Adobe AIR for Mac <= 19.0.0.241 Multiple Vulnerabilities (APSB15-32)

Critical Nessus Plugin ID 87246

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 8.9

Synopsis

The remote Mac OS X host has a browser plugin installed that is affected by multiple vulnerabilities.

Description

The version of Adobe AIR installed on the remote Mac OS X host is equal or prior to version 19.0.0.241. It is, therefore, affected by multiple vulnerabilities :

- Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code.
(CVE-2015-8438, CVE-2015-8446)

- Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, CVE-2015-8820)

- Multiple security bypass vulnerabilities exist that allow an attacker to write arbitrary data to the file system under user permissions. (CVE-2015-8453, CVE-2015-8440, CVE-2015-8409)

- A stack buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2015-8407, CVE-2015-8457)

- A type confusion error exists that allows an attacker to execute arbitrary code. (CVE-2015-8439, CVE-2015-8456)

- An integer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2015-8445)

- A buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2015-8415)

- Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, CVE-2015-8821, CVE-2015-8822

Solution

Upgrade to Adobe AIR version 20.0.0.204 or later.

See Also

https://helpx.adobe.com/security/products/flash-player/apsb15-32.html

Plugin Details

Severity: Critical

ID: 87246

File Name: macosx_adobe_air_apsb15-32.nasl

Version: 1.13

Type: local

Agent: macosx

Published: 2015/12/08

Updated: 2019/11/20

Dependencies: 56960

Risk Information

Risk Factor: Critical

VPR Score: 8.9

CVSS Score Source: CVE-2015-8457

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:air

Required KB Items: MacOSX/Adobe_AIR/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2015/12/08

Vulnerability Publication Date: 2015/12/08

Reference Information

CVE: CVE-2015-8045, CVE-2015-8047, CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8054, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8060, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8407, CVE-2015-8408, CVE-2015-8409, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8415, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8438, CVE-2015-8439, CVE-2015-8440, CVE-2015-8441, CVE-2015-8442, CVE-2015-8443, CVE-2015-8444, CVE-2015-8445, CVE-2015-8446, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8451, CVE-2015-8452, CVE-2015-8453, CVE-2015-8454, CVE-2015-8455, CVE-2015-8456, CVE-2015-8457, CVE-2015-8652, CVE-2015-8653, CVE-2015-8654, CVE-2015-8655, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, CVE-2015-8820, CVE-2015-8821, CVE-2015-8822

BID: 78710, 78712, 78713, 78714, 78715, 78716, 78717, 78718, 78802

ZDI: ZDI-15-601, ZDI-15-602, ZDI-15-603, ZDI-15-604, ZDI-15-605, ZDI-15-606, ZDI-15-607, ZDI-15-608, ZDI-15-609, ZDI-15-610, ZDI-15-611, ZDI-15-612, ZDI-15-613, ZDI-15-614, ZDI-15-655, ZDI-15-656, ZDI-15-657, ZDI-15-658, ZDI-15-659, ZDI-15-660, ZDI-15-661, ZDI-15-662, ZDI-15-663, ZDI-15-664

EDB-ID: 39042, 39043, 39047, 39049, 39051, 39052, 39053, 39054, 39072