Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-201508-0259 CVE-2015-5544 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553. This vulnerability CVE-2015-5545 , CVE-2015-5546 , CVE-2015-5547 , CVE-2015-5548 , CVE-2015-5549 , CVE-2015-5552 ,and CVE-2015-5553 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Failed exploit attempts will likely result in denial-of-service conditions. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0258 CVE-2015-5541 Adobe Flash Player and Adobe AIR Heap-based buffer overflow vulnerability CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5129. This vulnerability CVE-2015-5129 Is a different vulnerability.An attacker could execute arbitrary code. Failed attempts will likely cause a denial-of-service condition. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0257 CVE-2015-5540 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0256 CVE-2015-5539 Adobe Flash Player and Adobe AIR Vulnerabilities in arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability is CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 This is a different vulnerability. Supplementary information : CWE Vulnerability types by CWE-416: Use-after-free ( Using freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0070 CVE-2015-5565 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, and CVE-2015-5564. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 ,and CVE-2015-5564 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier
VAR-201508-0067 CVE-2015-5562 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5555, and CVE-2015-5558. This vulnerability CVE-2015-5554 , CVE-2015-5555 ,and CVE-2015-5558 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-843:Access of Resource Using Incompatible Type ( Mixing of molds ) Has been identified. http://cwe.mitre.org/data/definitions/843.htmlUnspecified by attacker " Mixing of molds (type confusion)" May be used to execute arbitrary code. Adobe FlashPlayer and AIR are prone to multiple remote code-execution vulnerabilities. Failed attempts will likely cause a denial-of-service condition. NOTE: This BID initially referenced CVE-2015-5128. This issue is now described in BID 76369. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
VAR-201508-0069 CVE-2015-5564 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
VAR-201508-0068 CVE-2015-5563 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
VAR-201508-0066 CVE-2015-5561 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
VAR-201508-0065 CVE-2015-5560 Adobe Flash Player and Adobe AIR Integer overflow vulnerability CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors. An attacker can exploit this issue to execute arbitrary code in the context of the application or cause denial-of-service conditions. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
VAR-201508-0064 CVE-2015-5559 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5561 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
VAR-201508-0063 CVE-2015-5558 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5555, and CVE-2015-5562. This vulnerability CVE-2015-5554 , CVE-2015-5555 ,and CVE-2015-5562 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-843:Access of Resource Using Incompatible Type ( Mixing of molds ) Has been identified. http://cwe.mitre.org/data/definitions/843.htmlUnspecified by attacker " Mixing of molds (type confusion)" May be used to execute arbitrary code. Adobe FlashPlayer and AIR are prone to multiple remote code-execution vulnerabilities. Failed attempts will likely cause a denial-of-service condition. NOTE: This BID initially referenced CVE-2015-5128. This issue is now described in BID 76369. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0062 CVE-2015-5557 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5556 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0060 CVE-2015-5555 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5554, CVE-2015-5558, and CVE-2015-5562. This vulnerability CVE-2015-5554 , CVE-2015-5558 ,and CVE-2015-5562 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-843:Access of Resource Using Incompatible Type ( Mixing of molds ) Has been identified. http://cwe.mitre.org/data/definitions/843.htmlUnspecified by attacker " Mixing of molds (type confusion)" May be used to execute arbitrary code. Adobe FlashPlayer and AIR are prone to multiple remote code-execution vulnerabilities. Failed attempts will likely cause a denial-of-service condition. NOTE: This BID initially referenced CVE-2015-5128. This issue is now described in BID 76369. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0059 CVE-2015-5554 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5555, CVE-2015-5558, and CVE-2015-5562. This vulnerability CVE-2015-5555 , CVE-2015-5558 ,and CVE-2015-5562 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-843:Access of Resource Using Incompatible Type ( Mixing of molds ) Has been identified. http://cwe.mitre.org/data/definitions/843.htmlUnspecified by attacker " Mixing of molds (type confusion)" May be used to execute arbitrary code. Adobe FlashPlayer and AIR are prone to multiple remote code-execution vulnerabilities. Failed attempts will likely cause a denial-of-service condition. NOTE: This BID initially referenced CVE-2015-5128. This issue is now described in BID 76369. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0061 CVE-2015-5556 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5551 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0057 CVE-2015-5552 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, and CVE-2015-5553. This vulnerability CVE-2015-5544 , CVE-2015-5545 , CVE-2015-5546 , CVE-2015-5547 , CVE-2015-5548 , CVE-2015-5549 ,and CVE-2015-5553 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Failed exploit attempts will likely result in denial-of-service conditions. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0058 CVE-2015-5553 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, and CVE-2015-5552. This vulnerability CVE-2015-5544 , CVE-2015-5545 , CVE-2015-5546 , CVE-2015-5547 , CVE-2015-5548 , CVE-2015-5549 ,and CVE-2015-5552 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Failed exploit attempts will likely result in denial-of-service conditions. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0056 CVE-2015-5551 Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565. This vulnerability CVE-2015-5127 , CVE-2015-5130 , CVE-2015-5134 , CVE-2015-5539 , CVE-2015-5540 , CVE-2015-5550 , CVE-2015-5556 , CVE-2015-5557 , CVE-2015-5559 , CVE-2015-5561 , CVE-2015-5563 , CVE-2015-5564 ,and CVE-2015-5565 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 18.0.0.209 and earlier versions and Adobe Flash Player Extended Support Release 13.0.0.309 and earlier versions based on Windows and Macintosh platforms, Adobe Flash Player for Windows, Macintosh and Linux platforms Google Chrome 18.0.0.209 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 18.0.0.209 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 18.0.0.209 on Windows 8.0 and 8.1 and previous versions, Adobe Flash Player for Linux 11.2.202.491 and previous versions based on Linux platforms, AIR Desktop Runtime 18.0.0.180 and previous versions based on Windows and Macintosh platforms, and AIR SDK 18.0 based on Windows, Macintosh, Android and iOS platforms. 0.180 and earlier and AIR SDK & Compiler 18.0.0.180 and earlier. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:1603-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1603.html Issue date: 2015-08-12 CVE Names: CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-19 listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563, CVE-2015-5564) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.508. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1252697 - flash-plugin: multiple code execution flaws (APSB15-19) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.508-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.508-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.508-1.el6_7.i686.rpm x86_64: flash-plugin-11.2.202.508-1.el6_7.