VARIoT IoT vulnerabilities database

Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets, aka Bug ID CSCuz66289. The Cisco IOSXRonNCS6000 is a set of operating systems running on 6000 series routers from Cisco. A denial of service vulnerability exists in Cisco IOSXR 6.0 and 6.0.1 on the Cisco NCS6000 appliance. Cisco IOS XR is prone to a remote denial-of-service vulnerability. This issue is being tracked by Cisco Bug ID CSCuz66289. Cisco IOS XR for Cisco NCS600 (64-bit) is vulnerable

UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root access via crafted CLI input, aka Bug ID CSCuz91263. Cisco Unified Computing System is prone to a local privilege-escalation because it fails to sanitize user-supplied input. A local attacker can exploit this issue to execute arbitrary commands with root level privileges. This issue is being tracked by Cisco Bug ID CSCuz91263. Cisco Unified Computing System (UCS) is a unified computing system of Cisco (Cisco). The system integrates network, computing and virtualization resources into one platform by extensively adopting virtualization technology. UCS Manager is one of the embedded device management software. UCS 6200 Fabric Interconnects is one of the interconnection devices

The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service via a crafted packet, aka Bug IDs CSCuy82904, CSCuy82909, and CSCuy82912. Vendors have confirmed this vulnerability Bug ID CSCuy82904 , CSCuy82909 ,and CSCuy82912 It is released as.Denial of service operation via a packet crafted by a third party (DoS) There is a possibility of being put into a state. Both Cisco IOS and IOSXE are operating systems developed by Cisco for its network devices. DatainMotion (DMo) application is one of the dynamic data update tools. A security vulnerability exists in the Cisco IOS 15.6(1)T release and the DMo application in IOSXE. An attacker can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug IDs CSCuy82904, CSCuy82909 and CSCuy82912

Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854. Both Cisco IOS and IOSXE are operating systems developed by Cisco for its network devices. CiscoIOxLocalManager is one of the local management components. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCuy19854

Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368. Cisco Fog Director for IOx is an automated management platform based on IOx (an end-to-end application support system that provides application hosting capabilities) for centralized management of multiple applications running on the edge of the network. The platform controls application settings and lifecycles, and supports access and monitoring of large-scale IoT deployments. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCuz89368

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130. This issue is being tracked by Cisco bug ID CSCuy83130. Cisco WebEx Meetings Server (CWMS) is a set of multi-functional conference solutions including audio, video and Web conference in Cisco's WebEx conference solution. A security vulnerability exists in CWMS version 2.6

Cisco Carrier Routing System (CRS) 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial of service (line-card reload) via crafted IPv6-over-MPLS packets, aka Bug ID CSCva32494. Vendors have confirmed this vulnerability Bug ID CSCva32494 It is released as.Skillfully crafted by a third party IPv6-over-MPLS Service disruption via packets ( Reload line card ) There is a possibility of being put into a state. Cisco CarrierRoutingSystem (CRS) is a carrier-class routing system from Cisco. A remote attacker could exploit the vulnerability by sending a specially crafted IPv6-over-MPLS packet to cause a denial of service (line-card overload). This issue is being tracked by Cisco Bug ID CSCva32494

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219. Cisco Web Security Appliance is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCuz27219. A remote attacker could exploit this vulnerability by sending a large number of specially crafted HTTP requests to cause a denial of service

The MOXA Nport 5110 is a serial communication server. Mosha Technology (Shanghai) Co., Ltd. Nport 5110 device has a blank password vulnerability, allowing an attacker to use this vulnerability to log in to the system background, gain administrator privileges, and obtain device sensitive information

Buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication. HuaweiUSG2100 is a unified security gateway product of Huawei Technologies, China. A number of HuaweiUSG products have a buffer overflow vulnerability that allows remote attackers to exploit this vulnerability to submit a special request to crash an application. Multiple Huawei USG Products are prone to a buffer-overflow vulnerability because they fail to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Attackers can exploit this issue to execute arbitrary code in the affected device. Failed exploit attempts will result in denial-of-service conditions. Point-to-Point Protocol over Ethernet (PPPoE) is a PPP protocol (point-to-point connection protocol) used in gateway products such as Huawei USG2100. The following products and versions are affected: Huawei USG2100 V300R001C00, V300R001C10; USG2200V300R001C00, V300R001C10; USG5100V300R001C00, V300R001C10;

Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of malformed packets. The Huawei S7700, S9300, S9700, and S12700 are Huawei's intelligent routing switches. A remote denial of service vulnerability exists in several HuaweiSwitches. The following products and versions are affected: Huawei S9300 V200R001C00 , V200R003C00 , V200R005C00 , V200R006C00 , V200R008C00 , S5300 V200R001C00 , V200R002C00 , V200R003C00 , V200R005C00 , V200R005C01 , V200R005C02 , V200R006C00 , V200R007C00 , V200R008C00 , S5700 V200R001C00 , V200R001C01 , V200R002C00 , V200R003C00 , V200R003C02 , V200R005C00 , V200R006C00 , V200R008C00 , S6300 V200R001C00 , V200R002C00 , V200R003C00 , V200R005C00 , V200R005C01 , V200R005C02 , V200R008C00 , S6700 V200R001C00 , V200R001C01 , V200R002C00 , V200R003C00 , V200R008C00 , S7700 V200R001C00 , V200R002C00 , V200R003C00 , V200R005C00 , V200R006C00 , V200R008C00 , S9700 V200R001C00 , V200R001C01 , V200R002C00 , V200R003C00, V200R005C00, V200R006C00, V200R008C00, S12700 V200R005C00, V200R006C00, V200R008C00

Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service, aka Bug ID CSCuy92704. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCuy92704. Cisco WebEx Meetings Server (CWMS) is a set of multi-functional conference solutions including audio, video and Web conference in Cisco's WebEx conference solution. A denial of service vulnerability exists in CWMS version 2.6

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7119. Vendors have confirmed this vulnerability SVE-2016-7119 It is released as.Denial of service by attacker ( System crash ) It may be put into a state or it may be authorized. SamsungNote is a smartphone released by South Korea's Samsung. Telecom is one of the communication components. Samsung Mobile Phones are prone to multiple denial-of-service vulnerabilities

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7121. Vendors have confirmed this vulnerability SVE-2016-7121 It is released as.Denial of service by attacker ( System crash ) It may be put into a state or it may be authorized. SamsungNote is a smartphone released by South Korea's Samsung. Telecom is one of the communication components. Samsung Mobile Phones are prone to multiple denial-of-service vulnerabilities

The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value. AVer Information EH6108H+ hybrid DVR, version X9.03.24.00.07l and possibly earlier, reportedly contains multiple vulnerabilities, including undocumented privileged accounts, authentication bypass, and information exposure. In addition, JVNVU#95660277 Then CWE-302 It is published as CWE-302: Authentication Bypass by Assumed-Immutable Data http://cwe.mitre.org/data/definitions/302.htmlBy a third party handle By using the value of the parameter, you may be able to bypass the access restriction of the page or change the password. AVerInformationEH6108H+hybridDVRVU is a DVR product from AVerInformation. AVerInformationEH6108H+hybridDVRVU has a certification bypass vulnerability. A hard coded credentials vulnerability. 2. An authentication-bypass vulnerability. 3. An information-disclosure vulnerability. Attackers may exploit these issues to gain unauthorized access to restricted content by bypassing intended security restrictions or to obtain sensitive information and gain root privileges. AVer Information EH6108H+ X9.03.24.00.07l and prior are vulnerable. Version X9.03.24.00.07l and possibly earlier are reported to contain multiple vulnerabilities. Both accounts have root privileges and may be used to gain access via an undocumented telnet service that cannot be disabled through the web user interface and runs by default. CWE-200: Information Exposure - CVE-2016-6537 User credentials are reported to be stored and transmitted in an insecure manner. In the configuration page of the web interface, passwords are stored in base64-encoded strings. In client requests, credentials are listed in plain text in the cookie header. For more information, refer to the researcher's disclosure. Solution: The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround. Restrict access As a general good security practice, only allow connections from trusted hosts and networks. References: http://surveillance.aver.com/model/embedded-hybrid-DVR-EH6108H-plus/ https://www.appsecconsulting.com/blog/easy-root-on-aver-eh6108h-hybrid-dvr-a nd-more https://cwe.mitre.org/data/definitions/798.html https://cwe.mitre.org/data/definitions/302.html https://cwe.mitre.org/data/definitions/200.html

