Vulnerability CVE-2015-0307


Published: 2015-01-13

Description:
Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.

Vendor: Adobe
Product: Flash player 
Version:
16.0.0.235
16.0.0.234
15.0.0.246
15.0.0.239
15.0.0.238
15.0.0.223
15.0.0.189
15.0.0.167
15.0.0.152
15.0.0.144
14.0.0.179
14.0.0.176
14.0.0.145
14.0.0.125
13.0.0.259
11.2.202.425
Product: Adobe air 
Version: 15.0.0.356;
Product: Adobe air sdk and compiler 
Version: 15.0.0.356;
Product: Adobe air sdk 
Version: 15.0.0.356;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
8.5/10
7.8/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
Complete

 References:
http://helpx.adobe.com/security/products/flash-player/apsb15-01.html
http://secunia.com/advisories/62177
http://secunia.com/advisories/62187
http://security.gentoo.org/glsa/glsa-201502-02.xml
http://www.securityfocus.com/bid/72037
http://www.securitytracker.com/id/1031525
https://exchange.xforce.ibmcloud.com/vulnerabilities/99988

Related CVE
CVE-2018-4990
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current us...
CVE-2018-4994
Adobe Connect versions 9.7.5 and earlier have an exploitable Authentication Bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-4992
Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper input validation vulnerability. Successful exploitation could lead to local privilege escalation.
CVE-2018-4991
Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Improper certificate validation vulnerability. Successful exploitation could lead to a security bypass.
CVE-2018-4944
Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-4943
Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. Successful exploitation could lead to JavaScript code execution in the context of the PhoneGap app.
CVE-2018-4942
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.
CVE-2018-4941
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.

Copyright 2018, cxsecurity.com

 

Back to Top