Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.

Adobe Flash Player was updated to 11.2.202.280: (bnc#814635)

http://www.adobe.com/support/security/bulletins/apsb13-11.html

  - APSB13-11, CVE-2013-1378, CVE-2013-1379, CVE-2013-1380,     CVE-2013-2555

The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the included Flash components.

The mobile device uses a version of BlackBerry 10 OS that is prior to 10.1.0.1880. It is, therefore, affected by the following vulnerabilities in the version of Flash Player supplied with it :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to cause a denial of     service or to execute arbitrary code. (CVE-2013-1378,     CVE-2013-1379, CVE-2013-1380)

  - An integer overflow condition exists that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2013-2555)

Note that this plugin has relied solely on the version of the installed OS and has not attempted to verify whether Flash content is disabled in the device's browser.

The remote host is affected by the vulnerability described in GLSA-201309-06 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple unspecified vulnerabilities have been discovered in Adobe Flash       Player. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open specially crafted SWF       content, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition. Furthermore,       a remote attacker may be able to bypass access restrictions.
  Workaround :

    There is no known workaround at this time.

Adobe Flash Player has been updated to 11.2.202.280 to fix various bugs and security issues.

More information can be found on:
http://www.adobe.com/support/security/bulletins/apsb13-11.html

  - APSB13-11, CVE-2013-1378 / CVE-2013-1379 / CVE-2013-1380     / CVE-2013-2555

Adobe Flash Player has been updated to 11.2.202.280 to fix various bugs and security issues.

More information can be found on :

http://www.adobe.com/support/security/bulletins/apsb13-11.html

  - APSB13-11, (CVE-2013-1378 / CVE-2013-1379 /     CVE-2013-1380 / CVE-2013-2555)

The remote host contains a browser plug-in that is affected by multiple vulnerabilities.

The remote host has Adobe Flash Player installed. 

Versions of Flash Player 11.x equal to or earlier than 11.6.602.180, or 10.x equal to or earlier than 10.3.183.68 are affected by multiple vulnerabilities:

  - A remote memory-corruption vulnerability exists, which may result in arbitrary code-execution. (CVE-2013-1378)

  - A remote memory-corruption vulnerability, which may result in an arbitrary code-execution. (CVE-2013-1379)

  - A remote memory-corruption vulnerability exists, which may result in an arbitrary code-execution. (CVE-2013-1380)

  - A remote integer-overflow vulnerability exists, which may result in arbitrary code-execution. (CVE-2013-2555)

The remote host has a version of Adobe Flash player installed that may be affected by multiple vulnerabilities. Versions of Flash Player 11.x equal to or earlier than 11.6.602.180, or 10.x equal to or earlier than 10.3.183.68 are affected by multiple vulnerabilities:

  - A remote memory-corruption vulnerability exists, which may result in arbitrary code-execution. (CVE-2013-1378)

  - A remote memory-corruption vulnerability, which may result in an arbitrary code-execution. (CVE-2013-1379)

  - A remote memory-corruption vulnerability exists, which may result in an arbitrary code-execution. (CVE-2013-1380)

  - A remote integer-overflow vulnerability exists, which may result in arbitrary code-execution. (CVE-2013-2555)

An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes multiple vulnerabilities in Adobe Flash Player.
These vulnerabilities are detailed in the Adobe Security bulletin APSB13-11, listed in the References section. Specially crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content. (CVE-2013-1378, CVE-2013-1379, CVE-2013-1380, CVE-2013-2555)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.280.

Versions of Adobe AIR prior to 3.7.0.1530 are outdated and thus unpatched for the following vulnerabilities :

 - Multiple memory corruption errors exist that could lead to code execution. (CVE-2013-1378, CVE-2013-1379, CVE-2013-1380)
  - An integer overflow error exists that could lead to code execution. (CVE-2013-2555)

According to its version, the instance of Flash Player installed on the remote Mac OS X host is 11.x equal or prior to 11.6.602.180, or 10.x equal or prior to 10.3.183.68.  It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple memory corruption errors exist that could lead     to code execution. (CVE-2013-1378, CVE-2013-1379,     CVE-2013-1380)

  - An integer overflow error exists that could lead to code     execution. (CVE-2013-2555)

According to its version, the instance of Adobe AIR 3.x on the remote Mac OS X host is 3.6.0.6090 or earlier.  It is, therefore, reportedly affected by multiple vulnerabilities :

  - Multiple memory corruption errors exist that could lead     to code execution. (CVE-2013-1378, CVE-2013-1379,     CVE-2013-1380)

  - An integer overflow error exists that could lead to code     execution. (CVE-2013-2555)

According to its version, the instance of Flash Player installed on the remote Windows host is 11.x equal or prior to 11.6.602.180, or 10.x equal or prior to 10.3.183.68.  It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple memory corruption errors exist that could lead     to code execution. (CVE-2013-1378, CVE-2013-1379,     CVE-2013-1380)

  - An integer overflow error exists that could lead to code     execution. (CVE-2013-2555)

According to its version, the instance of Adobe AIR 3.x on the remote Windows host is 3.6.0.6090 or earlier.  It is, therefore, potentially affected by the following vulnerabilities :

  - Multiple memory corruption errors exist that could lead     to code execution. (CVE-2013-1378, CVE-2013-1379,     CVE-2013-1380)

  - An integer overflow error exists that could lead to code     execution. (CVE-2013-2555)

The remote host is missing KB2833510.  It may, therefore, be affected by the following vulnerabilities related to the installed version of the Adobe Flash ActiveX control :

  - Multiple memory corruption errors exist that could lead     to code execution. (CVE-2013-1378, CVE-2013-1379,     CVE-2013-1380)

  - An integer overflow error exists that could lead to code     execution. (CVE-2013-2555)

ID	Name	Product	Family	Severity
74973	openSUSE Security Update : flash-player (openSUSE-SU-2013:0672-1)	Nessus	SuSE Local Security Checks	critical
72964	HP Systems Insight Manager < 7.3 Multiple Vulnerabilities	Nessus	Windows	critical
71992	BlackBerry < 10.1.0.1880 Multiple Flash Player Code Execution Vulnerabilities	Nessus	Mobile Devices	critical
69889	GLSA-201309-06 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
65958	SuSE 10 Security Update : flash-player (ZYPP Patch Number 8539)	Nessus	SuSE Local Security Checks	critical
65939	SuSE 11.2 Security Update : flash-player (SAT Patch Number 7613)	Nessus	SuSE Local Security Checks	critical
6752	Flash Player <= 10.3.183.68 / 11.6.602.180 Multiple Vulnerabilities (APSB13-11)	Nessus Network Monitor	Web Clients	critical
6751	Flash Player <= 10.3.183.68 / 11.6.602.180 Multiple Vulnerabilities (APSB13-11)	Nessus Network Monitor	Web Clients	critical
65922	RHEL 5 / 6 : flash-plugin (RHSA-2013:0730)	Nessus	Red Hat Local Security Checks	critical
6830	Adobe AIR < 3.7.0.1530 Multiple Vulnerabilities (APSB13-11)	Nessus Network Monitor	Web Clients	high
65912	Flash Player for Mac <= 10.3.183.68 / 11.6.602.180 Multiple Vulnerabilities (APSB13-11)	Nessus	MacOS X Local Security Checks	critical
65911	Adobe AIR for Mac 3.x <= 3.6.0.6090 Multiple Vulnerabilities (APSB13-11)	Nessus	MacOS X Local Security Checks	critical
65910	Flash Player <= 10.3.183.68 / 11.6.602.180 Multiple Vulnerabilities (APSB13-11)	Nessus	Windows	critical
65909	Adobe AIR 3.x <= 3.6.0.6090 Multiple Vulnerabilities (APSB13-11)	Nessus	Windows	critical
65884	MS KB2833510: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10	Nessus	Windows	critical

Detections

Analytics

CVE-2013-2555

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical