VARIoT IoT vulnerabilities database

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an intended application-password requirement by leveraging the running of the app in the background state. Siemens SIMATIC WinCC is a monitoring control and data acquisition SCADA and human machine interface HMI system. Multiple Siemens SIMATIC WinCC products are prone to a local security-bypass vulnerability. Successful exploits will allow local attackers to bypass certain security restrictions. Other attacks are also possible. The following products are vulnerable: Versions prior to Siemens SIMATIC WinCC Sm@rtClient 1.0.2 are vulnerable. Versions prior to Siemens SIMATIC WinCC Sm@rtClient for IOS 1.0.2 are vulnerable. Siemens SIMATIC WinCC Sm@rtClient app for iOS is a set of client applications based on the iOS platform of Siemens, Germany, which provides remote mobile operation and observation of SIMATIC HMI systems

Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic. Phoenix Contact ProConOs and MultiProg are applications that run processes to control and manage IEC 61131 logic. Phoenix Contact ProConOs and MultiProg are prone to an authentication-bypass vulnerability. Attackers can exploit this issue to bypass authentication mechanism and gain unauthorized access. http://drupal.org/node/207891

Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier. A remote attacker can exploit the vulnerability to inject arbitrary web scripts or HTML

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets. The General Electric Company is the world's largest manufacturer of electrical equipment, electrical and electronic equipment. Multiple General Electric (GE) products have a denial of service vulnerability that allows an attacker to exploit a vulnerability to submit a special message to consume switch resources and restart the device. An attacker can exploit this issue to exhaust the switch resources and cause the device to reboot; causing denial-of-service condition. There are security vulnerabilities in several GE switches

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network. The General Electric Company is the world's largest manufacturer of electrical equipment, electrical and electronic equipment. Multiple General Electric (GE) products have security vulnerabilities that allow an attacker to exploit this vulnerability to obtain sensitive information, perform unauthorized operations, or initiate a denial of service attack. This may lead to further attacks

Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic, as demonstrated by Active Directory credential information. Panasonic Provided by Arbitrator Back-End Server (BES) Vulnerability that does not encrypt communication between client and server (CWE-319) Exists. By this vulnerability Active Directory And other sensitive information have been reported to be leaked. CWE-319: Cleartext Transmission of Sensitive Information http://cwe.mitre.org/data/definitions/319.htmlThird parties may obtain confidential information. Panasonic Arbitrator is a surveillance camera application. This may result in further attacks. Panasonic Arbitrator is a high-definition car digital video recording system produced by Panasonic Corporation of Japan. There is a security flaw in Panasonic Arbitrator's BES, which is caused by the program not using encryption algorithms

Cisco AnyConnect on Android and OS X does not properly verify the host type, which allows remote attackers to spoof authentication forms and possibly capture credentials via unspecified vectors, aka Bug IDs CSCuo24931 and CSCuo24940. Vendors have confirmed this vulnerability Bug ID CSCuo24931 and CSCuo24940 It is released as.A third party may spoof the authentication form and capture the authentication information. Cisco AnyConnect Secure Mobility Client is prone to a security vulnerability. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This issue is being tracked by Cisco Bug IDs CSCuo24931 and, CSCuo24940. Cisco AnyConnect on Android and OS X is a set of VPN applications based on the Android and OS X platforms of Cisco, which provides encrypted network connection functions. A security vulnerability exists in Cisco AnyConnect based on Android and OS X platforms. The vulnerability is caused by the program not validating the host type correctly

Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS, as used on the Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA), allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCus22925 and CSCup08113. Vendors have confirmed this vulnerability Bug ID CSCus22925 and CSCup08113 It is released as.By any third party through unspecified parameters Web Script or HTML May be inserted. Cisco AsyncOS is Cisco's custom operating system for the performance and security of all messaging applications. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug IDs CSCus22925 and CSCup08113. Cisco AsyncOS is an operating system used in these products

Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473. Successful exploits may allow the attacker to cause excessive CPU usage, resulting in denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCur12473. Security vulnerabilities exist in Cisco TelePresence VCS and Cisco Expressway

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that change the (1) Enable Wireless, (2) MBSSID, (3) BSSID, (4) Hide Access Point, (5) SSID, (6) Country, (7) Channel, (8) Wireless mode, or (9) Max Associated Clients setting via a crafted request to index.cgi. D-Link DAP-1360 is a wireless access point product (AP) of D-Link. A cross-site request forgery vulnerability exists in D-Link DAP-1360 routers with firmware version 2.5.4 and earlier

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DAP-1360 router with firmware 2.5.4 and earlier allow remote attackers to hijack the authentication of unspecified users for requests that (1) change the MAC filter restrict mode, (2) add a MAC address to the filter, or (3) remove a MAC address from the filter via a crafted request to index.cgi. Dap-1360 Firmware is prone to a cross-site request forgery vulnerability. D-Link DAP-1360 is a wireless access point product (AP) of D-Link

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0304. This vulnerability CVE-2015-0304 Is a different vulnerability.An attacker could execute arbitrary code. Failed exploit attempts likely result in denial-of-service conditions. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Failed exploit attempts will likely cause a denial-of-service condition. A use-after-free vulnerability exists in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. (CVE-2015-0301, CVE-2015-0302, CVE-2015-0307) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.429. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors. Adobe Flash Player and Adobe AIR Can get important information from the process memory, or service disruption (out-of-bounds read) There are vulnerabilities that are put into a state.A third party obtains important information from the process memory or disrupts service operation (out-of-bounds read) There is a possibility of being put into a state. This vulnerability allows remote attackers to disclose arbitrary memory on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the AVSegmentedSource::getABRProfileInfoAtIndex function. Once the AVSegmentedSource class is initialized with a valid m3u8 file, it is possible for an attacker to force out-of-bounds reads. An attacker can leverage this vulnerability to disclose arbitrary memory. Adobe Flash Player and Adobe AIR are prone to a memory-corruption vulnerability. Attackers can exploit this issue to cause denial-of-service conditions or gain access to sensitive information. other attacks are also possible. Security flaws exist in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion.". Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. Security flaws exist in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303. This vulnerability CVE-2015-0303 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. Security flaws exist in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309. This vulnerability CVE-2015-0309 Is a different vulnerability.An attacker could execute arbitrary code. Failed exploit attempts likely result in denial-of-service conditions. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306. This vulnerability CVE-2015-0306 Are different vulnerabilities.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. Security flaws exist in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to obtain sensitive keystroke information via unspecified vectors. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Security flaws exist in several Adobe products. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309, CVE-2015-0305, CVE-2015-0308) This update also fixes multiple information disclosure flaws in flash-plugin. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors. Note: The impact of this issue is currently unknown. We will update this BID when more information emerges. A security vulnerability exists in several Adobe products due to the programs not properly validating files. An attacker could exploit this vulnerability to take control of an affected system. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.442" References ========== [ 1 ] CVE-2015-0301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0301 [ 2 ] CVE-2015-0302 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0302 [ 3 ] CVE-2015-0303 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0303 [ 4 ] CVE-2015-0304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0304 [ 5 ] CVE-2015-0305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0305 [ 6 ] CVE-2015-0306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0306 [ 7 ] CVE-2015-0307 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0307 [ 8 ] CVE-2015-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0308 [ 9 ] CVE-2015-0309 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0309 [ 10 ] CVE-2015-0310 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0310 [ 11 ] CVE-2015-0311 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0311 [ 12 ] CVE-2015-0314 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0314 [ 13 ] CVE-2015-0315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0315 [ 14 ] CVE-2015-0316 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0316 [ 15 ] CVE-2015-0317 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0317 [ 16 ] CVE-2015-0318 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0318 [ 17 ] CVE-2015-0319 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0319 [ 18 ] CVE-2015-0320 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0320 [ 19 ] CVE-2015-0321 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0321 [ 20 ] CVE-2015-0322 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0322 [ 21 ] CVE-2015-0323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0323 [ 22 ] CVE-2015-0324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0324 [ 23 ] CVE-2015-0325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0325 [ 24 ] CVE-2015-0326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0326 [ 25 ] CVE-2015-0327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0327 [ 26 ] CVE-2015-0328 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0328 [ 27 ] CVE-2015-0329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0329 [ 28 ] CVE-2015-0330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0330 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: flash-plugin security update Advisory ID: RHSA-2015:0052-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0052.html Issue date: 2015-01-14 CVE Names: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. These vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-0301, CVE-2015-0302, CVE-2015-0307) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.429. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1181903 - CVE-2015-0303 CVE-2015-0306 CVE-2015-0304 CVE-2015-0309 CVE-2015-0305 CVE-2015-0308 flash-plugin: Multiple code-execution flaws (APSB15-01) 1181909 - CVE-2015-0301 CVE-2015-0302 CVE-2015-0307 flash-plugin: Information disclosure via various methods (APSB15-01) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: flash-plugin-11.2.202.429-1.el5.i386.rpm x86_64: flash-plugin-11.2.202.429-1.el5.i386.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: flash-plugin-11.2.202.429-1.el6.i686.rpm x86_64: flash-plugin-11.2.202.429-1.el6.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0301 https://access.redhat.com/security/cve/CVE-2015-0302 https://access.redhat.com/security/cve/CVE-2015-0303 https://access.redhat.com/security/cve/CVE-2015-0304 https://access.redhat.com/security/cve/CVE-2015-0305 https://access.redhat.com/security/cve/CVE-2015-0306 https://access.redhat.com/security/cve/CVE-2015-0307 https://access.redhat.com/security/cve/CVE-2015-0308 https://access.redhat.com/security/cve/CVE-2015-0309 https://access.redhat.com/security/updates/classification/#critical https://helpx.adobe.com/security/products/flash-player/apsb15-01.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUttFMXlSAg2UNWIIRAiVoAJwLqivuUq0OowsqXdh4/yKQTSVEGwCgjsTX 184Uc4WBUliIJ2nt+9H/bDY= =OQFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce