Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Adobe Updates for Multiple Vulnerabilities
Informations
Name TA07-355A First vendor Publication 2007-12-21
Vendor US-CERT Last vendor Modification 2007-12-21
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Adobe has released Security bulletin APSB07-20 to address multiple vulnerabilities affecting Adobe Flash Player. Attackers could exploit these vulnerabilities to execute arbitrary code, perform DNS rebinding and cross-site scripting attacks, conduct port scans, or cause a denial of service.

I. Description

Adobe Security Update APSB07-20 addresses a number of vulnerabilities affecting Adobe Flash 9.0.48.0 and earlier, 8.0.35.0 and earlier and
7.0.70 and earlier. Further details are available in the related vulnerability notes.

An attacker could exploit these vulnerabilities by convincing a user to load a specially crafted Flash file. Flash content is widely deployed on the internet. An attacker could distribute Flash files using web sites that allow user-supplied content, like popular social networking sites.

II. Impact

The impacts of these vulnerabilities vary. An attacker may be able to execute arbitrary code, perform DNS rebinding or cross-site scripting attacks, conduct port scans, or cause a denial of service.

III. Solution

Upgrade Flash Player

Upgrade Flash Player according to the information in Adobe Security bulletin APSB97-20. For the port scanning issue (CVE-2007-4324), consider ActionScript network socket functionality per TechNote kb402956.

Adobe provides a way to determine which version of Flash Player is installed and a way to configure notifications of updates.

Original Source

Url : http://www.us-cert.gov/cas/techalerts/TA07-355A.html

CWE : Common Weakness Enumeration

% Id Name
38 % CWE-264 Permissions, Privileges, and Access Controls
25 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
25 % CWE-20 Improper Input Validation
12 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10210
 
Oval ID: oval:org.mitre.oval:def:10210
Title: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.
Family: unix Class: vulnerability
Reference(s): CVE-2007-6244
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10519
 
Oval ID: oval:org.mitre.oval:def:10519
Title: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.
Family: unix Class: vulnerability
Reference(s): CVE-2007-6246
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11069
 
Oval ID: oval:org.mitre.oval:def:11069
Title: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Family: unix Class: vulnerability
Reference(s): CVE-2007-6243
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11874
 
Oval ID: oval:org.mitre.oval:def:11874
Title: ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.
Description: ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.
Family: unix Class: vulnerability
Reference(s): CVE-2007-4324
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17651
 
Oval ID: oval:org.mitre.oval:def:17651
Title: USN-547-1 -- pcre3 vulnerabilities
Description: Tavis Ormandy and Will Drewry discovered multiple flaws in the regular expression handling of PCRE.
Family: unix Class: patch
Reference(s): USN-547-1
CVE-2007-1659
CVE-2007-1660
CVE-2007-1661
CVE-2007-1662
CVE-2007-4766
CVE-2007-4767
CVE-2007-4768
Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 6.10
Ubuntu 7.04
Ubuntu 7.10
Product(s): pcre3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18752
 
Oval ID: oval:org.mitre.oval:def:18752
Title: DSA-1570-1 kazehakase - execution of arbitrary code
Description: Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library.
Family: unix Class: patch
Reference(s): DSA-1570-1
CVE-2006-7227
CVE-2006-7228
CVE-2006-7230
CVE-2007-1659
CVE-2007-1660
CVE-2007-1661
CVE-2007-1662
CVE-2007-4766
CVE-2007-4767
CVE-2007-4768
Version: 7
Platform(s): Debian GNU/Linux 4.0
Product(s): kazehakase
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20218
 
Oval ID: oval:org.mitre.oval:def:20218
Title: DSA-1399-1 pcre3 - arbitrary code execution
Description: Tavis Ormandy of the Google Security Team has discovered several security issues in PCRE, the Perl-Compatible Regular Expression library, which potentially allow attackers to execute arbitrary code by compiling specially crafted regular expressions.
Family: unix Class: patch
Reference(s): DSA-1399-1
CVE-2007-1659
CVE-2007-1660
CVE-2007-1661
CVE-2007-1662
CVE-2007-4766
CVE-2007-4767
CVE-2007-4768
Version: 5
Platform(s): Debian GNU/Linux 4.0
Product(s): pcre3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22648
 
