{"id": "CVE-2015-7635", "bulletinFamily": "NVD", "title": "CVE-2015-7635", "description": "Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.\n<a href=\"http://cwe.mitre.org/data/definitions/416.html\">CWE-416: Use After Free</a>", "published": "2015-10-18T10:59:00", "modified": "2018-01-05T02:30:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7635", "reporter": "cve@mitre.org", "references": ["https://helpx.adobe.com/security/products/flash-player/apsb15-25.html", "http://rhn.redhat.com/errata/RHSA-2015-2024.html", "http://www.securityfocus.com/bid/77061", "http://rhn.redhat.com/errata/RHSA-2015-1893.html"], "cvelist": ["CVE-2015-7635"], "type": "cve", "lastseen": "2019-05-29T18:14:44", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "7378ad685f0fffb98c8e3a5562942d7c"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "436a2d27dbfc166550d10e72ec88e078"}, {"key": "cvss", "hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d"}, {"key": "cvss2", "hash": "2eda51aa00254f6a2acf49f602c4bbfa"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "04fb5d848b1b1ef4a905836b37ac2613"}, {"key": "href", "hash": "87733ea1c7b04601e31b503bbc5fd3cd"}, {"key": "modified", "hash": "7e76cf634ea9b5917f898f477e277fff"}, {"key": "published", "hash": "7c6240a1ef41fc0bfd53471ed262e0ed"}, {"key": "references", "hash": "f3570715cd4d26129d96e2a911b420d0"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "4a7c5bcb3b814a1c5c9792a89a3892c4"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "ee0cfa3af803fd4139a255b1a90b45f4eaf1b2cfd2438294fdcd2ef574ea8cc8", "viewCount": 1, "enchantments": {"score": {"value": 9.0, "vector": "NONE", "modified": "2019-05-29T18:14:44"}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310806096", "OPENVAS:1361412562310806093", "OPENVAS:1361412562310806097", "OPENVAS:1361412562310806094", "OPENVAS:1361412562310806095"]}, {"type": "kaspersky", "idList": ["KLA10679"]}, {"type": "nessus", "idList": ["REDHAT-RHSA-2015-1893.NASL", "REDHAT-RHSA-2015-2024.NASL"]}, {"type": "redhat", "idList": ["RHSA-2015:2024"]}], "modified": "2019-05-29T18:14:44"}, "vulnersScore": 9.0}, "objectVersion": "1.3", "cpe": [], "affectedSoftware": [{"name": "adobe flash_player", "operator": "le", "version": "11.2.202.521"}, {"name": "adobe air", "operator": "le", "version": "19.0.0.190"}, {"name": "adobe flash_player", "operator": "le", "version": "19.0.0.185"}, {"name": "adobe air_sdk_&_compiler", "operator": "le", "version": "19.0.0.190"}, {"name": "adobe air_sdk", "operator": "le", "version": "19.0.0.190"}], "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": [], "cwe": ["NVD-CWE-Other"]}

{"openvas": [{"lastseen": "2019-05-29T18:37:03", "bulletinFamily": "scanner", "description": "This host is installed with Adobe Air\n and is prone to multiple vulnerabilities.", "modified": "2018-10-12T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310806096", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806096", "title": "Adobe Air Multiple Vulnerabilities -01 Oct15 (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_adobe_air_mult_vuln01_oct15_win.nasl 11872 2018-10-12 11:22:41Z cfischer $\n#\n# Adobe Air Multiple Vulnerabilities -01 Oct15 (Windows)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:adobe_air\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806096\");\n script_version(\"$Revision: 11872 $\");\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\",\n \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\",\n \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\",\n \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\",\n \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\",\n \"CVE-2015-7644\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 13:22:41 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 15:34:40 +0530 (Fri, 16 Oct 2015)\");\n script_name(\"Adobe Air Multiple Vulnerabilities -01 Oct15 (Windows)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Air\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Improper implementation of the Flash broker API.\n\n - Multiple memory corruption errors.\n\n - An use-after-free error.\n\n - An error in same origin policy.\n\n - A buffer overflow error.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to obtain sensitive information, execute arbitrary code or cause a denial of\n service and have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Air versions before\n 19.0.0.213 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Air version\n 19.0.0.213 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_adobe_flash_player_detect_win.nasl\");\n script_mandatory_keys(\"Adobe/Air/Win/Installed\");\n script_xref(name:\"URL\", value:\"http://get.adobe.com/air\");\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!airVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:airVer, test_version:\"19.0.0.213\"))\n{\n report = 'Installed version: ' + airVer + '\\n' +\n 'Fixed version: ' + \"19.0.0.213\" + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:58", "bulletinFamily": "scanner", "description": "This host is installed with Adobe Air\n and is prone to multiple vulnerabilities.", "modified": "2018-10-12T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310806097", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806097", "title": "Adobe