Adobe flash-player was updated to 11.2.202.626 to fix the following security issues :

Security update to 11.2.202.626 (boo#984695) :

  - APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,     CVE-2016-4125, CVE-2016-4127, CVE-2016-4128,     CVE-2016-4129, CVE-2016-4130, CVE-2016-4131,     CVE-2016-4132, CVE-2016-4133, CVE-2016-4134,     CVE-2016-4135, CVE-2016-4136, CVE-2016-4137,     CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,     CVE-2016-4141, CVE-2016-4142, CVE-2016-4143,     CVE-2016-4144, CVE-2016-4145, CVE-2016-4146,     CVE-2016-4147, CVE-2016-4148, CVE-2016-4149,     CVE-2016-4150, CVE-2016-4151, CVE-2016-4152,     CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,     CVE-2016-4156, CVE-2016-4166, CVE-2016-4171

Please see https://helpx.adobe.com/security/products/flash-player/apsb16-18.html for more information.

An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update upgrades Flash Player to version 11.2.202.626.

Security Fix(es) :

* This update fixes multiple vulnerabilities in Adobe Flash Player.
These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
(CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 21.0.0.242. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,     CVE-2016-4125, CVE-2016-4127, CVE-2016-4128,     CVE-2016-4129, CVE-2016-4130, CVE-2016-4131,     CVE-2016-4132, CVE-2016-4133, CVE-2016-4134,     CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,     CVE-2016-4151, CVE-2016-4152, CVE-2016-4153,     CVE-2016-4154, CVE-2016-4155, CVE-2016-4156,     CVE-2016-4166, CVE-2016-4171)

  - Multiple heap buffer overflow conditions exist due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     execute arbitrary code. (CVE-2016-4135, CVE-2016-4136,     CVE-2016-4138).

  - An unspecified vulnerability exists that allows an     unauthenticated, remote attacker to bypass the     same-origin policy, resulting in the disclosure of     potentially sensitive information. (CVE-2016-4139)

  - An unspecified flaw exists when loading certain dynamic     link libraries due to using a search path that includes     directories which may not be trusted or under the user's     control. An unauthenticated, remote attacker can exploit     this, by inserting a specially crafted library in the     path, to execute arbitrary code in the context of the     user. (CVE-2016-4140)

  - Multiple use-after-free errors exist that allow an     unauthenticated, remote attacker to deference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,     CVE-2016-4146, CVE-2016-4147, CVE-2016-4148)

  - Multiple type confusion errors exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-4144, CVE-2016-4149)

The remote Windows host is missing KB3167685. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,     CVE-2016-4125, CVE-2016-4127, CVE-2016-4128,     CVE-2016-4129, CVE-2016-4130, CVE-2016-4131,     CVE-2016-4132, CVE-2016-4133, CVE-2016-4134,     CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,     CVE-2016-4151, CVE-2016-4152, CVE-2016-4153,     CVE-2016-4154, CVE-2016-4155, CVE-2016-4156,     CVE-2016-4166, CVE-2016-4171)

  - Multiple heap buffer overflow conditions exist due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     execute arbitrary code. (CVE-2016-4135, CVE-2016-4136,     CVE-2016-4138).

  - An unspecified vulnerability exists that allows an     unauthenticated, remote attacker to bypass the     same-origin policy, resulting in the disclosure of     potentially sensitive information. (CVE-2016-4139)

  - An unspecified flaw exists when loading certain dynamic     link libraries due to using a search path that includes     directories which may not be trusted or under the user's     control. An unauthenticated, remote attacker can exploit     this, by inserting a specially crafted library in the     path, to execute arbitrary code in the context of the     user. (CVE-2016-4140)

  - Multiple use-after-free errors exist that allow an     unauthenticated, remote attacker to deference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,     CVE-2016-4146, CVE-2016-4147, CVE-2016-4148)

  - Multiple type confusion errors exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-4144, CVE-2016-4149)

Adobe reports :

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-4144, CVE-2016-4149).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2016-4135, CVE-2016-4136, CVE-2016-4138).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).

