PT-2015-1235 · Adobe+3 · Flash Player+4

Publicado 2015-05-12 · Atualizado 2017-01-03 · CVE-2015-3077

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player (affected versions not specified) Adobe AIR (affected versions not specified) ALT Linux (affected versions not specified)

Description The issue is caused by accessing a resource through incompatible types, which can allow a remote attacker to execute arbitrary code by manipulating data types. This can potentially lead to remote code execution.

Recommendations For Adobe Flash Player, consider disabling access to incompatible types until a patch is available. For Adobe AIR, restrict the use of resources that can be accessed through incompatible types to minimize the risk of exploitation. For ALT Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Enumeração de Fraquezas

CWE-843

Identificadores relacionados

ALT-PU-2015-1438

BDU:2015-10198

BDU:2015-10199

BDU:2015-10200

CVE-2015-3077

MGASA-2015-0218

OPENSUSE-SU-2015_0914-1

RHSA-2015:1005

RHSA-2015_1005

SUSE-SU-2015:0878-1

Produtos afetados

Alt Linux

Air

Flash Player

Red Hat

Suse

Referências · 124

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_job_overflow.rb · Exploit
• https://bdu.fstec.ru/vul/2015-10208 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2015-1438 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-3090 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3091 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2015-3077 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10206 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-3090.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3078 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=15916 · Nota
• https://access.redhat.com/security/cve/CVE-2015-3084 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3084 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-3093 · Nota
• https://access.redhat.com/security/cve/CVE-2015-3089 · Nota
• https://access.redhat.com/errata/RHSA-2015:1005 · Nota