VARIoT IoT vulnerabilities database

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted setMask arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7657 , CVE-2015-7658 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8042 , CVE-2015-8043 , CVE-2015-8044 ,and CVE-2015-8046 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlCrafted by attackers setMask Arbitrary code may be executed via the argument. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the setMask method. By manipulating the arguments passed to the setMask method, an attacker can force a dangling pointer to be reused after it has been freed. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation. Supplementary information : CWE Vulnerability type by CWE-843:Access of Resource Using Incompatible Type ( Mixing of molds ) Has been identified. http://cwe.mitre.org/data/definitions/843.htmlBy the attacker, NetConnection Unspecified in object implementation " Mixing of molds (type confusion)" May be used to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the NetConnection objects. By overriding specific object properties, it is possible to trigger a type confusion condition. Failed exploit attempts will likely cause a denial-of-service condition. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.213 and earlier versions, based on AIR for Android 19 on the Android platform. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionCallMethod arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7658 , CVE-2015-7660 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8042 , CVE-2015-8043 , CVE-2015-8044 ,and CVE-2015-8046 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlCrafted by attackers actionCallMethod Arbitrary code may be executed via the argument. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the actionCallMethod opcode. By manipulating the arguments passed to the actionCallMethod opcode, an attacker can force a dangling pointer to be reused after it has been freed. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8044, and CVE-2015-8046. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7657 , CVE-2015-7658 , CVE-2015-7660 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8042 , CVE-2015-8044 ,and CVE-2015-8046 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.213 and earlier versions, AIR for Android 19.0.0 based on the Android platform. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8046. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7657 , CVE-2015-7658 , CVE-2015-7660 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8042 , CVE-2015-8043 ,and CVE-2015-8046 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.213 and earlier versions, AIR for Android 19.0.0 based on the Android platform. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8044. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7657 , CVE-2015-7658 , CVE-2015-7660 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8042 , CVE-2015-8043 ,and CVE-2015-8044 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.213 and earlier versions, AIR for Android 19.0.0 based on the Android platform. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted loadSound call, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7657 , CVE-2015-7658 , CVE-2015-7660 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8043 , CVE-2015-8044 ,and CVE-2015-8046 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlCrafted by attackers loadSound Arbitrary code may be executed via a call. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Sound objects. By calling the loadSound method, it is possible to trigger a use-after-free. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionInstanceOf arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046. This vulnerability CVE-2015-7651 , CVE-2015-7652 , CVE-2015-7653 , CVE-2015-7654 , CVE-2015-7655 , CVE-2015-7656 , CVE-2015-7657 , CVE-2015-7660 , CVE-2015-7661 , CVE-2015-7663 , CVE-2015-8042 , CVE-2015-8043 , CVE-2015-8044 ,and CVE-2015-8046 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlCrafted by attackers actionInstanceOf Arbitrary code may be executed via the argument. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the actionInstanceOf opcode. By manipulating the arguments passed to the actionInstanceOf opcode, an attacker can force a dangling pointer to be reused after it has been freed. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.226 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player Extended Support Release 18.0.0.255 and earlier versions, AIR Desktop Runtime 19.0.0.213 and earlier versions; based on Windows, Macintosh , Adobe Flash Player for Google Chrome 19.0.0.226 and earlier versions on Linux and ChromeOS platforms, Adobe Flash Player for Microsoft Edge and Internet Explorer 19.0.0.226 and earlier versions based on Windows 10 platforms, Adobe Flash Player based on Windows 8.0 and 8.1 platforms For Internet Explorer 10 and 11 19.0.0.226 and earlier versions, Adobe Flash Player for Linux 11.2.202.540 and earlier versions based on Linux platforms, AIR SDK 19.0.0.213 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2023-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2023.html Issue date: 2015-11-11 CVE Names: CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.548. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.548-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.548-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyVTXlSAg2UNWIIRAvDjAJwKgOImEj7zcQ5I39hBWiMAxYluDACdF+vN A2xUVKrwMjMMezKi8h7ucP4= =2cUK -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

The web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and 3.0(0.54) allows remote authenticated users to bypass intended access restrictions and modify the configuration by leveraging the Monitor-Only role, aka Bug ID CSCuw42640. Vendors report this vulnerability Bug ID CSCuw42640 Published as.By a remotely authenticated user, Monitor-Only By using roles, access restrictions can be bypassed and settings may be changed. Attackers can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug ID CSCuw42640

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi. plural F5 Product iControl API Contains a privileged vulnerability."Resource Administrator" By a remotely authenticated user with the role of iControl/iControlPortal.cgi To SOAP Request iCall of (1) Script or (2) There is a possibility that the privilege is obtained through the handler. Multiple F5 BIG-IP Products are prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges and perform unauthorized actions. F5 BIG-IP LTM, etc. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. A security vulnerability exists in the iControl API of several F5 products due to the iControl/iControlPortal.cgi file not adequately filtering SOAP requests. 0 version, BIG-IQ ADC version 4.5.0

The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands, as well as utilizes an outdated vulnerable version of Apache commons-collections, which may allow an attacker to implement deserialization attacks and control the EAP Controller server. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. Apache Commons Collections (ACC) The library deserialization process is vulnerable. Java Application ACC When using the library directly or within the range accessible by specifying the class path ACC If a library is installed, arbitrary code may be executed. Apache Commons Collections (ACC) Library http://commons.apache.org/proper/commons-collections/ Deserialize untrusted data (CWE-502) 2015 Year 1 Held on the moon AppSec California 2015 In Gabriel Lawrence Mr. and Chris Frohoff He talked about a vulnerability that could deserialize untrusted data and showed that it could execute arbitrary code. Any use of the serialization function that is not appropriate Java Application or Java Libraries are affected by this vulnerability. Deserialize untrusted data (CWE-502) http://cwe.mitre.org/data/definitions/502.html Gabriel Lawrence Mr. and Chris Frohoff Mr. Lecture http://frohoff.github.io/appseccali-marshalling-pickles/ 2015 Year 11 A month Foxglove Security of Stephen Breen Mr. this problem Apache Commons Collections (ACC) Exist in the library, especially for deserializing untrusted data InvokerTransformer It was pointed out that arbitrary code could be executed when using classes. ACC Software that uses the library, WebSphere , Jenkins , WebLogic , OpenNMS Etc. are also affected. Foxglove Security of Stephen Breen Mr (What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.) http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Jenkins https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WebLogic http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html?elq_mid=31793&sh=&cmid=WWSU12091612MPP001C179 ACC Library version 3.2.1 , 4.0 Both are affected by this vulnerability. version 3.2.1 , 4.0 https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Apache Software Fondation Has posted an official view of the vulnerability on its blog. Here you can find advice on countermeasures and links to related information. In addition, entries related to this vulnerability (COLLECTIONS-580) Is built on a bug management system. Official view https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Entries related to this vulnerability (COLLECTIONS-580) https://issues.apache.org/jira/browse/COLLECTIONS-580 ACC other than, Groovy And Spring The same problem is being investigated for these issues. Lawrence Mr. and Frohoff In his presentation material, Java not only Python And Ruby It is stated that the same problem exists in applications and libraries written in the above. Regardless of the programming language or library used, it is important to fully consider the data serialization capabilities from the software design stage.Apache Commons Collections I'm using a library Java Application or Java Library is optional Java It may be possible to execute code. Also, ACC Even if the library is not used directly, it can be accessed by specifying the class path. ACC If the library exists, any Java It may be possible to execute code. It can extend or add Java collections framework. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Vulnerability in Java Deserialization Affecting Cisco Products Advisory ID: cisco-sa-20151209-java-deserialization Revision 1.0 For Public Release: 2015 December 9 16:00 GMT +--------------------------------------------------------------------- Summary ======= A vulnerability in the Java deserialization used by the Apache Commons Collections (ACC) library could allow an unauthenticated, remote attacker to execute arbitrary code. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. The report contains detailed proof-of-concept code for a number of applications, including WebSphere Application Server, JBoss, Jenkins, OpenNMS, and WebLogic. A wide range of potential impacts includes allowing the attacker to obtain sensitive information. Object serialization is a technique that many programming languages use to convert an object into a sequence of bits for transfer purposes. Deserialization is a technique that reassembles those bits back to an object. Many applications accept serialized objects from the network without performing input validation checks before deserializing it. Additional details about the vulnerability are available at the following links: Official Vulnerability Note from CERT: http://www.kb.cert.org/vuls/id/576313 Foxglove Security: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Apache Commons Statement: https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Oracle Security Alert: https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852 Cisco will release software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWaE9BAAoJEIpI1I6i1Mx31a0QALya6VDmcGiyx3AlCzsKGISc 3NJP4PPjVFGjHQmB/+bXn1zXLZ63JgbOZuG9pLxhmJpPMxQI8jeXEHqzVmrA9cOj u/QRGkITxQaRS50cwFJXPDOVWWCTcHLhuk83Ofih8vhC8UPBy1FGMBl5rpVLDkG9 ue8yX5ACEQ078F78dpcnJmbv1Hxu021wI+nM3pn7C/aOrJ1wSNop8KkFZ+VHzbKY aeuMFqhal+ePx+JoIC4JMrTll/BLxjI17tKrzXas6D4zKNGSO0WxnEFjDWuPlc89 2y3DnaVc0eeAVPy3ODN6wJzuro4w69z1GrvXPkBfVe9WNKD1lMGRUPMRwnb/zjxu DT8Ms4LDaVCLDZ01ox3BpuZIDBP1q2Xk6ToObeHUNMSDM9IuMeVOz9BtxJxO8Yp/ YfVaoqkM6Vrf5oXKUvWow0r19+ODp18JUnc8qT7Cj0b9PwtlOUqpsNE+cAzPyZh7 UBYLPm2AZypOgw4ryUf66p3l+NGLvLdA+A1u0m+YfXSrsuEFCosUeppmZMvgzEME 7TDSbOlt6yj9W/U3ioYbhLWk1D2whTyDybXz4MLaPTPxfxozyePOcthU7R/PVGrU M0Do8nugnDXE0rYVRooF3+A/6ahoKUb9QR00O4xN4A94lfXqgc6t+180S4vavgxS g9ZP7zYVhaDCRufDoNVI =nsL1 -----END PGP SIGNATURE----- . References: CVE-2016-4373 CERT-VU#576313 PSRT110183 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Operations Manager for Linux - v9.1x, v9.20.x/9.21.x and versions prior to v9.21.130 HP Operations Manager for Solaris - v9.1x, v9.20.x/9.21.x and versions prior to 9.21.130 HP Operations Manager for Unix - v9.1x, 9.20.x/9.21.x and versions prior to 9.21.130 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2016-4373 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay/?docI d=emr_na-c01345499 RESOLUTION HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of HP Operations Manager for Unix/Solaris/Linux. For v9.1x Upgrade to HP OM v9.2 and then apply 9.21.130 patch. For v9.2x - Apply 9.21.130 patch. Please download the HP OM 9.21.130 patch from the following location: https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facetse arch/document/KM322544?lang=en&cc=us&hpappid=202392_SSO_PRO_HPE HISTORY Version:1 (rev.1) - 25 July 2016 - Initial release Version:2 (rev.2) - 11 August 2016 - Changed the product version and resolution section Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners

The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service commands in EAP controller versions 2.5.3 and earlier. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode. TP-LINK EAP Controller Is vulnerable to a lack of authentication for critical functions.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apache Commons Collections (ACC) The library deserialization process is vulnerable. Java Application ACC When using the library directly or within the range accessible by specifying the class path ACC If a library is installed, arbitrary code may be executed. Apache Commons Collections (ACC) Library http://commons.apache.org/proper/commons-collections/ Deserialize untrusted data (CWE-502) 2015 Year 1 Held on the moon AppSec California 2015 In Gabriel Lawrence Mr. and Chris Frohoff He talked about a vulnerability that could deserialize untrusted data and showed that it could execute arbitrary code. Any use of the serialization function that is not appropriate Java Application or Java Libraries are affected by this vulnerability. Deserialize untrusted data (CWE-502) http://cwe.mitre.org/data/definitions/502.html Gabriel Lawrence Mr. and Chris Frohoff Mr. Lecture http://frohoff.github.io/appseccali-marshalling-pickles/ 2015 Year 11 A month Foxglove Security of Stephen Breen Mr. this problem Apache Commons Collections (ACC) Exist in the library, especially for deserializing untrusted data InvokerTransformer It was pointed out that arbitrary code could be executed when using classes. ACC Software that uses the library, WebSphere , Jenkins , WebLogic , OpenNMS Etc. are also affected. Foxglove Security of Stephen Breen Mr (What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.) http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Jenkins https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WebLogic