Main Vulnerability Database Vulnerabilities #VU5416

Heap-based buffer overflow in Adobe Flash Player for Linux and Adobe Flash Player - CVE-2015-3113

Published: January 26, 2017 / Updated: November 20, 2020

Vulnerability identifier: #VU5416

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-3113

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Affected software

Adobe Flash Player for Linux
Adobe Flash Player
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
iMC SHM
HPE iMC PLAT

How to mitigate CVE-2015-3113

Install update from vendor's website.

iMC SHM - update to 7.1 E0301P05
HPE iMC PLAT - update to 7.1 E0303P16

Links to Public Exploits and PoC-codes

External References

https://helpx.adobe.com/security/products/flash-player/apsb15-14.html