CVE-2015-5123

Опубликовано: 14 июл. 2015

Источник: nvd

CVSS3: 9.8

CVSS3: 7.8

CVSS2: 10

EPSS Средний

Описание

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

Ссылки

http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerges-from-hacking-team-leak/
Broken Link
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=144050155601375&w=2
Mailing List
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1235.html
Third Party Advisory
http://www.kb.cert.org/vuls/id/918568
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/75710
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032890
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/ncas/alerts/TA15-195A
Third Party Advisory
US Government Resource
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784
Broken Link
Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html
Broken Link
Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html
Broken Link
Vendor Advisory
https://security.gentoo.org/glsa/201508-01
Third Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerges-from-hacking-team-leak/
Broken Link
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=144050155601375&w=2
Mailing List
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1235.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*

Версия от 11.0 (включая) до 11.2.202.481 (включая)

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

Одно из

cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*

Версия от 13.0 (включая) до 13.0.0.302 (включая)

cpe:2.3:a:adobe:flash_player:*:*:*:*:chrome:*:*:*

Версия от 18.0 (включая) до 18.0.0.203 (включая)

cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*

Версия от 18.0 (включая) до 18.0.0.203 (включая)

Одно из

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.47561

Средний

9.8 Critical

CVSS3

7.8 High

CVSS3

10 Critical

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2015-5123

CVSS3: 9.8

ubuntu

больше 10 лет назад

CVE-2015-5123

redhat

больше 10 лет назад

GHSA-6hpg-rw47-66vr

CVSS3: 9.8

github

больше 3 лет назад

BDU:2015-10799

fstec

больше 10 лет назад

Уязвимость программной платформы Flash Player, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

BDU:2015-10798

fstec

больше 10 лет назад

EPSS

Процентиль: 98%

0.47561

Средний

9.8 Critical

CVSS3

7.8 High

CVSS3

10 Critical

CVSS2

Дефекты

CWE-416