PT-2015-3154 · Adobe+3 · Flash Player+6

Published

2015-12-28

·

Updated

2017-09-10

·

CVE-2015-8644

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 18.0.0.324 Adobe Flash Player versions 19.x and 20.x prior to 20.0.0.267 on Windows and OS X Adobe Flash Player versions prior to 11.2.202.559 on Linux Adobe AIR versions prior to 20.0.0.233 Adobe AIR SDK versions prior to 20.0.0.233 Adobe AIR SDK & Compiler versions prior to 20.0.0.233
Description The issue is related to a "type confusion" error, allowing attackers to execute arbitrary code. This can be exploited by a remote attacker due to the uncertainty of "type inconsistency".
Recommendations For Adobe Flash Player versions prior to 18.0.0.324, update to version 18.0.0.324 or later. For Adobe Flash Player versions 19.x and 20.x prior to 20.0.0.267 on Windows and OS X, update to version 20.0.0.267 or later. For Adobe Flash Player versions prior to 11.2.202.559 on Linux, update to version 11.2.202.559 or later. For Adobe AIR versions prior to 20.0.0.233, update to version 20.0.0.233 or later. For Adobe AIR SDK versions prior to 20.0.0.233, update to version 20.0.0.233 or later. For Adobe AIR SDK & Compiler versions prior to 20.0.0.233, update to version 20.0.0.233 or later.

Exploit

Fix

Type Confusion

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2015-2208
BDU:2016-00370
CVE-2015-8644
MGASA-2015-0493
OPENSUSE-SU-2015_2400-1
RHSA-2015:2697
RHSA-2015_2697
SUSE-SU-2015:2401-1
SUSE-SU-2015:2402-1

Affected Products

Alt Linux
Air
Air Sdk
Air Sdk & Compiler
Flash Player
Red Hat
Suse