Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309.

Versions of Adobe Flash player equal or prior to 16.0.0.235 are outdated and thus unpatched for the following vulnerabilities :

  - An unspecified improper file validation issue. (CVE-2015-0301)

  - An unspecified information disclosure vulnerability, which can be exploited to capture keystrokes. (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an attacker to execute arbitrary code. (CVE-2015-0303, CVE-2015-0306)

   - Multiple heap-based buffer overflow vulnerabilities that can be exploited to execute arbitrary code. (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be exploited to leak memory addresses. (CVE-2015-0307)

   - A use-after-free vulnerability that results in arbitrary code execution. (CVE-2015-0308)

Versions of Adobe Flash player equal or prior to 16.0.0.305 are outdated and thus unpatched for the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist due to improper input validation. A remote attacker could exploit these to execute arbitrary code (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339).
  - Multiple type confusion flaws exist, which an attacker could exploit to execute arbitrary code (CVE-2015-0334, CVE-2015-0336).
  - An unspecified flaw exists that allows an attacker to bypass cross-domain policy (CVE-2015-0337).
  - An integer overflow vulnerability exists due to improper input validation, which an attacker can exploit to execute arbitrary code (CVE-2015-0338).
  - An unspecified flaw exists that allows an attacker to bypass restrictions and upload arbitrary files (CVE-2015-0340).
  - Multiple use-after-free vulnerabilities exist that can allow an attacker to dereference memory which has already been freed and execute arbitrary code (CVE-2015-0341, CVE-2015-0342).
  - An unspecified improper file validation issue (CVE-2015-0301).
  - An unspecified information disclosure vulnerability, which can be exploited to capture keystrokes (CVE-2015-0302).
  - Multiple memory corruption vulnerabilities allow an attacker to execute arbitrary code (CVE-2015-0303, CVE-2015-0306).
   - Multiple heap-based buffer overflow vulnerabilities that can be exploited to execute arbitrary code (CVE-2015-0304, CVE-2015-0309).
  - An unspecified type confusion vulnerability that can lead to code execution (CVE-2015-0305).
  - An out-of-bounds read vulnerability that can be exploited to leak memory addresses (CVE-2015-0307).
   - A use-after-free vulnerability that results in arbitrary code execution (CVE-2015-0308).
  - An information disclosure vulnerability exists due to a flaw that can allow bypassing of memory randomization mitigations, aiding in further attacks (CVE-2015-0310).
  - A use-after-free error exists that allows an attacker to crash the application or execute arbitrary code (CVE-2015-0311).
  - A double-free error exists that allows an attacker to crash the application or possibly execute arbitrary code (CVE-2015-0312).
  - Several use-after-free errors exist that allow arbitrary code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).
  - Several memory corruption errors exist that allow arbitrary code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330).
  - Several type confusion errors exist that allow arbitrary code execution (CVE-2015-0317, CVE-2015-0319).
  - Several heap-based buffer overflow errors exist that allow arbitrary code execution (CVE-2015-0323, CVE-2015-0327).
  - A buffer overflow error exists that allows arbitrary code execution (CVE-2015-0324).
  - Several NULL pointer dereference errors exist that have unspecified impacts (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328).
  - A use-after-free error exists within the processing of invalid m3u8 playlists. A remote attacker, with a specially crafted m3u8 playlist file, can force a dangling pointer to be reused after it has been freed, allowing the execution of arbitrary code (CVE-2015-0331).

The remote host is affected by the vulnerability described in GLSA-201502-02 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Adobe Flash Player was updated to 11.2.202.440 (bsc#914463) :

  - APSA15-01, CVE-2015-0311

  - Update of flashplayer (executable binary) for i386 is     not available. This binary was disabled.

  - Security update to 11.2.202.438 (bsc#914333) :

  - APSB15-02, CVE-2015-0310

  - Security update to 11.2.202.429 (bsc#913057) :

  - APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303,     CVE-2015-0304, CVE-2015-0305, CVE-2015-0306,     CVE-2015-0307, CVE-2015-0308, CVE-2015-0309.

  - Disable flash player on machines without SSE2     (bnc#856386).

  - Remove outdated README and keep only up-to-date     readme.txt.

Adobe reports :

These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.

Adobe Flash Player was updated to fix several vulnerabilities.

More information can be found at http://helpx.adobe.com/security/products/flash-player/apsb15-01.html .

Adobe Flash Player was updated to 11.2.202.429 (bsc#913057) :

  - APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303,     CVE-2015-0304, CVE-2015-0305, CVE-2015-0306,     CVE-2015-0307, CVE-2015-0308, CVE-2015-0309.

  - Disable flash player on machines without SSE2     (bnc#856386).

More information can be found on http://helpx.adobe.com/security/products/flash-player/apsb15-01.html

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0052 advisory.

