CVE-2015-0310Adobe Flash Player ASLR Bypass Vulnerability
Explotación conocida — Adobe Flash Player ASLR Bypass Vulnerability
CISA confirmó el 25.05.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.06.2022.
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2015-0310
Descripción
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| adobe | flash player | < 11.2.202.438 |
Referencias y parches
- GLSA-201502-02 vendor-advisoryThird Party Advisory
- 72261 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 62660 third-party-advisoryBroken Link
- 62740 third-party-advisoryBroken Link
- 1031609 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- http://helpx.adobe.com/security/products/flash-player/apsb15-02.html PatchVendor Advisory
- 62452 third-party-advisoryBroken Link
- 62601 third-party-advisoryBroken Link
- https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0310 US Government Resource
Coincidencias CPE (NVD) (3)
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*< 11.2.202.438cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*< 13.0.0.262cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 14.0 < 16.0.0.287