Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Vulnerability definitions for APSB17-07
Vulnerability definitions for APSB17-07.
- Loading branch information
Showing
3 changed files
with
135 additions
and
0 deletions.
There are no files selected for viewing
45 changes: 45 additions & 0 deletions
45
repository/definitions/vulnerability/oval_com.dtcc_def_669.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| <oval-def:definition xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" class="vulnerability" id="oval:com.dtcc:def:669" version="0"> | ||
| <oval-def:metadata> | ||
| <oval-def:title>Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability - CVE-2017-2997</oval-def:title> | ||
| <oval-def:affected family="windows"> | ||
| <oval-def:platform>Microsoft Windows Vista</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 7</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 8</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 8.1</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 10</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2003</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2008</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2008 R2</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2012</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2012 R2</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2016</oval-def:platform> | ||
| <oval-def:product>ActiveX Control</oval-def:product> | ||
| <oval-def:product>Adobe Flash Player</oval-def:product> | ||
| <oval-def:product>Pepper Flash</oval-def:product> | ||
| </oval-def:affected> | ||
| <oval-def:reference ref_id="CVE-2017-2997" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2997" source="CVE" /> | ||
| <oval-def:description>Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution.</oval-def:description> | ||
| <oval-def:oval_repository> | ||
| <oval-def:dates> | ||
| <oval-def:submitted date="2017-04-12T09:25:21+00:00"> | ||
| <oval-def:contributor organization="DTCC">Alexander Chua</oval-def:contributor> | ||
| </oval-def:submitted> | ||
| </oval-def:dates> | ||
| <oval-def:status>INITIAL SUBMISSION</oval-def:status> | ||
| </oval-def:oval_repository> | ||
| </oval-def:metadata> | ||
| <oval-def:criteria comment="Check for installation of vulnerable Adobe Flash Player + vulnerable file version" operator="OR"> | ||
| <oval-def:criteria comment="Adobe Flash Player is installed + version" operator="AND"> | ||
| <oval-def:extend_definition comment="Adobe Flash Player is installed" definition_ref="oval:org.mitre.oval:def:6700" /> | ||
| <oval-def:criterion comment="Check if Adobe Flash Player version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2801" /> | ||
| </oval-def:criteria> | ||
| <oval-def:criteria comment="Pepper Flash for Google Chrome version" operator="AND"> | ||
| <oval-def:extend_definition comment="Google Chrome is installed" definition_ref="oval:org.mitre.oval:def:11914" /> | ||
| <oval-def:criterion comment="Check if Pepper Flash for Google Chrome version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2799" /> | ||
| </oval-def:criteria> | ||
| <oval-def:criteria comment="ActiveX Control is installed + Flash*.ocx version" operator="AND"> | ||
| <oval-def:extend_definition comment="ActiveX Control is installed" definition_ref="oval:org.mitre.oval:def:26707" /> | ||
| <oval-def:criterion comment="Check if Flash*.ocx version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2800" /> | ||
| </oval-def:criteria> | ||
| </oval-def:criteria> | ||
| </oval-def:definition> |
45 changes: 45 additions & 0 deletions
45
repository/definitions/vulnerability/oval_com.dtcc_def_670.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| <oval-def:definition xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" class="vulnerability" id="oval:com.dtcc:def:670" version="0"> | ||
| <oval-def:metadata> | ||
| <oval-def:title>Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability - CVE-2017-2998</oval-def:title> | ||
| <oval-def:affected family="windows"> | ||
| <oval-def:platform>Microsoft Windows Vista</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 7</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 8</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 8.1</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 10</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2003</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2008</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2008 R2</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2012</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2012 R2</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2016</oval-def:platform> | ||
| <oval-def:product>ActiveX Control</oval-def:product> | ||
| <oval-def:product>Adobe Flash Player</oval-def:product> | ||
| <oval-def:product>Pepper Flash</oval-def:product> | ||
| </oval-def:affected> | ||
| <oval-def:reference ref_id="CVE-2017-2998" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2998" source="CVE" /> | ||
| <oval-def:description>Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.</oval-def:description> | ||
| <oval-def:oval_repository> | ||
| <oval-def:dates> | ||
| <oval-def:submitted date="2017-04-12T09:25:21+00:00"> | ||
| <oval-def:contributor organization="DTCC">Alexander Chua</oval-def:contributor> | ||
| </oval-def:submitted> | ||
| </oval-def:dates> | ||
| <oval-def:status>INITIAL SUBMISSION</oval-def:status> | ||
| </oval-def:oval_repository> | ||
| </oval-def:metadata> | ||
| <oval-def:criteria comment="Check for installation of vulnerable Adobe Flash Player + vulnerable file version" operator="OR"> | ||
| <oval-def:criteria comment="Adobe Flash Player is installed + version" operator="AND"> | ||
| <oval-def:extend_definition comment="Adobe Flash Player is installed" definition_ref="oval:org.mitre.oval:def:6700" /> | ||
| <oval-def:criterion comment="Check if Adobe Flash Player version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2801" /> | ||
| </oval-def:criteria> | ||
| <oval-def:criteria comment="Pepper Flash for Google Chrome version" operator="AND"> | ||
| <oval-def:extend_definition comment="Google Chrome is installed" definition_ref="oval:org.mitre.oval:def:11914" /> | ||
| <oval-def:criterion comment="Check if Pepper Flash for Google Chrome version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2799" /> | ||
| </oval-def:criteria> | ||
| <oval-def:criteria comment="ActiveX Control is installed + Flash*.ocx version" operator="AND"> | ||
| <oval-def:extend_definition comment="ActiveX Control is installed" definition_ref="oval:org.mitre.oval:def:26707" /> | ||
| <oval-def:criterion comment="Check if Flash*.ocx version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2800" /> | ||
| </oval-def:criteria> | ||
| </oval-def:criteria> | ||
| </oval-def:definition> |
45 changes: 45 additions & 0 deletions
45
repository/definitions/vulnerability/oval_com.dtcc_def_671.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| <oval-def:definition xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" class="vulnerability" id="oval:com.dtcc:def:671" version="0"> | ||
| <oval-def:metadata> | ||
| <oval-def:title>Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability - CVE-2017-2999</oval-def:title> | ||
| <oval-def:affected family="windows"> | ||
| <oval-def:platform>Microsoft Windows Vista</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 7</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 8</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 8.1</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows 10</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2003</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2008</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2008 R2</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2012</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2012 R2</oval-def:platform> | ||
| <oval-def:platform>Microsoft Windows Server 2016</oval-def:platform> | ||
| <oval-def:product>ActiveX Control</oval-def:product> | ||
| <oval-def:product>Adobe Flash Player</oval-def:product> | ||
| <oval-def:product>Pepper Flash</oval-def:product> | ||
| </oval-def:affected> | ||
| <oval-def:reference ref_id="CVE-2017-2999" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2999" source="CVE" /> | ||
| <oval-def:description>Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.</oval-def:description> | ||
| <oval-def:oval_repository> | ||
| <oval-def:dates> | ||
| <oval-def:submitted date="2017-04-12T09:25:21+00:00"> | ||
| <oval-def:contributor organization="DTCC">Alexander Chua</oval-def:contributor> | ||
| </oval-def:submitted> | ||
| </oval-def:dates> | ||
| <oval-def:status>INITIAL SUBMISSION</oval-def:status> | ||
| </oval-def:oval_repository> | ||
| </oval-def:metadata> | ||
| <oval-def:criteria comment="Check for installation of vulnerable Adobe Flash Player + vulnerable file version" operator="OR"> | ||
| <oval-def:criteria comment="Adobe Flash Player is installed + version" operator="AND"> | ||
| <oval-def:extend_definition comment="Adobe Flash Player is installed" definition_ref="oval:org.mitre.oval:def:6700" /> | ||
| <oval-def:criterion comment="Check if Adobe Flash Player version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2801" /> | ||
| </oval-def:criteria> | ||
| <oval-def:criteria comment="Pepper Flash for Google Chrome version" operator="AND"> | ||
| <oval-def:extend_definition comment="Google Chrome is installed" definition_ref="oval:org.mitre.oval:def:11914" /> | ||
| <oval-def:criterion comment="Check if Pepper Flash for Google Chrome version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2799" /> | ||
| </oval-def:criteria> | ||
| <oval-def:criteria comment="ActiveX Control is installed + Flash*.ocx version" operator="AND"> | ||
| <oval-def:extend_definition comment="ActiveX Control is installed" definition_ref="oval:org.mitre.oval:def:26707" /> | ||
| <oval-def:criterion comment="Check if Flash*.ocx version is less than 25.0.0.127" test_ref="oval:org.cisecurity:tst:2800" /> | ||
| </oval-def:criteria> | ||
| </oval-def:criteria> | ||
| </oval-def:definition> |