SuSE 11.3 Security Update : flash-player (SAT Patch Number 10458)

critical Nessus Plugin ID 81877

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

flash-player has been updated to fix eleven security vulnerabilities :

- Multiple memory corruption issues exist due to not properly validating user input, which an attacker can exploit to execute arbitrary code. (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)

- Multiple type confusions flaws exist, which an attacker can exploit to execute arbitrary code. (CVE-2015-0334, CVE-2015-0336)

- An unspecified flaw exists that allows an attacker to bypass cross-domain policy. (CVE-2015-0337)

- An integer overflow condition exists due to not properly validating user input, which an attacker can exploit to execute arbitrary code. (CVE-2015-0338)

- An unspecified flaw exists that allows an attacker to bypass restrictions and upload arbitrary files.
(CVE-2015-0340)

- Multiple use-after-free errors exist that can allow an attacker to deference already freed memory and execute arbitrary code. (CVE-2015-0341, CVE-2015-0342)

Solution

Apply SAT patch number 10458.

Plugin Details

Severity: Critical

ID: 81877

File Name: suse_11_flash-player-150313.nasl

Version: 1.12

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 3/17/2015

Updated: 1/6/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:flash-player, p-cpe:/a:novell:suse_linux:11:flash-player-gnome, p-cpe:/a:novell:suse_linux:11:flash-player-kde4, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/13/2015

Vulnerability Publication Date: 3/12/2015

Exploitable With

Core Impact

Metasploit (Adobe Flash Player NetConnection Type Confusion)

Reference Information

CVE: CVE-2015-0332, CVE-2015-0333, CVE-2015-0334, CVE-2015-0335, CVE-2015-0336, CVE-2015-0337, CVE-2015-0338, CVE-2015-0339, CVE-2015-0340, CVE-2015-0341, CVE-2015-0342

BID: 73080, 73081, 73082, 73083, 73084, 73085, 73086, 73087, 73088, 73089, 73091

Detections

Analytics