VARIoT IoT vulnerabilities database

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6977 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7001 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 ,and CVE-2016-7019 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Attackers can exploit these issues to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6989. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. The product enables viewing of applications, content and video across screens and browsers. The following versions are affected: versions prior to 18.0.0.382 on Windows and OS X-based platforms, versions prior to 23.x from 19.x to 23.0.0.185, and versions prior to 11.2.202.637 on Linux-based platforms. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:2057-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2057.html Issue date: 2016-10-12 CVE Names: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.637. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1383931 - CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 flash-plugin: multiple code execution issues fixed in APSB16-32 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4273 https://access.redhat.com/security/cve/CVE-2016-4286 https://access.redhat.com/security/cve/CVE-2016-6981 https://access.redhat.com/security/cve/CVE-2016-6982 https://access.redhat.com/security/cve/CVE-2016-6983 https://access.redhat.com/security/cve/CVE-2016-6984 https://access.redhat.com/security/cve/CVE-2016-6985 https://access.redhat.com/security/cve/CVE-2016-6986 https://access.redhat.com/security/cve/CVE-2016-6987 https://access.redhat.com/security/cve/CVE-2016-6989 https://access.redhat.com/security/cve/CVE-2016-6990 https://access.redhat.com/security/cve/CVE-2016-6992 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-32.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX/n7xXlSAg2UNWIIRAsVXAJwL/4ZCoClD7cAvqvPN13L7ccpYNQCgogk5 6UAFhMbkHmPLVjTeEA1eCe8= =qe9H -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6990. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. The product enables viewing of applications, content and video across screens and browsers. The following versions are affected: versions prior to 18.0.0.382 on Windows and OS X-based platforms, versions prior to 23.x from 19.x to 23.0.0.185, and versions prior to 11.2.202.637 on Linux-based platforms. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:2057-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2057.html Issue date: 2016-10-12 CVE Names: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.637. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1383931 - CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 flash-plugin: multiple code execution issues fixed in APSB16-32 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4273 https://access.redhat.com/security/cve/CVE-2016-4286 https://access.redhat.com/security/cve/CVE-2016-6981 https://access.redhat.com/security/cve/CVE-2016-6982 https://access.redhat.com/security/cve/CVE-2016-6983 https://access.redhat.com/security/cve/CVE-2016-6984 https://access.redhat.com/security/cve/CVE-2016-6985 https://access.redhat.com/security/cve/CVE-2016-6986 https://access.redhat.com/security/cve/CVE-2016-6987 https://access.redhat.com/security/cve/CVE-2016-6989 https://access.redhat.com/security/cve/CVE-2016-6990 https://access.redhat.com/security/cve/CVE-2016-6992 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-32.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX/n7xXlSAg2UNWIIRAsVXAJwL/4ZCoClD7cAvqvPN13L7ccpYNQCgogk5 6UAFhMbkHmPLVjTeEA1eCe8= =qe9H -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion.". Supplementary information : CWE Vulnerability type by CWE-704: Incorrect Type Conversion or Cast ( Bad type conversion or cast ) Has been identified. Failed exploit attempts will likely cause a denial-of-service condition. The product enables viewing of applications, content and video across screens and browsers. The following versions are affected: versions prior to 18.0.0.382 on Windows and OS X-based platforms, versions prior to 23.x from 19.x to 23.0.0.185, and versions prior to 11.2.202.637 on Linux-based platforms. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:2057-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2057.html Issue date: 2016-10-12 CVE Names: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. This update upgrades Flash Player to version 11.2.202.637. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1383931 - CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 flash-plugin: multiple code execution issues fixed in APSB16-32 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4273 https://access.redhat.com/security/cve/CVE-2016-4286 https://access.redhat.com/security/cve/CVE-2016-6981 https://access.redhat.com/security/cve/CVE-2016-6982 https://access.redhat.com/security/cve/CVE-2016-6983 https://access.redhat.com/security/cve/CVE-2016-6984 https://access.redhat.com/security/cve/CVE-2016-6985 https://access.redhat.com/security/cve/CVE-2016-6986 https://access.redhat.com/security/cve/CVE-2016-6987 https://access.redhat.com/security/cve/CVE-2016-6989 https://access.redhat.com/security/cve/CVE-2016-6990 https://access.redhat.com/security/cve/CVE-2016-6992 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-32.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX/n7xXlSAg2UNWIIRAsVXAJwL/4ZCoClD7cAvqvPN13L7ccpYNQCgogk5 6UAFhMbkHmPLVjTeEA1eCe8= =qe9H -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass intended access restrictions via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlAn attacker may be able to bypass access restrictions. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. The product enables viewing of applications, content and video across screens and browsers. The following versions are affected: versions prior to 18.0.0.382 on Windows and OS X-based platforms, versions prior to 23.x from 19.x to 23.0.0.185, and versions prior to 11.2.202.637 on Linux-based platforms. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:2057-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2057.html Issue date: 2016-10-12 CVE Names: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. This update upgrades Flash Player to version 11.2.202.637. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1383931 - CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 flash-plugin: multiple code execution issues fixed in APSB16-32 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4273 https://access.redhat.com/security/cve/CVE-2016-4286 https://access.redhat.com/security/cve/CVE-2016-6981 https://access.redhat.com/security/cve/CVE-2016-6982 https://access.redhat.com/security/cve/CVE-2016-6983 https://access.redhat.com/security/cve/CVE-2016-6984 https://access.redhat.com/security/cve/CVE-2016-6985 https://access.redhat.com/security/cve/CVE-2016-6986 https://access.redhat.com/security/cve/CVE-2016-6987 https://access.redhat.com/security/cve/CVE-2016-6989 https://access.redhat.com/security/cve/CVE-2016-6990 https://access.redhat.com/security/cve/CVE-2016-6992 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-32.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX/n7xXlSAg2UNWIIRAsVXAJwL/4ZCoClD7cAvqvPN13L7ccpYNQCgogk5 6UAFhMbkHmPLVjTeEA1eCe8= =qe9H -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. The product enables viewing of applications, content and video across screens and browsers. The following versions are affected: versions prior to 18.0.0.382 on Windows and OS X-based platforms, versions prior to 23.x from 19.x to 23.0.0.185, and versions prior to 11.2.202.637 on Linux-based platforms. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:2057-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2057.html Issue date: 2016-10-12 CVE Names: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.637. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4273, CVE-2016-4286, CVE-2016-6981, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6987, CVE-2016-6989, CVE-2016-6990, CVE-2016-6992) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1383931 - CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 flash-plugin: multiple code execution issues fixed in APSB16-32 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.637-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.637-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.637-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.637-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4273 https://access.redhat.com/security/cve/CVE-2016-4286 https://access.redhat.com/security/cve/CVE-2016-6981 https://access.redhat.com/security/cve/CVE-2016-6982 https://access.redhat.com/security/cve/CVE-2016-6983 https://access.redhat.com/security/cve/CVE-2016-6984 https://access.redhat.com/security/cve/CVE-2016-6985 https://access.redhat.com/security/cve/CVE-2016-6986 https://access.redhat.com/security/cve/CVE-2016-6987 https://access.redhat.com/security/cve/CVE-2016-6989 https://access.redhat.com/security/cve/CVE-2016-6990 https://access.redhat.com/security/cve/CVE-2016-6992 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-32.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX/n7xXlSAg2UNWIIRAsVXAJwL/4ZCoClD7cAvqvPN13L7ccpYNQCgogk5 6UAFhMbkHmPLVjTeEA1eCe8= =qe9H -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993. This vulnerability CVE-2016-1089 , CVE-2016-6944 , CVE-2016-6945 , CVE-2016-6946 , CVE-2016-6949 , CVE-2016-6952 , CVE-2016-6953 , CVE-2016-6961 , CVE-2016-6962 , CVE-2016-6963 , CVE-2016-6964 , CVE-2016-6965 , CVE-2016-6967 , CVE-2016-6968 , CVE-2016-6969 , CVE-2016-6971 , CVE-2016-6979 , CVE-2016-6988 ,and CVE-2016-6993 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993. This vulnerability CVE-2016-1091 , CVE-2016-6944 , CVE-2016-6945 , CVE-2016-6946 , CVE-2016-6949 , CVE-2016-6952 , CVE-2016-6953 , CVE-2016-6961 , CVE-2016-6962 , CVE-2016-6963 , CVE-2016-6964 , CVE-2016-6965 , CVE-2016-6967 , CVE-2016-6968 , CVE-2016-6969 , CVE-2016-6971 , CVE-2016-6979 , CVE-2016-6988 ,and CVE-2016-6993 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Windows and Mac OS X Run on Adobe Reader and Acrobat Any code that could be executed or service disruption ( Memory corruption ) There are vulnerabilities that are put into a state. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6977 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7001 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7011 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 , CVE-2016-7019 , CVE-2016-7852 ,and CVE-2016-7854 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Adobe Acrobat and Reader are prone to multiple unspecified memory-corruption vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. The following products and versions are affected: Adobe Reader XI and Acrobat XI prior to 11.0.18; Acrobat and Acrobat Reader DC Classic prior to 15.006.30243; Acrobat and Acrobat Reader DC Continuous prior to 15.020.20039

