Bug 476328 (CVE-2013-3344)

Summary:	<www-plugins/adobe-flash-11.2.202.297 - multiple vulnerabilities (CVE-2013-{3344,3345,3347})
Product:	Gentoo Security	Reporter:	Jeroen Roovers (RETIRED) <jer>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	desktop-misc
Priority:	Normal	Keywords:	STABLEREQ
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://www.adobe.com/support/security/bulletins/apsb13-17.html
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=476520
Whiteboard:	A2 [glsa]
Package list:		Runtime testing required:	---

Description Jeroen Roovers (RETIRED) gentoo-dev

2013-07-09 23:25:40 UTC

Arch teams, please test and mark stable:
=www-plugins/adobe-flash-11.2.202.297
Stable KEYWORDS : amd64 x86

Comment 1 Agostino Sarubbo gentoo-dev

2013-07-10 05:17:27 UTC

amd64 stable

Comment 2 Agostino Sarubbo gentoo-dev

2013-07-10 05:18:14 UTC

x86 stable

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev

2013-07-10 10:50:24 UTC

Older versions removed, including the vulnerable 10* which reached EOL.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2013-08-27 03:29:48 UTC

CVE-2013-3347 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3347):
  Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before
  11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before
  11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x
  allows attackers to execute arbitrary code via PCM data that is not properly
  handled during resampling.

CVE-2013-3345 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3345):
  Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on
  Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on
  Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers
  to execute arbitrary code or cause a denial of service (memory corruption)
  via unspecified vectors.

CVE-2013-3344 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3344):
  Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and
  11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on
  Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on
  Android 4.x allows attackers to execute arbitrary code via unspecified
  vectors.

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2013-09-14 02:54:57 UTC

This issue was resolved and addressed in
 GLSA 201309-06 at http://security.gentoo.org/glsa/glsa-201309-06.xml
by GLSA coordinator Sean Amoss (ackle).