CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
7.7 | $0-$5k | 0.00 |
A vulnerability classified as critical was found in Adobe Flash Player (Multimedia Player Software). This vulnerability affects an unknown code. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
The weakness was published 12/28/2015 (Website). The advisory is available at helpx.adobe.com. This vulnerability was named CVE-2015-8634. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available.
It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 87656 (Adobe AIR <= 20.0.0.204 Multiple Vulnerabilities (APSB16-01)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows. The commercial vulnerability scanner Qualys is able to test this issue with plugin 168350 (OpenSuSE Security Update for flash-player (openSUSE-SU-2015:2400-1)).
Upgrading to version 18.0.0.324 eliminates this vulnerability.
The vulnerability is also documented in the databases at Exploit-DB (39221), Tenable (87656), SecurityFocus (BID 79701†) and Vulnerability Center (SBV-55409†). Similar entries are available at VDB-79926, VDB-79927, VDB-79931 and VDB-79932.
Product
Type
Vendor
Name
Version
- 3.2.0.207
- 3.5.0.1060
- 3.9.0.1010 SDK
- 3.9.0.1030
- 3.9.0.1060
- 3.9.0.1380
- 3.9.0.1380 SDK
- 4.0.0.1390
- 6.0.79
- 8
- 8.0.24.0
- 9
- 9.0.16.0
- 9.0.48.0
- 9.0.114.0
- 9.0.115.0
- 9.0.124.0
- 9.24
- 10
- 10.0.12.36
- 10.1.102.64
- 10.1.106.16
- 10.3.183.29
- 11
- 11.1.102.55
- 11.1.102.63
- 11.1.111.0
- 11.1.111.10
- 11.1.111.10 (Android 3.x)
- 11.1.111.19
- 11.1.111.24 (Android)
- 11.1.111.54 (Android 2.x-3.x)
- 11.1.111.64
- 11.1.115.9 (Android 4.x)
- 11.1.115.11
- 11.1.115.20
- 11.1.115.58 (Android 4.x)
- 11.1.115.69
- 11.2.202.235
- 11.2.202.236
- 11.2.202.236 (Linux)
- 11.2.202.238 (Linux)
- 11.2.202.238(Linux)
- 11.2.202.243
- 11.2.202.270
- 11.2.202.285
- 11.2.202.297
- 11.2.202.310
- 11.2.202.327
- 11.2.202.332
- 11.2.202.335
- 11.2.202.346
- 11.2.202.359
- 11.2.202.378 for Linu
- 11.2.202.418
- 11.2.202.424
- 11.2.202.460
- 11.2.202.466
- 11.2.202.481
- 11.2.202.491
- 11.2.202.508
- 11.2.202.521
- 11.2.202.535
- 11.2.202.548
- 11.2.202.554
- 11.2.202.569
- 11.2.202.577
- 11.2.202.621
- 11.2.202.632
- 11.2.202.635
- 11.2.202.637
- 11.2.202.644
- 11.3.300.257 (Windows)
- 11.3.300.271
- 11.4.402.265
- 11.4.402.265 (Windows, Mac)
- 11.4.402.265(Windows, Mac)
- 11.4.402.287
- 11.5.502.110 (Win
- 11.5.502.135
- 11.5.502.149
- 11.6.602.167
- 11.6.602.168
- 11.6.602.171
- 11.6.602.180
- 11.7.700.169
- 11.7.700.202
- 11.7.700.224
- 11.7.700.225
- 11.7.700.242
- 11.7.700.260
- 11.7.700.261
- 11.8.800.94
- 11.8.800.168
- 11.9.900.151
- 11.9.900.152
- 11.9.900.170
- 12.0.0.38
- 12.0.0.41
- 12.0.0.43
- 12.0.0.44
- 12.0.0.77
- 13.0.0.182
- 13.0.0.206
- 13.0.0.214
- 13.0.0.250
- 13.0.0.252
- 13.0.0.264
- 13.0.0.281
- 13.0.0.289
- 13.0.0.296
- 13.0.0.302
- 14.0.0.125
- 14.0.0.125 for Windows
- 14.0.0.137
- 14.0.0.145
- 14.0.0.178
- 15.0.0.167
- 15.0.0.189
- 15.0.0.223
- 15.0.0.239
- 15.0.0.258
- 16.0.0.235
- 16.0.0.257
- 16.0.0.287
- 16.0.0.296
- 17
- 17.0.0
- 17.0.0.134
- 17.0.0.169
- 17.0.0.188
- 18
- 18.0.0
- 18.0.0.160
- 18.0.0.194
- 18.0.0.203
- 18.0.0.204
- 18.0.0.209
- 18.0.0.232
- 18.0.0.240
- 18.0.0.241
- 18.0.0.252
- 18.0.0.261
- 18.0.0.268
License
Support
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.0VulDB Meta Temp Score: 7.7
VulDB Base Score: 7.3
VulDB Temp Score: 6.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 8.8
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Use after freeCWE: CWE-416 / CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 87656
Nessus Name: Adobe AIR <= 20.0.0.204 Multiple Vulnerabilities (APSB16-01)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
OpenVAS ID: 803490
OpenVAS Name: Adobe Air Multiple Vulnerabilities -01 Dec15 (Windows)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Flash Player 18.0.0.324
Fortigate IPS: 🔍
Timeline
12/23/2015 🔍12/28/2015 🔍
12/28/2015 🔍
12/28/2015 🔍
12/29/2015 🔍
12/29/2015 🔍
07/01/2022 🔍
Sources
Vendor: adobe.comAdvisory: RHSA-2015:2697
Status: Not defined
CVE: CVE-2015-8634 (🔍)
OVAL: 🔍
SecurityFocus: 79701
SecurityTracker: 1034544
Vulnerability Center: 55409 - [APSB16-01] Adobe Flash Player <20.0.0.267 Remote Code Execution - CVE-2015-8634, Critical
scip Labs: https://www.scip.ch/en/?labs.20161013
See also: 🔍
Entry
Created: 12/29/2015 01:22 PMUpdated: 07/01/2022 04:50 PM
Changes: 12/29/2015 01:22 PM (43), 01/27/2018 12:39 PM (28), 07/01/2022 04:34 PM (4), 07/01/2022 04:42 PM (11), 07/01/2022 04:50 PM (1)
Complete: 🔍
Cache ID: 44:2E6:40
No comments yet. Languages: en.
Please log in to comment.