Air Multiple Vulnerabilities -01 Oct15 (Mac OS X)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_adobe_air_mult_vuln01_oct15_macosx.nasl 11872 2018-10-12 11:22:41Z cfischer $\n#\n# Adobe Air Multiple Vulnerabilities -01 Oct15 (Mac OS X)\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:adobe_air\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806097\");\n script_version(\"$Revision: 11872 $\");\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\",\n \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\",\n \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\",\n \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\",\n \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\",\n \"CVE-2015-7644\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 13:22:41 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 14:34:40 +0530 (Fri, 16 Oct 2015)\");\n script_name(\"Adobe Air Multiple Vulnerabilities -01 Oct15 (Mac OS X)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Air\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Improper implementation of the Flash broker API.\n\n - Multiple memory corruption errors.\n\n - An use-after-free error.\n\n - An error in same origin policy.\n\n - A buffer overflow error.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to obtain sensitive information, execute arbitrary code or cause a denial of\n service and have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Air versions before\n 19.0.0.213 on Mac OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Air version\n 19.0.0.213 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"secpod_adobe_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Adobe/Air/MacOSX/Version\");\n script_xref(name:\"URL\", value:\"http://get.adobe.com/air\");\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!airVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:airVer, test_version:\"19.0.0.213\"))\n{\n report = 'Installed version: ' + airVer + '\\n' +\n 'Fixed version: ' + \"19.0.0.213\" + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T22:13:40", "bulletinFamily": "scanner", "description": "This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.", "modified": "2019-07-17T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310806094", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806094", "title": "Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Mac OS X)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Mac OS X)\n#\n# Authors:\n# Rinu <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:flash_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806094\");\n script_version(\"2019-07-17T11:14:11+0000\");\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\",\n \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\",\n \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\",\n \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\",\n \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\",\n \"CVE-2015-7644\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 11:14:11 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 13:33:10 +0530 (Fri, 16 Oct 2015)\");\n script_name(\"Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Mac OS X)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Improper implementation of the Flash broker API.\n\n - Multiple memory corruption errors.\n\n - An use-after-free error.\n\n - An error in same origin policy.\n\n - A buffer overflow error.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to obtain sensitive information, execute arbitrary code or cause a denial of\n service and have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Flash Player before version\n 18.0.0.252 and 19.x through 19.0.0.185 on Mac OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Flash Player version\n 18.0.0.252 or 19.0.0.207 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"secpod_adobe_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Adobe/Flash/Player/MacOSX/Version\");\n\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!playerVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:playerVer, test_version:\"18.0.0.252\"))\n{\n fix = \"18.0.0.252\";\n VULN = TRUE;\n}\n\nif(version_in_range(version:playerVer, test_version:\"19.0\", test_version2:\"19.0.0.185\"))\n{\n fix = \"19.0.0.207\";\n VULN = TRUE;\n}\n\nif(VULN)\n{\n report = 'Installed version: ' + playerVer + '\\n' +\n 'Fixed version: ' + fix + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T22:12:49", "bulletinFamily": "scanner", "description": "This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.", "modified": "2019-07-17T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310806095", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806095", "title": "Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Linux)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Linux)\n#\n# Authors:\n# Rinu <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:flash_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806095\");\n script_version(\"2019-07-17T11:14:11+0000\");\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\",\n \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\",\n \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\",\n \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\",\n \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\",\n \"CVE-2015-7644\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 11:14:11 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 13:35:25 +0530 (Fri, 16 Oct 2015)\");\n script_name(\"Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Linux)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Improper implementation of the Flash broker API.\n\n - Multiple memory corruption errors.\n\n - An use-after-free error.\n\n - An error in same origin policy.\n\n - A buffer overflow error.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to obtain sensitive information, execute arbitrary code or cause a denial of\n service and have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Flash Player before version\n 11.2.202.535 on Linux.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Flash Player version\n 11.2.202.535 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_adobe_flash_player_detect_lin.nasl\");\n script_mandatory_keys(\"AdobeFlashPlayer/Linux/Ver\");\n\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!playerVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:playerVer, test_version:\"11.2.202.535\"))\n{\n report = 'Installed version: ' + playerVer + '\\n' +\n 'Fixed version: 11.2.202.535 \\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T22:13:47", "bulletinFamily": "scanner", "description": "This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.", "modified": "2019-07-17T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310806093", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806093", "title": "Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Windows)\n#\n# Authors:\n# Rinu <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:adobe:flash_player\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806093\");\n script_version(\"2019-07-17T11:14:11+0000\");\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\",\n \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\",\n \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\",\n \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\",\n \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\",\n \"CVE-2015-7644\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 11:14:11 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 17:18:06 +0530 (Fri, 16 Oct 2015)\");\n script_name(\"Adobe Flash Player Multiple Vulnerabilities - 01 Oct15 (Windows)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Adobe Flash\n Player and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Improper implementation of the Flash broker API.\n\n - Multiple memory corruption errors.\n\n - An use-after-free error.\n\n - An error in same origin policy.\n\n - A buffer overflow error.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to obtain sensitive information, execute arbitrary code or cause a denial of\n service and have other unspecified impacts.\");\n\n script_tag(name:\"affected\", value:\"Adobe Flash Player before version\n 18.0.0.252 and 19.x through 19.0.0.185 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Adobe Flash Player version\n 18.0.0.252 or 19.0.0.207 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n\n script_xref(name:\"URL\", value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_adobe_flash_player_detect_win.nasl\");\n script_mandatory_keys(\"AdobeFlashPlayer/Win/Installed\");\n\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!playerVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:playerVer, test_version:\"18.0.0.252\"))\n{\n fix = \"18.0.0.252\";\n VULN = TRUE;\n}\n\nif(version_in_range(version:playerVer, test_version:\"19.0\", test_version2:\"19.0.0.185\"))\n{\n fix = \"19.0.0.207\";\n VULN = TRUE;\n}\n\nif(VULN)\n{\n report = 'Installed version: ' + playerVer + '\\n' +\n 'Fixed version: ' + fix + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "kaspersky": [{"lastseen": "2019-03-21T00:14:35", "bulletinFamily": "info", "description": "### *Detect date*:\n10/13/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Adobe Flash Player &amp; AIR. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions or execute arbitrary code.\n\n### *Affected products*:\nAdobe Flash Player versions earlier than 19.0.0.207 \nAdobe Flash Player Extended Support Release versions earlier than 18.0.0.252 \nAdobe Flash Player for Linux versions earlier than 11.2.202.535 \nAdobe AIR versions earlier than 19.0.0.213\n\n### *Solution*:\nUpdate to the latest version \n[Get Flash Player](<https://get.adobe.com/flashplayer/>) \n[Get AIR](<https://get.adobe.com/air/>)\n\n### *Original advisories*:\n[Adobe bulletin](<https://helpx.adobe.com/security/products/flash-player/apsb15-25.html>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Adobe Flash Player ActiveX](<https://threats.kaspersky.com/en/product/Adobe-Flash-Player-ActiveX/>)\n\n### *CVE-IDS*:\n[CVE-2015-7627](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7627>)10.0Critical \n[CVE-2015-7628](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7628>)5.0Critical \n[CVE-2015-7637](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7637>)10.0Critical \n[CVE-2015-7636](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7636>)10.0Critical \n[CVE-2015-7644](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7644>)10.0Critical \n[CVE-2015-7635](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7635>)10.0Critical \n[CVE-2015-5569](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5569>)10.0Critical \n[CVE-2015-7625](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7625>)10.0Critical \n[CVE-2015-7626](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7626>)10.0Critical \n[CVE-2015-7630](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7630>)10.0Critical \n[CVE-2015-7629](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7629>)9.3Critical \n[CVE-2015-7643](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7643>)9.3Critical \n[CVE-2015-7631](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7631>)9.3Critical \n[CVE-2015-7641](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7641>)10.0Critical \n[CVE-2015-7633](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7633>)10.0Critical \n[CVE-2015-7639](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7639>)10.0Critical \n[CVE-2015-7640](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7640>)10.0Critical \n[CVE-2015-7638](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7638>)10.0Critical \n[CVE-2015-7634](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7634>)10.0Critical \n[CVE-2015-7632](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7632>)9.3Critical \n[CVE-2015-7642](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7642>)10.0Critical", "modified": "2019-03-07T00:00:00", "published": "2015-10-13T00:00:00", "id": "KLA10679", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10679", "title": "\r KLA10679Multiple vulnerabilities in Adobe Flash Player & AIR ", "type": "kaspersky", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2020-04-01T02:13:35", "bulletinFamily": "scanner", "description": "An updated Adobe Flash Player package that fixes multiple security\nissues is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe flash-plugin package contains a Mozilla Firefox compatible Adobe\nFlash Player web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player.\nThese vulnerabilities, detailed in the Adobe Security Bulletin\nAPSB15-25 listed in the References section, could allow an attacker to\ncreate a specially crafted SWF file that would cause flash-plugin to\ncrash, execute arbitrary code, or disclose sensitive information when\nthe victim loaded a page containing the malicious SWF content.\n(CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627,\nCVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631,\nCVE-2015-7632, CVE-2015-7633, CVE-2015-7634, CVE-2015-7643,\nCVE-2015-7644)\n\nAll users of Adobe Flash Player should install this updated package,\nwhich upgrades Flash Player to version 11.2.202.535.", "modified": "2020-04-02T00:00:00", "id": "REDHAT-RHSA-2015-1893.NASL", "href": "https://www.tenable.com/plugins/nessus/86396", "published": "2015-10-15T00:00:00", "title": "RHEL 6 : flash-plugin (RHSA-2015:1893)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:1893. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86396);\n script_version(\"2.16\");\n script_cvs_date(\"Date: 2019/10/24 15:35:40\");\n\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\", \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\", \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\", \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\", \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\", \"CVE-2015-7644\");\n script_xref(name:\"RHSA\", value:\"2015:1893\");\n\n script_name(english:\"RHEL 6 : flash-plugin (RHSA-2015:1893)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated Adobe Flash Player package that fixes multiple security\nissues is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe flash-plugin package contains a Mozilla Firefox compatible Adobe\nFlash Player web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player.\nThese vulnerabilities, detailed in the Adobe Security Bulletin\nAPSB15-25 listed in the References section, could allow an attacker to\ncreate a specially crafted SWF file that would cause flash-plugin to\ncrash, execute arbitrary code, or disclose sensitive information when\nthe victim loaded a page containing the malicious SWF content.\n(CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627,\nCVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631,\nCVE-2015-7632, CVE-2015-7633, CVE-2015-7634, CVE-2015-7643,\nCVE-2015-7644)\n\nAll users of Adobe Flash Player should install this updated package,\nwhich upgrades Flash Player to version 11.2.202.535.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2015:1893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7644\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7633\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7634\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7626\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7627\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7625\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7631\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-5569\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7632\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7628\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7629\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected flash-plugin package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:flash-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:1893\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", reference:\"flash-plugin-11.2.202.535-1.el6_7\")) flag++;\n\n\n if (flag)\n {\n flash_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check only applies to RedHat released\\n' +\n 'versions of the flash-plugin package. This check does not apply to\\n' +\n 'Adobe released versions of the flash-plugin package, which are\\n' +\n 'versioned similarly and cause collisions in detection.\\n\\n' +\n\n 'If you are certain you are running the Adobe released package of\\n' +\n 'flash-plugin and are running a version of it equal or higher to the\\n' +\n 'RedHat version listed above then you can consider this a false\\n' +\n 'positive.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat() + flash_plugin_caveat\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"flash-plugin\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-01T02:13:35", "bulletinFamily": "scanner", "description": "An updated Adobe Flash Player package that fixes multiple security\nissues is now available for Red Hat Enterprise Linux 5 Supplementary.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe flash-plugin package contains a Mozilla Firefox compatible Adobe\nFlash Player web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player.\nThese vulnerabilities, detailed in the Adobe Security Bulletins\nAPSB15-25, APSB15-27, and APSB15-28 listed in the References section,\ncould allow an attacker to create a specially crafted SWF file that\nwould cause flash-plugin to crash, execute arbitrary code, or disclose\nsensitive information when the victim loaded a page containing the\nmalicious SWF content. (CVE-2015-5569, CVE-2015-7625, CVE-2015-7626,\nCVE-2015-7627, CVE-2015-7628, CVE-2015-7629, CVE-2015-7630,\nCVE-2015-7631, CVE-2015-7632, CVE-2015-7633, CVE-2015-7634,\nCVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638,\nCVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642,\nCVE-2015-7643, CVE-2015-7644, CVE-2015-7645, CVE-2015-7647,\nCVE-2015-7648, CVE-2015-7651, CVE-2015-7652, CVE-2015-7653,\nCVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657,\nCVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661,\nCVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043,\nCVE-2015-8044, CVE-2015-8046)\n\nAll users of Adobe Flash Player should install this updated package,\nwhich upgrades Flash Player to version 11.2.202.548.", "modified": "2020-04-02T00:00:00", "id": "REDHAT-RHSA-2015-2024.NASL", "href": "https://www.tenable.com/plugins/nessus/86862", "published": "2015-11-12T00:00:00", "title": "RHEL 5 : flash-plugin (RHSA-2015:2024)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:2024. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(86862);\n script_version(\"2.15\");\n script_cvs_date(\"Date: 2019/10/24 15:35:40\");\n\n script_cve_id(\"CVE-2015-5569\", \"CVE-2015-7625\", \"CVE-2015-7626\", \"CVE-2015-7627\", \"CVE-2015-7628\", \"CVE-2015-7629\", \"CVE-2015-7630\", \"CVE-2015-7631\", \"CVE-2015-7632\", \"CVE-2015-7633\", \"CVE-2015-7634\", \"CVE-2015-7635\", \"CVE-2015-7636\", \"CVE-2015-7637\", \"CVE-2015-7638\", \"CVE-2015-7639\", \"CVE-2015-7640\", \"CVE-2015-7641\", \"CVE-2015-7642\", \"CVE-2015-7643\", \"CVE-2015-7644\", \"CVE-2015-7645\", \"CVE-2015-7647\", \"CVE-2015-7648\", \"CVE-2015-7651\", \"CVE-2015-7652\", \"CVE-2015-7653\", \"CVE-2015-7654\", \"CVE-2015-7655\", \"CVE-2015-7656\", \"CVE-2015-7657\", \"CVE-2015-7658\", \"CVE-2015-7659\", \"CVE-2015-7660\", \"CVE-2015-7661\", \"CVE-2015-7662\", \"CVE-2015-7663\", \"CVE-2015-8042\", \"CVE-2015-8043\", \"CVE-2015-8044\", \"CVE-2015-8046\");\n script_xref(name:\"RHSA\", value:\"2015:2024\");\n\n script_name(english:\"RHEL 5 : flash-plugin (RHSA-2015:2024)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated Adobe Flash Player package that fixes multiple security\nissues is now available for Red Hat Enterprise Linux 5 Supplementary.\n\nRed Hat Product Security has rated this update as having Critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe flash-plugin package contains a Mozilla Firefox compatible Adobe\nFlash Player web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player.\nThese vulnerabilities, detailed in the Adobe Security Bulletins\nAPSB15-25, APSB15-27, and APSB15-28 listed in the References section,\ncould allow an attacker to create a specially crafted SWF file that\nwould cause flash-plugin to crash, execute arbitrary code, or disclose\nsensitive information when the victim loaded a page containing the\nmalicious SWF content. (CVE-2015-5569, CVE-2015-7625, CVE-2015-7626,\nCVE-2015-7627, CVE-2015-7628, CVE-2015-7629, CVE-2015-7630,\nCVE-2015-7631, CVE-2015-7632, CVE-2015-7633, CVE-2015-7634,\nCVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638,\nCVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642,\nCVE-2015-7643, CVE-2015-7644, CVE-2015-7645, CVE-2015-7647,\nCVE-2015-7648, CVE-2015-7651, CVE-2015-7652, CVE-2015-7653,\nCVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657,\nCVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661,\nCVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043,\nCVE-2015-8044, CVE-2015-8046)\n\nAll users of Adobe Flash Player should install this updated package,\nwhich upgrades Flash Player to version 11.2.202.548.