VARIoT IoT vulnerabilities database

The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215. SAP NetWeaver is a set of service-oriented integrated application platform from SAP (Germany), which provides a development and operating environment for SAP applications. SAP NetWeaver AS (Application Server) Java is an application server running on NetWeaver and based on the Java programming language. An unauthorized access vulnerability exists in SAP NetWeaver AS Java. An attacker could use this vulnerability to obtain sensitive information

ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default password of 1234 for the admin account, which allows remote attackers to obtain administrative access via unspecified vectors. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL NBG-418N, PMG5318-B20A and P-660HW-T1 are products of ZyXEL Technology. Both NBG-418N and P-660HW-T1 are wireless broadband routers; PMG5318-B20A is a wireless switch product. There are security vulnerabilities in several ZyXEL routers. A remote attacker could exploit this vulnerability to modify the system configuration. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions. There is a security vulnerability in ZyXEL P-660HW-T1 2 devices using ZyNOS 3.40(AXH.0) firmware, PMG5318-B20A devices and NBG-418N devices using 1.00AANC0b5 firmware. The vulnerability is caused by using '1234' as admin account password

Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830. Cisco Prime Infrastructure (PI) is a set of Cisco (Cisco) wireless management solutions through Cisco Prime LAN Management Solution (LMS) and Cisco Prime Network Control System (NCS) technology. There is a security vulnerability in Cisco PI version 2.2, which is caused by the program not handling SSL renegotiation requests correctly. A remote attacker could exploit this vulnerability to cause a denial of service (daemon crash)

ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL PMG5318-B20A There is a vulnerability in the device firmware that can gain administrator privileges. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A remote attacker could exploit this vulnerability to modify the system configuration. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions

The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. In addition, National Vulnerability Database (NVD) Then CWE-330 , JVNVU#97093739 Then CWE-613 It is published as CWE-330: Use of Insufficiently Random Values http://cwe.mitre.org/data/definitions/330.html CWE-613: Insufficient Session Expiration http://cwe.mitre.org/data/definitions/613.htmlAccess restrictions may be avoided by using an unattended workstation by a third party. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security vulnerability exists in the ZyXEL PMG5318-B20A with firmware version V100AANC0b5. A remote attacker can use the vulnerability information to gain access to the device. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions

The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. The ZyXEL PMG5318-B20A is a wireless switch from ZyXEL Technology. A security hole exists in the 'PingIPAddr' parameter in the diagnostic ping function of the ZyXEL PMG5318-B20A using V100AANC0b5 firmware. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. Multiple cross-site scripting vulnerabilities 3. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions

Multiple cross-site scripting (XSS) vulnerabilities in Forms/rpAuth_1 on ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0) allow remote attackers to inject arbitrary web script or HTML via the (1) LoginPassword or (2) hiddenPassword parameter. Several models of ZyXEL routers are vulnerable to multiple issues, including weak default passwords, command injections due to improper input validation, and cross-site scripting. ZyXEL P-660HW-T1 v2 Device firmware ZyNOS of Forms/rpAuth_1 Contains a cross-site scripting vulnerability. In addition, JVNVU#97093739 Then CWE-80 It is published as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) http://cwe.mitre.org/data/definitions/80.htmlBy a third party (1) LoginPassword Or (2) hiddenPassword Any via parameter Web Script or HTML May be inserted. The Zyxel P-660HW-T1 is a wireless router product from ZyXEL Technology. Multiple ZyXEL Routers are prone to following security vulnerabilities: 1. An insecure default-password vulnerability 2. A command-execution vulnerability 4. A security-bypass vulnerability 5. An authorization-bypass Successful exploits allow attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing attackers to steal cookie-based authentication credentials, execute arbitrary commands, to gain unauthorized access and bypass security restrictions and perform unauthorized actions

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7641 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7643. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7642 ,and CVE-2015-7643 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1893-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1893.html Issue date: 2015-10-15 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-25 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.535-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.535-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.535-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.535-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.535-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.535-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWH5NuXlSAg2UNWIIRAvqkAJ9lON9Rky8IogN+LkeEn3KgxxlWIACfeHmR muWHgTd958nNy5EHHzsSy4I= =T7iE -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015. Adobe Flash Player Contains a vulnerability that allows arbitrary code execution. Attacks on this vulnerability 2015 Year 10 Observed on the moon.Skillfully crafted by a third party SWF An arbitrary code may be executed via the file. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. The title and technical details have been changed to better reflect the underlying component affected. The product enables viewing of applications, content and video across screens and browsers. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.548" References ========== [ 1 ] CVE-2015-5569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5569 [ 2 ] CVE-2015-7625 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7625 [ 3 ] CVE-2015-7626 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7626 [ 4 ] CVE-2015-7627 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7627 [ 5 ] CVE-2015-7628 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7628 [ 6 ] CVE-2015-7629 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7629 [ 7 ] CVE-2015-7630 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7630 [ 8 ] CVE-2015-7631 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7631 [ 9 ] CVE-2015-7632 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7632 [ 10 ] CVE-2015-7633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7633 [ 11 ] CVE-2015-7634 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7634 [ 12 ] CVE-2015-7643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7643 [ 13 ] CVE-2015-7644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7644 [ 14 ] CVE-2015-7645 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7645 [ 15 ] CVE-2015-7646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7646 [ 16 ] CVE-2015-7647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7647 [ 17 ] CVE-2015-7648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7648 [ 18 ] CVE-2015-7651 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7651 [ 19 ] CVE-2015-7652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7652 [ 20 ] CVE-2015-7653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7653 [ 21 ] CVE-2015-7654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7654 [ 22 ] CVE-2015-7655 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7655 [ 23 ] CVE-2015-7656 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7656 [ 24 ] CVE-2015-7657 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7657 [ 25 ] CVE-2015-7658 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7658 [ 26 ] CVE-2015-7659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7659 [ 27 ] CVE-2015-7660 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7660 [ 28 ] CVE-2015-7661 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7661 [ 29 ] CVE-2015-7662 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7662 [ 30 ] CVE-2015-7663 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7663 [ 31 ] CVE-2015-8042 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8042 [ 32 ] CVE-2015-8043 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8043 [ 33 ] CVE-2015-8044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8044 [ 34 ] CVE-2015-8046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8046 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201511-02 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1913-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1913.html Issue date: 2015-10-16 CVE Names: CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes three security issues is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-27 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.540-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.540-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.540-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.540-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.540-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.540-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-27.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWIW/NXlSAg2UNWIIRApqoAJoDDP+CRbgmKdj4oKw5jnkbbFEuiQCfQZ34 X58Rs0/PxDIcNbEglTImjS8= =0kyk -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability is CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7636 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 This is a different vulnerability. Supplementary information : CWE Vulnerability types by CWE-416: Use-after-free ( Using freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428. This vulnerability CVE-2015-3095 , CVE-2015-5087 , CVE-2015-5094 , CVE-2015-5100 , CVE-2015-5102 , CVE-2015-5103 ,and CVE-2015-5104 Is a different vulnerability.By the attacker, Adobe Collaboration Sync Any file may be deleted through. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of junction points. An attacker running code in the context of a sandboxed Adobe Reader process can set up a junction point in the Synchronizer folder and then run Adobe Collaboration Sync which will delete the contents of the folder. This may lead to further attacks. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7635 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644. This vulnerability CVE-2015-7629 , CVE-2015-7631 , CVE-2015-7636 , CVE-2015-7637 , CVE-2015-7638 , CVE-2015-7639 , CVE-2015-7640 , CVE-2015-7641 , CVE-2015-7642 , CVE-2015-7643 ,and CVE-2015-7644 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.185 and earlier versions and Extended Support Release 18.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR Desktop Runtime 19.0.0.190 and earlier versions, based on Windows, Macintosh, Adobe Flash Player for Google Chrome 19.0.0.185 and earlier on Linux and ChromeOS, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 19.0.0.185 and earlier on Windows 10, Adobe Flash Player on Windows 8.0 and 8.1 For Internet Explorer 10 and 11 19.0.0.185 and earlier versions, Adobe Flash Player for Linux 11.2.202.521 and earlier versions based on Linux platforms, AIR SDK 19.0.0.190 and earlier versions and AIR SDK based on Windows, Macintosh, Android and iOS platforms & Compiler 19.0.0.190 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:2024-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2024.html Issue date: 2015-11-11 CVE Names: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7635 CVE-2015-7636 CVE-2015-7637 CVE-2015-7638 CVE-2015-7639 CVE-2015-7640 CVE-2015-7641 CVE-2015-7642 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25, APSB15-27, and APSB15-28 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1271383 - flash-plugin: multiple code execution issues fixed in APSB15-25 1271388 - flash-plugin: information leak and hardening fixes in APSB15-25 1271966 - CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27 1280062 - flash-plugin: multiple code execution issues fixed in APSB15-28 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.548-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.548-1.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7635 https://access.redhat.com/security/cve/CVE-2015-7636 https://access.redhat.com/security/cve/CVE-2015-7637 https://access.redhat.com/security/cve/CVE-2015-7638 https://access.redhat.com/security/cve/CVE-2015-7639 https://access.redhat.com/security/cve/CVE-2015-7640 https://access.redhat.com/security/cve/CVE-2015-7641 https://access.redhat.com/security/cve/CVE-2015-7642 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://access.redhat.com/security/cve/CVE-2015-7645 https://access.redhat.com/security/cve/CVE-2015-7647 https://access.redhat.com/security/cve/CVE-2015-7648 https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-25.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://helpx.adobe.com/security/products/flash-player/apsb15-28.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWQyWTXlSAg2UNWIIRAl6GAKCUFPmvf4wjsXXDijZN3b6tGFg6ywCffbvg CNf9sF8DWG6aZFgviILLieM= =1JsD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

The Function apply implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623. This vulnerability CVE-2015-6707 , CVE-2015-6708 , CVE-2015-6709 , CVE-2015-6710 , CVE-2015-6711 , CVE-2015-6712 , CVE-2015-6713 , CVE-2015-6714 , CVE-2015-6716 , CVE-2015-6717 , CVE-2015-6718 , CVE-2015-6719 , CVE-2015-6720 , CVE-2015-6721 , CVE-2015-6722 , CVE-2015-6723 , CVE-2015-6724 , CVE-2015-6725 , CVE-2015-7614 , CVE-2015-7616 , CVE-2015-7618 , CVE-2015-7619 , CVE-2015-7620 ,and CVE-2015-7623 Is a different vulnerability.By the attacker, JavaScript API Execution restrictions may be avoided. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the apply method of Function objects. By creating a specially crafted PDF with specific Javascript instructions, it is possible to bypass the Javascript API restrictions. A remote attacker could exploit this vulnerability to execute arbitrary code. Adobe Acrobat and Reader are prone to multiple security-bypass vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. There are security vulnerabilities in the Function application implementation of several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

The Function bind implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623. This vulnerability CVE-2015-6707 , CVE-2015-6708 , CVE-2015-6709 , CVE-2015-6710 , CVE-2015-6711 , CVE-2015-6712 , CVE-2015-6713 , CVE-2015-6715 , CVE-2015-6716 , CVE-2015-6717 , CVE-2015-6718 , CVE-2015-6719 , CVE-2015-6720 , CVE-2015-6721 , CVE-2015-6722 , CVE-2015-6723 , CVE-2015-6724 , CVE-2015-6725 , CVE-2015-7614 , CVE-2015-7616 , CVE-2015-7618 , CVE-2015-7619 , CVE-2015-7620 ,and CVE-2015-7623 Is a different vulnerability.By the attacker, JavaScript API Execution restrictions may be avoided. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the bind method of Function objects. By creating a specially crafted PDF with specific Javascript instructions, it is possible to bypass the Javascript API restrictions. A remote attacker could exploit this vulnerability to execute arbitrary code. Adobe Acrobat and Reader are prone to multiple security-bypass vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. There are security vulnerabilities in the function binding implementation process of multiple Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier