VARIoT IoT vulnerabilities database
VAR-201606-0341 | CVE-2016-1860 | Apple OS X of Intel Graphics Driver Vulnerability in obtaining important kernel memory layout information |
CVSS V2: 4.3 CVSS V3: 3.3 Severity: LOW |
Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1862. This vulnerability CVE-2016-1862 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) Has been identified. http://cwe.mitre.org/data/definitions/254.htmlAn attacker could obtain important kernel memory layout information through a crafted application. Apple Mac OS X is prone to multiple information-disclosure vulnerabilities and an arbitrary code-execution vulnerability. Failed exploits may result in denial-of-service conditions. Intel Graphics Driver is one of the graphics card drivers
VAR-201606-0344 | CVE-2016-1864 | Apple iOS and Safari Used in etc. WebKit of XSS Auditor Vulnerability in which important information is obtained |
CVSS V2: 5.0 CVSS V3: 4.3 Severity: MEDIUM |
The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL. Apple iOS and Safari Used in etc. WebKit is prone to an information-disclosure vulnerability.
Successful exploits may allow the attacker to gain access to sensitive information. Information obtained may lead to further attacks. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser included with Mac OS X and iOS operating systems. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A security vulnerability exists in WebKit's XSS auditor used in Apple iOS versions prior to 9.3 and Safari versions prior to 9.1. The vulnerability stems from the program's improper handling of block-mode redirects. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-2 iOS 9.3.3
iOS 9.3.3 is now available and addresses the following:
Calendar
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A maliciously crafted calendar invite may cause a device to
unexpectedly restart
Description: A null pointer dereference was addressed through
improved memory handling.
CVE-2016-4592 : Mikhail
WebKit
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may disclose image data from
another website
Description: A timing issue existed in the processing of SVG.
CVE-2016-4587 : Apple
WebKit JavaScript Bindings
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to script
execution in the context of a non-HTTP service
Description: A cross-protocol cross-site scripting (XPXSS) issue
existed in Safari when submitting forms to non-HTTP services
compatible with HTTP/0.9. This issue was addressed by disabling
scripts and plugins on resources loaded over HTTP/0.9.
CVE-2016-4651 : Obscure
WebKit Page Loading
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website may exfiltrate data cross-origin
Description: A cross-site scripting issue existed in Safari URL
redirection.
CVE-2016-4585 : Takeshi Terada of Mitsui Bussan Secure Directions,
Inc.
CVE-2016-4584 : Chris Vienneau
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-1 OS X El Capitan v10.11.6 and Security Update
2016-004
OS X El Capitan v10.11.6 and Security Update 2016-004 is now
available and addresses the following:
apache_mod_php
Available for:
OS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple issues existed in PHP versions prior to
5.5.36. These were addressed by updating PHP to version 5.5.36.
CVE-2016-4650
Audio
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4647 : Juwei Lin (@fuzzerDOTcn) of Trend Micro
Audio
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to determine kernel memory layout
Description: An out-of-bounds read was addressed through improved
input validation.
CVE-2016-4648 : Juwei Lin(@fuzzerDOTcn) of Trend Micro
Audio
Available for: OS X El Capitan v10.11 and later
Impact: Parsing a maliciously crafted audio file may lead to the
disclosure of user information
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4646 : Steven Seeley of Source Incite working with Trend
Micro's Zero Day Initiative
Audio
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4649 : Juwei Lin(@fuzzerDOTcn) of Trend Micro
bsdiff
Available for: OS X El Capitan v10.11 and later
Impact: A local attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: An integer overflow existed in bspatch. This issue was
addressed through improved bounds checking.
CVE-2014-9862 : an anonymous researcher
CFNetwork
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to view sensitive user information
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed through improved
restrictions.
CVE-2016-4645 : Abhinav Bansal of Zscaler Inc.
CoreGraphics
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
CoreGraphics
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to elevate privileges
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2016-4652 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
FaceTime
Available for: OS X El Capitan v10.11 and later
Impact: An attacker in a privileged network position may be able to
cause a relayed call to continue transmitting audio while appearing
as if the call terminated
Description: User interface inconsistencies existed in the handling
of relayed calls. These issues were addressed through improved
FaceTime display logic.
CVE-2016-4635 : Martin Vigo
Graphics Drivers
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4634 : Stefan Esser of SektionEins
ImageIO
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
ImageIO
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4629 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
CVE-2016-4630 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
Intel Graphics Driver
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4633 : an anonymous researcher
IOHIDFamily
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
IOSurface
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A use-after-free was addressed through improved memory
management.