http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html?elq_mid=31793&sh=&cmid=WWSU12091612MPP001C179 ACC Library version 3.2.1 , 4.0 Both are affected by this vulnerability. version 3.2.1 , 4.0 https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Apache Software Fondation Has posted an official view of the vulnerability on its blog. Here you can find advice on countermeasures and links to related information. In addition, entries related to this vulnerability (COLLECTIONS-580) Is built on a bug management system. Official view https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Entries related to this vulnerability (COLLECTIONS-580) https://issues.apache.org/jira/browse/COLLECTIONS-580 ACC other than, Groovy And Spring The same problem is being investigated for these issues. Lawrence Mr. and Frohoff In his presentation material, Java not only Python And Ruby It is stated that the same problem exists in applications and libraries written in the above. Regardless of the programming language or library used, it is important to fully consider the data serialization capabilities from the software design stage.Apache Commons Collections I'm using a library Java Application or Java Library is optional Java It may be possible to execute code. Also, ACC Even if the library is not used directly, it can be accessed by specifying the class path. ACC If the library exists, any Java It may be possible to execute code. It can extend or add Java collections framework. TP-LINK EAP Controller is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks. EAP Controller version 2.5.3 and prior are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Vulnerability in Java Deserialization Affecting Cisco Products Advisory ID: cisco-sa-20151209-java-deserialization Revision 1.0 For Public Release: 2015 December 9 16:00 GMT +--------------------------------------------------------------------- Summary ======= A vulnerability in the Java deserialization used by the Apache Commons Collections (ACC) library could allow an unauthenticated, remote attacker to execute arbitrary code. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. The report contains detailed proof-of-concept code for a number of applications, including WebSphere Application Server, JBoss, Jenkins, OpenNMS, and WebLogic. A wide range of potential impacts includes allowing the attacker to obtain sensitive information. Object serialization is a technique that many programming languages use to convert an object into a sequence of bits for transfer purposes. Deserialization is a technique that reassembles those bits back to an object. Many applications accept serialized objects from the network without performing input validation checks before deserializing it. Additional details about the vulnerability are available at the following links: Official Vulnerability Note from CERT: http://www.kb.cert.org/vuls/id/576313 Foxglove Security: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Apache Commons Statement: https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Oracle Security Alert: https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852 Cisco will release software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWaE9BAAoJEIpI1I6i1Mx31a0QALya6VDmcGiyx3AlCzsKGISc 3NJP4PPjVFGjHQmB/+bXn1zXLZ63JgbOZuG9pLxhmJpPMxQI8jeXEHqzVmrA9cOj u/QRGkITxQaRS50cwFJXPDOVWWCTcHLhuk83Ofih8vhC8UPBy1FGMBl5rpVLDkG9 ue8yX5ACEQ078F78dpcnJmbv1Hxu021wI+nM3pn7C/aOrJ1wSNop8KkFZ+VHzbKY aeuMFqhal+ePx+JoIC4JMrTll/BLxjI17tKrzXas6D4zKNGSO0WxnEFjDWuPlc89 2y3DnaVc0eeAVPy3ODN6wJzuro4w69z1GrvXPkBfVe9WNKD1lMGRUPMRwnb/zjxu DT8Ms4LDaVCLDZ01ox3BpuZIDBP1q2Xk6ToObeHUNMSDM9IuMeVOz9BtxJxO8Yp/ YfVaoqkM6Vrf5oXKUvWow0r19+ODp18JUnc8qT7Cj0b9PwtlOUqpsNE+cAzPyZh7 UBYLPm2AZypOgw4ryUf66p3l+NGLvLdA+A1u0m+YfXSrsuEFCosUeppmZMvgzEME 7TDSbOlt6yj9W/U3ioYbhLWk1D2whTyDybXz4MLaPTPxfxozyePOcthU7R/PVGrU M0Do8nugnDXE0rYVRooF3+A/6ahoKUb9QR00O4xN4A94lfXqgc6t+180S4vavgxS g9ZP7zYVhaDCRufDoNVI =nsL1 -----END PGP SIGNATURE-----

HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library. The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands, as well as utilizes an outdated vulnerable version of Apache commons-collections, which may allow an attacker to implement deserialization attacks and control the EAP Controller server. Apache Commons Collections (ACC) The library deserialization process is vulnerable. Java Application ACC When using the library directly or within the range accessible by specifying the class path ACC If a library is installed, arbitrary code may be executed. Apache Commons Collections (ACC) Library http://commons.apache.org/proper/commons-collections/ Deserialize untrusted data (CWE-502) 2015 Year 1 Held on the moon AppSec California 2015 In Gabriel Lawrence Mr. and Chris Frohoff He talked about a vulnerability that could deserialize untrusted data and showed that it could execute arbitrary code. Any use of the serialization function that is not appropriate Java Application or Java Libraries are affected by this vulnerability. Deserialize untrusted data (CWE-502) http://cwe.mitre.org/data/definitions/502.html Gabriel Lawrence Mr. and Chris Frohoff Mr. Lecture http://frohoff.github.io/appseccali-marshalling-pickles/ 2015 Year 11 A month Foxglove Security of Stephen Breen Mr. this problem Apache Commons Collections (ACC) Exist in the library, especially for deserializing untrusted data InvokerTransformer It was pointed out that arbitrary code could be executed when using classes. ACC Software that uses the library, WebSphere , Jenkins , WebLogic , OpenNMS Etc. are also affected. Foxglove Security of Stephen Breen Mr (What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.) http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Jenkins https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WebLogic http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html?elq_mid=31793&sh=&cmid=WWSU12091612MPP001C179 ACC Library version 3.2.1 , 4.0 Both are affected by this vulnerability. version 3.2.1 , 4.0 https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Apache Software Fondation Has posted an official view of the vulnerability on its blog. Here you can find advice on countermeasures and links to related information. In addition, entries related to this vulnerability (COLLECTIONS-580) Is built on a bug management system. Official view https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Entries related to this vulnerability (COLLECTIONS-580) https://issues.apache.org/jira/browse/COLLECTIONS-580 ACC other than, Groovy And Spring The same problem is being investigated for these issues. Lawrence Mr. and Frohoff In his presentation material, Java not only Python And Ruby It is stated that the same problem exists in applications and libraries written in the above. Regardless of the programming language or library used, it is important to fully consider the data serialization capabilities from the software design stage.Apache Commons Collections I'm using a library Java Application or Java Library is optional Java It may be possible to execute code. Also, ACC Even if the library is not used directly, it can be accessed by specifying the class path. ACC If the library exists, any Java It may be possible to execute code. It can extend or add Java collections framework. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Vulnerability in Java Deserialization Affecting Cisco Products Advisory ID: cisco-sa-20151209-java-deserialization Revision 1.0 For Public Release: 2015 December 9 16:00 GMT +--------------------------------------------------------------------- Summary ======= A vulnerability in the Java deserialization used by the Apache Commons Collections (ACC) library could allow an unauthenticated, remote attacker to execute arbitrary code. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. The report contains detailed proof-of-concept code for a number of applications, including WebSphere Application Server, JBoss, Jenkins, OpenNMS, and WebLogic. A wide range of potential impacts includes allowing the attacker to obtain sensitive information. Object serialization is a technique that many programming languages use to convert an object into a sequence of bits for transfer purposes. Deserialization is a technique that reassembles those bits back to an object. Many applications accept serialized objects from the network without performing input validation checks before deserializing it. Additional details about the vulnerability are available at the following links: Official Vulnerability Note from CERT: http://www.kb.cert.org/vuls/id/576313 Foxglove Security: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Apache Commons Statement: https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Oracle Security Alert: https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852 Cisco will release software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWaE9BAAoJEIpI1I6i1Mx31a0QALya6VDmcGiyx3AlCzsKGISc 3NJP4PPjVFGjHQmB/+bXn1zXLZ63JgbOZuG9pLxhmJpPMxQI8jeXEHqzVmrA9cOj u/QRGkITxQaRS50cwFJXPDOVWWCTcHLhuk83Ofih8vhC8UPBy1FGMBl5rpVLDkG9 ue8yX5ACEQ078F78dpcnJmbv1Hxu021wI+nM3pn7C/aOrJ1wSNop8KkFZ+VHzbKY aeuMFqhal+ePx+JoIC4JMrTll/BLxjI17tKrzXas6D4zKNGSO0WxnEFjDWuPlc89 2y3DnaVc0eeAVPy3ODN6wJzuro4w69z1GrvXPkBfVe9WNKD1lMGRUPMRwnb/zjxu DT8Ms4LDaVCLDZ01ox3BpuZIDBP1q2Xk6ToObeHUNMSDM9IuMeVOz9BtxJxO8Yp/ YfVaoqkM6Vrf5oXKUvWow0r19+ODp18JUnc8qT7Cj0b9PwtlOUqpsNE+cAzPyZh7 UBYLPm2AZypOgw4ryUf66p3l+NGLvLdA+A1u0m+YfXSrsuEFCosUeppmZMvgzEME 7TDSbOlt6yj9W/U3ioYbhLWk1D2whTyDybXz4MLaPTPxfxozyePOcthU7R/PVGrU M0Do8nugnDXE0rYVRooF3+A/6ahoKUb9QR00O4xN4A94lfXqgc6t+180S4vavgxS g9ZP7zYVhaDCRufDoNVI =nsL1 -----END PGP SIGNATURE----- . References: CVE-2016-1985 PSRT102960 CERT-VU#576313 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Operations Manager for Windows v8.x, and v9.0. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2016-1985 (AV:L/AC:L/Au:N/C:C/I:C/A:C) 7.2 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of Operations Manager for windows: https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea rch/document/KM02058067 HISTORY Version:1 (rev.1) - 29 January 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands, as well as utilizes an outdated vulnerable version of Apache commons-collections, which may allow an attacker to implement deserialization attacks and control the EAP Controller server. plural Cisco The serialized object interface of the product contains an arbitrary command execution vulnerability. http://cwe.mitre.org/data/definitions/502.