Detections
Analytics

MS KB3132372: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge

critical Nessus Plugin ID 87671

Language:

Synopsis

The remote Windows host has a browser plugin installed that is affected by multiple vulnerabilities.

Description

The remote Windows host is missing KB3132372. It is, therefore, affected by multiple vulnerabilities :
 - A type confusion error exists that a remote attacker can exploit to execute arbitrary code. (CVE-2015-8644)

 - An integer overflow condition exists that a remote attacker can exploit to execute arbitrary code.
 (CVE-2015-8651)

 - Multiple use-after-free errors exist that a remote attacker can exploit to execute arbitrary code.
 (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650)

 - Multiple memory corruption issues exist that allow a remote attacker to execute arbitrary code.
 (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645)

Solution

Install Microsoft KB3132372.

See Also

https://support.microsoft.com/en-us/help/3132372/microsoft-security-advisory-update-for-vulnerabilities-in-adobe-flash

https://helpx.adobe.com/security/products/flash-player/apsb16-01.html

Plugin Details

Severity: Critical

ID: 87671

File Name: smb_kb3132372.nasl

Version: 1.12

Type: local

Agent: windows

Family: Windows

Published: 12/30/2015

Updated: 5/25/2022

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2015-8459

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:flash_player

Required KB Items: SMB/Registry/Enumerated, SMB/WindowsVersion

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/29/2015

Vulnerability Publication Date: 12/28/2015

CISA Known Exploited Vulnerability Due Dates: 6/15/2022

Reference Information

CVE: CVE-2015-8459, CVE-2015-8460, CVE-2015-8634, CVE-2015-8635, CVE-2015-8636, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8644, CVE-2015-8645, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650, CVE-2015-8651

MSKB: 3132372