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-5127 https://access.redhat.com/security/cve/CVE-2015-5128 https://access.redhat.com/security/cve/CVE-2015-5129 https://access.redhat.com/security/cve/CVE-2015-5130 https://access.redhat.com/security/cve/CVE-2015-5131 https://access.redhat.com/security/cve/CVE-2015-5132 https://access.redhat.com/security/cve/CVE-2015-5133 https://access.redhat.com/security/cve/CVE-2015-5134 https://access.redhat.com/security/cve/CVE-2015-5539 https://access.redhat.com/security/cve/CVE-2015-5540 https://access.redhat.com/security/cve/CVE-2015-5541 https://access.redhat.com/security/cve/CVE-2015-5544 https://access.redhat.com/security/cve/CVE-2015-5545 https://access.redhat.com/security/cve/CVE-2015-5546 https://access.redhat.com/security/cve/CVE-2015-5547 https://access.redhat.com/security/cve/CVE-2015-5548 https://access.redhat.com/security/cve/CVE-2015-5549 https://access.redhat.com/security/cve/CVE-2015-5550 https://access.redhat.com/security/cve/CVE-2015-5551 https://access.redhat.com/security/cve/CVE-2015-5552 https://access.redhat.com/security/cve/CVE-2015-5553 https://access.redhat.com/security/cve/CVE-2015-5554 https://access.redhat.com/security/cve/CVE-2015-5555 https://access.redhat.com/security/cve/CVE-2015-5556 https://access.redhat.com/security/cve/CVE-2015-5557 https://access.redhat.com/security/cve/CVE-2015-5558 https://access.redhat.com/security/cve/CVE-2015-5559 https://access.redhat.com/security/cve/CVE-2015-5560 https://access.redhat.com/security/cve/CVE-2015-5561 https://access.redhat.com/security/cve/CVE-2015-5562 https://access.redhat.com/security/cve/CVE-2015-5563 https://access.redhat.com/security/cve/CVE-2015-5564 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVy2mAXlSAg2UNWIIRAty7AKCcTl+pzRlPMcYb+ESu7xg0C9nkVwCfbcNj SwY72oO+5brzzyYR9NLDDnE= =izmD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.508" References ========== [ 1 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 2 ] CVE-2015-5122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5122 [ 3 ] CVE-2015-5123 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5123 [ 4 ] CVE-2015-5124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5124 [ 5 ] CVE-2015-5125 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5125 [ 6 ] CVE-2015-5127 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5127 [ 7 ] CVE-2015-5129 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5129 [ 8 ] CVE-2015-5130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5130 [ 9 ] CVE-2015-5131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5131 [ 10 ] CVE-2015-5132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5132 [ 11 ] CVE-2015-5133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5133 [ 12 ] CVE-2015-5134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5134 [ 13 ] CVE-2015-5539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5539 [ 14 ] CVE-2015-5540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5540 [ 15 ] CVE-2015-5541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5541 [ 16 ] CVE-2015-5544 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5544 [ 17 ] CVE-2015-5545 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5545 [ 18 ] CVE-2015-5546 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5546 [ 19 ] CVE-2015-5547 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5547 [ 20 ] CVE-2015-5548 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5548 [ 21 ] CVE-2015-5549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5549 [ 22 ] CVE-2015-5550 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5550 [ 23 ] CVE-2015-5551 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5551 [ 24 ] CVE-2015-5552 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5552 [ 25 ] CVE-2015-5553 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5553 [ 26 ] CVE-2015-5554 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5554 [ 27 ] CVE-2015-5555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5555 [ 28 ] CVE-2015-5556 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5556 [ 29 ] CVE-2015-5557 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5557 [ 30 ] CVE-2015-5558 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5558 [ 31 ] CVE-2015-5559 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5559 [ 32 ] CVE-2015-5560 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5560 [ 33 ] CVE-2015-5561 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5561 [ 34 ] CVE-2015-5562 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5562 [ 35 ] CVE-2015-5563 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5563 [ 36 ] CVE-2015-5564 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5564 [ 37 ] CVE-2015-5965 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5965 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201508-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05385680 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05385680 Version: 1 HPSBMU03692 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-02-03 Last Updated: 2017-02-03 Potential Security Impact: Remote: Bypass Security Restrictions, Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Denial of Service (DoS), Disclosure of Information, Execution of Arbitrary Code Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Multiple potential security vulnerabilities have been identified in HPE Matrix Operating Enviroment (MOE) on Windows. The vulnerabilities could be exploited remotely resulting in the Bypass of Security Restrictions, cross-site request forgery (CSRF), cross-site scripting (XSS), Denial of Service (DoS), Disclosure of Information, and Execution of Arbitrary Code. References: - CVE-2016-8531 - Information Disclosure - VSE - CVE-2016-8532 - XSS - VCEM - CVE-2016-8533 - Priviledge Escalation - VCEM - CVE-2016-8534 - Privilege Elevation - VSE - CVE-2016-8535 - Http Parameter Pollution - VCEM - CVE-2017-5780 - Clickjacking - MRM - CVE-2017-5781 - CSRF - VSE - CVE-2017-5782 - HSTS Header Missing - IO - CVE-2017-5783 - Clickjacking - SPM - CVE-2017-5784 - HSTS Header Missing - SPM - CVE-2017-5785 - Information Disclosure - SPM - CVE-2015-5127 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5129 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5130 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5131 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5132 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5133 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5134 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5539 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5540 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5541 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5544 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5545 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5546 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5547 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5548 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5549 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5550 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5551 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5552 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5553 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5555 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5556 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5557 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5558 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5559 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5560 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5561 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5562 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5563 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5564 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5565 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5566 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5575 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5576 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5580 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5574 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5588 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5570 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5572 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6678 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5571 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5582 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5584 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5587 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5579 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5568 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6679 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6682 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6677 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5573 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5578 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5577 - Adobe Flash - unauthorized disclosure of information - CVE-2015-6676 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5581 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8415 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8416 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8417 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8418 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8419 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8420 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8421 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8422 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8423 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8424 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8425 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8426 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8427 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8428 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8429 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8430 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8431 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8432 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8433 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8434 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8435 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8436 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8437 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8438 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8439 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8440 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8441 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8442 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8443 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8444 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8445 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8446 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8447 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8448 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8449 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8450 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8451 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8452 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8453 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8454 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8455 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8456 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8457 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8044 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8459 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8460 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8634 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8635 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8636 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8638 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8639 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8640 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8641 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8642 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8643 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8644 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8645 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8646 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8647 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8648 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8649 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8650 - Adobe Flash - unauthorized disclosure of information - CVE-2015-8651 - Adobe Flash - unauthorized disclosure of information - CVE-2016-2183 - Sweet32, DES, 3DES - CVE-2016-0777 - OpenSSH, unauthorized disclosure of information - CVE-2016-0778 - OpenSSH, unauthorized disclosure of information - CVE-2016-1907 - OpenSSH, unauthorized disclosure of information - CVE-2009-5028 - Namazu, unauthorized disclosure of information - CVE-2011-4345 - Namazu, unauthorized disclosure of information - CVE-2015-5254 - Apache ActiveMQ unauthorized disclosure of information - CVE-2016-4366 - HPE SIM, unauthorized disclosure of information - CVE-2015-5554 - Adobe Flash - unauthorized disclosure of information - CVE-2015-5567 - Adobe Flash - unauthorized disclosure of information - CVE-2016-8517 - HPE SIM, Cross-site Scripting (XSS) - CVE-2016-8516 - HPE SIM, Denial of Service - CVE-2016-8518 - HPE SIM, Denial of Service SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP Matrix Operating Environment Software 7.6 - HP Systems Insight Manager (HP SIM), Software 7.6 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2009-5028 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2011-4345 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N) CVE-2015-5127 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5129 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5130 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5131 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5132 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5133 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5134 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5254 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2015-5539 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5540 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5541 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5544 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5545 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5546 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5547 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5548 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5549 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5550 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5551 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5552 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5553 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5554 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5555 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5556 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5557 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5558 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5559 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5560 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5561 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5562 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5563 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5564 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5565 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5566 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5567 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5568 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5570 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5571 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-5572 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5573 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5574 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5575 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5576 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-5577 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5578 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5579 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5580 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5581 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5582 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5584 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5587 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-5588 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6676 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6677 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6678 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-6679 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2015-6682 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8044 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8415 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8416 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8417 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8418 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8419 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8420 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8421 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8422 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8423 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8424 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8425 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8426 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8427 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8428 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8429 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8430 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8431 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8432 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8433 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8434 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8435 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8436 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8437 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8438 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8439 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8440 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8441 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8442 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8443 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8444 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8445 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8446 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8447 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8448 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8449 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8450 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8451 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8452 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8453 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2015-8454 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8455 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8456 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8457 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8459 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2015-8460 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8634 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8635 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8636 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8638 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8639 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8640 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8641 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8642 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8643 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8644 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8645 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8646 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8647 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8648 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8649 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8650 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2015-8651 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) CVE-2016-0777 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N) CVE-2016-0778 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.6 (AV:N/AC:H/Au:S/C:P/I:P/A:P) CVE-2016-1907 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-4366 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE-2016-8516 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P) CVE-2016-8517 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N 7.9 (AV:N/AC:M/Au:S/C:C/I:C/A:N) CVE-2016-8518 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N) CVE-2016-8531 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) CVE-2016-8532 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N 7.0 (AV:N/AC:M/Au:S/C:P/I:C/A:N) CVE-2016-8533 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N) CVE-2016-8534 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) CVE-2016-8535 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) CVE-2017-5780 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N) CVE-2017-5781 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N 5.0 (AV:L/AC:M/Au:S/C:P/I:C/A:N) CVE-2017-5782 5.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5783 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) CVE-2017-5784 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) CVE-2017-5785 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities in the HPE Matrix Operating Environment (MOE). The update kit applicable to the HPE Matrix Operating Environment (MOE) 7.6 is available at the following location: * <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPID> HPE has addressed these vulnerabilities for the impacted software components bundled with HPE Matrix Operating Environment in the following HPE Security Bulletins: **HPE Systems Insight Manager (SIM)** HPE Security Bulletin: HPSBMU03668 * <https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05356388> HISTORY Version:1 (rev.1) - 3 February 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners
VAR-201508-0602 CVE-2015-2897 Sierra Wireless GX, ES, and LS gateways running ALEOS contain hard-coded credentials CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session. Sierra Wireless Provided by AirLink Management software running on the gateway device ALEOS Has a problem with hard-coded credentials. ALEOS version 4.3.4 And earlier, these root Authorized accounts are enabled by default, telnet Or ssh It is accessible at. ALEOS version 4.3.5 From 4.4.1 By default, hard-coded accounts are enabled, but remote access is disabled. CWE-259: Use of Hard-coded Password https://cwe.mitre.org/data/definitions/259.htmlA remote attacker could manipulate the affected device. Sierra Wireless ALEOS is prone to multiple privilege-escalation vulnerabilities. A remote attacker could exploit this vulnerability via an SSH or TELNET session to gain administrator access. The following devices are affected: AirLink ES, GX, LS