SynopsisThe remote Windows host has a version of Adobe AIR installed that is affected by multiple vulnerabilities.
DescriptionAccording to its version, the installation of Adobe AIR on the remote Windows host is equal or prior to 18.104.22.168. It is, therefore, affected by multiple vulnerabilities :
- An unspecified vulnerability exists that allows an attacker to bypass the fix for CVE-2014-5333.
- An unspecified memory address randomization flaw exists on Windows 7 64-bit. (CVE-2015-3097)
- Multiple unspecified flaws exist that allow a remote attacker to bypass the same-origin-policy, resulting in the disclosure of sensitive information. (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102)
- A remote code execution vulnerability exists due to an unspecified stack overflow flaw. (CVE-2015-3100)
- A permission flaw exists in the Flash broker for IE that allows an attacker to perform a privilege escalation. (CVE-2015-3101)
- Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107)
- An integer overflow condition exists due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-3104)
- A memory corruption flaw exists due to improper validation of user-supplied input. A remote attacker can exploit this flaw, via specially crafted flash content, to corrupt memory and execute arbitrary code.
- An unspecified memory leak exists that allows an attacker to bypass the Address Space Layout Randomization (ASLR) feature. (CVE-2015-3108)
SolutionUpgrade to Adobe AIR 22.214.171.124 or later.