, fix:cutoff_version, strict:FALSE) <= 0)\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Path : ' + path +\n '\\n Installed version : ' + version +\n '\\n Fixed version : ' + fix +\n '\\n';\n security_hole(port:0, extra:report);\n }\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_INST_PATH_NOT_VULN, \"Flash Player for Mac\", version, path);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T03:30:16", "description": "The version of Google Chrome installed on the remote Mac OS X host is\nprior to 40.0.2214.111. It is, therefore, affected by the following\nvulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\n\n - A use-after-free error exists related to the DOM\n component. (CVE-2015-1209)\n\n - A cross-origin bypass error exists related to the V8\n JavaScript engine bindings. (CVE-2015-1210)\n\n - A privilege escalation error exists related to service\n workers. (CVE-2015-1211)\n\n - Various, unspecified errors exist. (CVE-2015-1212)", "edition": 26, "published": "2015-02-06T00:00:00", "title": "Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-1210", "CVE-2015-0330", "CVE-2015-1212", "CVE-2015-0331", "CVE-2015-1209", "CVE-2015-0314", "CVE-2015-1211", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "MACOSX_GOOGLE_CHROME_40_0_2214_111.NASL", "href": "https://www.tenable.com/plugins/nessus/81208", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81208);\n script_version(\"1.18\");\n script_cvs_date(\"Date: 2019/11/25\");\n\n script_cve_id(\n \"CVE-2015-0313\",\n \"CVE-2015-0314\",\n \"CVE-2015-0315\",\n \"CVE-2015-0316\",\n \"CVE-2015-0317\",\n \"CVE-2015-0318\",\n \"CVE-2015-0319\",\n \"CVE-2015-0320\",\n \"CVE-2015-0321\",\n \"CVE-2015-0322\",\n \"CVE-2015-0323\",\n \"CVE-2015-0324\",\n \"CVE-2015-0325\",\n \"CVE-2015-0326\",\n \"CVE-2015-0327\",\n \"CVE-2015-0328\",\n \"CVE-2015-0329\",\n \"CVE-2015-0330\",\n \"CVE-2015-0331\",\n \"CVE-2015-1209\",\n \"CVE-2015-1210\",\n \"CVE-2015-1211\",\n \"CVE-2015-1212\"\n );\n script_bugtraq_id(\n 72429,\n 72497,\n 72514,\n 72698\n );\n\n script_name(english:\"Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)\");\n script_summary(english:\"Checks the version number of Google Chrome.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Mac OS X host contains a web browser that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Mac OS X host is\nprior to 40.0.2214.111. It is, therefore, affected by the following\nvulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\n\n - A use-after-free error exists related to the DOM\n component. (CVE-2015-1209)\n\n - A cross-origin bypass error exists related to the V8\n JavaScript engine bindings. (CVE-2015-1210)\n\n - A privilege escalation error exists related to service\n workers. (CVE-2015-1211)\n\n - Various, unspecified errors exist. (CVE-2015-1212)\");\n # http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9661eacd\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-15-047/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome 40.0.2214.111 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-0331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_google_chrome_installed.nbin\");\n script_require_keys(\"MacOSX/Google Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"MacOSX/Google Chrome/Installed\");\n\ngoogle_chrome_check_version(fix:'40.0.2214.111', severity:SECURITY_HOLE, xss:TRUE);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T03:05:39", "description": "The version of Google Chrome installed on the remote Windows host is\nprior to 40.0.2214.111. It is, therefore, affected by the following\nvulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\n\n - A use-after-free error exists related to the DOM\n component. (CVE-2015-1209)\n\n - A cross-origin bypass error exists related to the V8\n JavaScript engine bindings. (CVE-2015-1210)\n\n - A privilege escalation error exists related to service\n workers. (CVE-2015-1211)\n\n - Various, unspecified errors exist. (CVE-2015-1212)", "edition": 26, "published": "2015-02-06T00:00:00", "title": "Google Chrome < 40.0.2214.111 Multiple Vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0313", "CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-1210", "CVE-2015-0330", "CVE-2015-1212", "CVE-2015-0331", "CVE-2015-1209", "CVE-2015-0314", "CVE-2015-1211", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0318", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0320", "CVE-2015-0323"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "GOOGLE_CHROME_40_0_2214_111.NASL", "href": "https://www.tenable.com/plugins/nessus/81207", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81207);\n script_version(\"1.18\");\n script_cvs_date(\"Date: 2019/11/25\");\n\n script_cve_id(\n \"CVE-2015-0313\",\n \"CVE-2015-0314\",\n \"CVE-2015-0315\",\n \"CVE-2015-0316\",\n \"CVE-2015-0317\",\n \"CVE-2015-0318\",\n \"CVE-2015-0319\",\n \"CVE-2015-0320\",\n \"CVE-2015-0321\",\n \"CVE-2015-0322\",\n \"CVE-2015-0323\",\n \"CVE-2015-0324\",\n \"CVE-2015-0325\",\n \"CVE-2015-0326\",\n \"CVE-2015-0327\",\n \"CVE-2015-0328\",\n \"CVE-2015-0329\",\n \"CVE-2015-0330\",\n \"CVE-2015-0331\",\n \"CVE-2015-1209\",\n \"CVE-2015-1210\",\n \"CVE-2015-1211\",\n \"CVE-2015-1212\"\n );\n script_bugtraq_id(\n 72429,\n 72497,\n 72514,\n 72698\n );\n\n script_name(english:\"Google Chrome < 40.0.2214.111 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version number of Google Chrome.