Subject: [ASA-201706-15] lib32-flashplugin: arbitrary code execution

Arch Linux Security Advisory ASA-201706-15
==========================================

Severity: Critical
Date    : 2017-06-14
CVE-ID  : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078
          CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083
          CVE-2017-3084
Package : lib32-flashplugin
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-298

Summary
=======

The package lib32-flashplugin before version 26.0.0.126-1 is vulnerable
to arbitrary code execution.

Resolution
==========

Upgrade to 26.0.0.126-1.

# pacman -Syu "lib32-flashplugin>=26.0.0.126-1"

The problems have been fixed upstream in version 26.0.0.126.

Workaround
==========

None.

Description
===========

- CVE-2017-3075 (arbitrary code execution)

A use-after-free vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3076 (arbitrary code execution)

A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3077 (arbitrary code execution)

A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3078 (arbitrary code execution)

A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3079 (arbitrary code execution)

A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3081 (arbitrary code execution)

A use-after-free vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3082 (arbitrary code execution)

A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3083 (arbitrary code execution)

A use-after-free vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

- CVE-2017-3084 (arbitrary code execution)

A use-after-free vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.126.

Impact
======

A remote attacker can execute arbitrary code on the affected host.

References
==========

https://helpx.adobe.com/security/products/flash-player/apsb17-17.html
https://security.archlinux.org/CVE-2017-3075
https://security.archlinux.org/CVE-2017-3076
https://security.archlinux.org/CVE-2017-3077
https://security.archlinux.org/CVE-2017-3078
https://security.archlinux.org/CVE-2017-3079
https://security.archlinux.org/CVE-2017-3081
https://security.archlinux.org/CVE-2017-3082
https://security.archlinux.org/CVE-2017-3083
https://security.archlinux.org/CVE-2017-3084