ASA-201707-10 log generated external raw
[ASA-201707-10] flashplugin: multiple issues |
---|
Arch Linux Security Advisory ASA-201707-10
==========================================
Severity: Critical
Date : 2017-07-11
CVE-ID : CVE-2017-3080 CVE-2017-3099 CVE-2017-3100
Package : flashplugin
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-344
Summary
=======
The package flashplugin before version 26.0.0.137-1 is vulnerable to
multiple issues including arbitrary code execution and information
disclosure.
Resolution
==========
Upgrade to 26.0.0.137-1.
# pacman -Syu "flashplugin>=26.0.0.137-1"
The problems have been fixed upstream in version 26.0.0.137.
Workaround
==========
None.
Description
===========
- CVE-2017-3080 (information disclosure)
A security issue leading to information disclosure has been found in
Adobe Flash Player < 26.0.0.137.
- CVE-2017-3099 (arbitrary code execution)
A memory corruption vulnerability leading to remote code execution has
been found in Adobe Flash Player < 26.0.0.137.
- CVE-2017-3100 (information disclosure)
A memory corruption vulnerability leading to the disclosure of a memory
address has been found in Adobe Flash Player < 26.0.0.137. It could be
used to bypass some security protections like ASLR.
Impact
======
A remote attacker can execute arbitrary code on the affected host.
References
==========
https://helpx.adobe.com/security/products/flash-player/apsb17-21.html
https://security.archlinux.org/CVE-2017-3080
https://security.archlinux.org/CVE-2017-3099
https://security.archlinux.org/CVE-2017-3100
|