svn commit: r386219 - head/security/vuxml

Wed May 13 14:39:01 UTC 2015

Author: xmj
Date: Wed May 13 14:39:00 2015
New Revision: 386219
URL: https://svnweb.freebsd.org/changeset/ports/386219

Log:
  Document multiple vulnerabilities in www/linux-*-flashplugin11.
  
  Security:	CVE-2015-3044
  Security:	CVE-2015-3077
  Security:	CVE-2015-3078
  Security:	CVE-2015-3079
  Security:	CVE-2015-3080
  Security:	CVE-2015-3081
  Security:	CVE-2015-3082
  Security:	CVE-2015-3083
  Security:	CVE-2015-3084
  Security:	CVE-2015-3085
  Security:	CVE-2015-3086
  Security:	CVE-2015-3087
  Security:	CVE-2015-3088
  Security:	CVE-2015-3089
  Security:	CVE-2015-3090
  Security:	CVE-2015-3091
  Security:	CVE-2015-3092
  Security:	CVE-2015-3093

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Wed May 13 14:33:35 2015	(r386218)
+++ head/security/vuxml/vuln.xml	Wed May 13 14:39:00 2015	(r386219)
@@ -57,6 +57,99 @@ Notes:
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="e206df57-f97b-11e4-b799-c485083ca99c">
+    <topic>Adobe Flash Player -- critical vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>linux-c6-flashplugin11</name>
+	<range><le>11.2r202.457</le></range>
+      </package>
+      <package>
+	<name>linux-f10-flashplugin11</name>
+	<range><le>11.2r202.457</le></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Adobe reports:</p>
+	<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-09.html">
+	  <p>
+	   Adobe has released security updates for Adobe Flash Player for
+	   Windows, Macintosh and Linux. These updates address vulnerabilities
+	   that could potentially allow an attacker to take control of the
+	   affected system. Adobe recommends users update their product
+	   installations to the latest versions.
+	  </p>
+	  <p>
+	   These updates resolve memory corruption vulnerabilities that could
+	   lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090,
+	   CVE-2015-3093).
+	  </p>
+	  <p>
+	   These updates resolve a heap overflow vulnerability that could lead
+	   to code execution (CVE-2015-3088).
+	  </p>
+	  <p>
+	   These updates resolve a time-of-check time-of-use (TOCTOU) race
+	   condition that could be exploited to bypass Protected Mode in
+	   Internet Explorer (CVE-2015-3081).
+	  </p>
+	  <p>
+	   These updates resolve validation bypass issues that could be
+	   exploited to write arbitrary data to the file system under user
+	   permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
+	  </p>
+	  <p>
+	   These updates resolve an integer overflow vulnerability that could
+	   lead to code execution (CVE-2015-3087).
+	  </p>
+	  <p>
+	   These updates resolve a type confusion vulnerability that could lead
+	   to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
+	  </p>
+	  <p>
+	   These updates resolve a use-after-free vulnerability that could lead
+	   to code execution (CVE-2015-3080).
+	  </p>
+	  <p>
+	   These updates resolve memory leak vulnerabilities that could be used
+	   to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
+	  </p>
+	  <p>
+	   These updates resolve a security bypass vulnerability that could lead
+	   to information disclosure (CVE-2015-3079), and provide additional
+	   hardening to protect against CVE-2015-3044.
+	  </p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2015-3044</cvename>
+      <cvename>CVE-2015-3077</cvename>
+      <cvename>CVE-2015-3078</cvename>
+      <cvename>CVE-2015-3079</cvename>
+      <cvename>CVE-2015-3080</cvename>
+      <cvename>CVE-2015-3081</cvename>
+      <cvename>CVE-2015-3082</cvename>
+      <cvename>CVE-2015-3083</cvename>
+      <cvename>CVE-2015-3084</cvename>
+      <cvename>CVE-2015-3085</cvename>
+      <cvename>CVE-2015-3086</cvename>
+      <cvename>CVE-2015-3087</cvename>
+      <cvename>CVE-2015-3088</cvename>
+      <cvename>CVE-2015-3089</cvename>
+      <cvename>CVE-2015-3090</cvename>
+      <cvename>CVE-2015-3091</cvename>
+      <cvename>CVE-2015-3092</cvename>
+      <cvename>CVE-2015-3093</cvename>
+      <url>https://helpx.adobe.com/security/products/flash-player/apsb15-09.html</url>
+    </references>
+    <dates>
+      <discovery>2015-05-12</discovery>
+      <entry>2015-05-13</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="d9b43004-f5fd-4807-b1d7-dbf66455b244">
     <topic>mozilla -- multiple vulnerabilities</topic>
     <affects>
