Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 465534 - <www-plugins/adobe-flash-11.2.202.280 - multiple vulnerabilities (CVE-2013-{1378,1379,1380,2555})
Summary: <www-plugins/adobe-flash-11.2.202.280 - multiple vulnerabilities (CVE-2013-{1...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://www.adobe.com/support/security...
Whiteboard: B2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-11 14:32 UTC by Jeroen Roovers (RETIRED)
Modified: 2013-09-14 02:54 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jeroen Roovers (RETIRED) gentoo-dev 2013-04-11 14:32:08 UTC 
"These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system."
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2013-04-11 14:33:44 UTC 
Arch teams, please test and mark stable:
=www-plugins/adobe-flash-11.2.202.280
Stable KEYWORDS : amd64 x86
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2013-04-11 14:36:55 UTC 
CVE-2013-1380 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1380):
  Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on
  Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on
  Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on
  Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler
  before 3.7.0.1530 allow attackers to execute arbitrary code or cause a
  denial of service (memory corruption) via unspecified vectors, a different
  vulnerability than CVE-2013-1378.

CVE-2013-1379 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1379):
  Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on
  Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on
  Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on
  Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler
  before 3.7.0.1530 do not properly initialize pointer arrays, which allows
  attackers to execute arbitrary code or cause a denial of service (memory
  corruption) via unspecified vectors.

CVE-2013-1378 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1378):
  Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on
  Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on
  Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on
  Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler
  before 3.7.0.1530 allow attackers to execute arbitrary code or cause a
  denial of service (memory corruption) via unspecified vectors, a different
  vulnerability than CVE-2013-1380.
Comment 3 Agostino Sarubbo gentoo-dev 2013-04-11 21:42:24 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2013-04-11 21:44:06 UTC 
amd64 stable
Comment 5 Sean Amoss (RETIRED) gentoo-dev Security 2013-04-12 11:15:18 UTC 
Updated existing GLSA draft.
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2013-09-14 02:54:51 UTC 
This issue was resolved and addressed in
 GLSA 201309-06 at http://security.gentoo.org/glsa/glsa-201309-06.xml
by GLSA coordinator Sean Amoss (ackle).