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-27.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://helpx.adobe.com/security/products/flash-player/apsb15-28.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2015:2024\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7644\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7633\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7634\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7626\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7627\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7625\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7631\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7630\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-5569\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7632\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7628\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7629\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7635\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7636\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7637\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7638\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7640\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7641\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7642\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7648\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7645\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7647\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7657\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7656\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7654\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7653\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7651\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7662\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7663\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7660\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7661\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7659\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-7658\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8044\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8043\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8042\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected flash-plugin package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:flash-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/11/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/11/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^5([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:2024\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL5\", reference:\"flash-plugin-11.2.202.548-1.el5\")) flag++;\n\n if (flag)\n {\n flash_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check only applies to RedHat released\\n' +\n 'versions of the flash-plugin package. This check does not apply to\\n' +\n 'Adobe released versions of the flash-plugin package, which are\\n' +\n 'versioned similarly and cause collisions in detection.\\n\\n' +\n\n 'If you are certain you are running the Adobe released package of\\n' +\n 'flash-plugin and are running a version of it equal or higher to the\\n' +\n 'RedHat version listed above then you can consider this a false\\n' +\n 'positive.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat() + flash_plugin_caveat\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"flash-plugin\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2019-05-29T14:35:33", "bulletinFamily": "unix", "description": "The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash\nPlayer web browser plug-in.\n\nThis update fixes multiple vulnerabilities in Adobe Flash Player. These\nvulnerabilities, detailed in the Adobe Security Bulletins APSB15-25,\nAPSB15-27, and APSB15-28 listed in the References section, could allow an\nattacker to create a specially crafted SWF file that would cause\nflash-plugin to crash, execute arbitrary code, or disclose sensitive\ninformation when the victim loaded a page containing the malicious SWF\ncontent. (CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627,\nCVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631, CVE-2015-7632,\nCVE-2015-7633, CVE-2015-7634, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637,\nCVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642,\nCVE-2015-7643, CVE-2015-7644, CVE-2015-7645, CVE-2015-7647, CVE-2015-7648,\nCVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655,\nCVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660,\nCVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043,\nCVE-2015-8044, CVE-2015-8046)\n\nAll users of Adobe Flash Player should install this updated package, which\nupgrades Flash Player to version 11.2.202.548.\n", "modified": "2017-07-27T07:18:58", "published": "2015-11-11T05:00:00", "id": "RHSA-2015:2024", "href": "https://access.redhat.com/errata/RHSA-2015:2024", "type": "redhat", "title": "(RHSA-2015:2024) Critical: flash-plugin security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}