Sign-up

ID

VAR-201603-0072


CVE

CVE-2015-8653


TITLE

Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-006962

DESCRIPTION

Adobe Flash Player and Adobe AIR Use freed memory (Use-after-free) May allow arbitrary code execution vulnerabilities. This vulnerability CVE-2015-8048 , CVE-2015-8049 , CVE-2015-8050 , CVE-2015-8055 , CVE-2015-8056 , CVE-2015-8057 , CVE-2015-8058 , CVE-2015-8059 , CVE-2015-8061 , CVE-2015-8062 , CVE-2015-8063 , CVE-2015-8064 , CVE-2015-8065 , CVE-2015-8066 , CVE-2015-8067 , CVE-2015-8068 , CVE-2015-8069 , CVE-2015-8070 , CVE-2015-8071 , CVE-2015-8401 , CVE-2015-8402 , CVE-2015-8403 , CVE-2015-8404 , CVE-2015-8405 , CVE-2015-8406 , CVE-2015-8410 , CVE-2015-8411 , CVE-2015-8412 , CVE-2015-8413 , CVE-2015-8414 , CVE-2015-8420 , CVE-2015-8421 , CVE-2015-8422 , CVE-2015-8423 , CVE-2015-8424 , CVE-2015-8425 , CVE-2015-8426 , CVE-2015-8427 , CVE-2015-8428 , CVE-2015-8429 , CVE-2015-8430 , CVE-2015-8431 , CVE-2015-8432 , CVE-2015-8433 , CVE-2015-8434 , CVE-2015-8435 , CVE-2015-8436 , CVE-2015-8437 , CVE-2015-8441 , CVE-2015-8442 , CVE-2015-8447 , CVE-2015-8448 , CVE-2015-8449 , CVE-2015-8450 , CVE-2015-8452 , CVE-2015-8454 , CVE-2015-8655 , CVE-2015-8821 ,and CVE-2015-8822 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlCrafted by attackers MPEG-4 An arbitrary code may be executed via the data. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within MPEG-4 parsing. A specially crafted MP4 file can force a dangling pointer to be reused after it has been freed. Adobe Flash Player, Adobe AIR SDK and Adobe AIR SDK & Compiler are all products of American Adobe (Adobe). A use-after-free vulnerability exists in several Adobe products. The following products and versions are affected: Adobe Flash Player Desktop Runtime 19.0.0.245 and earlier versions based on Windows and Macintosh platforms and Adobe Flash Player Extended Support Release 18.0.0.261 and earlier versions, Adobe Flash based on Windows, Macintosh, Linux and ChromeOS platforms Player for Google Chrome 19.0.0.245 and earlier, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 on Windows 10 19.0.0.245 and earlier, Adobe Flash Player for Internet Explorer 10 and 11 19.0 on Windows 8.0 and 8.1 .0.245 and earlier versions, Adobe Flash Player for Linux 11.2.202.548 and earlier versions based on Linux platforms, AIR Desktop Runtime 19.0.0.241 and earlier versions based on Windows and Macintosh platforms, AIR SDK based on Windows, Macintosh, Android and iOS platforms 19.0.0.241 and earlier versions and AIR SDK & Compiler 19.0.0

Trust: 1.44

sources: JVNDB: JVNDB-2015-006962 // ZDI: ZDI-15-657 // VULHUB: VHN-86614

AFFECTED PRODUCTS

vendor:adobemodel:air desktop runtimescope:lteversion:19.0.0.241

Trust: 1.0

vendor:adobemodel:air sdkscope:lteversion:19.0.0.241

Trust: 1.0

vendor:adobemodel:flash player desktop runtimescope:lteversion:19.0.0.245

Trust: 1.0

vendor:adobemodel:flash playerscope:lteversion:19.0.0.245

Trust: 1.0

vendor:adobemodel:airscope:lteversion:19.0.0.241

Trust: 1.0

vendor:adobemodel:air sdk \& compilerscope:lteversion:19.0.0.241

Trust: 1.0

vendor:adobemodel:flash playerscope:lteversion:11.2.202.548

Trust: 1.0

vendor:adobemodel:flash playerscope:lteversion:18.0.0.261

Trust: 1.0

vendor:googlemodel:chromescope:ltversion:47.0.2526.80 (windows/macintosh/linux/chrome os)

Trust: 0.8

vendor:adobemodel:airscope:ltversion:20.0.0.204 (android)

Trust: 0.8

vendor:adobemodel:airscope:ltversion:desktop runtime 20.0.0.204 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:air sdkscope:ltversion:20.0.0.204 (windows/macintosh/android/ios)

Trust: 0.8

vendor:adobemodel:air sdk & compilerscope:ltversion:20.0.0.204 (windows/macintosh/android/ios)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:11.2.202.554 (linux)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:20.0.0.228 (windows 10 edition microsoft edge/internet explorer 11)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:20.0.0.228 (windows 8.0 and 8.1 edition internet explorer 10/11)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:20.0.0.228 (windows/macintosh/linux/chromeos edition chrome)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:desktop runtime (firefox and safari support for ) 20.0.0.235 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:desktop runtime (internet explorer support for ) 20.0.0.228 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:flash playerscope:ltversion:continuous support release 18.0.0.268 (windows/macintosh)

Trust: 0.8

vendor:microsoftmodel:edgescope:eqversion:(windows 10)

Trust: 0.8

vendor:microsoftmodel:internet explorerscope:eqversion:10 (windows 8/windows server 2012/windows rt)

Trust: 0.8

vendor:microsoftmodel:internet explorerscope:eqversion:11 (windows 8.1/windows server 2012 r2/windows rt 8.1/windows 10)

Trust: 0.8

vendor:adobemodel:flashscope: - version: -

Trust: 0.7

vendor:adobemodel:flash playerscope:eqversion:20.0.0.286

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:19.0.0.245

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:19.0.0.207

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:19.0.0.185

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:20.0.0.228

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:18.0.0.261

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:19.0.0.226

Trust: 0.6

vendor:adobemodel:air sdkscope:eqversion:19.0.0.241

Trust: 0.6

vendor:adobemodel:flash playerscope:eqversion:20.0.0.235

Trust: 0.6

vendor:adobemodel:air sdk \\\& compilerscope:eqversion:19.0.0.241

Trust: 0.6

sources: ZDI: ZDI-15-657 // JVNDB: JVNDB-2015-006962 // CNNVD: CNNVD-201603-035 // NVD: CVE-2015-8653

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-8653
value: HIGH

Trust: 1.0

NVD: CVE-2015-8653
value: HIGH

Trust: 0.8

ZDI: CVE-2015-8653
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201603-035
value: HIGH

Trust: 0.6

VULHUB: VHN-86614
value: HIGH

Trust: 0.1

VULMON: CVE-2015-8653
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-8653
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

ZDI: CVE-2015-8653
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-86614
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-8653
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: ZDI: ZDI-15-657 // VULHUB: VHN-86614 // VULMON: CVE-2015-8653 // JVNDB: JVNDB-2015-006962 // CNNVD: CNNVD-201603-035 // NVD: CVE-2015-8653

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-86614 // JVNDB: JVNDB-2015-006962 // NVD: CVE-2015-8653

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201603-035

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201603-035

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006962

PATCH
title:APSB15-32url:https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
Trust: 1.5
title:APSB15-32url:https://helpx.adobe.com/jp/security/products/flash-player/apsb15-32.html
Trust: 0.8
title:Google Chromeurl:https://www.google.com/intl/ja/chrome/browser/features.html
Trust: 0.8
title:Stable Channel Updateurl:http://googlechromereleases.blogspot.jp/2015/12/stable-channel-update_8.html
Trust: 0.8
title:Stable Channel Update for Chrome OSurl:http://googlechromereleases.blogspot.jp/2015/12/stable-channel-update-for-chrome-os_9.html
Trust: 0.8
title:Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge (2755801)url:https://technet.microsoft.com/en-us/library/security/2755801
Trust: 0.8
title:Internet Explorer および Microsoft Edge 上の Adobe Flash Player の脆弱性に対応する更新プログラム (2755801)url:https://technet.microsoft.com/ja-jp/library/security/2755801
Trust: 0.8
title:アドビ システムズ社 Adobe Flash Player の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20151210f.html
Trust: 0.8
title:Multiple Adobe Remediation measures for reusing vulnerabilities after product releaseurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=60396
Trust: 0.6
title:Red Hat: Critical: flash-plugin security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20152593 - Security Advisory
Trust: 0.1
title:CVE-Studyurl:https://github.com/thdusdl1219/CVE-Study 
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-657 // 
            
            
            
            VULMON: CVE-2015-8653 // 
            
            
            
            JVNDB: JVNDB-2015-006962 // 
            
            
            
            CNNVD: CNNVD-201603-035

EXTERNAL IDS
db:NVDid:CVE-2015-8653
Trust: 3.3
db:ZDIid:ZDI-15-657
Trust: 2.5
db:BIDid:84162
Trust: 1.8
db:JVNDBid:JVNDB-2015-006962
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-3412
Trust: 0.7
db:CNNVDid:CNNVD-201603-035
Trust: 0.7
db:VULHUBid:VHN-86614
Trust: 0.1
db:VULMONid:CVE-2015-8653
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-657 // 
            
            
            
            VULHUB: VHN-86614 // 
            
            
            
            VULMON: CVE-2015-8653 // 
            
            
            
            JVNDB: JVNDB-2015-006962 // 
            
            
            
            CNNVD: CNNVD-201603-035 // 
            
            
            
            NVD: CVE-2015-8653

REFERENCES
url:https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
Trust: 2.5
url:http://www.securityfocus.com/bid/84162
Trust: 1.8
url:http://www.zerodayinitiative.com/advisories/zdi-15-657
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8653
Trust: 0.8
url:https://www.ipa.go.jp/security/ciadr/vul/20151209-adobeflashplayer.html
Trust: 0.8
url:https://www.jpcert.or.jp/at/2015/at150042.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8653
Trust: 0.8
url:https://www.npa.go.jp/cyberpolice/topics/?seq=17283
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/416.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2015:2593
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=42571
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-657 // 
            
            
            
            VULHUB: VHN-86614 // 
            
            
            
            VULMON: CVE-2015-8653 // 
            
            
            
            JVNDB: JVNDB-2015-006962 // 
            
            
            
            CNNVD: CNNVD-201603-035 // 
            
            
            
            NVD: CVE-2015-8653

CREDITS
AbdulAziz Hariri - HPE Zero Day Initiative
Trust: 0.7
sources:
            
            
            ZDI: ZDI-15-657

SOURCES
db:ZDIid:ZDI-15-657
db:VULHUBid:VHN-86614
db:VULMONid:CVE-2015-8653
db:JVNDBid:JVNDB-2015-006962
db:CNNVDid:CNNVD-201603-035
db:NVDid:CVE-2015-8653

LAST UPDATE DATE
2024-11-23T22:38:45.498000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-657date:2016-03-02T00:00:00
db:VULHUBid:VHN-86614date:2023-01-30T00:00:00
db:VULMONid:CVE-2015-8653date:2023-05-08T00:00:00
db:JVNDBid:JVNDB-2015-006962date:2016-03-08T00:00:00
db:CNNVDid:CNNVD-201603-035date:2023-02-01T00:00:00
db:NVDid:CVE-2015-8653date:2024-11-21T02:38:54.090

SOURCES RELEASE DATE
db:ZDIid:ZDI-15-657date:2016-03-02T00:00:00
db:VULHUBid:VHN-86614date:2016-03-04T00:00:00
db:VULMONid:CVE-2015-8653date:2016-03-04T00:00:00
db:JVNDBid:JVNDB-2015-006962date:2016-03-08T00:00:00
db:CNNVDid:CNNVD-201603-035date:2016-03-07T00:00:00
db:NVDid:CVE-2015-8653date:2016-03-04T23:59:01.797