PT-2015-1292 · Adobe+3 · Air Sdk & Compiler+6

Published 2015-06-09 · Updated 2016-12-31 · CVE-2015-3100

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.292 Adobe Flash Player versions 14.x through 18.x before 18.0.0.160 Adobe Flash Player version prior to 11.2.202.466 on Linux Adobe AIR versions prior to 18.0.0.144 on Windows Adobe AIR versions prior to 18.0.0.143 on OS X and Android Adobe AIR SDK versions prior to 18.0.0.144 on Windows Adobe AIR SDK versions prior to 18.0.0.143 on OS X Adobe AIR SDK & Compiler versions prior to 18.0.0.144 on Windows Adobe AIR SDK & Compiler versions prior to 18.0.0.143 on OS X

Description The issue is a stack-based buffer overflow that allows attackers to execute arbitrary code via unspecified vectors. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For Adobe Flash Player versions prior to 13.0.0.292, update to version 13.0.0.292 or later. For Adobe Flash Player versions 14.x through 18.x, update to version 18.0.0.160 or later. For Adobe Flash Player version prior to 11.2.202.466 on Linux, update to version 11.2.202.466 or later. For Adobe AIR versions prior to 18.0.0.144 on Windows, update to version 18.0.0.144 or later. For Adobe AIR versions prior to 18.0.0.143 on OS X and Android, update to version 18.0.0.143 or later. For Adobe AIR SDK versions prior to 18.0.0.144 on Windows, update to version 18.0.0.144 or later. For Adobe AIR SDK versions prior to 18.0.0.143 on OS X, update to version 18.0.0.143 or later. For Adobe AIR SDK & Compiler versions prior to 18.0.0.144 on Windows, update to version 18.0.0.144 or later. For Adobe AIR SDK & Compiler versions prior to 18.0.0.143 on OS X, update to version 18.0.0.143 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-1526

BDU:2015-10329

BDU:2015-10330

BDU:2015-10331

BDU:2015-10332

CVE-2015-3100

MGASA-2015-0248

OPENSUSE-SU-2015_1047-1

RHSA-2015:1086

RHSA-2015_1086

SUSE-SU-2015:1043-1

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

References · 124

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_drawing_fill.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3103 · Security Note
• https://bdu.fstec.ru/vul/2015-10915 · Security Note
• https://bdu.fstec.ru/vul/2015-10344 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0248 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10334 · Security Note
• https://bdu.fstec.ru/vul/2015-10909 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3100 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10898 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-3100 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:1043-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3099 · Security Note
• https://security.gentoo.org/glsa/201506-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10906 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3098 · Security Note