PT-2015-2661 · Adobe+3 · Flash Player+6
Bilou
·
Published
2015-11-10
·
Updated
2017-07-01
·
CVE-2015-7659
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Adobe Flash Player versions prior to 18.0.0.261
Adobe Flash Player versions 19.x prior to 19.0.0.245
Adobe AIR versions prior to 19.0.0.241
Adobe AIR SDK versions prior to 19.0.0.241
Adobe AIR SDK & Compiler versions prior to 19.0.0.241
Description
The issue is related to errors in data type mixing in Adobe Integrated Runtime and Flash Player, allowing a remote attacker to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation.
Recommendations
For Adobe Flash Player versions prior to 18.0.0.261, update to version 18.0.0.261 or later.
For Adobe Flash Player versions 19.x prior to 19.0.0.245, update to version 19.0.0.245 or later.
For Adobe AIR versions prior to 19.0.0.241, update to version 19.0.0.241 or later.
For Adobe AIR SDK versions prior to 19.0.0.241, update to version 19.0.0.241 or later.
For Adobe AIR SDK & Compiler versions prior to 19.0.0.241, update to version 19.0.0.241 or later.
As a temporary workaround, consider restricting access to the NetConnection object until a patch is available.
Fix
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Air
Air Sdk
Air Sdk & Compiler
Flash Player
Red Hat
Suse