Main Vulnerability Database Vulnerabilities #VU5413

Type confusion in Adobe products - CVE-2015-7647

Published: January 26, 2017 / Updated: September 14, 2018

Vulnerability identifier: #VU5413

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-7647

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Affected software

Adobe Flash Player for Linux
Adobe Flash Player
Adobe Flash Player Extended Support Release
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop

How to mitigate CVE-2015-7647

Install update from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #926 - Adobe Flash - Type Confusion in IExternalizable.readExternal When Performing Local Serialization (March 18, 2020)

External References

https://helpx.adobe.com/security/products/flash-player/apsb15-27.html