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains a web browser that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Windows host is\nprior to 40.0.2214.111. It is, therefore, affected by the following\nvulnerabilities :\n\n - Several use-after-free errors exist that allow arbitrary\n code execution. (CVE-2015-0313, CVE-2015-0315,\n CVE-2015-0320, CVE-2015-0322)\n\n - Several memory corruption errors exist that allow\n arbitrary code execution. (CVE-2015-0314,\n CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,\n CVE-2015-0329, CVE-2015-0330)\n\n - Several type confusion errors exist that allow\n arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)\n\n - Several heap-based buffer-overflow errors exist that\n allow arbitrary code execution. (CVE-2015-0323,\n CVE-2015-0327)\n\n - A buffer overflow error exists that allows arbitrary\n code execution. (CVE-2015-0324)\n\n - Several null pointer dereference errors exist that have\n unspecified impacts. (CVE-2015-0325, CVE-2015-0326,\n CVE-2015-0328).\n\n - A user-after-free error exists within the processing of\n invalid m3u8 playlists. A remote attacker, with a\n specially crafted m3u8 playlist file, can force a\n dangling pointer to be reused after it has been freed,\n allowing the execution of arbitrary code.\n (CVE-2015-0331)\n\n - A use-after-free error exists related to the DOM\n component. (CVE-2015-1209)\n\n - A cross-origin bypass error exists related to the V8\n JavaScript engine bindings. (CVE-2015-1210)\n\n - A privilege escalation error exists related to service\n workers. (CVE-2015-1211)\n\n - Various, unspecified errors exist. (CVE-2015-1212)\");\n # http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?9661eacd\");\n script_set_attribute(attribute:\"see_also\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-04.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.zerodayinitiative.com/advisories/ZDI-15-047/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome 40.0.2214.111 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-0331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"google_chrome_installed.nasl\");\n script_require_keys(\"SMB/Google_Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"SMB/Google_Chrome/Installed\");\ninstalls = get_kb_list(\"SMB/Google_Chrome/*\");\n\ngoogle_chrome_check_version(installs:installs, fix:'40.0.2214.111', severity:SECURITY_HOLE, xss:TRUE);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T11:04:25", "description": "The remote host is affected by the vulnerability described in GLSA-201502-02\n(Adobe Flash Player: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Adobe Flash Player.\n Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, obtain\n sensitive information or bypass security restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 23, "published": "2015-02-09T00:00:00", "title": "GLSA-201502-02 : Adobe Flash Player: Multiple vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0303", "CVE-2015-0305", "CVE-2015-0304", "CVE-2015-0308", "CVE-2015-0330", "CVE-2015-0301", "CVE-2015-0309", "CVE-2015-0314", "CVE-2015-0302", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0311", "CVE-2015-0318", "CVE-2015-0307", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0306", "CVE-2015-0320", "CVE-2015-0310", "CVE-2015-0323"], "modified": "2015-02-09T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:adobe-flash"], "id": "GENTOO_GLSA-201502-02.NASL", "href": "https://www.tenable.com/plugins/nessus/81225", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201502-02.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81225);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-0301\", \"CVE-2015-0302\", \"CVE-2015-0303\", \"CVE-2015-0304\", \"CVE-2015-0305\", \"CVE-2015-0306\", \"CVE-2015-0307\", \"CVE-2015-0308\", \"CVE-2015-0309\", \"CVE-2015-0310\", \"CVE-2015-0311\", \"CVE-2015-0314\", \"CVE-2015-0315\", \"CVE-2015-0316\", \"CVE-2015-0317\", \"CVE-2015-0318\", \"CVE-2015-0319\", \"CVE-2015-0320\", \"CVE-2015-0321\", \"CVE-2015-0322\", \"CVE-2015-0323\", \"CVE-2015-0324\", \"CVE-2015-0325\", \"CVE-2015-0326\", \"CVE-2015-0327\", \"CVE-2015-0328\", \"CVE-2015-0329\", \"CVE-2015-0330\");\n script_xref(name:\"GLSA\", value:\"201502-02\");\n\n script_name(english:\"GLSA-201502-02 : Adobe Flash Player: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201502-02\n(Adobe Flash Player: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Adobe Flash Player.\n Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, obtain\n sensitive information or bypass security restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201502-02\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Adobe Flash Player users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-plugins/adobe-flash-11.2.202.442'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Adobe Flash Player PCRE Regex Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:adobe-flash\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/02/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-plugins/adobe-flash\", unaffected:make_list(\"ge 11.2.202.442\"), vulnerable:make_list(\"lt 11.2.202.442\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Adobe Flash Player\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:19", "bulletinFamily": "unix", "cvelist": ["CVE-2015-0326", "CVE-2015-0328", "CVE-2015-0329", "CVE-2015-0327", "CVE-2015-0321", "CVE-2015-0317", "CVE-2015-0303", "CVE-2015-0305", "CVE-2015-0304", "CVE-2015-0308", "CVE-2015-0330", "CVE-2015-0301", "CVE-2015-0309", "CVE-2015-0314", "CVE-2015-0302", "CVE-2015-0322", "CVE-2015-0324", "CVE-2015-0315", "CVE-2015-0311", "CVE-2015-0318", "CVE-2015-0307", "CVE-2015-0319", "CVE-2015-0325", "CVE-2015-0316", "CVE-2015-0306", "CVE-2015-0320", "CVE-2015-0310", "CVE-2015-0323"], "description": "### Background\n\nThe Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Adobe Flash Player users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-plugins/adobe-flash-11.2.202.442\"", "edition": 1, "modified": "2015-02-06T00:00:00", "published": "2015-02-06T00:00:00", "id": "GLSA-201502-02", "href": "https://security.gentoo.org/glsa/201502-02", "type": "gentoo", "title": "Adobe Flash Player: Multiple vulnerabilities", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
