The version of Adobe AIR installed on the remote Mac OS X host is equal or prior to version 18.0.0.199. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified stack corruption issue exists that     allows a remote attacker to execute arbitrary code.
    (CVE-2015-5567, CVE-2015-5579)

  - A vector length corruption issue exists that allows a     remote attacker to have an unspecified impact.
    (CVE-2015-5568)

  - A use-after-free error exists in an unspecified     component due to improperly sanitized user-supplied     input. A remote attacker can exploit this, via a     specially crafted file, to deference already freed     memory and execute arbitrary code. (CVE-2015-5570,     CVE-2015-5574, CVE-2015-5581, CVE-2015-5584,     CVE-2015-6682)

  - An unspecified flaw exists due to a failure to reject     content from vulnerable JSONP callback APIs. A remote     attacker can exploit this to have an unspecified impact.
    (CVE-2015-5571)

  - An unspecified flaw exists that allows a remote attacker     to bypass security restrictions and gain access to     sensitive information. (CVE-2015-5572)

  - An unspecified type confusion flaw exists that allows a     remote attacker to execute arbitrary code.
    (CVE-2015-5573)

  - A flaw exists in an unspecified component due to     improper validation of user-supplied input when handling     a specially crafted file. A remote attacker can exploit     this to corrupt memory, resulting in a denial of service     or the execution of arbitrary code. (CVE-2015-5575,     CVE-2015-5577, CVE-2015-5578, CVE-2015-5580,     CVE-2015-5582, CVE-2015-5588, CVE-2015-6677)

  - A memory leak issue exists that allows a remote     attacker to have an unspecified impact. (CVE-2015-5576)

  - A stack buffer overflow condition exists due to improper     validation of user-supplied input. A remote attacker can     exploit this to execute arbitrary code. (CVE-2015-5587)

  - An unspecified overflow condition exists due to improper     validation of user-supplied input. A remote attacker can     exploit this to execute arbitrary code. (CVE-2015-6676,     CVE-2015-6678)

  - An unspecified flaw exists that allows a remote attacker     to bypass same-origin policy restrictions and gain     access to sensitive information. (CVE-2015-6679)

The remote Windows host is missing KB3087040. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified stack corruption issue exists that     allows a remote attacker to execute arbitrary code.
    (CVE-2015-5567, CVE-2015-5579)

  - A vector length corruption issue exists that allows a     remote attacker to have an unspecified impact.
    (CVE-2015-5568)

  - A use-after-free error exists in an unspecified     component due to improperly sanitized user-supplied     input. A remote attacker can exploit this, via a     specially crafted file, to deference already freed     memory and execute arbitrary code. (CVE-2015-5570,     CVE-2015-5574, CVE-2015-5581, CVE-2015-5584,     CVE-2015-6682)

  - An unspecified flaw exists due to a failure to reject     content from vulnerable JSONP callback APIs. A remote     attacker can exploit this to have an unspecified impact.
    (CVE-2015-5571)

  - An unspecified flaw exists that allows a remote attacker     to bypass security restrictions and gain access to     sensitive information. (CVE-2015-5572)

  - An unspecified type confusion flaw exists that allows a     remote attacker to execute arbitrary code.
    (CVE-2015-5573)

  - A flaw exists in an unspecified component due to     improper validation of user-supplied input when handling     a specially crafted file. A remote attacker can exploit     this to corrupt memory, resulting in a denial of service     or the execution of arbitrary code. (CVE-2015-5575,     CVE-2015-5577, CVE-2015-5578, CVE-2015-5580,     CVE-2015-5582, CVE-2015-5588, CVE-2015-6677)

  - A memory leak issue exists that allows a remote     attacker to have an unspecified impact. (CVE-2015-5576)

  - A stack buffer overflow condition exists due to improper     validation of user-supplied input. A remote attacker can     exploit this to execute arbitrary code. (CVE-2015-5587)

  - An unspecified overflow condition exists due to improper     validation of user-supplied input. A remote attacker can     exploit this to execute arbitrary code. (CVE-2015-6676,     CVE-2015-6678)

  - An unspecified flaw exists that allows a remote attacker     to bypass same-origin policy restrictions and gain     access to sensitive information. (CVE-2015-6679)

The remote host is affected by the vulnerability described in GLSA-201509-07 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Adobe AIR installed on the remote Windows host is equal or prior to version 18.0.0.199. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified stack corruption issue exists that     allows a remote attacker to execute arbitrary code.
    (CVE-2015-5567, CVE-2015-5579)

  - A vector length corruption issue exists that allows a     remote attacker to have an unspecified impact.
    (CVE-2015-5568)

  - A use-after-free error exists in an unspecified     component due to improperly sanitized user-supplied     input. A remote attacker can exploit this, via a     specially crafted file, to deference already freed     memory and execute arbitrary code. (CVE-2015-5570,     CVE-2015-5574, CVE-2015-5581, CVE-2015-5584,     CVE-2015-6682)

  - An unspecified flaw exists due to a failure to reject     content from vulnerable JSONP callback APIs. A remote     attacker can exploit this to have an unspecified impact.
    (CVE-2015-5571)

  - An unspecified flaw exists that allows a remote attacker     to bypass security restrictions and gain access to     sensitive information. (CVE-2015-5572)

  - An unspecified type confusion flaw exists that allows a     remote attacker to execute arbitrary code.
    (CVE-2015-5573)

  - A flaw exists in an unspecified component due to     improper validation of user-supplied input when handling     a specially crafted file. A remote attacker can exploit     this to corrupt memory, resulting in a denial of service     or the execution of arbitrary code. (CVE-2015-5575,     CVE-2015-5577, CVE-2015-5578, CVE-2015-5580,     CVE-2015-5582, CVE-2015-5588, CVE-2015-6677)

  - A memory leak issue exists that allows a remote     attacker to have an unspecified impact. (CVE-2015-5576)

  - A stack buffer overflow condition exists due to improper     validation of user-supplied input. A remote attacker can     exploit this to execute arbitrary code. (CVE-2015-5587)

  - An unspecified overflow condition exists due to improper     validation of user-supplied input. A remote attacker can     exploit this to execute arbitrary code. (CVE-2015-6676,     CVE-2015-6678)

  - An unspecified flaw exists that allows a remote attacker     to bypass same-origin policy restrictions and gain     access to sensitive information. (CVE-2015-6679)

Adobe reports :

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-5573).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-6676, CVE-2015-6678).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, CVE-2015-6677).

These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs (CVE-2015-5571).

These updates resolve a memory leak vulnerability (CVE-2015-5576).

These updates include further hardening to a mitigation to defend against vector length corruptions (CVE-2015-5568).

These updates resolve stack corruption vulnerabilities that could lead to code execution (CVE-2015-5567, CVE-2015-5579).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-5587).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-5572).

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-6679).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86062	Adobe AIR for Mac <= 18.0.0.199 Multiple Vulnerabilities (APSB15-23)	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical
86065	MS KB3087040: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge	Nessus	Windows	2015/9/22	2019/11/22	critical
91735	GLSA-201509-07 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/6/22	2021/1/11	critical
86059	Adobe AIR <= 18.0.0.199 Multiple Vulnerabilities (APSB15-23)	Nessus	Windows	2015/9/22	2022/4/11	critical
86188	FreeBSD : flash -- multiple vulnerabilities (4e3e8a50-65c1-11e5-948e-bcaec565249c)	Nessus	FreeBSD Local Security Checks	2015/9/29	2021/1/6	critical

检测

插件搜索

critical

critical

critical

critical

critical