Oval ID: oval:org.mitre.oval:def:22648
Title: ELSA-2007:1126: flash-plugin security update (Critical)
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.
Family: unix Class: patch
Reference(s): ELSA-2007:1126-01
CVE-2007-5275
CVE-2007-4324
CVE-2007-4768
CVE-2007-6242
CVE-2007-6243
CVE-2007-6244
CVE-2007-6245
CVE-2007-6246
Version: 37
Platform(s): Oracle Linux 5
Product(s): flash-plugin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23992
 
Oval ID: oval:org.mitre.oval:def:23992
Title: Unspecified vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X, has unknown "Highly Severe" impact and unknown attack vectors
Description: Unspecified vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X, has unknown "Highly Severe" impact and unknown attack vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2007-5476
Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24154
 
Oval ID: oval:org.mitre.oval:def:24154
Title: DEPRECATED: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.
Family: windows Class: vulnerability
Reference(s): CVE-2007-6246
Version: 3
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24322
 
Oval ID: oval:org.mitre.oval:def:24322
Title: DEPRECATED: Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error"
Description: Unspecified vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X, has unknown "Highly Severe" impact and unknown attack vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2007-5476
Version: 3
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24545
 
Oval ID: oval:org.mitre.oval:def:24545
Title: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.
Description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.
Family: windows Class: vulnerability
Reference(s): CVE-2007-6244
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24621
 
Oval ID: oval:org.mitre.oval:def:24621
Title: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.
Family: windows Class: vulnerability
Reference(s): CVE-2007-6245
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24854
 
Oval ID: oval:org.mitre.oval:def:24854
Title: ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not
Description: ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.
Family: windows Class: vulnerability
Reference(s): CVE-2007-4324
Version: 10
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24909
 
Oval ID: oval:org.mitre.oval:def:24909
Title: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Family: windows Class: vulnerability
Reference(s): CVE-2007-6243
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24929
 
Oval ID: oval:org.mitre.oval:def:24929
Title: Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors."
Description: Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors."
Family: windows Class: vulnerability
Reference(s): CVE-2007-6242
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8010
 
Oval ID: oval:org.mitre.oval:def:8010
Title: DSA-1570 kazehakase -- various
Description: Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library. The PCRE library has been updated to fix the security issues reported against it in previous Debian Security Advisories. This update ensures that kazehakase uses that supported library, and not its own embedded and insecure version.
Family: unix Class: patch
Reference(s): DSA-1570
CVE-2006-7227
CVE-2006-7228
CVE-2006-7230
CVE-2007-1659
CVE-2007-1660
CVE-2007-1661
CVE-2007-1662
CVE-2007-4766
CVE-2007-4767
CVE-2007-4768
Version: 3
Platform(s): Debian GNU/Linux 4.0
Product(s): kazehakase
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9188
 
Oval ID: oval:org.mitre.oval:def:9188
Title: Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors."
Description: Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors."
Family: unix Class: vulnerability
Reference(s): CVE-2007-6242
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9250
 
Oval ID: oval:org.mitre.oval:def:9250
Title: The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Description: The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Family: windows Class: vulnerability
Reference(s): CVE-2007-5275
Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Adobe AIR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9546
 
Oval ID: oval:org.mitre.oval:def:9546
Title: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.
Description: Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.
Family: unix Class: vulnerability
Reference(s): CVE-2007-6245
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9701
 
Oval ID: oval:org.mitre.oval:def:9701
Title: Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
Description: Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
Family: windows Class: vulnerability
Reference(s): CVE-2007-4768
Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Product(s): Adobe Flash Player
Adobe Reader
Adobe Acrobat
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 71
Application 1
Application 104
Application 4

OpenVAS Exploits

Date Description
2010-05-12 Name : Mac OS X Security Update 2007-009
File : nvt/macosx_secupd_2007-009.nasl
2010-05-12 Name : Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003
File : nvt/macosx_upd_10_5_3_secupd_2008-003.nasl
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-04-09 Name : Mandriva Update for pcre MDKSA-2007:211 (pcre)
File : nvt/gb_mandriva_MDKSA_2007_211.nasl
2009-03-23 Name : Ubuntu Update for pcre3 vulnerabilities USN-547-1
File : nvt/gb_ubuntu_USN_547_1.nasl
2009-02-16 Name : Fedora Update for pcre FEDORA-2008-1842
File : nvt/gb_fedora_2008_1842_pcre_fc7.nasl
2009-01-28 Name : SuSE Update for flash-player SUSE-SA:2007:069
File : nvt/gb_suse_2007_069.nasl
2009-01-23 Name : SuSE Update for flash-player SUSE-SA:2008:022
File : nvt/gb_suse_2008_022.nasl
2008-11-01 Name : FreeBSD Ports: linux-flashplugin
File : nvt/freebsd_linux-flashplugin4.nasl
2008-10-16 Name : Adobe Flash Player Multiple Security Bypass Vulnerabilities (Win)
File : nvt/gb_adobe_flash_player_sec_bypass_vuln_win.nasl
2008-10-16 Name : Adobe Flash Player Multiple Security Bypass Vulnerabilities (Linux)
File : nvt/gb_adobe_flash_player_sec_bypass_vuln_lin.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200711-30 (libpcre)
File : nvt/glsa_200711_30.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200801-02 (R)
File : nvt/glsa_200801_02.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200801-07 (netscape-flash)
File : nvt/glsa_200801_07.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200801-18 (kazehakase)
File : nvt/glsa_200801_18.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200801-19 (goffice)
File : nvt/glsa_200801_19.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200804-21 (netscape-flash)
File : nvt/glsa_200804_21.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-11 (chicken)
File : nvt/glsa_200805_11.nasl
2008-09-04 Name : FreeBSD Ports: pcre, pcre-utf8
File : nvt/freebsd_pcre0.nasl
2008-09-04 Name : FreeBSD Ports: linux-flashplugin
File : nvt/freebsd_linux-flashplugin2.nasl
2008-09-03 Name : Adobe Flash Player 9.0.115.0 and earlier vulnerability (Win)
File : nvt/smbcl_flash_player_CB-A08-0059.nasl
2008-09-03 Name : Adobe Flash Player 9.0.115.0 and earlier vulnerability (Lin)
File : nvt/flash_player_CB-A08-0059.nasl
2008-05-12 Name : Debian Security Advisory DSA 1570-1 (kazehakase)
File : nvt/deb_1570_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 1399-1 (pcre3)
File : nvt/deb_1399_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
51567 Adobe Flash Cross-domain Policy Canonicalization Weakness

41489 Adobe Flash Player SWF DNS Pinning Arbitrary Host TCP Connection

41488 Adobe Flash Player SWF Embedded JPG Handling Arbitrary Code Execution

41487 Adobe Flash Player Cross-domain Policy Unspecified Weakness

41486 Adobe Flash Player ActiveX in MSIE navigateToURL Function XSS

41485 Adobe Flash Player main.swf baseurl Parameter asfunction: Protocol Handler XSS

41484 Adobe Flash Player Unspecified Client Request Request Splitting

41483 Adobe Flash Player on Linux Memory Permission Weakness Local Privilege Escala...

41475 Adobe Flash Player ActionScript 3 (AS3) Crafted SWF Arbitrary Host Portscan

40766 Perl-Compatible Regular Expression (PCRE) Singleton Unicode Sequence Handling...

38128 Opera with Adobe Flash Player on Mac OS X Unspecified Issue

Flash Player contains an unspecified flaw when run in conjunction with the Opera web browser. No further details have been provided.

Information Assurance Vulnerability Management (IAVM)

Date Description
2008-01-23 IAVM : 2008-B-0011 - Multiple Adobe Dreamweaver CS3 and Adobe Acrobat Connect SWF Cross-Site Scrip...
Severity : Category II - VMSKEY : V0015694

Snort® IPS/IDS

Date Description
2014-01-10 ShockwaveFlash.ShockwaveFlash ActiveX clsid unicode access
RuleID : 7979 - Revision : 10 - Type : WEB-ACTIVEX
2014-01-10 ShockwaveFlash.ShockwaveFlash ActiveX clsid access
RuleID : 7978 - Revision : 15 - Type : BROWSER-PLUGINS
2014-01-10 Adobe Flash Player embedded JPG image height overflow attempt
RuleID : 28632 - Revision : 5 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player embedded JPG image height overflow attempt
RuleID : 28631 - Revision : 5 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player embedded JPG image height overflow attempt
RuleID : 27671 - Revision : 3 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player navigateToURL cross-site scripting attempt
RuleID : 17223 - Revision : 10 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player embedded JPG image width overflow attempt
RuleID : 13301 - Revision : 6 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player embedded JPG image height overflow attempt
RuleID : 13300 - Revision : 13 - Type : FILE-FLASH
2014-01-10 ShockwaveFlash.ShockwaveFlash ActiveX function call unicode access
RuleID : 13217 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10 ShockwaveFlash.ShockwaveFlash ActiveX function call access
RuleID : 13216 - Revision : 12 - Type : BROWSER-PLUGINS

Nessus® Vulnerability Scanner

Date Description
2013-01-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0980.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0945.nasl - Type : ACT_GATHER_INFO
2009-08-28 Name : The version of Adobe Acrobat on the remote Windows host is affected by multip...
File : adobe_acrobat_812.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0221.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2007-1126.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_flash-player-081107.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-211.nasl - Type : ACT_GATHER_INFO
2008-11-18 Name : The remote Windows host contains a runtime environment that is affected by mu...
File : adobe_air_apsb08-23.nasl - Type : ACT_GATHER_INFO
2008-11-12 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_flash-player-5757.nasl - Type : ACT_GATHER_INFO
2008-11-12 Name : The remote openSUSE host is missing a security update.
File : suse_flash-player-5747.nasl - Type : ACT_GATHER_INFO
2008-11-11 Name : The remote Windows host contains a browser plugin that is affected by multipl...
File : flash_player_apsb08-20.nasl - Type : ACT_GATHER_INFO
2008-10-20 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_78f456fd9c8711dda55e00163e000016.nasl - Type : ACT_GATHER_INFO
2008-05-29 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-003.nasl - Type : ACT_GATHER_INFO
2008-05-29 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_5_3.nasl - Type : ACT_GATHER_INFO
2008-05-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1570.nasl - Type : ACT_GATHER_INFO
2008-04-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200804-21.nasl - Type : ACT_GATHER_INFO
2008-04-17 Name : The remote openSUSE host is missing a security update.
File : suse_flash-player-5161.nasl - Type : ACT_GATHER_INFO
2008-04-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_flash-player-5159.nasl - Type : ACT_GATHER_INFO
2008-04-10 Name : The remote Windows host contains a browser plugin that is affected by multipl...
File : flash_player_apsb08-11.nasl - Type : ACT_GATHER_INFO
2008-03-19 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-002.nasl - Type : ACT_GATHER_INFO
2008-03-07 Name : The remote Fedora host is missing a security update.
File : fedora_2008-1842.nasl - Type : ACT_GATHER_INFO
2008-02-06 Name : The PDF file viewer on the remote Windows host is affected by multiple vulner...
File : adobe_reader_812.nasl - Type : ACT_GATHER_INFO
2008-01-21 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200801-07.nasl - Type : ACT_GATHER_INFO
2008-01-04 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_562cf6c4b9f111dca302000102cc8983.nasl - Type : ACT_GATHER_INFO
2007-12-24 Name : The remote openSUSE host is missing a security update.
File : suse_flash-player-4855.nasl - Type : ACT_GATHER_INFO
2007-12-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_flash-player-4856.nasl - Type : ACT_GATHER_INFO
2007-12-19 Name : The remote Windows host contains a browser plugin that is affected by multipl...
File : flash_player_apsb07-20.nasl - Type : ACT_GATHER_INFO
2007-12-18 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2007-009.nasl - Type : ACT_GATHER_INFO
2007-11-29 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-547-1.nasl - Type : ACT_GATHER_INFO
2007-11-26 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200711-30.nasl - Type : ACT_GATHER_INFO
2007-11-09 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-212.nasl - Type : ACT_GATHER_INFO
2007-11-07 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_bfd6eef48c9411dc8c55001c2514716c.nasl - Type : ACT_GATHER_INFO
2007-11-06 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1399.nasl - Type : ACT_GATHER_INFO