Arch Linux Security Advisory ASA-201605-18 ========================================== Severity: Critical Date : 2016-05-12 CVE-ID : CVE-2016-1096 CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115 CVE-2016-4116 CVE-2016-4117 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.621-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.621-1. # pacman -Syu "lib32-flashplugin>=11.2.202.621-1" The problem has been fixed upstream in version 11.2.202.621. Workaround ========== None. Description =========== - CVE-2016-1096: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1097: Use-after-free. Wen Guanxing from Pangu LAB, working with the Chromium Vulnerability Rewards Program . - CVE-2016-1098: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1099: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1100: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1101: Heap buffer overflow. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1102: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1103: Buffer overflow. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1104: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1105: Type confusion. Natalie Silvanovich of Google Project Zero. - CVE-2016-1106: Use-after-free. Natalie Silvanovich of Google Project Zero. - CVE-2016-1107: Use-after-free. NSFOCUS Security Team. - CVE-2016-1108: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-1109: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-1110: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-4108: Use-after-free. Natalie Silvanovich of Google Project Zero. - CVE-2016-4109: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4110: Use-after-free. willJ of Tencent PC Manager. - CVE-2016-4111: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4112: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4113: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4114: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4115: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4116: Vulnerability in the directory search path used to find resources. Ladislav Baco of CSIRT.SK. - CVE-2016-4117: Type confusion vulnerability that could lead to code execution. Genwei Jiang of FireEye, Inc. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsa16-02.html https://access.redhat.com/security/cve/CVE-2016-1096 https://access.redhat.com/security/cve/CVE-2016-1097 https://access.redhat.com/security/cve/CVE-2016-1098 https://access.redhat.com/security/cve/CVE-2016-1099 https://access.redhat.com/security/cve/CVE-2016-1100 https://access.redhat.com/security/cve/CVE-2016-1101 https://access.redhat.com/security/cve/CVE-2016-1102 https://access.redhat.com/security/cve/CVE-2016-1103 https://access.redhat.com/security/cve/CVE-2016-1104 https://access.redhat.com/security/cve/CVE-2016-1105 https://access.redhat.com/security/cve/CVE-2016-1106 https://access.redhat.com/security/cve/CVE-2016-1107 https://access.redhat.com/security/cve/CVE-2016-1108 https://access.redhat.com/security/cve/CVE-2016-1109 https://access.redhat.com/security/cve/CVE-2016-1110 https://access.redhat.com/security/cve/CVE-2016-4108 https://access.redhat.com/security/cve/CVE-2016-4109 https://access.redhat.com/security/cve/CVE-2016-4110 https://access.redhat.com/security/cve/CVE-2016-4111 https://access.redhat.com/security/cve/CVE-2016-4112 https://access.redhat.com/security/cve/CVE-2016-4113 https://access.redhat.com/security/cve/CVE-2016-4114 https://access.redhat.com/security/cve/CVE-2016-4115 https://access.redhat.com/security/cve/CVE-2016-4116 https://access.redhat.com/security/cve/CVE-2016-4117