PT-2015-2661 · Adobe+3 · Flash Player+6
Bilou
·
Publicado
2015-11-10
·
Atualizado
2017-07-01
·
CVE-2015-7659
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Adobe Flash Player versions prior to 18.0.0.261
Adobe Flash Player versions 19.x prior to 19.0.0.245
Adobe AIR versions prior to 19.0.0.241
Adobe AIR SDK versions prior to 19.0.0.241
Adobe AIR SDK & Compiler versions prior to 19.0.0.241
Description
The issue is related to errors in data type mixing in Adobe Integrated Runtime and Flash Player, allowing a remote attacker to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation.
Recommendations
For Adobe Flash Player versions prior to 18.0.0.261, update to version 18.0.0.261 or later.
For Adobe Flash Player versions 19.x prior to 19.0.0.245, update to version 19.0.0.245 or later.
For Adobe AIR versions prior to 19.0.0.241, update to version 19.0.0.241 or later.
For Adobe AIR SDK versions prior to 19.0.0.241, update to version 19.0.0.241 or later.
For Adobe AIR SDK & Compiler versions prior to 19.0.0.241, update to version 19.0.0.241 or later.
As a temporary workaround, consider restricting access to the NetConnection object until a patch is available.
Correção
Type Confusion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Air
Air Sdk
Air Sdk & Compiler
Flash Player
Red Hat
Suse