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. Apache Commons Collections (ACC) The library deserialization process is vulnerable. Java Application ACC When using the library directly or within the range accessible by specifying the class path ACC If a library is installed, arbitrary code may be executed. Apache Commons Collections (ACC) Library http://commons.apache.org/proper/commons-collections/ Deserialize untrusted data (CWE-502) 2015 Year 1 Held on the moon AppSec California 2015 In Gabriel Lawrence Mr. and Chris Frohoff He talked about a vulnerability that could deserialize untrusted data and showed that it could execute arbitrary code. Any use of the serialization function that is not appropriate Java Application or Java Libraries are affected by this vulnerability. Deserialize untrusted data (CWE-502) http://cwe.mitre.org/data/definitions/502.html Gabriel Lawrence Mr. and Chris Frohoff Mr. Lecture http://frohoff.github.io/appseccali-marshalling-pickles/ 2015 Year 11 A month Foxglove Security of Stephen Breen Mr. this problem Apache Commons Collections (ACC) Exist in the library, especially for deserializing untrusted data InvokerTransformer It was pointed out that arbitrary code could be executed when using classes. ACC Software that uses the library, WebSphere , Jenkins , WebLogic , OpenNMS Etc. are also affected. Foxglove Security of Stephen Breen Mr (What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.) http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Jenkins https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WebLogic http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html?elq_mid=31793&sh=&cmid=WWSU12091612MPP001C179 ACC Library version 3.2.1 , 4.0 Both are affected by this vulnerability. version 3.2.1 , 4.0 https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Apache Software Fondation Has posted an official view of the vulnerability on its blog. Here you can find advice on countermeasures and links to related information. In addition, entries related to this vulnerability (COLLECTIONS-580) Is built on a bug management system. Official view https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Entries related to this vulnerability (COLLECTIONS-580) https://issues.apache.org/jira/browse/COLLECTIONS-580 ACC other than, Groovy And Spring The same problem is being investigated for these issues. Lawrence Mr. and Frohoff In his presentation material, Java not only Python And Ruby It is stated that the same problem exists in applications and libraries written in the above. Regardless of the programming language or library used, it is important to fully consider the data serialization capabilities from the software design stage.Apache Commons Collections I'm using a library Java Application or Java Library is optional Java It may be possible to execute code. Also, ACC Even if the library is not used directly, it can be accessed by specifying the class path. ACC If the library exists, any Java It may be possible to execute code. Oracle WebLogic is an application server based on Java (J2EE) architecture of Oracle Corporation of the United States. Red Hat JBOSS is an open source J2EE-based application server from Red Hat. CloudBees Jenkins CI (formerly known as Hudson Labs) is a set of Java-based continuous integration tools developed by CloudBees. OpenNMS is a set of enterprise-level, Java / XML-based distributed network and system monitoring and management platform from the American OpenNMS company. It can extend or add Java collections framework. A remote command execution vulnerability exists in Java's deserialization process. A remote attacker can exploit this vulnerability by constructing an automatically executed code call chain to attach malicious code to user input and execute arbitrary Java functions or bytecode. The following products and versions are affected: JBoss Enterprise Application Platform 6.4.4, 5.2.0, 4.3.0_CP10, AS (Wildly) 6 and earlier, A-MQ 6.2.0, Fuse 6.2.0, SOA Platform (SOA-P) 5.3.1, Data Grid (JDG) 6.5.0, BRMS (BRMS) 6.1.0, BPMS (BPMS) 6.1.0, Data Virtualization (JDV) 6.1.0, Fuse Service Works (FSW) version 6.0.0, Enterprise Web Server (EWS) version 2.1, version 3.0, Jenkins version 1.555, WebSphere, WebLogic, OpenNMS. Apache Commons Collections（ACC）是美国阿帕奇（Apache）软件基金会的一个Apache Commons项目的Commons Proper（可重复利用Java组件库）中的组件，它可以扩展或增加Java集合框架. 多款Cisco产品的ACC库中使用的Java反序列化过程中存在安全漏洞。远程攻击者可通过提交特制的输入利用该漏洞执行任意代码。以下产品及版本受到影响：Cisco Digital Life RMS 1.8.1.1版本，Broadband Access Center Telco Wireless 3.8.1版本；SocialMiner，WebEx Meetings Server 1.x版本，2.x版本；NAC Agent for Windows；InTracer，Network Admission Control (NAC)，Visual Quality Experience Server，Visual Quality Experience Tools Server；ASA CX and Cisco Prime Security Manager，Clean Access Manager，NAC Appliance (Clean Access Server)，NAC Guest Server，NAC Server，Secure Access Control System (ACS)；Access Registrar Appliance，Cloupia Unified Infrastructure Controller，Configuration Professional，Digital Media Manager，Insight Reporter，Prime Access Registrar Appliance，Prime Access Registrar，Prime Collaboration Provisioning，Prime Home，Prime LAN Management Solution (LMS - Solaris)，Prime Optical for SPs，Prime Performance Manager，Prime Provisioning for SPs，Prime Provisioning，Prime Service Catalog Virtual Appliance，Security Manager，Data Center Analytics Framework (DCAF)；Broadband Access Center Telco Wireless；Computer Telephony Integration Object Server (CTIOS)，Hosted Collaboration Mediation Fulfillment，IM and Presence Service (CUPS)，IP Interoperability and Collaboration System (IPICS)，Management Heartbeat Server，MediaSense，MeetingPlace，Unified Communications Manager (UCM)，Unified Communications Manager Session Management Edition (SME)，Unified Contact Center Enterprise，Unified Intelligence Center，Unified Intelligent Contact Management Enterprise，Unified Sip Proxy；Media Experience Engines (MXE)，Show and Share，TelePresence Exchange System (CTX)，Videoscape Conductor；Business Video Services Automation Software (BV)，Cloud Email Security，Registered Envelope Service (CRES)，Unified Services Delivery Platform (CUSDP)，Communication/Collaboration Sizing Tool, Virtue Machine Placement Tool，Unified Communications Upgrade Readiness Assessment，DCAF UCS Collector，Network Change and Configuration Management，Partner Supporting Service (PSS) 1.x版本，SI component of Partner Supporting Service，Serial Number Assessment Service (SNAS)，Smart Net Total Care (SNTC). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Vulnerability in Java Deserialization Affecting Cisco Products Advisory ID: cisco-sa-20151209-java-deserialization Revision 1.0 For Public Release: 2015 December 9 16:00 GMT +--------------------------------------------------------------------- Summary ======= A vulnerability in the Java deserialization used by the Apache Commons Collections (ACC) library could allow an unauthenticated, remote attacker to execute arbitrary code. The report contains detailed proof-of-concept code for a number of applications, including WebSphere Application Server, JBoss, Jenkins, OpenNMS, and WebLogic. A wide range of potential impacts includes allowing the attacker to obtain sensitive information. Object serialization is a technique that many programming languages use to convert an object into a sequence of bits for transfer purposes. Deserialization is a technique that reassembles those bits back to an object. Many applications accept serialized objects from the network without performing input validation checks before deserializing it. Additional details about the vulnerability are available at the following links: Official Vulnerability Note from CERT: http://www.kb.cert.org/vuls/id/576313 Foxglove Security: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Apache Commons Statement: https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Oracle Security Alert: https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852 Cisco will release software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWaE9BAAoJEIpI1I6i1Mx31a0QALya6VDmcGiyx3AlCzsKGISc 3NJP4PPjVFGjHQmB/+bXn1zXLZ63JgbOZuG9pLxhmJpPMxQI8jeXEHqzVmrA9cOj u/QRGkITxQaRS50cwFJXPDOVWWCTcHLhuk83Ofih8vhC8UPBy1FGMBl5rpVLDkG9 ue8yX5ACEQ078F78dpcnJmbv1Hxu021wI+nM3pn7C/aOrJ1wSNop8KkFZ+VHzbKY aeuMFqhal+ePx+JoIC4JMrTll/BLxjI17tKrzXas6D4zKNGSO0WxnEFjDWuPlc89 2y3DnaVc0eeAVPy3ODN6wJzuro4w69z1GrvXPkBfVe9WNKD1lMGRUPMRwnb/zjxu DT8Ms4LDaVCLDZ01ox3BpuZIDBP1q2Xk6ToObeHUNMSDM9IuMeVOz9BtxJxO8Yp/ YfVaoqkM6Vrf5oXKUvWow0r19+ODp18JUnc8qT7Cj0b9PwtlOUqpsNE+cAzPyZh7 UBYLPm2AZypOgw4ryUf66p3l+NGLvLdA+A1u0m+YfXSrsuEFCosUeppmZMvgzEME 7TDSbOlt6yj9W/U3ioYbhLWk1D2whTyDybXz4MLaPTPxfxozyePOcthU7R/PVGrU M0Do8nugnDXE0rYVRooF3+A/6ahoKUb9QR00O4xN4A94lfXqgc6t+180S4vavgxS g9ZP7zYVhaDCRufDoNVI =nsL1 -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05376917 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05376917 Version: 1 HPSBMU03685 rev.1 - HPE Insight Control server provisioning (ICsp), Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-01-18 Last Updated: 2017-01-18 Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Denial of Service (DoS), Disclosure of Sensitive Information, Unauthorized Access to Files Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Insight Control server provisioning (ICsp) software. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS), arbitrary code execution, arbitrary command execution, unauthorized access to files or disclosure of sensitive information. References: - CVE-2015-6420 - Cisco routing and switching, execution of code - CVE-2016-0702 - OpenSSL, disclosure of information, "CacheBleed" - CVE-2016-0705 - OpenSSL, denial of service (DoS) - CVE-2016-0797 - OpenSSL, denial of service (DoS) - CVE-2016-0799 - OpenSSL, denial of service (DoS) - CVE-2016-2842 - OpenSSL, denial of service (DoS) - CVE-2015-7547 - glibc, denial of service (DoS) - CVE-2014-0050 - Apache Commons FileUpload, denial of service (DoS) - CVE-2014-4877 - wget, execution of arbitrary code SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Insight Control server provisioning all versions prior to 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2014-0050 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2014-4877 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-6420 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-7547 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) CVE-2016-0702 2.