    The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash     Player web browser plug-in.

    This update fixes multiple vulnerabilities in Adobe Flash Player. These     vulnerabilities are detailed in the Adobe Security Bulletin APSB15-01,     listed in the References section.

    Multiple flaws were found in the way flash-plugin displayed certain SWF     content. An attacker could use these flaws to create a specially crafted     SWF file that would cause flash-plugin to crash or, potentially, execute     arbitrary code when the victim loaded a page containing the malicious SWF     content. (CVE-2015-0303, CVE-2015-0306, CVE-2015-0304, CVE-2015-0309,     CVE-2015-0305, CVE-2015-0308)

    This update also fixes multiple information disclosure flaws in     flash-plugin. (CVE-2015-0301, CVE-2015-0302, CVE-2015-0307)

    All users of Adobe Flash Player should install this updated package, which     upgrades Flash Player to version 11.2.202.429.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is missing KB3024663. It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which could be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities that allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that could be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that could     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that could be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that can result in     arbitrary code execution. (CVE-2015-0308)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 39.0.2171.99. It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which can be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that can be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that results in arbitrary     code execution. (CVE-2015-0308)

According to its version, the installation of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 16.0.0.235.
It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which can be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that can be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that results in arbitrary     code execution. (CVE-2015-0308)

According to its version, the Adobe AIR installed on the remote Mac OS X host is equal or prior to 15.0.0.356. It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which can be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that can be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that results in arbitrary     code execution. (CVE-2015-0308)

The version of Google Chrome installed on the remote Windows host is a version prior to 39.0.2171.99. It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which can be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that can be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that results in arbitrary     code execution. (CVE-2015-0308)

According to its version, the installation of Adobe Flash Player installed on the remote Windows host is equal or prior to 16.0.0.235.
It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which can be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that can be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that results in arbitrary     code execution. (CVE-2015-0308)

According to its version, the Adobe AIR installed on the remote Windows host is equal or prior to 15.0.0.356. It is, therefore, affected by the following vulnerabilities :

  - An unspecified improper file validation issue.
    (CVE-2015-0301)

  - An unspecified information disclosure vulnerability,     which can be exploited to capture keystrokes.
    (CVE-2015-0302)

  - Multiple memory corruption vulnerabilities allow an     attacker to execute arbitrary code. (CVE-2015-0303,     CVE-2015-0306)

  - Multiple heap-based buffer overflow vulnerabilities     that can be exploited to execute arbitrary code.
    (CVE-2015-0304, CVE-2015-0309)

  - An unspecified type confusion vulnerability that can     lead to code execution. (CVE-2015-0305)

  - An out-of-bounds read vulnerability that can be     exploited to leak memory addresses. (CVE-2015-0307)

  - A use-after-free vulnerability that results in arbitrary     code execution. (CVE-2015-0308)

ID	Name	Product	Family	Severity
8657	Flash Player <= 16.0.0.235 Multiple Vulnerabilities (APSB15-01)	Nessus Network Monitor	Web Clients	high
8655	Flash Player < 16.0.0.306 (inferred) Multiple Vulnerabilities (APSB15-01 through 05)	Nessus Network Monitor	Web Clients	high
81225	GLSA-201502-02 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
81098	openSUSE Security Update : flash-player (openSUSE-SU-2015:0174-1)	Nessus	SuSE Local Security Checks	critical
80924	FreeBSD : Adobe Flash Player -- multiple vulnerabilities (cc294a2c-a232-11e4-8e9f-0011d823eebd)	Nessus	FreeBSD Local Security Checks	critical
80565	SuSE 11.3 Security Update : flash-player (SAT Patch Number 10164)	Nessus	SuSE Local Security Checks	critical
80564	openSUSE Security Update : flash-player (openSUSE-SU-2015:0059-1)	Nessus	SuSE Local Security Checks	critical
80544	RHEL 5 / 6 : flash-plugin (RHSA-2015:0052)	Nessus	Red Hat Local Security Checks	high
80489	MS KB3024663: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	critical
80488	Google Chrome < 39.0.2171.99 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
80487	Flash Player For Mac <= 16.0.0.235 Multiple Vulnerabilities (APSB15-01)	Nessus	MacOS X Local Security Checks	critical
80486	Adobe AIR for Mac <= 15.0.0.356 Multiple Vulnerabilities (APSB15-01)	Nessus	MacOS X Local Security Checks	critical
80485	Google Chrome < 39.0.2171.99 Multiple Vulnerabilities	Nessus	Windows	critical
80484	Flash Player <= 16.0.0.235 Multiple Vulnerabilities (APSB15-01)	Nessus	Windows	critical
80483	Adobe AIR <= 15.0.0.356 Multiple Vulnerabilities (APSB15-01)	Nessus	Windows	critical

Detections

Analytics

CVE-2015-0304

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical