CVE-2015-3135
HighSummary
A heap-based buffer overflow exists in Adobe Flash Player that can lead to arbitrary code execution. This affects versions before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X, and before 11.2.202.481 on Linux.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, posing a significant security risk to systems using the affected software versions.
Recommendation
It is recommended to update Adobe Flash Player and Adobe AIR to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Adobe Flash Player, Adobe AIR
See all- CVE-2015-8823High
Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before version 18.0.0.268 and in versions 19.x and 20.x before 20.0.0.228 on Windows and OS X, as well as before 11.2.202.554 on Linux. It allows attackers to execute arbitrary code via crafted text property.
- CVE-2016-1005High
Adobe Flash Player versions before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as Adobe AIR versions before 21.0.0.176, allow attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 data.
- CVE-2016-1002High
Adobe Flash Player versions before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as Adobe AIR versions before 21.0.0.176, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
- CVE-2016-1001High
A heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as in Adobe AIR before 21.0.0.176, allows attackers to execute arbitrary code.
- CVE-2016-0998High
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.333 and in versions 19.x through 21.x before 21.0.0.182 on Windows and OS X, as well as before 11.2.202.577 on Linux. A similar vulnerability exists in Adobe AIR and its SDK before version 21.0.0.176, allowing attackers to execute arbitrary code.
- CVE-2016-0996High
A use-after-free vulnerability in the setInterval method in Adobe Flash Player before version 18.0.0.333 and in versions 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as in Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176, allows attackers to execute arbitrary code via crafted arguments.
- CVE-2016-0994High
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.333 and in versions 19.x through 21.x before 21.0.0.182 on Windows and OS X, as well as before 11.2.202.577 on Linux, allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments.
- CVE-2016-0993High
Integer overflow in Adobe Flash Player before version 18.0.0.333 and in versions 19.x through 21.x before 21.0.0.182 on Windows and OS X, as well as before 11.2.202.577 on Linux, allows attackers to execute arbitrary code.
- CVE-2016-0992High
Adobe Flash Player versions before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, as well as Adobe AIR and its SDK versions before 21.0.0.176, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
- CVE-2016-0990High
A use-after-free vulnerability in Adobe Flash Player before version 18.0.0.333 and in versions 19.x through 21.x before 21.0.0.182 on Windows and OS X, as well as before 11.2.202.577 on Linux, allows attackers to execute arbitrary code.
Original NVD description (English source)
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.