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N) CVE-2016-0705 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2016-0797 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-0799 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2016-2842 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has made the following software updates available to resolve the vulnerabilities for the impacted versions of HPE Insight Control server provisioning (ICsp). Please download the latest version of Insight Control server provisioning (ICsp)-7.6 from the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=IMDVD> HISTORY Version:1 (rev.1) - 18 January 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners

Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ URI. For example, a remote attacker http://[IP address ]:37215/icon/../../../etc/inittab By directly accessing inittab It is possible to get the file. Depending on your settings, LAN You may be exposed to these attacks from the outside. Huawei HG532e, HG532n, and HG532s are wireless router products from Huawei. Multiple Huawei HG532 routers are prone to a directory-traversal vulnerability. An attacker can exploit this issue to obtain sensitive information that could aid in further attacks. The following products are affected: Huawei HG532e, HG532n, HG532s

The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic.". plural F5 BIG-IP Product vCMP Host has a service disruption (DoS) Vulnerabilities exist.By a third party " Malicious traffic " Through service disruption (DoS) There is a possibility of being put into a state. F5 BIG-IP Analytics and others are products of F5 Corporation of the United States. F5 BIG-IP Analytics is a suite of web application performance analysis software. APM is a set of solutions that provide secure and unified access to business-critical applications and networks. LTM is a local traffic manager. A security vulnerability exists in the vCMP host of several F5 products. A remote attacker can use malicious traffic to exploit this vulnerability to cause a denial of service

The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0 through 11.6.0, BIG-IP PSM 11.1.0 through 11.4.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ ADC 4.5.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code. plural F5 BIG-IP Product Datastor kernel Module contains service disruption (DoS) There are vulnerabilities that can be made state or gain privileges.Denial of service due to the use of permissions to upload and execute code by remotely authenticated users (DoS) It may be put into a state or it may be authorized. F5 BIG-IP Analytics and others are products of F5 Corporation of the United States. F5 BIG-IP Analytics is a suite of web application performance analysis software. APM is a set of solutions that provide secure and unified access to business-critical applications and networks. LTM is a local traffic manager. datastor kernel is a datastor kernel module used in these products. A security vulnerability exists in the datastor kernel module of several F5 products. 0 to 11.4.1; BIG-IQ Cloud and Security 4.0.0 to 4.5.0; BIG-IQ Device 4.2.0 to 4.5.0; BIG-IQ ADC 4.5.0; Enterprise Manager 3.0 .0 version to 3.1.1 version

Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet. SonicWall TotalSecure TZ 100 Series is a firewall product provided by Dell Inc. SonicWall TotalSecure TZ 100 Series contains a denial-of-service (DoS) vulnerability. FFRI,Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Processing a specially crafted packet may lead to a denial-of-service (DoS). An attacker can exploit this issue to cause a denial-of-service condition. Dell SonicWall TotalSecure TZ 100 is a Unified Threat Management (UTM) firewall from Dell, USA, that provides functions such as intrusion prevention, anti-malware, content/URL filtering, and application control

Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardcoded SSH keys, which makes it easier for remote attackers to obtain access via an SSH session. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. http://cwe.mitre.org/data/definitions/798.htmlBy a third party SSH Access may be gained through a session. Advantech EKI-122x-BE, EKI-132x and EKI-136x are all serial device networking servers of Advantech, Inc., which provide various redundant configurations and multiple channels for remote monitoring of serial devices via Ethernet communication protocol. Access configuration. Security vulnerabilities exist in several Advantech products. Multiple Advantech EKI products are prone to a security-bypass vulnerability

The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501. The platform collects, stores, and manages data from wireless clients, Cisco access points, and controllers. A security vulnerability exists in the default configuration of sshd_config in Cisco MSE 8.0.120.7 and earlier. Because the program allows login using the oracle account. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCuv40501