Vulnerabilities > CVE-2011-2452 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe Flash Player
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Windows NASL id HP_SYSTEMS_INSIGHT_MANAGER_700_MULTIPLE_VULNS.NASL description The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the following components : - TLS and SSL protocols - Apache Tomcat - Java - Flash Player - BlazeDS/GraniteDS - Adobe LiveCycle - Adobe Flex SDK - Systems Insight Manager last seen 2020-06-01 modified 2020-06-02 plugin id 59684 published 2012-06-15 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59684 title HP Systems Insight Manager < 7.0 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(59684); script_version("1.19"); script_cvs_date("Date: 2018/11/15 20:50:27"); script_cve_id( "CVE-2009-3555", "CVE-2010-2227", "CVE-2010-4470", "CVE-2010-4476", "CVE-2011-0611", "CVE-2011-0786", "CVE-2011-0788", "CVE-2011-0802", "CVE-2011-0814", "CVE-2011-0815", "CVE-2011-0817", "CVE-2011-0862", "CVE-2011-0863", "CVE-2011-0864", "CVE-2011-0865", "CVE-2011-0866", "CVE-2011-0867", "CVE-2011-0868", "CVE-2011-0869", "CVE-2011-0871", "CVE-2011-0872", "CVE-2011-0873", "CVE-2011-2092", "CVE-2011-2093", "CVE-2011-2130", "CVE-2011-2134", "CVE-2011-2135", "CVE-2011-2136", "CVE-2011-2137", "CVE-2011-2138", "CVE-2011-2139", "CVE-2011-2140", "CVE-2011-2414", "CVE-2011-2415", "CVE-2011-2416", "CVE-2011-2417", "CVE-2011-2425", "CVE-2011-2426", "CVE-2011-2427", "CVE-2011-2428", "CVE-2011-2429", "CVE-2011-2430", "CVE-2011-2444", "CVE-2011-2445", "CVE-2011-2450", "CVE-2011-2451", "CVE-2011-2452", "CVE-2011-2453", "CVE-2011-2454", "CVE-2011-2455", "CVE-2011-2456", "CVE-2011-2457", "CVE-2011-2458", "CVE-2011-2459", "CVE-2011-2460", "CVE-2011-2461", "CVE-2011-3556", "CVE-2011-3557", "CVE-2011-3558", "CVE-2012-1995", "CVE-2012-1996", "CVE-2012-1997", "CVE-2012-1998", "CVE-2012-1999" ); script_bugtraq_id( 36935, 41544, 42817, 46091, 46387, 47314, 48133, 48134, 48135, 48136, 48137, 48138, 48139, 48140, 48141, 48142, 48143, 48144, 48145, 48146, 48147, 48148, 48149, 48267, 48279, 49073, 49074, 49075, 49076, 49077, 49079, 49080, 49081, 49082, 49083, 49084, 49085, 49086, 49710, 49714, 49715, 49716, 49717, 49718, 50618, 50619, 50620, 50621, 50622, 50623, 50624, 50625, 50626, 50627, 50628, 50629, 50869, 53315 ); script_xref(name:"HP", value:"HPSBMU02769"); script_xref(name:"HP", value:"SSRT100846"); script_xref(name:"HP", value:"SSRT100093"); script_xref(name:"HP", value:"SSRT090028"); script_xref(name:"HP", value:"SSRT100110"); script_xref(name:"HP", value:"SSRT100373"); script_xref(name:"HP", value:"SSRT100426"); script_xref(name:"HP", value:"SSRT100514"); script_xref(name:"HP", value:"SSRT100562"); script_xref(name:"HP", value:"SSRT100639"); script_xref(name:"HP", value:"SSRT100702"); script_xref(name:"HP", value:"SSRT100819"); script_name(english:"HP Systems Insight Manager < 7.0 Multiple Vulnerabilities"); script_summary(english:"Checks the version of HP Systems Insight Manager."); script_set_attribute(attribute:"synopsis", value: "The remote Windows host contains software that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the following components : - TLS and SSL protocols - Apache Tomcat - Java - Flash Player - BlazeDS/GraniteDS - Adobe LiveCycle - Adobe Flex SDK - Systems Insight Manager"); script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?72e42ec4"); script_set_attribute(attribute:"solution", value:"Upgrade to HP Systems Insight Manager 7.0 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Java RMI Server Insecure Default Configuration Java Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(310); script_set_attribute(attribute:"vuln_publication_date", value:"2009/11/09"); script_set_attribute(attribute:"patch_publication_date", value:"2012/04/30"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/15"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:systems_insight_manager"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc."); script_dependencies("hp_systems_insight_manager_installed.nasl"); script_require_keys("installed_sw/HP Systems Insight Manager"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("install_func.inc"); include("misc_func.inc"); app_name = "HP Systems Insight Manager"; get_install_count(app_name:app_name, exit_if_zero:TRUE); install = get_single_install(app_name:app_name); path = install['path']; version = install['version']; if (version =~ '^(([A-Z]\\.)?0[0-5]\\.|([A-C]\\.)?0[0-6]\\.[0-9\\.]+)') { set_kb_item(name:'www/0/XSS', value:TRUE); set_kb_item(name:'www/0/XSRF', value:TRUE); port = get_kb_item('SMB/transport'); if (!port) port = 445; if (report_verbosity > 0) { report = '\n Path : ' + path + '\n Installed version : ' + version + '\n Fixed version : C.07.00.00.00' + '\n'; security_hole(port:port, extra:report); } else security_hole(port); } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);NASL family SuSE Local Security Checks NASL id SUSE_11_4_FLASH-PLAYER-111111.NASL description flash-player update to version 11.1.102.55 to fix the following critical security issues : CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460 last seen 2020-06-01 modified 2020-06-02 plugin id 75839 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75839 title openSUSE Security Update : flash-player (openSUSE-SU-2011:1240-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2011-4.NASL description This update provides flash-player 11.1.102.55, which files the following critical security issues : - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2445). - This update resolves a heap corruption vulnerability that could lead to code execution (CVE-2011-2450). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2451). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2452). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2453). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2454). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2455). - This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2011-2456). - This update resolves a stack overflow vulnerability that could lead to code execution (CVE-2011-2457). - This update resolves a vulnerability that could lead to a cross-domain policy bypass (Internet Explorer-only) (CVE-2011-2458). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2459). - This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2460). last seen 2020-06-01 modified 2020-06-02 plugin id 74525 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74525 title openSUSE Security Update : flash-player (openSUSE-2011-4) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_0E8E12120CE511E1849B003067B2972C.NASL description Adobe Product Security Incident Response Team reports : Critical vulnerabilities have been identified in Adobe Flash Player 11.0.1.152 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier versions for Android. In addition a patch was released for users of flash10. last seen 2020-06-01 modified 2020-06-02 plugin id 56803 published 2011-11-14 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56803 title FreeBSD : linux-flashplugin -- multiple vulnerabilities (0e8e1212-0ce5-11e1-849b-003067b2972c) NASL family SuSE Local Security Checks NASL id SUSE_11_FLASH-PLAYER-111111.NASL description flash-player update to version 11.1.102.55 to fix the following critical security issues : CVE-2011-2445 / CVE-2011-2450 / CVE-2011-2451 / CVE-2011-2452 / CVE-2011-2453 / CVE-2011-2454 / CVE-2011-2455 / CVE-2011-2456 / CVE-2011-2457 / CVE-2011-2458 / CVE-2011-2459 / CVE-2011-2460 last seen 2020-06-01 modified 2020-06-02 plugin id 57102 published 2011-12-13 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57102 title SuSE 11.1 Security Update : flash-player (SAT Patch Number 5413) NASL family Windows NASL id FLASH_PLAYER_APSB11-28.NASL description According to its version, the instance of Flash Player installed on the remote Windows host is 10.x equal to or earlier than 10.3.183.10 or 11.x equal to or earlier than 11.0.1.152. It is, therefore, reportedly affected by several critical vulnerabilities : - Several unspecified memory corruption errors exist that could lead to code execution. (CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, CVE-2011-2460) - An unspecified heap corruption error exists that could lead to code execution. (CVE-2011-2450) - An unspecified buffer overflow error exists that could lead to code execution. (CVE-2011-2456) - An unspecified stack overflow error exists that could lead to code execution. (CVE-2011-2457) - An unspecified error related to Internet Explorer can allow cross-domain policy violations. (CVE-2011-2458) last seen 2020-06-01 modified 2020-06-02 plugin id 56874 published 2011-11-18 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56874 title Flash Player <= 10.3.183.10 / 11.0.1.152 Multiple Vulnerabilities (APSB11-28) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201204-07.NASL description The remote host is affected by the vulnerability described in GLSA-201204-07 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted SWF file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to bypass intended access restrictions, bypass cross-domain policy, inject arbitrary web script, or obtain sensitive information. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 59623 published 2012-06-21 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59623 title GLSA-201204-07 : Adobe Flash Player: Multiple vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_FLASH-PLAYER-7832.NASL description flash-player update to version 11.1.102.55 to fix the following critical last seen 2020-06-01 modified 2020-06-02 plugin id 57195 published 2011-12-13 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/57195 title SuSE 10 Security Update : flash-player (ZYPP Patch Number 7832) NASL family Solaris Local Security Checks NASL id SOLARIS11_FLASH_20120207.NASL description The remote Solaris system is missing necessary patches to address security updates : - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. (CVE-2011-2445) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2011-2450) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. (CVE-2011-2451) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. (CVE-2011-2452) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. (CVE-2011-2453) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. (CVE-2011-2454) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2459, and CVE-2011-2460. (CVE-2011-2455) - Buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors. (CVE-2011-2456) - Stack-based buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors. (CVE-2011-2457) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, when Internet Explorer is used, allows remote attackers to bypass the cross-domain policy via a crafted web site. (CVE-2011-2458) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2460. (CVE-2011-2459) - Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459. (CVE-2011-2460) last seen 2020-06-01 modified 2020-06-02 plugin id 80611 published 2015-01-19 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/80611 title Oracle Solaris Third-Party Patch Update : flash (multiple_vulnerabilities_in_adobe_flashplayer4) NASL family MacOS X Local Security Checks NASL id MACOSX_FLASH_PLAYER_11_1_102_55.NASL description According to its version, the instance of Flash Player installed on the remote Mac OS X host is 10.x equal to or earlier than 10.3.183.10 or 11.x equal to or earlier than 11.0.1.152. It is therefore reportedly affected by several critical vulnerabilities : - Several unspecified memory corruption errors exist that could lead to code execution. (CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, CVE-2011-2460) - An unspecified heap corruption error exists that could lead to code execution. (CVE-2011-2450) - An unspecified buffer overflow error exists that could lead to code execution. (CVE-2011-2456) - An unspecified stack overflow error exists that could lead to code execution. (CVE-2011-2457) last seen 2020-06-01 modified 2020-06-02 plugin id 56875 published 2011-11-18 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56875 title Flash Player for Mac <= 10.3.183.10 / 11.0.1.152 Multiple Vulnerabilities (APSB11-28) NASL family SuSE Local Security Checks NASL id SUSE_11_3_FLASH-PLAYER-110921.NASL description flash-player update to version 11.1.102.55 to fix the following critical security issues : CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460 last seen 2020-06-01 modified 2020-06-02 plugin id 75502 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75502 title openSUSE Security Update : flash-player (openSUSE-SU-2011:1240-1) NASL family MacOS X Local Security Checks NASL id MACOSX_ADOBE_READER_APSA11-04.NASL description The version of Adobe Reader installed on the remote Mac OS X host is prior or equal to 10.1.1 or 9.4.6. It is, therefore, affected by a memory corruption issue related to the Universal 3D (U3D) file format. A remote attacker can exploit this, by convincing a user to view a maliciously crafted PDF file, to cause an application crash or to execute arbitrary code. Note that the Adobe Reader X user-specific option to use last seen 2020-06-01 modified 2020-06-02 plugin id 57044 published 2011-12-07 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/57044 title Adobe Reader <= 10.1.1 / 9.4.6 U3D Memory Corruption (APSA11-04, APSB11-28, APSB11-30, APSB12-01) (Mac OS X) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2011-1445.NASL description An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed on the Adobe security page APSB11-28, listed in the References section. Multiple security flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2459, CVE-2011-2460) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.3.183.11. last seen 2020-06-01 modified 2020-06-02 plugin id 56811 published 2011-11-14 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56811 title RHEL 5 / 6 : flash-plugin (RHSA-2011:1445) NASL family SuSE Local Security Checks NASL id SUSE_11_4_FLASH-PLAYER-111115.NASL description flash-player update to version 11.1.102.55 to fix the following critical security issues : CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460 last seen 2020-06-01 modified 2020-06-02 plugin id 75840 published 2014-06-13 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75840 title openSUSE Security Update : flash-player (openSUSE-SU-2011:1240-2) NASL family Windows NASL id ADOBE_AIR_APSB11-28.NASL description According to its version, the instance of Adobe AIR installed on the remote Windows host is 3.0 or earlier and is reportedly affected by several critical vulnerabilities : - Several unspecified memory corruption errors exist that could lead to code execution. (CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, CVE-2011-2460) - An unspecified heap corruption error exists that could lead to code execution. (CVE-2011-2450) - An unspecified buffer overflow error exists that could lead to code execution. (CVE-2011-2456) - An unspecified stack overflow error exists that could lead to code execution. (CVE-2011-2457) - An unspecified error related to Internet Explorer can allow cross-domain policy violations. (CVE-2011-2458) By tricking a user on the affected system into opening a specially crafted document with Flash content, an attacker could leverage these vulnerabilities to execute arbitrary code remotely on the system subject to the user last seen 2020-06-01 modified 2020-06-02 plugin id 56959 published 2011-11-28 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56959 title Adobe AIR <= 3.0 Multiple Vulnerabilities (APSB11-28) NASL family MacOS X Local Security Checks NASL id MACOSX_ADOBE_AIR_3_1_0_4880.NASL description According to its version, the instance of Adobe AIR installed on the remote Mac OS X host is 3.0 or earlier. It is therefore reportedly affected by several critical vulnerabilities : - Several unspecified memory corruption errors exist that could lead to code execution. (CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, CVE-2011-2460) - An unspecified heap corruption error exists that could lead to code execution. (CVE-2011-2450) - An unspecified buffer overflow error exists that could lead to code execution. (CVE-2011-2456) - An unspecified stack overflow error exists that could lead to code execution. (CVE-2011-2457) last seen 2020-06-01 modified 2020-06-02 plugin id 56962 published 2011-11-28 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56962 title Adobe AIR for Mac <= 3.0 Multiple Vulnerabilities (APSB11-28)
Oval
accepted 2015-08-03T04:00:43.958-04:00 class vulnerability contributors name Aharon Chernin organization DTCC name Scott Quint organization DTCC name Scott Quint organization DTCC name Josh Turpin organization Symantec Corporation name Josh Turpin organization Symantec Corporation name David Rothenberg organization The MITRE Corporation name Shane Shaffer organization G2, Inc. name Maria Kedovskaya organization ALTX-SOFT name Maria Kedovskaya organization ALTX-SOFT name Maria Kedovskaya organization ALTX-SOFT name Maria Kedovskaya organization ALTX-SOFT name Maria Mikhno organization ALTX-SOFT name Maria Mikhno organization ALTX-SOFT name Maria Mikhno organization ALTX-SOFT name Maria Mikhno organization ALTX-SOFT name Evgeniy Pavlov organization ALTX-SOFT name Maria Mikhno organization ALTX-SOFT
definition_extensions comment Adobe Flash Player 10 is installed oval oval:org.mitre.oval:def:7610 comment Adobe Flash Player 9 is installed oval oval:org.mitre.oval:def:7402 comment Adobe Flash Player is installed oval oval:org.mitre.oval:def:6700 comment Adobe AIR is installed oval oval:org.mitre.oval:def:7479 comment Adobe Flash Player is installed oval oval:org.mitre.oval:def:6700 comment Adobe AIR is installed oval oval:org.mitre.oval:def:7479 comment Adobe AIR is installed oval oval:org.mitre.oval:def:7479 comment Adobe Flash Player is installed oval oval:org.mitre.oval:def:6700 comment Adobe Flash Player is installed oval oval:org.mitre.oval:def:6700 comment ActiveX Control is installed oval oval:org.mitre.oval:def:26707
description Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. family windows id oval:org.mitre.oval:def:14189 status accepted submitted 2011-11-25T18:28:45.000-05:00 title Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. version 76 accepted 2013-02-04T04:00:38.527-05:00 class vulnerability contributors name Shane Shaffer organization G2, Inc. definition_extensions comment Adobe Flash Player is Installed oval oval:org.mitre.oval:def:12319 comment Adobe Flash Player 11 is installed oval oval:org.mitre.oval:def:16112 comment Adobe AIR is installed oval oval:org.mitre.oval:def:15988
description Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. family macos id oval:org.mitre.oval:def:16079 status accepted submitted 2012-12-20T15:35:55.661-05:00 title Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. version 4
Redhat
| advisories |
| ||||
| rpms |
|
References
- http://www.adobe.com/support/security/bulletins/apsb11-28.html
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
- http://www.redhat.com/support/errata/RHSA-2011-1445.html
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
- http://security.gentoo.org/glsa/glsa-201204-07.xml
- http://secunia.com/advisories/48819
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16079
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14189