CVE-2016-4625 : Ian Beer of Google Project Zero
Kernel
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
Kernel
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
libc++abi
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with
root privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4621 : an anonymous researcher
libexpat
Available for: OS X El Capitan v10.11 and later
Impact: Processing maliciously crafted XML may lead to unexpected
application termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-0718 : Gustavo Grieco
LibreSSL
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple issues existed in LibreSSL before 2.2.7. These
were addressed by updating LibreSSL to version 2.2.7.
CVE-2016-2108 : Huzaifa Sidhpurwala (Red Hat), Hanno Boeck, David Benjamin (Google) Mark Brand,
Ian Beer of Google Project Zero
CVE-2016-2109 : Brian Carpenter
libxml2
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-4449 : Kostya Serebryany
libxml2
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: Multiple vulnerabilities in libxml2
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxslt
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to execute arbitrary
code leading to compromise of user information
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4640 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to execute arbitrary
code leading to the compromise of user information
Description: A type confusion issue was addressed through improved
memory handling.
CVE-2016-4641 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to cause a denial of service
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2016-4639 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to gain root privileges
Description: A type confusion issue was addressed through improved
memory handling.
CVE-2016-4638 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
OpenSSL
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple issues existed in OpenSSL. These issues were resolved by backporting the fixes from OpenSSL 1.0.2h/1.0.1 to OpenSSL 0.9.8.
CVE-2016-2105 : Guido Vranken
CVE-2016-2106 : Guido Vranken
CVE-2016-2107 : Juraj Somorovsky
CVE-2016-2108 : Huzaifa Sidhpurwala (Red Hat), Hanno Boeck, David Benjamin (Google), Mark Brand and Ian Beer of Google Project Zero
CVE-2016-2109 : Brian Carpenter
CVE-2016-2176 : Guido Vranken
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted FlashPix Bitmap Image may
lead to unexpected application termination or arbitrary code
execution
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4596 : Ke Liu of Tencent's Xuanwu Lab
CVE-2016-4597 : Ke Liu of Tencent's Xuanwu Lab
CVE-2016-4600 : Ke Liu of Tencent's Xuanwu Lab
CVE-2016-4602 : Ke Liu of Tencent's Xuanwu Lab
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4598 : Ke Liu of Tencent's Xuanwu Lab
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted SGI file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4601 : Ke Liu of Tencent's Xuanwu Lab
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted Photoshop document may lead
to unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4599 : Ke Liu of Tencent's Xuanwu Lab
Safari Login AutoFill
Available for: OS X El Capitan v10.11 and later
Impact: A user's password may be visible on screen
Description: An issue existed in Safari's password auto-fill. This
issue was addressed through improved matching of form fields.
CVE-2016-4595 : Jonathan Lewis from DeARX Services (PTY) LTD
Sandbox Profiles
Available for: OS X El Capitan v10.11 and later
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Note: OS X El Capitan 10.11.6 includes the security content of Safari
9.1.2. For further details see https://support.apple.com/kb/HT206900
OS X El Capitan v10.11.6 and Security Update 2016-004 may be obtained
from the Mac App Store or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXAvAAoJEIOj74w0bLRG/5EP/2v9SJTrO+/4b3A1gqC1ch8y
+cJ04tXRsO7rvjKT5nCylo30U0Sanz/bUbDx4559YS7/P/IyeyZVheaTJwK8wzEy
pSOPpy35hUuVIw0/p4YsuHDThSBPFMmDljTxH7elkfuBV1lPSrCkyDXc0re2HxWV
xj68zAxtM0jkkhgcxb2ApZSZVXhrjUZtbY0xEVOoWKKFwbMvKfx+4xSqunwQeS1u
wevs1EbxfvsZbc3pG+xYcOonbegBzOy9aCvNO1Yv1zG+AYXC5ERMq1vk3PsWOTQN
ZVY1I7mvCaEfvmjq2isRw8XYapAIKISDLwMKBSYrZDQFwPQLRi1VXxQZ67Kq1M3k
ah04/lr0RIcoosIcBqxD2+1UAFjUzEUNFkYivjhuaeegN2QdL7Ujegf1QjdAt8lk
mmKduxYUDOaRX50Kw7n14ZveJqzE1D5I6QSItaZ9M1vR60a7u91DSj9D87vbt1YC
JM/Rvf/4vonp1NjwA2JQwCiZfYliBDdn9iiCl8mzxdsSRD/wXcZCs05nnKmKsCfc
55ET7IwdG3622lVheOJGQZuucwJiTn36zC11XVzZysQd/hLD5rUKUQNX1WOgZdzs
xPsslXF5MWx9jcdyWVSWxDrN0sFk+GpQFQDuVozP60xuxqR3qQ0TXir2NP39uIF5
YozOGPQFmX0OviWCQsX6
=ng+m
-----END PGP SIGNATURE-----
VAR-201607-0419 | CVE-2016-1425 | Cisco IOS Service disruption in (DoS) Vulnerabilities |
CVSS V2: 6.1 CVSS V3: 6.5 Severity: MEDIUM |
Cisco IOS 15.0(2)SG5, 15.1(2)SG3, 15.2(1)E, 15.3(3)S, and 15.4(1.13)S allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet, aka Bug ID CSCun66735.
An attacker can exploit this issue to cause denial-of-service conditions.
This issue is being tracked by Cisco Bug ID CSCun66735. The following releases are affected: Cisco IOS Release 15.0(2)SG5, Release 15.1(2)SG3, Release 15.2(1)E, Release 15.3(3)S, Release 15.4(1.13)S
VAR-201606-0278 | CVE-2016-1424 | Cisco IOS Service disruption in (DoS) Vulnerabilities |
CVSS V2: 6.1 CVSS V3: 6.5 Severity: MEDIUM |
Cisco IOS 15.2(1)T1.11 and 15.2(2)TST allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet, aka Bug ID CSCun63132.
An attacker can exploit this issue to cause denial-of-service conditions.
This issue is being tracked by Cisco Bug ID CSCun63132
VAR-201606-0281 | CVE-2016-1431 | Cisco FirePOWER Management Center Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur25516.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
This issue is being tracked by Cisco Bug ID CSCur25516
VAR-201606-0282 | CVE-2016-1432 | Cisco IOS XE on cBR-8 Converged Broadband Router IOS XE Denial of Service Vulnerability |
CVSS V2: 6.8 CVSS V3: 6.5 Severity: MEDIUM |
Cisco IOS XE 3.15S and 3.16S on cBR-8 Converged Broadband Router devices allows remote authenticated users to cause a denial of service (NULL pointer dereference and card restart) via a crafted SNMP request, aka Bug ID CSCuu68862. The Cisco IOSXEoncBR-8ConvergedBroadbandRouter is a set of operating systems running on the cBR-8 series of routers from Cisco. A denial of service vulnerability exists in the Cisco IOSXE 3.15S and 3.16S versions on the Cisco IOSXEoncBR-8ConvergedBroadbandRouter device.
An attacker can exploit this issue to cause a denial of service condition.
This issue is tracked by Cisco Bug ID CSCuu68862
VAR-201606-0056 | CVE-2016-5723 | Huawei FusionInsight HD In root Privileged vulnerability |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors. Huawei FusionInsight HD is prone to a local privilege-escalation vulnerability.
Huawei FusionInsight HD versions V100R002C30 and V100R002C50 are vulnerable. Huawei FusionInsight is an enterprise-level big data platform developed by China's Huawei (Huawei) for multiple industries and based on Apache open source community software for enhanced functions. The platform provides functions such as data storage, query and analysis. FusionInsight HD is one of the core components of the data engine
VAR-201606-0250 | CVE-2016-4514 | Moxa PT-7728 Vulnerability to change settings in device software |
CVSS V2: 4.6 CVSS V3: 7.7 Severity: HIGH |
Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy. Moxa PT-7728 There is a vulnerability in the device software that can be changed. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. MoxaPT-7728 is an Ethernet switch from Moxa for managing industrial applications. A security vulnerability exists in MoxaPT-77283.4build15081113, which is caused by a program failing to perform authentication correctly. A remote attacker could exploit this vulnerability to gain unauthorized access and modify key configurations. Moxa PT-7728 Series Switch is prone to an unauthorized access vulnerability. This may aid in further attacks.
Moxa PT-7728 Series Switch running firmware version 3.4 build 15081113 is vulnerable; other versions may also be affected
VAR-201606-0279 | CVE-2016-1427 | Cisco Prime Network Registrar System Configuration Protocol Core Messaging Interface Vulnerability Obtaining Important Information |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694. The Cisco PrimeNetwork Registrar (CPNR) is a network registrar product from Cisco. The product provides services such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and IP Address Management (IPAM). A security vulnerability exists in the SystemMessageProtocol (SCP) core message interface prior to CPNR 8.2.3.1 and 8.3 versions prior to 8.3.2.
This issue is being tracked by Cisco Bug ID CSCuv35694
VAR-201606-0511 | CVE-2016-4126 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified. Adobe AIR is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition.
Adobe AIR 21.0.0.215 and prior are vulnerable. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product
VAR-201606-0513 | CVE-2016-4124 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0506 | CVE-2016-4128 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0503 | CVE-2016-4150 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0504 | CVE-2016-4149 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0512 | CVE-2016-4125 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0509 | CVE-2016-4130 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0510 | CVE-2016-4127 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0507 | CVE-2016-4123 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0505 | CVE-2016-4129 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201606-0502 | CVE-2016-4151 | Microsoft Internet Explorer and Microsoft Edge of Adobe Flash Used in library Adobe Flash Player Vulnerability in |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083. This case MS16-083 This is a different vulnerability than the other vulnerabilities listed on the list.It may be affected unspecified.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. The former is the default browser included with operating systems prior to Windows 10; the latter is the default browser included with Windows 10, the latest operating system. in the United States. The former is a multimedia player product library; the latter is a cross-platform, browser-based multimedia player product. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:1238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2016:1238
Issue date: 2016-06-17
CVE Names: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124
CVE-2016-4125 CVE-2016-4127 CVE-2016-4128
CVE-2016-4129 CVE-2016-4130 CVE-2016-4131
CVE-2016-4132 CVE-2016-4133 CVE-2016-4134
CVE-2016-4135 CVE-2016-4136 CVE-2016-4137
CVE-2016-4138 CVE-2016-4139 CVE-2016-4140
CVE-2016-4141 CVE-2016-4142 CVE-2016-4143
CVE-2016-4144 CVE-2016-4145 CVE-2016-4146
CVE-2016-4147 CVE-2016-4148 CVE-2016-4149
CVE-2016-4150 CVE-2016-4151 CVE-2016-4152
CVE-2016-4153 CVE-2016-4154 CVE-2016-4155
CVE-2016-4156 CVE-2016-4166 CVE-2016-4171
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3.
This update upgrades Flash Player to version 11.2.202.626. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130,
CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135,
CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,
CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,
CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.626-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.626-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-4122
https://access.redhat.com/security/cve/CVE-2016-4123
https://access.redhat.com/security/cve/CVE-2016-4124
https://access.redhat.com/security/cve/CVE-2016-4125
https://access.redhat.com/security/cve/CVE-2016-4127
https://access.redhat.com/security/cve/CVE-2016-4128
https://access.redhat.com/security/cve/CVE-2016-4129
https://access.redhat.com/security/cve/CVE-2016-4130
https://access.redhat.com/security/cve/CVE-2016-4131
https://access.redhat.com/security/cve/CVE-2016-4132
https://access.redhat.com/security/cve/CVE-2016-4133
https://access.redhat.com/security/cve/CVE-2016-4134
https://access.redhat.com/security/cve/CVE-2016-4135
https://access.redhat.com/security/cve/CVE-2016-4136
https://access.redhat.com/security/cve/CVE-2016-4137
https://access.redhat.com/security/cve/CVE-2016-4138
https://access.redhat.com/security/cve/CVE-2016-4139
https://access.redhat.com/security/cve/CVE-2016-4140
https://access.redhat.com/security/cve/CVE-2016-4141
https://access.redhat.com/security/cve/CVE-2016-4142
https://access.redhat.com/security/cve/CVE-2016-4143
https://access.redhat.com/security/cve/CVE-2016-4144
https://access.redhat.com/security/cve/CVE-2016-4145
https://access.redhat.com/security/cve/CVE-2016-4146
https://access.redhat.com/security/cve/CVE-2016-4147
https://access.redhat.com/security/cve/CVE-2016-4148
https://access.redhat.com/security/cve/CVE-2016-4149
https://access.redhat.com/security/cve/CVE-2016-4150
https://access.redhat.com/security/cve/CVE-2016-4151
https://access.redhat.com/security/cve/CVE-2016-4152
https://access.redhat.com/security/cve/CVE-2016-4153
https://access.redhat.com/security/cve/CVE-2016-4154
https://access.redhat.com/security/cve/CVE-2016-4155
https://access.redhat.com/security/cve/CVE-2016-4156
https://access.redhat.com/security/cve/CVE-2016-4166
https://access.redhat.com/security/cve/CVE-2016-4171
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
https://helpx.adobe.com/security/products/flash-player/apsa16-03.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXY7HIXlSAg2UNWIIRAmytAJ9KBVDAyt7RbmNznJhC6uA9WwA6tACfSNyo
/QNQeCm3xe5AByAOnb1Veh0=
=5kdV
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce