Adobe Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600 allow attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.

Flash Player was updated to 11.2.202.251 (bnc#788450), fixing severe security issues :

  - CVE-2012-5274, CVE-2012-5275, CVE-2012-5276,     CVE-2012-5277, CVE-2012-5278, CVE-2012-5279,     CVE-2012-5280

The remote host is affected by the vulnerability described in GLSA-201309-06 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple unspecified vulnerabilities have been discovered in Adobe Flash       Player. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open specially crafted SWF       content, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to bypass access restrictions.
  Workaround :

    There is no known workaround at this time.

This update of flash-player fixes multiple (unspecified) buffer overflows, memory corruptions and other security-related issues.

Adobe reports :

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

According to its version, the instance of Flash Player installed on the remote Mac OS X host is 11.x equal to or earlier than 11.4.402.287, or 10.x equal to or earlier than 10.3.183.29.  It is, therefore, potentially affected by multiple vulnerabilities :

  - Several unspecified issues exist that can lead to buffer     overflows and arbitrary code execution. (CVE-2012-5274,     CVE-2012-5275, CVE-2012-5276, CVE-2012-5277,     CVE-2012-5280)

  - An unspecified security bypass issue exists that can     lead to arbitrary code execution. (CVE-2012-5278)

  - An unspecified issue exists that can lead to memory     corruption and arbitrary code execution. (CVE-2012-5279)

According to its version, the instance of Adobe AIR on the remote Mac OS X host is 3.4.0.2710 or earlier.  It is, therefore, reportedly affected by multiple vulnerabilities :

  - Several unspecified issues exist that can lead to buffer     overflows and arbitrary code execution. (CVE-2012-5274,     CVE-2012-5275, CVE-2012-5276, CVE-2012-5277,     CVE-2012-5280)

  - An unspecified security bypass issue exists that can     lead to arbitrary code execution. (CVE-2012-5278)

  - An unspecified issue exists that can lead to memory     corruption and arbitrary code execution. (CVE-2012-5279)

According to its version, the instance of Flash Player installed on the remote Windows host is 11.x equal to or earlier than 11.4.402.287, or 10.x equal to or earlier than 10.3.183.29.  It is, therefore, potentially affected by multiple vulnerabilities :

  - Several unspecified issues exist that can lead to buffer     overflows and arbitrary code execution. (CVE-2012-5274,     CVE-2012-5275, CVE-2012-5276, CVE-2012-5277,     CVE-2012-5280)

  - An unspecified security bypass issue exists that can     lead to arbitrary code execution. (CVE-2012-5278)

  - An unspecified issue exists that can lead to memory     corruption and arbitrary code execution. (CVE-2012-5279)

According to its version, the instance of Adobe AIR on the remote Windows host is 3.4.0.2710 or earlier.  It is, therefore, reportedly affected by multiple vulnerabilities :

  - Several unspecified issues exist that can lead to buffer     overflows and arbitrary code execution. (CVE-2012-5274,     CVE-2012-5275, CVE-2012-5276, CVE-2012-5277,     CVE-2012-5280)

  - An unspecified security bypass issue exists that can     lead to arbitrary code execution. (CVE-2012-5278)

  - An unspecified issue exists that can lead to memory     corruption and arbitrary code execution. (CVE-2012-5279)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:1431 advisory.

  - flash-plugin: multiple code-execution flaws (APSB12-24) (CVE-2012-5274, CVE-2012-5275, CVE-2012-5276,     CVE-2012-5277, CVE-2012-5278, CVE-2012-5279, CVE-2012-5280)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
74808	openSUSE Security Update : flash-player (openSUSE-SU-2013:0367-1)	Nessus	SuSE Local Security Checks	critical
69889	GLSA-201309-06 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
64141	SuSE 11.2 Security Update : flash-player (SAT Patch Number 7038)	Nessus	SuSE Local Security Checks	critical
62935	SuSE 10 Security Update : flash-player (ZYPP Patch Number 8360)	Nessus	SuSE Local Security Checks	critical
62866	FreeBSD : linux-flashplugin -- multiple vulnerabilities (4b8b748e-2a24-11e2-bb44-003067b2972c)	Nessus	FreeBSD Local Security Checks	critical
62838	Flash Player for Mac <= 10.3.183.29 / 11.4.402.287 Multiple Vulnerabilities (APSB12-24)	Nessus	MacOS X Local Security Checks	critical
62837	Adobe AIR for Mac 3.x <= 3.4.0.2710 Multiple Vulnerabilities (APSB12-24)	Nessus	MacOS X Local Security Checks	critical
62836	Flash Player <= 10.3.183.29 / 11.4.402.287 Multiple Vulnerabilities (APSB12-24)	Nessus	Windows	critical
62835	Adobe AIR 3.x <= 3.4.0.2710 Multiple Vulnerabilities (APSB12-24)	Nessus	Windows	critical
62834	RHEL 5 / 6 : flash-plugin (RHSA-2012:1431)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2012-5278

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high