PT-2015-2417 · Adobe+3 · Flash Player+6

Tokuji Akamine · Published 2015-10-14 · Updated 2017-07-01 · CVE-2015-7628

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 18.0.0.252 Adobe Flash Player versions 19.x prior to 19.0.0.207 Adobe Flash Player versions prior to 11.2.202.535 on Linux Adobe AIR versions prior to 19.0.0.213 Adobe AIR SDK versions prior to 19.0.0.213 Adobe AIR SDK & Compiler versions prior to 19.0.0.213

Description The issue is related to insufficient access control mechanisms in the Flash Player and Adobe Integrated Runtime platforms, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors. This can enable a remote attacker to circumvent existing restrictions and access protected information.

Recommendations For Adobe Flash Player versions prior to 18.0.0.252, update to version 18.0.0.252 or later. For Adobe Flash Player versions 19.x prior to 19.0.0.207, update to version 19.0.0.207 or later. For Adobe Flash Player versions prior to 11.2.202.535 on Linux, update to version 11.2.202.535 or later. For Adobe AIR versions prior to 19.0.0.213, update to version 19.0.0.213 or later. For Adobe AIR SDK versions prior to 19.0.0.213, update to version 19.0.0.213 or later. For Adobe AIR SDK & Compiler versions prior to 19.0.0.213, update to version 19.0.0.213 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2015-1873

BDU:2015-11782

CVE-2015-7628

MGASA-2015-0399

OPENSUSE-SU-2015_1744-1

RHSA-2015:1893

RHSA-2015:2024

RHSA-2015_1893

SUSE-SU-2015:1740-1

SUSE-SU-2015:1742-1

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

References · 110

• https://bdu.fstec.ru/vul/2015-11697 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7632 · Security Note
• https://bdu.fstec.ru/vul/2015-11788 · Security Note
• https://bdu.fstec.ru/vul/2015-11780 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-7628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7630 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7643 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7628 · Security Note
• https://bdu.fstec.ru/vul/2015-11789 · Security Note
• https://bdu.fstec.ru/vul/2016-00288 · Security Note
• https://helpx.adobe.com/security/products/flash-player/apsb15-25.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7628 · Vendor Advisory
• https://security.gentoo.org/glsa/201511-02 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7628 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html · Vendor Advisory