CVE-2015-3113high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
References
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html
http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://rhn.redhat.com/errata/RHSA-2015-1184.html
http://www.securityfocus.com/bid/75371
http://www.securitytracker.com/id/1032696
https://bugzilla.redhat.com/show_bug.cgi?id=1235036
https://bugzilla.suse.com/show_bug.cgi?id=935701
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467
https://helpx.adobe.com/security/products/flash-player/apsb15-14.html
Vulnerable Software
Configuration 1
AND
OR
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*
OR
Configuration 2
AND
OR
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 86083 | GLSA-201507-13 : Adobe Flash Player: Multiple vulnerabilities (Underminer) | Nessus | Gentoo Local Security Checks | critical |
| 8820 | Flash Player < 13.0.0.296 / 18.0.0.194 RCE (APSB15-14) | Nessus Network Monitor | Web Clients | high |
| 84424 | SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1137-1) | Nessus | SuSE Local Security Checks | critical |
| 84416 | openSUSE Security Update : Adobe Flash Player (openSUSE-2015-450) | Nessus | SuSE Local Security Checks | critical |
| 84397 | SUSE SLED12 Security Update : flash-player (SUSE-SU-2015:1136-1) | Nessus | SuSE Local Security Checks | critical |
| 84391 | RHEL 5 / 6 : flash-plugin (RHSA-2015:1184) | Nessus | Red Hat Local Security Checks | critical |
| 84383 | FreeBSD : Adobe Flash Player -- critical vulnerabilities (d02f6b01-1a3f-11e5-8bd6-c485083ca99c) | Nessus | FreeBSD Local Security Checks | critical |
| 84367 | MS KB3074219: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer | Nessus | Windows | critical |
| 84366 | Adobe Flash Player <= 18.0.0.161 RCE (APSB15-14) (Mac OS X) | Nessus | MacOS X Local Security Checks | critical |
| 84365 | Adobe Flash Player <= 18.0.0.161 RCE (APSB15-14) | Nessus | Windows | critical |