Arch Linux Security Advisory ASA-201509-8 ========================================= Severity: Critical Date : 2015-09-22 CVE-ID : CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579 CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584 CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.521-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 11.2.202.521-1. # pacman -Syu "flashplugin>=11.2.202.521-1" The problem has been fixed upstream in version 11.2.202.521. Workaround ========== None. Description =========== - CVE-2015-5573 (arbitrary code execution) These updates resolve a type confusion vulnerability that could lead to code execution. - CVE-2015-5570 CVE-2015-5574 CVE-2015-5581 CVE-2015-5584 CVE-2015-6682 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2015-6676 CVE-2015-6678 (arbitrary code execution) These updates resolve buffer overflow vulnerabilities that could lead to code execution. - CVE-2015-5575 CVE-2015-5577 CVE-2015-5578 CVE-2015-5580 CVE-2015-5582 CVE-2015-5588 CVE-2015-6677 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2015-5571 (insufficient validation) These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs. - CVE-2015-5576 (denial of service) These updates resolve a memory leak vulnerability. - CVE-2015-5568 (denial of service) These updates include further hardening to a mitigation to defend against vector length corruptions. - CVE-2015-5567 CVE-2015-5579 (arbitrary code execution) These updates resolve stack corruption vulnerabilities that could lead to code execution. - CVE-2015-5587 (arbitrary code execution) These updates resolve a stack overflow vulnerability that could lead to code execution. - CVE-2015-5572 (information disclosure) These updates resolve a security bypass vulnerability that could lead to information disclosure. - CVE-2015-6679 (information disclosure) These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure. Impact ====== A remote attacker is able to execute arbitrary code, obtain sensitive information or perform a denial of service attack via various vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-23.html https://access.redhat.com/security/cve/CVE-2015-5567 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5568 https://access.redhat.com/security/cve/CVE-2015-5570 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5571 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5572 https://access.redhat.com/security/cve/CVE-2015-5573 https://access.redhat.com/security/cve/CVE-2015-5574 https://access.redhat.com/security/cve/CVE-2015-5575 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5576 https://access.redhat.com/security/cve/CVE-2015-5577 https://access.redhat.com/security/cve/CVE-2015-5578 https://access.redhat.com/security/cve/CVE-2015-5579 https://access.redhat.com/security/cve/CVE-2015-5580 https://access.redhat.com/security/cve/CVE-2015-5581 https://access.redhat.com/security/cve/CVE-2015-5582 https://access.redhat.com/security/cve/CVE-2015-5584 https://access.redhat.com/security/cve/CVE-2015-5587 https://access.redhat.com/security/cve/CVE-2015-5588 https://access.redhat.com/security/cve/CVE-2015-6676 https://access.redhat.com/security/cve/CVE-2015-6677 https://access.redhat.com/security/cve/CVE-2015-6678 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6679 https://access.redhat.com/security/cve/CVE-2015-6682