Vulnerability CVE-2015-0306


Published: 2015-01-13   Modified: 2017-01-02

Description:
Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303.

Vendor: Adobe
Product: Flash player 
Version:
16.0.0.235
16.0.0.234
15.0.0.246
15.0.0.239
15.0.0.238
15.0.0.223
15.0.0.189
15.0.0.167
15.0.0.152
15.0.0.144
14.0.0.179
14.0.0.176
14.0.0.145
14.0.0.125
13.0.0.259
11.2.202.425
Product: Adobe air 
Version: 15.0.0.356;
Product: Adobe air sdk 
Version: 15.0.0.356;
Product: Adobe air sdk and compiler 
Version: 15.0.0.356;

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://helpx.adobe.com/security/products/flash-player/apsb15-01.html
http://secunia.com/advisories/62177
http://secunia.com/advisories/62187
http://security.gentoo.org/glsa/glsa-201502-02.xml
http://www.securityfocus.com/bid/72036
http://www.securitytracker.com/id/1031525
http://xforce.iss.net/xforce/xfdb/99984

Related CVE
CVE-2017-2996
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2992
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2993
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2994
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2995
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2988
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2990
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2991
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful exploitation could lead to arbitrary code execution.

Copyright 2017, cxsecurity.com