These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4140).

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2016-4139).

The version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to version 21.0.0.242. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,     CVE-2016-4125, CVE-2016-4127, CVE-2016-4128,     CVE-2016-4129, CVE-2016-4130, CVE-2016-4131,     CVE-2016-4132, CVE-2016-4133, CVE-2016-4134,     CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,     CVE-2016-4151, CVE-2016-4152, CVE-2016-4153,     CVE-2016-4154, CVE-2016-4155, CVE-2016-4156,     CVE-2016-4166, CVE-2016-4171)

  - Multiple heap buffer overflow conditions exist due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     execute arbitrary code. (CVE-2016-4135, CVE-2016-4136,     CVE-2016-4138).

  - An unspecified vulnerability exists that allows an     unauthenticated, remote attacker to bypass the     same-origin policy, resulting in the disclosure of     potentially sensitive information. (CVE-2016-4139)

  - An unspecified flaw exists when loading certain dynamic     link libraries due to using a search path that includes     directories which may not be trusted or under the user's     control. An unauthenticated, remote attacker can exploit     this, by inserting a specially crafted library in the     path, to execute arbitrary code in the context of the     user. (CVE-2016-4140)

  - Multiple use-after-free errors exist that allow an     unauthenticated, remote attacker to deference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,     CVE-2016-4146, CVE-2016-4147, CVE-2016-4148)

  - Multiple type confusion errors exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-4144, CVE-2016-4149)

The remote host is affected by the vulnerability described in GLSA-201606-08 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Adobe flash-player was updated to 11.2.202.626 to fix the following security issues :

Security update to 11.2.202.626 (boo#984695) :

  - APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,     CVE-2016-4125, CVE-2016-4127, CVE-2016-4128,     CVE-2016-4129, CVE-2016-4130, CVE-2016-4131,     CVE-2016-4132, CVE-2016-4133, CVE-2016-4134,     CVE-2016-4135, CVE-2016-4136, CVE-2016-4137,     CVE-2016-4138, CVE-2016-4139, CVE-2016-4140,     CVE-2016-4141, CVE-2016-4142, CVE-2016-4143,     CVE-2016-4144, CVE-2016-4145, CVE-2016-4146,     CVE-2016-4147, CVE-2016-4148, CVE-2016-4149,     CVE-2016-4150, CVE-2016-4151, CVE-2016-4152,     CVE-2016-4153, CVE-2016-4154, CVE-2016-4155,     CVE-2016-4156, CVE-2016-4166, CVE-2016-4171

Please see https://helpx.adobe.com/security/products/flash-player/apsb16-18.html for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
91706	openSUSE Security Update : flash-player (openSUSE-2016-740)	Nessus	SuSE Local Security Checks	6/20/2016	3/28/2022	critical
91711	RHEL 5 / 6 : flash-plugin (RHSA-2016:1238)	Nessus	Red Hat Local Security Checks	6/20/2016	3/28/2022	critical
91708	openSUSE Security Update : flash-player (openSUSE-2016-743)	Nessus	SuSE Local Security Checks	6/20/2016	3/28/2022	critical
91670	Adobe Flash Player <= 21.0.0.242 Multiple Vulnerabilities (APSB16-18)	Nessus	Windows	6/17/2016	4/11/2022	critical
91672	MS16-083: Security Update for Adobe Flash Player (3167685)	Nessus	Windows : Microsoft Bulletins	6/17/2016	3/28/2022	critical
91698	FreeBSD : flash -- multiple vulnerabilities (0e3dfdde-35c4-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	6/20/2016	3/28/2022	critical
91671	Adobe Flash Player for Mac <= 21.0.0.242 Multiple Vulnerabilities (APSB16-18)	Nessus	MacOS X Local Security Checks	6/17/2016	3/28/2022	critical
91702	GLSA-201606-08 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/20/2016	3/28/2022	critical
93156	SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:1613-1)	Nessus	SuSE Local Security Checks	8/29/2016	3/28/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical