CVE-2015-3102

10.06.2015, 01:59

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3098 and CVE-2015-3099.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	5 UNKNOWN	NETWORK	LOW	AV:N/AC:L/Au:N/C:P/I:N/A:N
adobe	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 67%

Vendor	Product	Version
adobe	air	𝑥 ≤ 17.0.0.144
google	android	*
adobe	air	𝑥 ≤ 17.0.0.172
adobe	air_sdk	𝑥 ≤ 17.0.0.172
adobe	air_sdk_\&_compiler	𝑥 ≤ 17.0.0.172
adobe	flash_player	𝑥 ≤ 11.2.202.460
adobe	flash_player	𝑥 ≤ 13.0.0.289
adobe	flash_player	14.0.0.125
adobe	flash_player	14.0.0.145
adobe	flash_player	14.0.0.176
adobe	flash_player	14.0.0.179
adobe	flash_player	15.0.0.152
adobe	flash_player	15.0.0.167
adobe	flash_player	15.0.0.189
adobe	flash_player	15.0.0.223
adobe	flash_player	15.0.0.239
adobe	flash_player	15.0.0.246
adobe	flash_player	16.0.0.235
adobe	flash_player	16.0.0.257
adobe	flash_player	16.0.0.287
adobe	flash_player	16.0.0.296
adobe	flash_player	17.0.0.134
adobe	flash_player	17.0.0.169
adobe	flash_player	17.0.0.188

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

adobe-flashplugin

vivid	Fixed 1:20150609.1-0vivid1 released
utopic	Fixed 1:20150609.1-0utopic1 released
trusty	Fixed 1:20150609.1-0trusty1 released
precise	Fixed 1:20150609.1-0precise1 released

flashplugin-nonfree

vivid	Fixed 11.2.202.466ubuntu0.15.04.1 released
utopic	Fixed 11.2.202.466ubuntu0.14.10.1 released
trusty	Fixed 11.2.202.466ubuntu0.14.04.1 released
precise	Fixed 11.2.202.466ubuntu0.12.04.1 released

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html

http://rhn.redhat.com/errata/RHSA-2015-1086.html

http://www.securityfocus.com/bid/75080

http://www.securitytracker.com/id/1032519

https://helpx.adobe.com/security/products/flash-player/apsb15-11.html

https://security.gentoo.org/glsa/201506-01