PT-2015-1235 · Adobe+3 · Flash Player+4

Published 2015-05-12 · Updated 2017-01-03 · CVE-2015-3077

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player (affected versions not specified) Adobe AIR (affected versions not specified) ALT Linux (affected versions not specified)

Description The issue is caused by accessing a resource through incompatible types, which can allow a remote attacker to execute arbitrary code by manipulating data types. This can potentially lead to remote code execution.

Recommendations For Adobe Flash Player, consider disabling access to incompatible types until a patch is available. For Adobe AIR, restrict the use of resources that can be accessed through incompatible types to minimize the risk of exploitation. For ALT Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2015-1438

BDU:2015-10198

BDU:2015-10199

BDU:2015-10200

CVE-2015-3077

MGASA-2015-0218

OPENSUSE-SU-2015_0914-1

RHSA-2015:1005

RHSA-2015_1005

SUSE-SU-2015:0878-1

Affected Products

Alt Linux

Air

Flash Player

Red Hat

Suse

References · 124

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_job_overflow.rb · Exploit
• https://bdu.fstec.ru/vul/2015-10208 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1438 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3091 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-3077 · Security Note
• https://bdu.fstec.ru/vul/2015-10206 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3078 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3084 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3081 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3077 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3093 · Security Note
• https://bdu.fstec.ru/vul/2015-10040 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3085 · Security Note
• https://bdu.fstec.ru/vul/2015-10223 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3044 · Security Note