Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Versions of Adobe AIR prior to 17.0.0.144 are outdated and thus unpatched for the following vulnerabilities :

 - Multiple memory corruption flaws exist due to improper validation of user-supplied input. An attacker can exploit these flaws to execute arbitrary code. (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)
 - Multiple type confusion flaws exist that allow an attacker to execute arbitrary code. (CVE-2015-0334, CVE-2015-0336)
 - A unspecified flaw exists that allows an attacker to bypass cross-domain policy. (CVE-2015-0337)
 - An integer overflow condition exists due improper validation of user-supplied input. An attacker can exploit to execute arbitrary code. (CVE-2015-0338)
 - A unspecified flaw exists that allows an attacker to bypass restrictions and upload arbitrary files. (CVE-2015-0340)
 - Multiple use-after-free errors exist that allow an attacker to dereference already freed memory and execute arbitrary code. (CVE-2015-0341, CVE-2015-0342)

According to its version, the installation of Adobe AIR on the remote Mac OS X host is equal or prior to 17.0.0.124. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption flaws exist due to improper     validation of user-supplied input. An attacker can     exploit these flaws to execute arbitrary code.
    (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,     CVE-2015-0339)

  - Multiple type confusions flaws exist that allow an     attacker to execute arbitrary code. (CVE-2015-0334,     CVE-2015-0336)

  - A unspecified flaw exists that allows an attacker to     bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow condition exists due improper     validation of user-supplied input. An attacker can     exploit to execute arbitrary code. (CVE-2015-0338)

  - A unspecified flaw exists that allows an attacker to     bypass restrictions and upload arbitrary files.
    (CVE-2015-0340)

  - Multiple use-after-free errors exist that allow an     attacker to deference already freed memory and execute     arbitrary code. (CVE-2015-0341, CVE-2015-0342)

According to its version, the installation of Adobe AIR on the remote Windows host is equal or prior to 17.0.0.124. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption flaws exist due to improper     validation of user-supplied input. An attacker can     exploit these flaws to execute arbitrary code.
    (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,     CVE-2015-0339)

  - Multiple type confusions flaws exist that allow an     attacker to execute arbitrary code. (CVE-2015-0334,     CVE-2015-0336)

  - A unspecified flaw exists that allows an attacker to     bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow condition exists due improper     validation of user-supplied input. An attacker can     exploit to execute arbitrary code. (CVE-2015-0338)

  - A unspecified flaw exists that allows an attacker to     bypass restrictions and upload arbitrary files.
    (CVE-2015-0340)

  - Multiple use-after-free errors exist that allow an     attacker to deference already freed memory and execute     arbitrary code. (CVE-2015-0341, CVE-2015-0342)

Adobe Flash Player was updated to 11.2.202.451 (bsc#922033).

These security issues were fixed :

  - Memory corruption vulnerabilities that could lead to     code execution (CVE-2015-0332, CVE-2015-0333,     CVE-2015-0335, CVE-2015-0339).

  - Type confusion vulnerabilities that could lead to code     execution (CVE-2015-0334, CVE-2015-0336).

  - A vulnerability that could lead to a cross-domain policy     bypass (CVE-2015-0337).

  - A vulnerability that could lead to a file upload     restriction bypass (CVE-2015-0340).

  - An integer overflow vulnerability that could lead to     code execution (CVE-2015-0338).

