Adobe Flash Player TextField use after free

Summaryinfo

A vulnerability, which was classified as critical, was found in Adobe Flash Player. The affected element is an unknown function of the component TextField Handler. The manipulation results in use after free. This vulnerability is known as CVE-2015-8823. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Adobe Flash Player (Multimedia Player Software) (affected version not known). It has been classified as critical. Affected is some unknown functionality of the component TextField Handler. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted text property, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, CVE-2015-8821, and CVE-2015-8822.

The weakness was published 04/22/2016 (Website). The advisory is available at zerodayinitiative.com. This vulnerability is traded as CVE-2015-8823. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 87304 (RHEL 5 / 6 : flash-plugin (RHSA-2015:2593)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 124388 (Adobe Flash Player and AIR Security Update (APSB15-32)).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (87304). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Multimedia Player Software

Vendor

• Adobe

Name

• Flash Player

License

• free

Support

• end of life

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion