The remote host is affected by the vulnerability described in GLSA-201204-07 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted SWF       file, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to bypass intended access restrictions,       bypass cross-domain policy, inject arbitrary web script, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote host is earlier than 18.0.1025.142 and is, therefore, affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can     allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction     and 'EUC-JP'. This can lead to cross-site scripting     attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text     handling and text fragment handling. (CVE-2011-3059,     CVE-2011-3060)

  - A certificate checking error exists related to the     SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'.
    (CVE-2011-3062)

  - Navigation requests from the renderer are not validated     carefully enough.(CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping.
    (CVE-2011-3064)

  - An unspecified memory corruption error exists related     to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains     errors related to ActiveX and the NetStream class.
    These errors can allow memory corruption, denial of     service via application crashes and possibly code     execution. (CVE-2012-0772, CVE-2012-0773)

According to its version, the instance of Adobe AIR 3.x on the remote Windows host is 3.1.0.4880 or earlier and is reportedly affected by several critical memory corruption vulnerabilities :
 
  - Memory corruption vulnerabilities related to URL     security domain checking. (CVE-2012-0772)

  - A flaw in the NetStream Class that could lead to remote     code execution. (CVE-2012-0773)

By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize these vulnerabilities to execute arbitrary code subject to the users' privileges.

ID	名稱	產品	系列	已發布	已更新	嚴重性
59623	GLSA-201204-07 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/21	2022/6/8	critical
58536	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Nessus	Windows	2012/3/30	2026/5/19	high
58537	Adobe AIR 3.x <= 3.1.0.4880 Multiple Memory Corruption Vulnerabilities (APSB12-07)	Nessus	Windows	2012/3/30	2022/4/11	high

偵測

搜尋 Plugin

critical

high

high