Flash Player < 13.0.0.305 / 18.0.0.209 Multiple RCE (APSB15-18)
high Nessus Network Monitor Plugin ID 8822
Synopsis
The remote host is running an outdated version of Adobe Flash Player for Internet Explorer that is affected by multiple remote code execution vulnerabilities.Description
Versions of Adobe Flash Player prior to 18.0.0.209 are outdated and thus unpatched for the following vulnerabilities :- A use-after-free error exists in the opaqueBackground class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5122)
- A use-after-free error exists in the BitmapData class in the ActionScript 3 (AS3) implementation. A remote attacker, via specially crafted Flash content, can dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-5123)
Solution
Upgrade to Adobe Flash Player version 18.0.0.209 or later. If 18.x cannot be obtained, 13.0.0.305 has also been patched for these vulnerabilities.See Also
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html
Plugin Details
Severity: High
ID: 8822
Family: Web Clients
Published: 7/24/2015
Updated: 3/6/2019
Risk Information
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:F/RL:OF/RC:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:adobe:flash_player
Patch Publication Date: 7/14/2015
Vulnerability Publication Date: 7/14/2015
Exploitable With
Core Impact
Metasploit (Adobe Flash opaqueBackground Use After Free)
Reference Information
CVE: CVE-2015-5122, CVE-2015-5123
IAVA: 2015-A-0132