A week in security (November 19 – 25)

Last week on Malwarebytes Labs, we took a look at a devastating business email compromise attack, web skimming antics, and the fresh perils of Deepfakes. We also checked out some Chrome bug issues, and took the deepest of deep dives into DNA testing. Other cybersecurity news Adobe Flash bug—get...

Brave Software: Brave allows flash to follow 307 redirects to other origins with arbitrary content-types

Steps to reproduce: Used https://github.com/sp1d3r/swfjsoncsrf in latest available version of flash to send a post request cross-domain with a non-simple content type. Actual results: The request is sent in firefox. Expected results: The request should either not be sent or the content-type shoul...

MGASA-2018-0467 Updated flash-player-plugin packages fix security vulnerability

A critical vulnerability in Adobe Flash Player 31.0.0.148 and earlier versions. Successful exploitation could lead to arbitrary code execution in the context of the current user. CVE-2018-15981...

Updated flash-player-plugin packages fix security vulnerability

A critical vulnerability in Adobe Flash Player 31.0.0.148 and earlier versions. Successful exploitation could lead to arbitrary code execution in the context of the current user. CVE-2018-15981...

[ASA-201811-19] flashplugin: arbitrary code execution

Arch Linux Security Advisory ASA-201811-19 ========================================== Severity: Critical Date : 2018-11-22 CVE-ID : CVE-2018-15981 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-818 Summary ======= The package flashplug...

Adobe Flash Player <= 31.0.0.148 (APSB18-44)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 31.0.0.148. It is therefore affected by an arbitrary code execution vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

FreeBSD : Flash Player -- arbitrary code execution (8f128c72-ecf9-11e8-aa00-6451062f0f7a)

Adobe reports : - This update resolves a type confusion vulnerability that could lead to arbitrary code execution CVE-2018-15981. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques...

Adobe Flash Player Security Update (APSB18-44) - Linux

Adobe Flash Player is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Within Google Chrome Security Update (APSB18-44) - Linux

Adobe Flash Player is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Within Google Chrome Security Update (APSB18-44) - Windows

Adobe Flash Player is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Arbitrary Code Execution Vulnerability (CNVD-2018-23622)

Adobe Flash Player is a cross-platform, browser-based multimedia player product. An arbitrary code execution vulnerability exists in Adobe Flash Player. An attacker can exploit the vulnerability to execute arbitrary code...

KB4477029: Security update for Adobe Flash Player (November 2018)

The remote Windows host is missing security update KB4477029. It is, therefore, affected by an arbitrary code execution vulnerability in Adobe Flash Player. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid119095; scriptversion"1.6"; scriptcvsdate"Date: 2019/11/01";...

Adobe Flash Player for Mac <= 31.0.0.148 (APSB18-44)

The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 31.0.0.148. It is therefore affected by an arbitrary code execution vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid119093; scriptversion"1.5";...

RHEL 6 : flash-plugin (RHSA-2018:3644)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3644 advisory. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version...

Adobe Flash Player Security Update (APSB18-44) - Windows

Adobe Flash Player is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Security Update (APSB18-44) - Mac OS X

Adobe Flash Player is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Within Google Chrome Security Update (APSB18-44) - Mac OS X

Adobe Flash Player is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Security Update (APSB18-44) - Windows

Adobe Flash Player within Microsoft Edge or Internet Explorer is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Critical Adobe Flash Bug Impacts Windows, macOS, Linux and Chrome OS

Adobe released a patch for a critical flaw on Tuesday that leaves its Flash Player vulnerable to arbitrary code execution by an adversary. Affected are versions of the Flash Player running on Windows, macOS, Linux and Chrome OS. In tandem, a Microsoft Security Advisory was also issued for the bug...

Critical: Red Hat Security Advisory: flash-plugin security update

An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...