310 lines
18 KiB
JSON
310 lines
18 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20142342",
|
|
"Version": "oval:org.altlinux.errata:def:20142342",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2014-2342: package `adobe-flash-player` update to version 11-alt35",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2014-2342",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2014-2342",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0573",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0573",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0574",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0574",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0576",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0576",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0577",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0577",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0581",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0581",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0582",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0582",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0583",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0583",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0584",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0584",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0585",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0585",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0586",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0586",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0588",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0588",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0589",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0589",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-0590",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-0590",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-8437",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-8437",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-8438",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-8438",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-8440",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-8440",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-8441",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-8441",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-8442",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-8442",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades adobe-flash-player to version 11-alt35. \nSecurity Fix(es):\n\n * CVE-2014-0573: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0588 and CVE-2014-8438.\n\n * CVE-2014-0574: Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.\n\n * CVE-2014-0576: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0581, CVE-2014-8440, and CVE-2014-8441.\n\n * CVE-2014-0577: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.\n\n * CVE-2014-0581: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-8440, and CVE-2014-8441.\n\n * CVE-2014-0582: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0589.\n\n * CVE-2014-0583: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to complete a transition from Low Integrity to Medium Integrity via unspecified vectors.\n\n * CVE-2014-0584: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2014-0577, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.\n\n * CVE-2014-0585: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0586, and CVE-2014-0590.\n\n * CVE-2014-0586: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0590.\n\n * CVE-2014-0588: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-8438.\n\n * CVE-2014-0589: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0582.\n\n * CVE-2014-0590: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0586.\n\n * CVE-2014-8437: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow remote attackers to discover session tokens via unspecified vectors.\n\n * CVE-2014-8438: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-0588.\n\n * CVE-2014-8440: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8441.\n\n * CVE-2014-8441: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8440.\n\n * CVE-2014-8442: Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allow attackers to complete a transition from Low Integrity to Medium Integrity by leveraging incorrect permissions.",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "Critical",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2014-11-12"
|
|
},
|
|
"Updated": {
|
|
"Date": "2014-11-12"
|
|
},
|
|
"BDUs": null,
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2014-0573",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0573",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0574",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-94",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0574",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0576",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0576",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0577",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-94",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0577",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0581",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0581",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0582",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0582",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0583",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0583",
|
|
"Impact": "High",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0584",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-94",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0584",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0585",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-94",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0585",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0586",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-94",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0586",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0588",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0588",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0589",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0589",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-0590",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-0590",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-8437",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
"CWE": "CWE-200",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-8437",
|
|
"Impact": "Low",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-8438",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-8438",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-8440",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-8440",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-8441",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-8441",
|
|
"Impact": "Critical",
|
|
"Public": "20141111"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-8442",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
|
"CWE": "CWE-264",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-8442",
|
|
"Impact": "High",
|
|
"Public": "20141111"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20142342001",
|
|
"Comment": "i586-mozilla-plugin-adobe-flash is earlier than 3:11.2.202.418-alt35"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20142342002",
|
|
"Comment": "mozilla-plugin-adobe-flash is earlier than 3:11.2.202.418-alt35"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |