CVE-2015-3107

10.06.2015, 01:59

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	10 UNKNOWN	NETWORK	LOW	AV:N/AC:L/Au:N/C:C/I:C/A:C
adobe	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 97%

Vendor	Product	Version
adobe	air	𝑥 ≤ 17.0.0.144
google	android	*
opensuse	evergreen	11.4
adobe	flash_player	𝑥 ≤ 13.0.0.289
adobe	flash_player	14.0.0.125
adobe	flash_player	14.0.0.145
adobe	flash_player	14.0.0.176
adobe	flash_player	14.0.0.179
adobe	flash_player	15.0.0.152
adobe	flash_player	15.0.0.167
adobe	flash_player	15.0.0.189
adobe	flash_player	15.0.0.223
adobe	flash_player	15.0.0.239
adobe	flash_player	15.0.0.246
adobe	flash_player	16.0.0.235
adobe	flash_player	16.0.0.257
adobe	flash_player	16.0.0.287
adobe	flash_player	16.0.0.296
adobe	flash_player	17.0.0.134
adobe	flash_player	17.0.0.169
adobe	flash_player	17.0.0.188
adobe	air	𝑥 ≤ 17.0.0.172
adobe	air_sdk	𝑥 ≤ 17.0.0.172
adobe	air_sdk_\&_compiler	𝑥 ≤ 17.0.0.172
adobe	flash_player	𝑥 ≤ 11.2.202.460

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

adobe-flashplugin

vivid	Fixed 1:20150609.1-0vivid1 released
utopic	Fixed 1:20150609.1-0utopic1 released
trusty	Fixed 1:20150609.1-0trusty1 released
precise	Fixed 1:20150609.1-0precise1 released

flashplugin-nonfree

vivid	Fixed 11.2.202.466ubuntu0.15.04.1 released
utopic	Fixed 11.2.202.466ubuntu0.14.10.1 released
trusty	Fixed 11.2.202.466ubuntu0.14.04.1 released
precise	Fixed 11.2.202.466ubuntu0.12.04.1 released