CVE-2015-0310

Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://helpx.adobe.com/security/products/flash-player/apsb15-02.html	Patch Vendor Advisory
http://secunia.com/advisories/62452
http://secunia.com/advisories/62601
http://secunia.com/advisories/62660
http://secunia.com/advisories/62740
http://security.gentoo.org/glsa/glsa-201502-02.xml
http://www.securityfocus.com/bid/72261
http://www.securitytracker.com/id/1031609

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:a:adobe:flash_player::::::::
	cpe:2.3:a:adobe:flash_player:14.0.0.125:::::::*
	cpe:2.3:a:adobe:flash_player:14.0.0.145:::::::*
	cpe:2.3:a:adobe:flash_player:14.0.0.176:::::::*
	cpe:2.3:a:adobe:flash_player:14.0.0.179:::::::*
	cpe:2.3:a:adobe:flash_player:15.0.0.152:::::::*
	cpe:2.3:a:adobe:flash_player:15.0.0.167:::::::*
	cpe:2.3:a:adobe:flash_player:15.0.0.189:::::::*
	cpe:2.3:a:adobe:flash_player:15.0.0.223:::::::*
	cpe:2.3:a:adobe:flash_player:15.0.0.239:::::::*
	cpe:2.3:a:adobe:flash_player:15.0.0.246:::::::*
	cpe:2.3:a:adobe:flash_player:16.0.0.235:::::::*
	cpe:2.3:a:adobe:flash_player:16.0.0.257:::::::*

OR	cpe:2.3:o:apple:mac_os_x:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2015-01-23 21:59

Updated : 2023-12-10 11:31

NVD link : CVE-2015-0310

Mitre link : CVE-2015-0310

CVE.ORG link : CVE-2015-0310

JSON object : View

Products Affected

adobe

flash_player

microsoft

windows

linux

linux_kernel

apple

mac_os_x

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-0310", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-01-23T21:59:00.050", "references": [{"url": "http://helpx.adobe.com/security/products/flash-player/apsb15-02.html", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "http://secunia.com/advisories/62452", "source": "psirt@adobe.com"}, {"url": "http://secunia.com/advisories/62601", "source": "psirt@adobe.com"}, {"url": "http://secunia.com/advisories/62660", "source": "psirt@adobe.com"}, {"url": "http://secunia.com/advisories/62740", "source": "psirt@adobe.com"}, {"url": "http://security.gentoo.org/glsa/glsa-201502-02.xml", "source": "psirt@adobe.com"}, {"url": "http://www.securityfocus.com/bid/72261", "source": "psirt@adobe.com"}, {"url": "http://www.securitytracker.com/id/1031609", "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015."}, {"lang": "es", "value": "Adobe Flash Player anterior a 13.0.0.262 y 14.x hasta 16.x anterior a 16.0.0.287 en Windows y OS X y anterior a 11.2.202.438 en Linux no restringe correctamente el descubrimiento de direcciones de la memoria, lo que permite a atacantes evadir el mecanismo de protecci\u00f3n ASLR en Windows, y tener un impacto no especificado en otras plataformas, a trav\u00e9s de vectores desconocidos, tal y como fue utilizado activamente en enero del 2015."}], "lastModified": "2015-11-13T17:08:35.050", "cisaActionDue": "2022-06-15", "cisaExploitAdd": "2022-05-25", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9EFC697-FC54-4ECA-8870-831327DA8089", "versionEndIncluding": "11.2.202.429"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39D587BE-3F2C-44E3-8280-4A2FED199632", "versionEndIncluding": "13.0.0.260"}, {"criteria": "cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5D7202D-56DF-400B-9F09-E7D9938222D3"}, {"criteria": "cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D4F0D21-A64B-46C1-9591-96529661DF0B"}, {"criteria": "cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86961019-3B81-458E-949F-A2F006EA55FE"}, {"criteria": "cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25895BE9-71FD-4DE7-90FC-0199470A8738"}, {"criteria": "cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D55A950-7D48-413C-AD43-6AC64FBE790C"}, {"criteria": "cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1A22B74-453D-4A8A-B79A-2B3143A0D995"}, {"criteria": "cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FE4B077-67D1-4B25-976E-715FB6B2A1D1"}, {"criteria": "cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFC91B68-6B35-47BD-BC02-3F836E772CF3"}, {"criteria": "cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3BE6004-C30A-46E2-9F25-785E12BBF640"}, {"criteria": "cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFE8E51F-7A32-41A4-B03A-73E52EB64C04"}, {"criteria": "cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E13E927-A77C-4681-AFDE-A5A14093234D"}, {"criteria": "cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27629FF0-5EB9-476F-B5B3-115F663AB65E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com", "cisaRequiredAction": "The impacted product is end-of-life and should be disconnected if still in use.", "cisaVulnerabilityName": "Adobe Flash Player ASLR Bypass Vulnerability"}