The version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to version 18.0.0.194. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

The remote Windows host is missing KB3065823. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

flash-player was updated to fix 35 security issues.

These security issues were fixed :

  - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer     overflow vulnerabilities that could lead to code     execution (bsc#937339).

  - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130,     CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory     corruption vulnerabilities that could lead to code     execution (bsc#937339).

  - CVE-2015-3126, CVE-2015-4429: NULL pointer dereference     issues (bsc#937339).

  - CVE-2015-3114: A security bypass vulnerability that     could lead to information disclosure (bsc#937339).

  - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121,     CVE-2015-3122, CVE-2015-4433: Type confusion     vulnerabilities that could lead to code execution     (bsc#937339).

  - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117,     CVE-2015-3127, CVE-2015-3128, CVE-2015-3129,     CVE-2015-3131, CVE-2015-3132, CVE-2015-3136,     CVE-2015-3137, CVE-2015-4428, CVE-2015-4430,     CVE-2015-5119: Use-after-free vulnerabilities that could     lead to code execution (bsc#937339).

  - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116,     CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could     be exploited to bypass the same-origin-policy and lead     to information disclosure (bsc#937339).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote Windows host is prior to 43.0.2357.132. It is, therefore, affected by multiple vulnerabilities in the bundled version of Adobe Flash :

  - An information disclosure vulnerability exists that     allows an attacker to guess the address for the Flash     heap. (CVE-2015-3097)

  - Multiple heap-based buffer overflow vulnerabilities     exist that allow arbitrary code execution.
    (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)

  - Multiple memory corruption vulnerabilities exist that     allow arbitrary code execution. (CVE-2015-3117,     CVE-2015-3123, CVE-2015-3130, CVE-2015-3133,     CVE-2015-3134, CVE-2015-4431)

  - Multiple NULL pointer dereference flaws exist.
    (CVE-2015-3126, CVE-2015-4429)

  - A security bypass vulnerability exists that results in     an information disclosure. (CVE-2015-3114)

  - Multiple type confusion vulnerabilities exist that allow     arbitrary code execution. (CVE-2015-3119, CVE-2015-3120,     CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)

  - Multiple use-after-free errors exist that allow     arbitrary code execution. (CVE-2015-3118, CVE-2015-3124,     CVE-2015-5117, CVE-2015-3127, CVE-2015-3128,     CVE-2015-3129, CVE-2015-3131, CVE-2015-3132,     CVE-2015-3136, CVE-2015-3137, CVE-2015-4428,     CVE-2015-4430, CVE-2015-5119)

  - Multiple same-origin policy bypass vulnerabilities exist     that allow information disclosure. (CVE-2014-0578,     CVE-2015-3115, CVE-2015-3116, CVE-2015-3125,     CVE-2015-5116)

  - A memory corruption issue exists due to improper     validation of user-supplied input. An attacker can     exploit this to execute arbitrary code. (CVE-2015-5124)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201507-13 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
84644	Adobe Flash Player <= 18.0.0.194 Multiple Vulnerabilities (APSB15-16) (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/7/9	2022/3/8	critical
84645	MS KB3065823: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	2015/7/9	2022/3/8	critical
84662	SUSE SLED12 Security Update : flash-player (SUSE-SU-2015:1211-1) (Underminer)	Nessus	SuSE Local Security Checks	2015/7/13	2022/3/8	critical
84667	Google Chrome < 43.0.2357.132 Multiple Vulnerabilities	Nessus	Windows	2015/7/10	2026/5/19	critical
86083	GLSA-201507-13 : Adobe Flash Player: Multiple vulnerabilities (Underminer)	Nessus	Gentoo Local Security Checks	2015/9/23	2022/4/22	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical