KLA10574 Multiple vulnerabilities in Adobe Flash Player

Multiple serious vulnerabilities have been found in Adobe products. Malicious users can exploit these vulnerabilities to write local files, bypass security restrictions, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Memory corruption, heap overflow, integer overflow, type confusion, use after free and memory leak can be exploited remotely via an unknown vectors;
2. Race condition can be exploited remotely via vectors related to Internet Explorer;
3. Unknown vulnerabilities can be exploited remotely via an unknown vectors.

Original advisories

Adobe bulletin

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Adobe-Flash-Player-ActiveX

Adobe-AIR

Adobe-Flash-Player-NPAPI

Adobe-Flash-Player-PPAPI

CVE list

CVE-2015-3044 critical

CVE-2015-3089 critical

CVE-2015-3088 critical

CVE-2015-3084 critical

CVE-2015-3086 critical

CVE-2015-3091 critical

CVE-2015-3078 critical

CVE-2015-3079 critical

CVE-2015-3080 critical

CVE-2015-3081 warning

CVE-2015-3092 critical

CVE-2015-3090 critical

CVE-2015-3087 critical

CVE-2015-3077 critical

CVE-2015-3085 high

CVE-2015-3083 high

CVE-2015-3082 high

CVE-2015-3093 critical

Solution

Update to the latest versionGet AIR

Get Flash Player

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

Affected Products

• Adobe Flash Player versions earlier than 17.0.0.188 for OS X and WindowsAdobe Flash Player ESR versions earlier than 13.0.0.289Adobe Flash Player versions earlier than 11.2.202.460 for LinuxAdobe AIR runtime, SDK and Compiler versions earlier than 17.0.0.172