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120. Vendors have confirmed this vulnerability SVE-2016-7120 It is released as.Denial of service by attacker ( System crash ) It may be put into a state or it may be authorized. SamsungNote is a smartphone released by South Korea's Samsung. Telecom is one of the communication components. Samsung Mobile Phones are prone to multiple denial-of-service vulnerabilities

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings. AVer Information EH6108H+ hybrid DVR, version X9.03.24.00.07l and possibly earlier, reportedly contains multiple vulnerabilities, including undocumented privileged accounts, authentication bypass, and information exposure. AVerInformationEH6108H+hybridDVRVU is a DVR product from AVerInformation. AVerInformationEH6108H+hybridDVR has an information disclosure vulnerability. Attackers can exploit vulnerabilities to obtain sensitive information. A hard coded credentials vulnerability. 2. 3. AVer Information EH6108H+ X9.03.24.00.07l and prior are vulnerable. Version X9.03.24.00.07l and possibly earlier are reported to contain multiple vulnerabilities. Both accounts have root privileges and may be used to gain access via an undocumented telnet service that cannot be disabled through the web user interface and runs by default. CWE-302: Authentication Bypass by Assumed-Immutable Data - CVE-2016-6536 By guessing the handle parameter of the /setup page of the web interface, an unauthenticated attacker reportedly may be able to access restricted pages and alter DVR configurations or change user passwords. CWE-200: Information Exposure - CVE-2016-6537 User credentials are reported to be stored and transmitted in an insecure manner. In the configuration page of the web interface, passwords are stored in base64-encoded strings. In client requests, credentials are listed in plain text in the cookie header. Solution: The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround. Restrict access As a general good security practice, only allow connections from trusted hosts and networks. References: http://surveillance.aver.com/model/embedded-hybrid-DVR-EH6108H-plus/ https://www.appsecconsulting.com/blog/easy-root-on-aver-eh6108h-hybrid-dvr-a nd-more https://cwe.mitre.org/data/definitions/798.html https://cwe.mitre.org/data/definitions/302.html https://cwe.mitre.org/data/definitions/200.html

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session. AVer Information EH6108H+ hybrid DVR, version X9.03.24.00.07l and possibly earlier, reportedly contains multiple vulnerabilities, including undocumented privileged accounts, authentication bypass, and information exposure. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. AVerInformationEH6108H+hybridDVRVU is a DVR product from AVerInformation. An attacker can exploit the vulnerability to gain root privileges. 2. An authentication-bypass vulnerability. 3. An information-disclosure vulnerability. AVer Information EH6108H+ X9.03.24.00.07l and prior are vulnerable. The vulnerability stems from the fact that the program contains hard-coded accounts. Version X9.03.24.00.07l and possibly earlier are reported to contain multiple vulnerabilities. Both accounts have root privileges and may be used to gain access via an undocumented telnet service that cannot be disabled through the web user interface and runs by default. CWE-302: Authentication Bypass by Assumed-Immutable Data - CVE-2016-6536 By guessing the handle parameter of the /setup page of the web interface, an unauthenticated attacker reportedly may be able to access restricted pages and alter DVR configurations or change user passwords. CWE-200: Information Exposure - CVE-2016-6537 User credentials are reported to be stored and transmitted in an insecure manner. In the configuration page of the web interface, passwords are stored in base64-encoded strings. In client requests, credentials are listed in plain text in the cookie header. For more information, refer to the researcher's disclosure. Solution: The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround. Restrict access As a general good security practice, only allow connections from trusted hosts and networks. References: http://surveillance.aver.com/model/embedded-hybrid-DVR-EH6108H-plus/ https://www.appsecconsulting.com/blog/easy-root-on-aver-eh6108h-hybrid-dvr-a nd-more https://cwe.mitre.org/data/definitions/798.html https://cwe.mitre.org/data/definitions/302.html https://cwe.mitre.org/data/definitions/200.html

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, and CVE-2016-6931. This vulnerability CVE-2016-4272 , CVE-2016-4279 , CVE-2016-6921 , CVE-2016-6923 , CVE-2016-6925 , CVE-2016-6926 , CVE-2016-6927 , CVE-2016-6929 , CVE-2016-6930 ,and CVE-2016-6931 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely result in denial-of-service conditions. The product enables viewing of applications, content and video across screens and browsers. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:1865-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1865.html Issue date: 2016-09-14 CVE Names: CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.635. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1375725 - flash-plugin: multiple code execution issues fixed in APSB16-29 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.635-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.635-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.635-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.635-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.635-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.635-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.635-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.635-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.635-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.635-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4271 https://access.redhat.com/security/cve/CVE-2016-4272 https://access.redhat.com/security/cve/CVE-2016-4274 https://access.redhat.com/security/cve/CVE-2016-4275 https://access.redhat.com/security/cve/CVE-2016-4276 https://access.redhat.com/security/cve/CVE-2016-4277 https://access.redhat.com/security/cve/CVE-2016-4278 https://access.redhat.com/security/cve/CVE-2016-4279 https://access.redhat.com/security/cve/CVE-2016-4280 https://access.redhat.com/security/cve/CVE-2016-4281 https://access.redhat.com/security/cve/CVE-2016-4282 https://access.redhat.com/security/cve/CVE-2016-4283 https://access.redhat.com/security/cve/CVE-2016-4284 https://access.redhat.com/security/cve/CVE-2016-4285 https://access.redhat.com/security/cve/CVE-2016-4287 https://access.redhat.com/security/cve/CVE-2016-6921 https://access.redhat.com/security/cve/CVE-2016-6922 https://access.redhat.com/security/cve/CVE-2016-6923 https://access.redhat.com/security/cve/CVE-2016-6924 https://access.redhat.com/security/cve/CVE-2016-6925 https://access.redhat.com/security/cve/CVE-2016-6926 https://access.redhat.com/security/cve/CVE-2016-6927 https://access.redhat.com/security/cve/CVE-2016-6929 https://access.redhat.com/security/cve/CVE-2016-6930 https://access.redhat.com/security/cve/CVE-2016-6931 https://access.redhat.com/security/cve/CVE-2016-6932 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-29.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX2Pp+XlSAg2UNWIIRAp1iAKCmfmh77bYTg10K3b0b6aJuxtLEgACfZlyh ynwsnFlRoTlOLVQLiobHvps= =1fXO -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, and CVE-2016-6932. This vulnerability CVE-2016-4272 , CVE-2016-4279 , CVE-2016-6921 , CVE-2016-6923 , CVE-2016-6925 , CVE-2016-6926 , CVE-2016-6927 , CVE-2016-6929 , CVE-2016-6930 ,and CVE-2016-6932 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely result in denial-of-service conditions. The product enables viewing of applications, content and video across screens and browsers. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2016:1865-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1865.html Issue date: 2016-09-14 CVE Names: CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 ===================================================================== 1. Summary: An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.635. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1375725 - flash-plugin: multiple code execution issues fixed in APSB16-29 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.635-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.635-1.el5_11.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.635-1.el5_11.i386.rpm x86_64: flash-plugin-11.2.202.635-1.el5_11.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.635-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.635-1.el6_8.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.635-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.635-1.el6_8.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.635-1.el6_8.i686.rpm x86_64: flash-plugin-11.2.202.635-1.el6_8.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4271 https://access.redhat.com/security/cve/CVE-2016-4272 https://access.redhat.com/security/cve/CVE-2016-4274 https://access.redhat.com/security/cve/CVE-2016-4275 https://access.redhat.com/security/cve/CVE-2016-4276 https://access.redhat.com/security/cve/CVE-2016-4277 https://access.redhat.com/security/cve/CVE-2016-4278 https://access.redhat.com/security/cve/CVE-2016-4279 https://access.redhat.com/security/cve/CVE-2016-4280 https://access.redhat.com/security/cve/CVE-2016-4281 https://access.redhat.com/security/cve/CVE-2016-4282 https://access.redhat.com/security/cve/CVE-2016-4283 https://access.redhat.com/security/cve/CVE-2016-4284 https://access.redhat.com/security/cve/CVE-2016-4285 https://access.redhat.com/security/cve/CVE-2016-4287 https://access.redhat.com/security/cve/CVE-2016-6921 https://access.redhat.com/security/cve/CVE-2016-6922 https://access.redhat.com/security/cve/CVE-2016-6923 https://access.redhat.com/security/cve/CVE-2016-6924 https://access.redhat.com/security/cve/CVE-2016-6925 https://access.redhat.com/security/cve/CVE-2016-6926 https://access.redhat.com/security/cve/CVE-2016-6927 https://access.redhat.com/security/cve/CVE-2016-6929 https://access.redhat.com/security/cve/CVE-2016-6930 https://access.redhat.com/security/cve/CVE-2016-6931 https://access.redhat.com/security/cve/CVE-2016-6932 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb16-29.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX2Pp+XlSAg2UNWIIRAp1iAKCmfmh77bYTg10K3b0b6aJuxtLEgACfZlyh ynwsnFlRoTlOLVQLiobHvps= =1fXO -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player 23.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-23.0.0.205" All Adobe Flash Player 11.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.635" References ========== [ 1 ] CVE-2016-4182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4182 [ 2 ] CVE-2016-4271 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4271 [ 3 ] CVE-2016-4272 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4272 [ 4 ] CVE-2016-4273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4273 [ 5 ] CVE-2016-4274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4274 [ 6 ] CVE-2016-4275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4275 [ 7 ] CVE-2016-4276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4276 [ 8 ] CVE-2016-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4277 [ 9 ] CVE-2016-4278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4278 [ 10 ] CVE-2016-4279 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4279 [ 11 ] CVE-2016-4280 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4280 [ 12 ] CVE-2016-4281 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4281 [ 13 ] CVE-2016-4282 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4282 [ 14 ] CVE-2016-4283 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4283 [ 15 ] CVE-2016-4284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4284 [ 16 ] CVE-2016-4285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4285 [ 17 ] CVE-2016-4286 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4286 [ 18 ] CVE-2016-4287 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4287 [ 19 ] CVE-2016-6921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6921 [ 20 ] CVE-2016-6922 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6922 [ 21 ] CVE-2016-6923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6923 [ 22 ] CVE-2016-6924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6924 [ 23 ] CVE-2016-6925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6925 [ 24 ] CVE-2016-6926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6926 [ 25 ] CVE-2016-6927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6927 [ 26 ] CVE-2016-6929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6929 [ 27 ] CVE-2016-6930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6930 [ 28 ] CVE-2016-6931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6931 [ 29 ] CVE-2016-6932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6932 [ 30 ] CVE-2016-6981 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6981 [ 31 ] CVE-2016-6982 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6982 [ 32 ] CVE-2016-6983 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6983 [ 33 ] CVE-2016-6984 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6984 [ 34 ] CVE-2016-6985 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6985 [ 35 ] CVE-2016-6986 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6986 [ 36 ] CVE-2016-6987 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6987 [ 37 ] CVE-2016-6989 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6989 [ 38 ] CVE-2016-6990 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6990 [ 39 ] CVE-2016-6992 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6992 [ 40 ] CVE-2016-7855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7855 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5