[arch-security] [ASA-201604-7] flashplugin: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201604-7
=========================================

Severity: Critical
Date    : 2016-04-10
CVE-ID  : CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013
          CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017
          CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021
          CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025
          CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029
          CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033
Package : flashplugin
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package flashplugin before version 11.2.202.616-1 is vulnerable to
multiple issues including but not limited to arbitrary code execution,
JIT spraying mitigation bypass and sandbox restriction bypass.

Resolution
==========

Upgrade to 11.2.202.616-1.

# pacman -Syu "flashplugin>=11.2.202.616-1"

The problems have been fixed upstream in version 11.2.202.616.

Workaround
==========

None.

Description
===========

- CVE-2016-1006 (JIT spraying mitigation bypass)

These updates harden a mitigation against JIT spraying attacks that
could be used to bypass memory layout randomization mitigations.

- CVE-2016-1015 CVE-2016-1019 (arbitrary code execution)

These updates resolve type confusion vulnerabilities that could lead to
code execution.

- CVE-2016-1011 CVE-2016-1013 CVE-2016-1016 CVE-2016-1017 CVE-2016-1031
  (arbitrary code execution)

These updates resolve use-after-free vulnerabilities that could lead to
code execution.

- CVE-2016-1012 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023
  CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028
  CVE-2016-1029 CVE-2016-1032 CVE-2016-1033 (arbitrary code execution)

These updates resolve memory corruption vulnerabilities that could lead
to code execution.

- CVE-2016-1018 (arbitrary code execution)

These updates resolve a stack overflow vulnerability that could lead to
code execution.

- CVE-2016-1030 (sandbox restriction bypass)

These updates resolve a security bypass vulnerability.

- CVE-2016-1014 (arbitrary code execution)

These updates resolve a vulnerability in the directory search path used
to find resources that could lead to code execution.

Impact
======

A remote attacker is able to execute arbitrary code, bypass JIT spraying
mitigations and bypass sandbox restrictions via multiple vectors.

References
==========

https://helpx.adobe.com/security/products/flash-player/apsa16-01.html
https://helpx.adobe.com/security/products/flash-player/apsb16-10.html
https://access.redhat.com/security/cve/CVE-2016-1006
https://access.redhat.com/security/cve/CVE-2016-1011
https://access.redhat.com/security/cve/CVE-2016-1012
https://access.redhat.com/security/cve/CVE-2016-1013
https://access.redhat.com/security/cve/CVE-2016-1014
https://access.redhat.com/security/cve/CVE-2016-1015
https://access.redhat.com/security/cve/CVE-2016-1016
https://access.redhat.com/security/cve/CVE-2016-1017
https://access.redhat.com/security/cve/CVE-2016-1018
https://access.redhat.com/security/cve/CVE-2016-1019
https://access.redhat.com/security/cve/CVE-2016-1020
https://access.redhat.com/security/cve/CVE-2016-1021
https://access.redhat.com/security/cve/CVE-2016-1022
https://access.redhat.com/security/cve/CVE-2016-1023
https://access.redhat.com/security/cve/CVE-2016-1024
https://access.redhat.com/security/cve/CVE-2016-1025
https://access.redhat.com/security/cve/CVE-2016-1026
https://access.redhat.com/security/cve/CVE-2016-1027
https://access.redhat.com/security/cve/CVE-2016-1028
https://access.redhat.com/security/cve/CVE-2016-1029
https://access.redhat.com/security/cve/CVE-2016-1030
https://access.redhat.com/security/cve/CVE-2016-1031
https://access.redhat.com/security/cve/CVE-2016-1032
https://access.redhat.com/security/cve/CVE-2016-1033

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160410/d86f97b8/attachment.asc>