  - Use-after-free vulnerabilities that could lead to code     execution (CVE-2015-0341, CVE-2015-0342).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Adobe Flash player equal or prior to 16.0.0.305 are outdated and thus unpatched for the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist due to improper input validation. A remote attacker could exploit these to execute arbitrary code (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339).
  - Multiple type confusion flaws exist, which an attacker could exploit to execute arbitrary code (CVE-2015-0334, CVE-2015-0336).
  - An unspecified flaw exists that allows an attacker to bypass cross-domain policy (CVE-2015-0337).
  - An integer overflow vulnerability exists due to improper input validation, which an attacker can exploit to execute arbitrary code (CVE-2015-0338).
  - An unspecified flaw exists that allows an attacker to bypass restrictions and upload arbitrary files (CVE-2015-0340).
  - Multiple use-after-free vulnerabilities exist that can allow an attacker to dereference memory which has already been freed and execute arbitrary code (CVE-2015-0341, CVE-2015-0342).
  - An unspecified improper file validation issue (CVE-2015-0301).
  - An unspecified information disclosure vulnerability, which can be exploited to capture keystrokes (CVE-2015-0302).
  - Multiple memory corruption vulnerabilities allow an attacker to execute arbitrary code (CVE-2015-0303, CVE-2015-0306).
   - Multiple heap-based buffer overflow vulnerabilities that can be exploited to execute arbitrary code (CVE-2015-0304, CVE-2015-0309).
  - An unspecified type confusion vulnerability that can lead to code execution (CVE-2015-0305).
  - An out-of-bounds read vulnerability that can be exploited to leak memory addresses (CVE-2015-0307).
   - A use-after-free vulnerability that results in arbitrary code execution (CVE-2015-0308).
  - An information disclosure vulnerability exists due to a flaw that can allow bypassing of memory randomization mitigations, aiding in further attacks (CVE-2015-0310).
  - A use-after-free error exists that allows an attacker to crash the application or execute arbitrary code (CVE-2015-0311).
  - A double-free error exists that allows an attacker to crash the application or possibly execute arbitrary code (CVE-2015-0312).
  - Several use-after-free errors exist that allow arbitrary code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).
  - Several memory corruption errors exist that allow arbitrary code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330).
  - Several type confusion errors exist that allow arbitrary code execution (CVE-2015-0317, CVE-2015-0319).
  - Several heap-based buffer overflow errors exist that allow arbitrary code execution (CVE-2015-0323, CVE-2015-0327).
  - A buffer overflow error exists that allows arbitrary code execution (CVE-2015-0324).
  - Several NULL pointer dereference errors exist that have unspecified impacts (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328).
  - A use-after-free error exists within the processing of invalid m3u8 playlists. A remote attacker, with a specially crafted m3u8 playlist file, can force a dangling pointer to be reused after it has been freed, allowing the execution of arbitrary code (CVE-2015-0331).

Versions of Adobe Flash player prior to 17.0 are outdated and thus unpatched for the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist due to improper input validation. A remote attacker could exploit these to execute arbitrary code. (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)

  - Multiple type confusion flaws exist, which an attacker could exploit to execute arbitrary code. (CVE-2015-0334, CVE-2015-0336)

  - An unspecified flaw exists that allows an attacker to bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow vulnerability exists due to improper input validation, which an attacker can exploit to execute arbitrary code. (CVE-2015-0338)

  - An unspecified flaw exists that allows an attacker to bypass restrictions and upload arbitrary files. (CVE-2015-0340)

  - Multiple use-after-free vulnerabilities exist that can allow an attacker to dereference memory which has already been freed and execute arbitrary code. (CVE-2015-0341, CVE-2015-0342)

The remote host is affected by the vulnerability described in GLSA-201503-09 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or bypass       security restrictions.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0697 advisory.

  - flash-plugin: multiple code execution issues fixed in APSB15-05 (CVE-2015-0332, CVE-2015-0333,     CVE-2015-0334, CVE-2015-0335, CVE-2015-0336, CVE-2015-0338, CVE-2015-0339, CVE-2015-0341, CVE-2015-0342)

  - flash-plugin: cross-domain policy bypass (APSB15-05) (CVE-2015-0337)

  - flash-plugin: file upload restriction bypass (APSB15-05) (CVE-2015-0340)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

flash-player has been updated to fix eleven security vulnerabilities :

  - Multiple memory corruption issues exist due to not     properly validating user input, which an attacker can     exploit to execute arbitrary code. (CVE-2015-0332,     CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)

  - Multiple type confusions flaws exist, which an attacker     can exploit to execute arbitrary code. (CVE-2015-0334,     CVE-2015-0336)

  - An unspecified flaw exists that allows an attacker to     bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow condition exists due to not properly     validating user input, which an attacker can exploit to     execute arbitrary code. (CVE-2015-0338)

  - An unspecified flaw exists that allows an attacker to     bypass restrictions and upload arbitrary files.
    (CVE-2015-0340)

  - Multiple use-after-free errors exist that can allow an     attacker to deference already freed memory and execute     arbitrary code. (CVE-2015-0341, CVE-2015-0342)

Adobe Flash Player was updated to 11.2.202.451 (bsc#922033).

These security issues were fixed :

  - Memory corruption vulnerabilities that could lead to     code execution (CVE-2015-0332, CVE-2015-0333,     CVE-2015-0335, CVE-2015-0339).

  - Type confusion vulnerabilities that could lead to code     execution (CVE-2015-0334, CVE-2015-0336).

  - A vulnerability that could lead to a cross-domain policy     bypass (CVE-2015-0337).

  - A vulnerability that could lead to a file upload     restriction bypass (CVE-2015-0340).

  - An integer overflow vulnerability that could lead to     code execution (CVE-2015-0338).

  - Use-after-free vulnerabilities that could lead to code     execution (CVE-2015-0341, CVE-2015-0342).

Adobe reports :

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-0334, CVE-2015-0336). These updates resolve a vulnerability that could lead to a cross-domain policy bypass (CVE-2015-0337). These updates resolve a vulnerability that could lead to a file upload restriction bypass (CVE-2015-0340). These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-0338). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0341, CVE-2015-0342).

According to its version, the Adobe Flash Player installed on the remote Mac OS X host is equal or prior to version 16.0.0.305. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist due to not     properly validating user input, which an attacker can     exploit to execute arbitrary code. (CVE-2015-0332,     CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)

  - Multiple type confusions flaws exist, which an attacker     can exploit to execute arbitrary code. (CVE-2015-0334,     CVE-2015-0336)

  - An unspecified flaw exists that allows an attacker to     bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow condition exists due to not properly     validating user input, which an attacker can exploit to     execute arbitrary code. (CVE-2015-0338)

  - An unspecified flaw exists that allows an attacker to     bypass restrictions and upload arbitrary files.
    (CVE-2015-0340)

  - Multiple use-after-free errors exist that can allow an     attacker to deference already freed memory and execute     arbitrary code. (CVE-2015-0341, CVE-2015-0342)

According to its version, the Adobe Flash Player installed on the remote Windows host is equal or prior to version 16.0.0.305. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist due to not     properly validating user input, which an attacker can     exploit to execute arbitrary code. (CVE-2015-0332,     CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)

  - Multiple type confusions flaws exist, which an attacker     can exploit to execute arbitrary code. (CVE-2015-0334,     CVE-2015-0336)

  - An unspecified flaw exists that allows an attacker to     bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow condition exists due to not properly     validating user input, which an attacker can exploit to     execute arbitrary code. (CVE-2015-0338)

  - An unspecified flaw exists that allows an attacker to     bypass restrictions and upload arbitrary files.
    (CVE-2015-0340)

  - Multiple use-after-free errors exist that can allow an     attacker to deference already freed memory and execute     arbitrary code. (CVE-2015-0341, CVE-2015-0342)

The remote Windows host is missing KB3044132. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues exist due to not     properly validating user input, which an attacker can     exploit to execute arbitrary code. (CVE-2015-0332,     CVE-2015-0333, CVE-2015-0335, CVE-2015-0339)

  - Multiple type confusions flaws exist, which an attacker     can exploit to execute arbitrary code. (CVE-2015-0334,     CVE-2015-0336)

  - An unspecified flaw exists that allows an attacker to     bypass cross-domain policy. (CVE-2015-0337)

  - An integer overflow condition exists due to not properly     validating user input, which an attacker can exploit to     execute arbitrary code. (CVE-2015-0338)

  - An unspecified flaw exists that allows an attacker to     bypass restrictions and upload arbitrary files.
    (CVE-2015-0340)

  - Multiple use-after-free errors exist that can allow an     attacker to deference already freed memory and execute     arbitrary code. (CVE-2015-0341, CVE-2015-0342)

ID	Name	Product	Family	Severity
8823	Adobe AIR < 17.0.0.144 Multiple Vulnerabilities (APSB15-05)	Nessus Network Monitor	Web Clients	high
84159	Adobe AIR for Mac <= 17.0.0.124 Multiple Vulnerabilities (APSB15-05)	Nessus	MacOS X Local Security Checks	critical
84155	Adobe AIR <= 17.0.0.124 Multiple Vulnerabilities (APSB15-05)	Nessus	Windows	critical
83698	SUSE SLED12 Security Update : flash-player (SUSE-SU-2015:0491-1)	Nessus	SuSE Local Security Checks	critical
8655	Flash Player < 16.0.0.306 (inferred) Multiple Vulnerabilities (APSB15-01 through 05)	Nessus Network Monitor	Web Clients	high
8654	Flash Player < 17.0 Multiple Vulnerabilities (APSB15-05)	Nessus Network Monitor	Web Clients	high
82008	GLSA-201503-09 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
81908	RHEL 5 / 6 : flash-plugin (RHSA-2015:0697)	Nessus	Red Hat Local Security Checks	high
81877	SuSE 11.3 Security Update : flash-player (SAT Patch Number 10458)	Nessus	SuSE Local Security Checks	critical
81868	openSUSE Security Update : flash-player (openSUSE-2015-225)	Nessus	SuSE Local Security Checks	critical
81867	FreeBSD : Adobe Flash Player -- critical vulnerabilities (8b3ecff5-c9b2-11e4-b71f-00bd5af88c00)	Nessus	FreeBSD Local Security Checks	critical
81820	Flash Player For Mac <= 16.0.0.305 Multiple Vulnerabilities (APSB15-05)	Nessus	MacOS X Local Security Checks	critical
81819	Flash Player <= 16.0.0.305 Multiple Vulnerabilities (APSB15-05)	Nessus	Windows	critical
81732	MS KB3044132: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	critical

Detections

Analytics

CVE-2015-0338

high

Tenable Plugins

high

critical

critical

critical

high

high

critical

high

critical

critical

critical

critical

critical

critical