CVE-2015-8047

10.12.2015, 05:59

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	10 UNKNOWN	NETWORK	LOW	AV:N/AC:L/Au:N/C:C/I:C/A:C
adobe	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 86%

Vendor	Product	Version
adobe	air_sdk	𝑥 ≤ 19.0.0.241
adobe	air_sdk_\&_compiler	𝑥 ≤ 19.0.0.241
adobe	flash_player	𝑥 ≤ 11.2.202.548
adobe	flash_player	𝑥 ≤ 18.0.0.261
adobe	flash_player	19.0.0.185
adobe	flash_player	19.0.0.207
adobe	flash_player	19.0.0.226
adobe	flash_player	19.0.0.245
adobe	air	𝑥 ≤ 19.0.0.241

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

adobe-flashplugin

wily	Fixed 1:20151208.1-0ubuntu0.15.10.1 released
vivid	Fixed 1:20151208.1-0ubuntu0.15.04.1 released
trusty	Fixed 1:20151208.1-0ubuntu0.14.04.1 released
precise	Fixed 1:20151208.1-0ubuntu0.12.04.1 released

flashplugin-nonfree

wily	Fixed 11.2.202.554ubuntu0.15.10.1 released
vivid	Fixed 11.2.202.554ubuntu0.15.04.1 released
trusty	Fixed 11.2.202.554ubuntu0.14.04.1 released
precise	Fixed 11.2.202.554ubuntu0.12.04.1 released

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html

http://www.securityfocus.com/bid/78710

http://www.securitytracker.com/id/1034318

https://helpx.adobe.com/security/products/flash-player/apsb15-32.html