Unscored severity · published Sep 22, 2015
CVE-2015-5576
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190,…
–
CVSS
5.5%
EPSS
No
On KEV
Description
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Air · Adobe
through 18.0.0.199; through 18.0.0.143 · source: NVD
AS
Air Sdk · Adobe
through 18.0.0.199 · source: NVD
AS
Air Sdk & Compiler · Adobe
through 18.0.0.180 · source: NVD
FP
Flash Player · Adobe
through 13.0.0.289; 14.0.0.125; 14.0.0.145; 14.0.0.176; 14.0.0.179; 15.0.0.152; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5576
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1814.html
www.securityfocus.com
http://www.securityfocus.com/bid/76802
More from Air
8.8
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
8.8
CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability
8.8
CVE-2014-8439
Adobe Flash Player Dereferenced Pointer Vulnerability
8.8
CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity
8.8
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability