ID

VAR-201506-0085

CVE

CVE-2015-3101

TITLE

Adobe Flash Player and Adobe AIR of Flash Broker integrity level "Low" From "During" Vulnerabilities migrated to

DESCRIPTION

The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors. This vulnerability CVE-2015-3098 and CVE-2015-3102 Is a different vulnerability.An attacker could move the integrity level from low to medium. Attackers can exploit this issue to gain elevated privileges within the application. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201506-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Adobe Flash Player: Multiple vulnerabilities Date: June 21, 2015 Bugs: #551658 ID: 201506-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Adobe Flash Player, the worst of which allows remote attackers to execute arbitrary code. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-plugins/adobe-flash < 11.2.202.466 >= 11.2.202.466 Description =========== Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.466" References ========== [ 1 ] CVE-2015-3096 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3096 [ 2 ] CVE-2015-3097 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3097 [ 3 ] CVE-2015-3098 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3098 [ 4 ] CVE-2015-3099 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3099 [ 5 ] CVE-2015-3100 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3100 [ 6 ] CVE-2015-3101 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3101 [ 7 ] CVE-2015-3102 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3102 [ 8 ] CVE-2015-3103 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3103 [ 9 ] CVE-2015-3104 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3104 [ 10 ] CVE-2015-3105 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3105 [ 11 ] CVE-2015-3106 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3106 [ 12 ] CVE-2015-3107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3107 [ 13 ] CVE-2015-3108 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3108 [ 14 ] CVE-2015-4472 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4472 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201506-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

permissions and access control

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Behrang Fouladi Azarnaminy and Axel Souchet of the 360 Vulcan Team.

SOURCES

LAST UPDATE DATE

2024-11-23T21:14:29.772000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE