远程 Windows 主机上安装的 Google Chrome 版本低于 43.0.2357.132。因而会受到 Adobe Flash 捆绑版本中多种漏洞的影响。

- 存在信息泄露漏洞，攻击者可利用此漏洞猜测 Flash 堆地址。(CVE-2015-3097)

- 存在多种基于堆的缓冲区溢出漏洞，可导致执行任意代码。
 （CVE-2015-3135、CVE-2015-4432、CVE-2015-5118）

- 存在多种内存损坏漏洞，可导致执行任意代码。（CVE-2015-3117、CVE-2015-3123、CVE-2015-3130、CVE-2015-3133、CVE-2015-3134、CVE-2015-4431）

- 存在多种空指针取消引用缺陷。
 （CVE-2015-3126、CVE-2015-4429）

- 存在一个安全绕过漏洞，可导致信息泄露。(CVE-2015-3114)

- 存在多种类型混淆漏洞，可导致执行任意代码。（CVE-2015-3119、CVE-2015-3120、CVE-2015-3121、CVE-2015-3122、CVE-2015-4433）

- 存在多种释放后使用错误，可导致执行任意代码。（CVE-2015-3118、CVE-2015-3124、CVE-2015-5117、CVE-2015-3127、CVE-2015-3128、CVE-2015-3129、CVE-2015-3131、CVE-2015-3132、CVE-2015-3136、CVE-2015-3137、CVE-2015-4428、CVE-2015-4430、CVE-2015-5119）

- 存在多种同源策略绕过漏洞，可导致信息泄露。（CVE-2014-0578、CVE-2015-3115、CVE-2015-3116、CVE-2015-3125、CVE-2015-5116）

- 由于对用户提供的输入验证不当，存在一个内存损坏问题。攻击者可利用此缺陷执行任意代码。(CVE-2015-5124)

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

更新 flash-player 以修复 35 个安全问题。

修复了这些安全问题：

- CVE-2015-3135、CVE-2015-4432、 CVE-2015-5118：可导致代码执行的堆缓冲区溢出漏洞 (bsc#937339)。

- CVE-2015-3117、CVE-2015-3123、CVE-2015-3130、CVE-2015-3133、CVE-2015-3134、CVE-2015-4431：可导致代码执行的内存损坏漏洞 (bsc#937339)。

- CVE-2015-3126、CVE-2015-4429：空指针取消引用问题 (bsc#937339)。

CVE-2015-3114：可造成信息泄露的安全绕过漏洞 (bsc#937339)。

- CVE-2015-3119、CVE-2015-3120、CVE-2015-3121、CVE-2015-3122、CVE-2015-4433：可导致代码执行的类型混淆漏洞 (bsc#937339)。

- CVE-2015-3118、CVE-2015-3124、CVE-2015-5117、CVE-2015-3127、CVE-2015-3128、CVE-2015-3129、CVE-2015-3131、CVE-2015-3132、CVE-2015-3136、CVE-2015-3137、CVE-2015-4428、CVE-2015-4430、CVE-2015-5119：可导致代码执行的释放后使用漏洞 (bsc#937339)。

- CVE-2014-0578、CVE-2015-3115、CVE-2015-3116、CVE-2015-3125、CVE-2015-5116：可被利用以绕过同源策略并导致信息泄露的漏洞 (bsc#937339)。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

Versions of Adobe Flash Player prior to 18.0.0.203 are outdated and thus unpatched for the following vulnerabilities :

  - An information disclosure vulnerability exists that allows an attacker to guess the address for the Flash heap. (CVE-2015-3097)
  - Multiple heap-based buffer overflow vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)
  - Multiple memory corruption vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431)
  - Multiple NULL pointer dereference flaws exist. (CVE-2015-3126, CVE-2015-4429)
  - A security bypass vulnerability exists that results in an information disclosure. (CVE-2015-3114)
  - Multiple type confusion vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)
  - Multiple use-after-free errors exist that allow arbitrary code execution. (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119)
  - Multiple same-origin policy bypass vulnerabilities exist that allow information disclosure. (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116)
  - A memory corruption issue exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-5124)

The version of Google Chrome OS on the remote mobile host is prior to 43.0.2357.132 and thus unpatched for the following vulnerabilities :

 - A use-after-free error exists in the opaqueBackground class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5122) 
 - A use-after-free error exists in the BitmapData class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5123) 
 - A flaw exists due to user-supplied input not being properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-5124) 
 - An information disclosure vulnerability exists that allows an attacker to guess the address for the Flash heap. (CVE-2015-3097) 
 - Multiple heap-based buffer overflow vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118) 
 - Multiple memory corruption vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431) 
 - Multiple NULL pointer dereference flaws exist. (CVE-2015-3126, CVE-2015-4429) 
 - A security bypass vulnerability exists that results in an information disclosure. (CVE-2015-3114) 
 - Multiple type confusion vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433) 
 - Multiple use-after-free errors exist that allow arbitrary code execution. (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119) 
 - Multiple same-origin policy bypass vulnerabilities exist that allow information disclosure. (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116) 
 - A memory corruption issue exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-5124)

Versions of Adobe AIR prior to 18.0.0.180 are outdated and thus unpatched for the following vulnerabilities :

 - An information disclosure vulnerability exists that allows an attacker to guess the address for the Flash heap. (CVE-2015-3097)
 - Multiple heap-based buffer overflow vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118)
 - Multiple memory corruption vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431)
 - Multiple NULL pointer dereference flaws exist. (CVE-2015-3126, CVE-2015-4429)
 - A security bypass vulnerability exists that results in an information disclosure. (CVE-2015-3114)
 - Multiple type confusion vulnerabilities exist that allow arbitrary code execution. (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433)
 - Multiple use-after-free errors exist that allow arbitrary code execution. (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119)
 - Multiple same-origin policy bypass vulnerabilities exist that allow information disclosure. (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116)
 - A memory corruption issue exists due to improper validation of user-supplied input. An attacker can exploit this to execute arbitrary code. (CVE-2015-5124)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
84667	Google Chrome < 43.0.2357.132 多种漏洞	Nessus	Windows	2015/7/10	2022/4/11	critical
84663	SUSE SLED11 安全更新：flash-player (SUSE-SU-2015:1214-1)	Nessus	SuSE Local Security Checks	2015/7/13	2022/3/8	critical
8821	Flash Player < 13.0.0.302 / 18.0.0.203 Multiple Vulnerabilities (APSB15-16)	Nessus Network Monitor	Web Clients	2015/7/24	2019/3/6	high
8886	Google Chrome OS < 43.0.2357.132 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2015/9/25	2019/3/6	critical
8858	Adobe AIR < 18.0.0.180 Multiple Vulnerabilities (APSB15-16)	Nessus Network Monitor	Web Clients	2015/9/11	2019/3/6	high

检测

插件搜索

critical

critical

high

critical

high