Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

Versions of Adobe Flash player equal or prior to 16.0.0.296 are outdated and thus unpatched for the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary code execution. (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow arbitrary code execution. (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer overflow errors exist that allow arbitrary code execution. (CVE-2015-0323, CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary code execution. (CVE-2015-0324

  - Several NULL pointer dereference errors exist that have unspecified impacts. (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328).

  - A use-after-free error exists within the processing of invalid m3u8 playlists. A remote attacker, with a specially crafted m3u8 playlist file, can force a dangling pointer to be reused after it has been freed, allowing the execution of arbitrary code. (CVE-2015-0331)

Versions of Adobe Flash player equal or prior to 16.0.0.305 are outdated and thus unpatched for the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist due to improper input validation. A remote attacker could exploit these to execute arbitrary code (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339).
  - Multiple type confusion flaws exist, which an attacker could exploit to execute arbitrary code (CVE-2015-0334, CVE-2015-0336).
  - An unspecified flaw exists that allows an attacker to bypass cross-domain policy (CVE-2015-0337).
  - An integer overflow vulnerability exists due to improper input validation, which an attacker can exploit to execute arbitrary code (CVE-2015-0338).
  - An unspecified flaw exists that allows an attacker to bypass restrictions and upload arbitrary files (CVE-2015-0340).
  - Multiple use-after-free vulnerabilities exist that can allow an attacker to dereference memory which has already been freed and execute arbitrary code (CVE-2015-0341, CVE-2015-0342).
  - An unspecified improper file validation issue (CVE-2015-0301).
  - An unspecified information disclosure vulnerability, which can be exploited to capture keystrokes (CVE-2015-0302).
  - Multiple memory corruption vulnerabilities allow an attacker to execute arbitrary code (CVE-2015-0303, CVE-2015-0306).
   - Multiple heap-based buffer overflow vulnerabilities that can be exploited to execute arbitrary code (CVE-2015-0304, CVE-2015-0309).
  - An unspecified type confusion vulnerability that can lead to code execution (CVE-2015-0305).
  - An out-of-bounds read vulnerability that can be exploited to leak memory addresses (CVE-2015-0307).
   - A use-after-free vulnerability that results in arbitrary code execution (CVE-2015-0308).
  - An information disclosure vulnerability exists due to a flaw that can allow bypassing of memory randomization mitigations, aiding in further attacks (CVE-2015-0310).
  - A use-after-free error exists that allows an attacker to crash the application or execute arbitrary code (CVE-2015-0311).
  - A double-free error exists that allows an attacker to crash the application or possibly execute arbitrary code (CVE-2015-0312).
  - Several use-after-free errors exist that allow arbitrary code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).
  - Several memory corruption errors exist that allow arbitrary code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330).
  - Several type confusion errors exist that allow arbitrary code execution (CVE-2015-0317, CVE-2015-0319).
  - Several heap-based buffer overflow errors exist that allow arbitrary code execution (CVE-2015-0323, CVE-2015-0327).
  - A buffer overflow error exists that allows arbitrary code execution (CVE-2015-0324).
  - Several NULL pointer dereference errors exist that have unspecified impacts (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328).
  - A use-after-free error exists within the processing of invalid m3u8 playlists. A remote attacker, with a specially crafted m3u8 playlist file, can force a dangling pointer to be reused after it has been freed, allowing the execution of arbitrary code (CVE-2015-0331).

The version of Google Chrome installed on the remote Windows host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to the DOM component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8 JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service workers. (CVE-2015-1211)

  - Various unspecified errors exist. (CVE-2015-1212)

Numerous vulnerabilities affect the Adobe Flash Player plugin which is bundled with this version of Chrome :

  - Several use-after-free errors exist that allow arbitrary code execution. (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow arbitrary code execution. (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330)

  - Type confusion errors exist that allow arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Heap-based buffer overflow errors exist that allow arbitrary code execution. (CVE-2015-0323, CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary code execution. (CVE-2015-0324)

  - Several NULL pointer dereference errors exist that have unspecified impacts. (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328)

  - A use-after-free error exists within the processing of invalid m3u8 playlists. A remote attacker, with a specially crafted m3u8 playlist file, can force a dangling pointer to be reused after it has been freed, allowing the execution of arbitrary code. (CVE-2015-0331)

flash-player was updated to version 11.2.202.442 to fix 18 security issues.

These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313 / CVE-2015-0315 / CVE-2015-0320 / CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314 / CVE-2015-0316 / CVE-2015-0318 / CVE-2015-0321 / CVE-2015-0329 / CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317 / CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323 / CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - NULL pointer dereference issues.
(CVE-2015-0325 / CVE-2015-0326 / CVE-2015-0328)

More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html

flash-player was updated to version 11.2.202.442 to fix 18 security issues.

These security issues were fixed :

  - Use-after-free vulnerabilities that could lead to code     execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320,     CVE-2015-0322). 

  - Memory corruption vulnerabilities that could lead to     code execution (CVE-2015-0314, CVE-2015-0316,     CVE-2015-0318, CVE-2015-0321, CVE-2015-0329,     CVE-2015-0330). 

  - Type confusion vulnerabilities that could lead to code     execution (CVE-2015-0317, CVE-2015-0319). 

  - Heap buffer overflow vulnerabilities that could lead to     code execution (CVE-2015-0323, CVE-2015-0327). 

  - Buffer overflow vulnerability that could lead to code     execution (CVE-2015-0324). 

  - NULL pointer dereference issues (CVE-2015-0325,     CVE-2015-0326, CVE-2015-0328).

More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html

The remote host is missing KB3021953. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328)

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

The version of Google Chrome installed on the remote Mac OS X host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

The version of Google Chrome installed on the remote Windows host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

According to its version, the Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 16.0.0.296. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

According to its version, the Adobe Flash Player installed on the remote Windows host is equal or prior to 16.0.0.296. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

ID	Name	Product	Family	Severity
8660	Flash Player <= 16.0.0.296 Multiple Vulnerabilities (APSB15-04)	Nessus Network Monitor	Web Clients	high
8655	Flash Player < 16.0.0.306 (inferred) Multiple Vulnerabilities (APSB15-01 through 05)	Nessus Network Monitor	Web Clients	high
8582	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
81245	SuSE 11.3 Security Update : flash-player, flash-player-gnome, flash-player-kde4 (SAT Patch Number 10287)	Nessus	SuSE Local Security Checks	critical
81243	openSUSE Security Update : flash-player (openSUSE-2015-118)	Nessus	SuSE Local Security Checks	critical
81209	MS KB3021953: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	critical
81208	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
81207	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities	Nessus	Windows	critical
81128	Flash Player For Mac <= 16.0.0.296 Unspecified Code Execution (APSA15-02 / APSB15-04)	Nessus	MacOS X Local Security Checks	critical
81127	Flash Player <= 16.0.0.296 Unspecified Code Execution (APSA15-02 / APSB15-04)	Nessus	Windows	critical

Detections

Analytics

CVE-2015-0313

critical

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

critical

critical