10

CVE-2015-5119

Warnung
Exploit

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Flash Player Version >= 13.0.0.182 <= 13.0.0296
   Apple ≫ macOS X Version-
   Microsoft ≫ Windows Version-
Adobe ≫ Flash Player Version >= 14.0.0.125 <= 18.0.0.194
   Apple ≫ macOS X Version-
   Microsoft ≫ Windows Version-
Adobe ≫ Flash Player Version <= 11.2.202.468
   Linux ≫ Linux Kernel Version-
Redhat ≫ Enterprise Linux Eus Version6.6
Opensuse ≫ Evergreen Version11.4
Opensuse ≫ Opensuse Version13.1
Opensuse ≫ Opensuse Version13.2
Suse ≫ Linux Enterprise Desktop Version11 Updatesp3
Suse ≫ Linux Enterprise Desktop Version11 Updatesp4
Suse ≫ Linux Enterprise Desktop Version12 Update-

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Adobe Flash Player Use-After-Free Vulnerability

Schwachstelle

A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.

Beschreibung

The impacted product is end-of-life and should be disconnected if still in use.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 93.27% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.kb.cert.org/vuls/id/561288
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/75568
Third Party Advisory
Broken Link
VDB Entry
http://www.securitytracker.com/id/1032809
Third Party Advisory
Broken Link
VDB Entry
http://www.us-cert.gov/ncas/alerts/TA15-195A
Third Party Advisory
US Government Resource