Red Hat Security Advisory

RHSA-2017:0526

flash-plugin security update

Released 2017-03-15 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Supplementary (v. 6) flash-plugin-25.0.0.127-1.el6_8
Red Hat Enterprise Linux Server Supplementary (v. 6) flash-plugin-25.0.0.127-1.el6_8
Red Hat Enterprise Linux Workstation Supplementary (v. 6) flash-plugin-25.0.0.127-1.el6_8

Fixes 8 records

TI-2017-02217 CVE-2017-2997 · GHSA-4vhw-m4wv-jrr8

Memory corruption in Adobe Flash Player 24.0.0.221 and earlier.

MEDIUM 48

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.07404 Published 2017-03-14 Partial fix CWE-119

TI-2017-02214 CVE-2017-2994 · GHSA-qjg3-fxfr-j85c

Use after free in Adobe Flash Player 24.0.0.194 and earlier.

MEDIUM 47

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.06262 Published 2017-02-15 Partial fix CWE-416

TI-2017-02223 CVE-2017-3003 · GHSA-3hf8-m65w-793g

Use after free in Adobe Flash Player 24.0.0.221 and earlier.

MEDIUM 46

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to an interaction between the privacy user interface and the ActionScript 2 Camera object.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05254 Published 2017-03-14 Partial fix CWE-416

TI-2017-02222 CVE-2017-3002 · GHSA-27h4-gxf8-4gg7

Use after free in Adobe Flash Player 24.0.0.221 and earlier.

MEDIUM 46

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability in the ActionScript2 TextField object related to the variable property.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05099 Published 2017-03-14 Partial fix CWE-416

TI-2017-02221 CVE-2017-3001 · GHSA-f273-f358-rg3v

Use after free in Adobe Flash Player 24.0.0.221 and earlier.

MEDIUM 46

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to garbage collection in the ActionScript 2 VM.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05099 Published 2017-03-14 Partial fix CWE-416

TI-2017-02219 CVE-2017-2999 · GHSA-ggwr-6xg7-m7g8

Out-of-bounds write in Adobe Flash Player 24.0.0.221 and earlier.

MEDIUM 45

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04101 Published 2017-03-14 Partial fix CWE-787

TI-2017-02218 CVE-2017-2998 · GHSA-9mf8-jm57-rfw8

Out-of-bounds write in Adobe Flash Player 24.0.0.221 and earlier.

MEDIUM 45

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04066 Published 2017-03-14 Partial fix CWE-787

TI-2017-02220 CVE-2017-3000 · GHSA-vh5p-gf3p-64qv

Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random…

MEDIUM 40

Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0836 Published 2017-03-14 Partial fix