Windows and Mac OS X Run on Adobe Reader and Acrobat Any code that could be executed or service disruption ( Memory corruption ) There are vulnerabilities that are put into a state. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6977 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7001 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7011 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 , CVE-2016-7019 , CVE-2016-7853 ,and CVE-2016-7854 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Adobe Acrobat and Reader are prone to multiple unspecified memory-corruption vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. The following products and versions are affected: Adobe Reader XI and Acrobat XI prior to 11.0.18; Acrobat and Acrobat Reader DC Classic prior to 15.006.30243; Acrobat and Acrobat Reader DC Continuous prior to 15.020.20039

Windows and Mac OS X Run on Adobe Reader and Acrobat Any code that could be executed or service disruption ( Memory corruption ) There are vulnerabilities that are put into a state. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6977 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7001 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7011 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 , CVE-2016-7019 , CVE-2016-7852 ,and CVE-2016-7853 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of JPEG2000 images. The process does not properly validate user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Adobe Acrobat and Reader are prone to multiple unspecified memory-corruption vulnerabilities. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. The following products and versions are affected: Adobe Reader XI and Acrobat XI prior to 11.0.18; Acrobat and Acrobat Reader DC Classic prior to 15.006.30243; Acrobat and Acrobat Reader DC Continuous prior to 15.020.20039

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6977 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7011 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 ,and CVE-2016-7019 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Attackers can exploit these issues to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

The TP-LinkArcher CR-700 is a router. A cross-site scripting vulnerability exists in TP-LinkArcherCR-700. A remote attacker can exploit this vulnerability to change the router configuration by importing a configuration file.

SiemensIPCamera is a Siemens webcam. There are any file download vulnerabilities in SiemensIPCamera. The attacker can download the config.ini file, which contains the administrator account password of the camera.

H3C VG voice gateway equipment is a new generation of integrated voice, fax, and data access equipment developed by H3C for industry and enterprise users. H3C VG 10-40 has an unauthorized access vulnerability that allows an attacker to obtain sensitive information about the gateway device.

SoftCMS is a large-scale video surveillance management system from Moxa. SoftCMS 1.5 version has a security bypass vulnerability in the password input field of the user login page, allowing attackers to use this vulnerability to bypass user authentication and log in to the system.

Languang Innovation is a leading domestic supplier of digital workshop solutions, has a high market share in aerospace DNC / MDC / MES, and is the main integrator of CIMCO in China. Languang DSS-Max is a DNC / MDC production decision support system, mainly used for machine tool data collection and analysis, and provides support for production decisions based on machine tool utilization and other information. Languang DSS-Max system provides users with an access interface in WEB mode. Its WEB login interface is not strict in input checking and there is a SQL injection vulnerability. Use “1’or 1 = 1-” as the user name, and the password is blank, you can directly enter the system.

The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1, as used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1, allows remote attackers to cause a denial of service (crash) via a type 2F packet with a '01 19' opcode. Citrix License Server for Windows and License Server VPX are products of Citrix Systems. The former is a Windows-based authentication server, and the latter is an authentication server device. There are security vulnerabilities in versions of Citrix License Server for Windows prior to 11.14.0.1 and versions prior to License Server VPX 11.14.0.1. A remote attacker could exploit the vulnerability to cause a denial of service (server crash)

General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) ,and CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. https://cwe.mitre.org/data/definitions/254.html https://cwe.mitre.org/data/definitions/284.htmlA remote attacker could gain privileged access. GE Bently Nevada 3500 / 22M is a vibration monitoring system. GE Bently Nevada 3500 / 22M has a security bypass vulnerability. Allows an attacker to perform unauthorized operations. This may lead to other attacks. The following products are vulnerable: GE Bently Nevada 3500/22M (USB version) prior to firmware Version 5.0 are vulnerable. USB and Serial are 2 versions of it

Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Ipswitch WhatsUp Gold 16.4.1 is vulnerable; other versions may also be vulnerable. Ipswitch WhatsUp Gold is a set of unified infrastructure and application monitoring software from Ipswitch in the United States. The software supports the performance management of networks, servers, virtual environments and applications. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands