Adobe AIR <= 18.0.0.180 Multiple Vulnerabilities (APSB15-19)

This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.


Synopsis :

The remote Windows host has a version of Adobe AIR installed that is
affected by multiple vulnerabilities.

Description :

According to its version, the installation of Adobe AIR on the remote
Windows host is equal or prior to 18.0.0.180. It is, therefore,
affected by multiple vulnerabilities :

- Multiple type confusion errors exist that allow an
attacker to execute arbitrary code. (CVE-2015-5128,
CVE-2015-5554, CVE-2015-5555, CVE-2015-5558,
CVE-2015-5562)

- An unspecified vulnerability exists related to vector
length corruptions. (CVE-2015-5125)

- Multiple user-after-free errors exist that allow an
attacker to execute arbitrary code. (CVE-2015-5550,
CVE-2015-5551, CVE-2015-3107, CVE-2015-5556,
CVE-2015-5130, CVE-2015-5134, CVE-2015-5539,
CVE-2015-5540, CVE-2015-5557, CVE-2015-5559,
CVE-2015-5127, CVE-2015-5563, CVE-2015-5561,
CVE-2015-5564, CVE-2015-5565, CVE-2015-5566)

- Multiple heap buffer overflow conditions exist that
allow an attacker to execute arbitrary code.
(CVE-2015-5129, CVE-2015-5541)

- Multiple buffer overflow conditions exist that allow an
attacker to execute arbitrary code. (CVE-2015-5131,
CVE-2015-5132, CVE-2015-5133)

- Multiple memory corruption issues exist that allow an
attacker to execute arbitrary code. (CVE-2015-5544,
CVE-2015-5545, CVE-2015-5546, CVE-2015-5547,
CVE-2015-5548, CVE-2015-5549, CVE-2015-5552,
CVE-2015-5553)

- An integer overflow condition exists that allows an
attacker to execute arbitrary code. (CVE-2015-5560)

See also :

https://helpx.adobe.com/security/products/flash-player/apsb15-19.html

Solution :

Upgrade to Adobe AIR 18.0.0.199 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true