VARIoT IoT vulnerabilities database

The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the network for cleartext-equivalent traffic. Clorius Controls A/S is an industrial control system software. Remote attackers can perform man-in-the-middle attacks to gain access to sensitive information. This may aid in further attacks

Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R9, 12.3R2 before 12.3R2-S3, 12.3 before 12.3R3, 13.1 before 13.1R4, and 13.2 before 13.2R1 allows remote attackers to cause a denial of service (assertion failure and rpd restart) via a crafted BGP FlowSpec prefix. Juniper Junos There is a service disruption ( Violation of representation and routing process daemon (rpd) Reboot ) There are vulnerabilities that are put into a state. Supplementary information : CWE Vulnerability type by CWE-17: Code ( code ) Has been identified. Juniper Junos is prone to a remote denial-of-service vulnerability. Exploiting this issue may allow remote attackers to crash and restart the RPD (Routing Protocol Daemon), causing denial-of-service conditions. Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware system. The operating system provides a secure programming interface and Junos SDK. The following versions are affected: Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 Version 12.2 before R9, version 12.3R2 before 12.3R2-S3, version 12.3 before 12.3R3, version 13.1 before 13.1R4, and version 13.2 before 13.2R1

Juniper Junos 11.4 before 11.4R13, 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, 12.2 before 12.2R9, 12.3R7 before 12.3R7-S1, 12.3 before 12.3R8, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R2, and 14.2 before 14.2R1 allows remote attackers to cause a denial of service (kernel crash and restart) via a crafted fragmented OSPFv3 packet with an IPsec Authentication Header (AH). Juniper Junos is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause an affected device to crash, denying service to legitimate users. Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware system. The operating system provides a secure programming interface and Junos SDK. The following versions are affected: Juniper Junos 11.4 before 11.4R13, 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, 12.2 before 12.2R9, 12.3R7-S1 Before 12.3R7, 12.3 before 12.3R8, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R2, 14.2 before 14.2R1

Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15, 12.3 before 12.3R9, 13.1 before 13.1R4-S3, 13.2 before 13.2R6, 13.3 before 13.3R5, 14.1 before 14.1R3, and 14.2 before 14.2R1 does not properly handle double quotes in authorization attributes in the TACACS+ configuration, which allows local users to bypass the security policy and execute commands via unspecified vectors. Juniper Junos is prone to local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges. Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware system. The operating system provides a secure programming interface and Junos SDK. The following versions are affected: Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15, 12.3 before 12.3R9, 13.1 before 13.1R4-S3, 13.2R6 Version 13.2 before, version 13.3 before 13.3R5, version 14.1 before 14.1R3, version 14.2 before 14.2R1

The Juniper MX Series routers with Junos 13.3R3 through 13.3Rx before 13.3R6, 14.1 before 14.1R4, 14.1X50 before 14.1X50-D70, and 14.2 before 14.2R2, when configured as a broadband edge (BBE) router, allows remote attackers to cause a denial of service (jpppd crash and restart) by sending a crafted PAP Authenticate-Request after the PPPoE Discovery and LCP phase are complete. Juniper Junos is prone to a remote denial-of-service vulnerability. Exploiting this issue may allow remote attackers to crash and restart the Juniper PPP daemon, causing denial-of-service conditions. Juniper Networks MX Series routers with Junos is a Juniper MX series router running the Junos operating system from Juniper Networks. A security vulnerability exists in Juniper Networks MX Series routers with Junos. The following versions are affected: Juniper Networks MX Series routers with Junos 13.3R3 to 13.3Rx prior to 13.3R6, 14.1 prior to 14.1R4, 14.1X50 prior to 14.1X50-D70, and 14.2 prior to 14.2R2

The stateless firewall in Juniper Junos 13.3R3, 14.1R1, and 14.1R2, when using Trio-based PFE modules, does not properly match ports, which might allow remote attackers to bypass firewall rule. Supplementary information : CWE Vulnerability type by CWE-17: Code ( code ) Has been identified. http://cwe.mitre.org/data/definitions/17.htmlA third party may bypass firewall rules. Juniper Junos is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware system. The operating system provides a secure programming interface and Junos SDK. The vulnerability is caused by incorrect port matching when the program uses the Trio-based PFE module. The following releases are affected: Juniper Junos Release 13.3R3, Release 14.1R1, Release 14.1R2

The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability.". Samsungwssyncmlnps is a software update service in Samsung's smartphones in South Korea. Kiesrestore is one of the system recovery features. A directory traversal vulnerability exists in Kiesrestore in versions prior to Samsungwssyncmlnps2015-10-31. An attacker could exploit this vulnerability to write to any file. Local attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Successful exploits may lead to other attacks

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an intended application-password requirement by leveraging the running of the app in the background state. Siemens SIMATIC WinCC is a monitoring control and data acquisition SCADA and human machine interface HMI system. Multiple Siemens SIMATIC WinCC products are prone to a local security-bypass vulnerability. Successful exploits will allow local attackers to bypass certain security restrictions. Other attacks are also possible. The following products are vulnerable: Versions prior to Siemens SIMATIC WinCC Sm@rtClient 1.0.2 are vulnerable. Versions prior to Siemens SIMATIC WinCC Sm@rtClient for IOS 1.0.2 are vulnerable. Siemens SIMATIC WinCC Sm@rtClient app for iOS is a set of client applications based on the iOS platform of Siemens, Germany, which provides remote mobile operation and observation of SIMATIC HMI systems

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic. Phoenix Contact ProConOs and MultiProg are applications that run processes to control and manage IEC 61131 logic. Phoenix Contact ProConOs and MultiProg are prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass authentication mechanism and gain unauthorized access. http://drupal.org/node/207891

Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier. A remote attacker can exploit the vulnerability to inject arbitrary web scripts or HTML

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets. The General Electric Company is the world's largest manufacturer of electrical equipment, electrical and electronic equipment. Multiple General Electric (GE) products have a denial of service vulnerability that allows an attacker to exploit a vulnerability to submit a special message to consume switch resources and restart the device. An attacker can exploit this issue to exhaust the switch resources and cause the device to reboot; causing denial-of-service condition. There are security vulnerabilities in several GE switches

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network. The General Electric Company is the world's largest manufacturer of electrical equipment, electrical and electronic equipment. Multiple General Electric (GE) products have security vulnerabilities that allow an attacker to exploit this vulnerability to obtain sensitive information, perform unauthorized operations, or initiate a denial of service attack. This may lead to further attacks

Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic, as demonstrated by Active Directory credential information. Panasonic Provided by Arbitrator Back-End Server (BES) Vulnerability that does not encrypt communication between client and server (CWE-319) Exists. By this vulnerability Active Directory And other sensitive information have been reported to be leaked. CWE-319: Cleartext Transmission of Sensitive Information http://cwe.mitre.org/data/definitions/319.htmlThird parties may obtain confidential information. Panasonic Arbitrator is a surveillance camera application. This may result in further attacks. Panasonic Arbitrator is a high-definition car digital video recording system produced by Panasonic Corporation of Japan. There is a security flaw in Panasonic Arbitrator's BES, which is caused by the program not using encryption algorithms

Cisco AnyConnect on Android and OS X does not properly verify the host type, which allows remote attackers to spoof authentication forms and possibly capture credentials via unspecified vectors, aka Bug IDs CSCuo24931 and CSCuo24940. Vendors have confirmed this vulnerability Bug ID CSCuo24931 and CSCuo24940 It is released as.A third party may spoof the authentication form and capture the authentication information. Cisco AnyConnect Secure Mobility Client is prone to a security vulnerability. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This issue is being tracked by Cisco Bug IDs CSCuo24931 and, CSCuo24940. Cisco AnyConnect on Android and OS X is a set of VPN applications based on the Android and OS X platforms of Cisco, which provides encrypted network connection functions. A security vulnerability exists in Cisco AnyConnect based on Android and OS X platforms. The vulnerability is caused by the program not validating the host type correctly

Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS, as used on the Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA), allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCus22925 and CSCup08113. Vendors have confirmed this vulnerability Bug ID CSCus22925 and CSCup08113 It is released as.By any third party through unspecified parameters Web Script or HTML May be inserted. Cisco AsyncOS is Cisco's custom operating system for the performance and security of all messaging applications. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug IDs CSCus22925 and CSCup08113. Cisco AsyncOS is an operating system used in these products

Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473. Successful exploits may allow the attacker to cause excessive CPU usage, resulting in denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCur12473. Security vulnerabilities exist in Cisco TelePresence VCS and Cisco Expressway

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that change the (1) Enable Wireless, (2) MBSSID, (3) BSSID, (4) Hide Access Point, (5) SSID, (6) Country, (7) Channel, (8) Wireless mode, or (9) Max Associated Clients setting via a crafted request to index.cgi. D-Link DAP-1360 is a wireless access point product (AP) of D-Link. A cross-site request forgery vulnerability exists in D-Link DAP-1360 routers with firmware version 2.5.4 and earlier

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 router with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that (1) change the MAC filter restrict mode, (2) add a MAC address to the filter, or (3) remove a MAC address from the filter via a crafted request to index.cgi. Dap-1360 Firmware is prone to a cross-site request forgery vulnerability. D-Link DAP-1360 is a wireless access point product (AP) of D-Link

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0304. This vulnerability CVE-2015-0304 Is a different vulnerability.An attacker could execute arbitrary code. Failed exploit attempts likely result in denial-of-service conditions. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. (CVE-2015-0301, CVE-2015-0302, CVE-2015-0307) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.429. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce