An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes multiple vulnerabilities in Adobe Flash Player.
These vulnerabilities, detailed in the Adobe Security Bulletin APSB15-25 listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
(CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631, CVE-2015-7632, CVE-2015-7633, CVE-2015-7634, CVE-2015-7643, CVE-2015-7644)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.535.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:2024 advisory.

    The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash     Player web browser plug-in.

    This update fixes multiple vulnerabilities in Adobe Flash Player. These     vulnerabilities, detailed in the Adobe Security Bulletins APSB15-25,     APSB15-27, and APSB15-28 listed in the References section, could allow an     attacker to create a specially crafted SWF file that would cause     flash-plugin to crash, execute arbitrary code, or disclose sensitive     information when the victim loaded a page containing the malicious SWF     content. (CVE-2015-5569, CVE-2015-7625, CVE-2015-7626, CVE-2015-7627,     CVE-2015-7628, CVE-2015-7629, CVE-2015-7630, CVE-2015-7631, CVE-2015-7632,     CVE-2015-7633, CVE-2015-7634, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637,     CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642,     CVE-2015-7643, CVE-2015-7644, CVE-2015-7645, CVE-2015-7647, CVE-2015-7648,     CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655,     CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660,     CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043,     CVE-2015-8044, CVE-2015-8046)

    All users of Adobe Flash Player should install this updated package, which     upgrades Flash Player to version 11.2.202.548.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Adobe AIR prior to 19.0.0.213 are outdated and thus unpatched for the following vulnerabilities :

 - An unspecified vulnerability exists related to the defense-in-depth feature in the Flash Broker API. No other details are available. (CVE-2015-5569)
 - Multiple unspecified memory corruption issues exist due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634)
 - A unspecified vulnerability exists that can be exploited by a remote attacker to bypass the same-origin policy, allowing the disclosure of sensitive information. (CVE-2015-7628)
 - Multiple unspecified use-after-free errors exist that can be exploited by a remote attacker to dereference already freed memory, potentially allowing the execution of arbitrary code. (CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, CVE-2015-7644)
 - An unspecified buffer overflow condition exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-7632)

Versions of Adobe Flash Player prior to 19.0.0.207 are outdated and thus unpatched for the following vulnerabilities :

 - An unspecified vulnerability exists related to the defense-in-depth feature in the Flash Broker API. No other details are available. (CVE-2015-5569)
 - Multiple unspecified memory corruption issues exist due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634)
 - A unspecified vulnerability exists that can be exploited by a remote attacker to bypass the same-origin policy, allowing the disclosure of sensitive information. (CVE-2015-7628)
 - Multiple unspecified use-after-free errors exist that can be exploited by a remote attacker to dereference already freed memory, potentially allowing the execution of arbitrary code. (CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, CVE-2015-7644)
 - An unspecified buffer overflow condition exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-7632)

ID	Name	Product	Family	Published	Updated	Severity
86396	RHEL 6 : flash-plugin (RHSA-2015:1893)	Nessus	Red Hat Local Security Checks	10/15/2015	10/24/2019	critical
86862	RHEL 5 : flash-plugin (RHSA-2015:2024)	Nessus	Red Hat Local Security Checks	11/12/2015	11/4/2024	high
9005	Adobe AIR < 19.0.0.213 Multiple Vulnerabilities (APSB15-25)	Nessus Network Monitor	Web Clients	10/21/2015	3/6/2019	critical
9006	Flash Player < 19.0.0.207 Multiple Vulnerabilities (APSB15-25)	Nessus Network Monitor	Web Clients	10/21/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical