Adobe Flash Player before 11.7.700.252 and 11.8.x and 11.9.x before 11.9.900.152 on Windows and Mac OS X and before 11.2.202.327 on Linux, Adobe AIR before 3.9.0.1210, Adobe AIR SDK before 3.9.0.1210, and Adobe AIR SDK & Compiler before 3.9.0.1210 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-5329.

Adobe Flash Player was updated to 11.2.202.327: (bnc#850220)

  - APSB13-26, CVE-2013-5329, CVE-2013-5330

The remote host is affected by the vulnerability described in GLSA-201402-06 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple unspecified vulnerabilities have been discovered in Adobe Flash       Player. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted SWF       file using Adobe Flash Player, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Adobe has released Flash Player 11.2.202.327 for Linux to correct the following :

  - These updates resolve memory corruption vulnerabilities     that could lead to code execution (CVE-2013-5329 /     CVE-2013-5330). More information can be found on:
    http://www.adobe.com/support/security/bulletins/apsb13-2     6.html

An updated Adobe Flash Player package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes multiple vulnerabilities in Adobe Flash Player.
These vulnerabilities are detailed in the Adobe Security bulletin APSB13-26, listed in the References section. Specially crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content. (CVE-2013-5329, CVE-2013-5330)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.327.

Adobe reports :

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

According to its version, the instance of Flash Player installed on the remote Mac OS X host is equal or prior to 11.7.700.242 / 11.8.x or 11.9.x equal or prior to 11.9.900.117.  It is, therefore, potentially affected by multiple memory corruption vulnerabilities that could lead to code execution.

According to its version, the instance of Adobe AIR on the remote Mac OS X host is 3.9.0.1030 or earlier.  It is, therefore, reportedly affected by multiple memory corruption errors that could lead to code execution.

According to its version, the instance of Flash Player installed on the remote Windows host is equal or prior to 11.7.700.242 / 11.8.x or 11.9.x equal or prior to 11.9.900.117.  It is, therefore, potentially affected by multiple memory corruption vulnerabilities that could lead to code execution.

According to its version, the instance of Adobe AIR on the remote Windows host is 3.9.0.1030 or earlier.  It is, therefore, potentially affected by multiple memory corruption vulnerabilities that could lead to code execution.

The remote host is missing KB2898108.  It is, therefore, affected by two memory corruption vulnerabilities in the installed version of the Adobe Flash ActiveX control, which could lead to code execution.

ID	Name	Product	Family	Severity
75207	openSUSE Security Update : flash-player (openSUSE-SU-2013:1737-1)	Nessus	SuSE Local Security Checks	critical
72383	GLSA-201402-06 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
70936	SuSE 11.2 / 11.3 Security Update : flash-player (SAT Patch Numbers 8554 / 8555)	Nessus	SuSE Local Security Checks	critical
70913	RHEL 5 / 6 : flash-plugin (RHSA-2013:1518)	Nessus	Red Hat Local Security Checks	critical
70866	FreeBSD : linux-flashplugin -- multiple vulnerabilities (adcbdba2-4c27-11e3-9848-98fc11cdc4f5)	Nessus	FreeBSD Local Security Checks	critical
70860	Flash Player for Mac <= 11.7.700.242 / 11.9.900.117 Memory Corruptions (APSB13-26)	Nessus	MacOS X Local Security Checks	critical
70859	Adobe AIR for Mac <= 3.9.0.1030 Memory Corruptions (APSB13-26)	Nessus	MacOS X Local Security Checks	critical
70858	Flash Player <= 11.7.700.242 / 11.9.900.117 Memory Corruptions (APSB13-26)	Nessus	Windows	critical
70857	Adobe AIR <= 3.9.0.1030 Memory Corruptions (APSB13-26)	Nessus	Windows	critical
70856	MS KB2898108: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10	Nessus	Windows	critical

Detections

Analytics

CVE-2013-5330

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical