Security Alert (A15-12-09): Multiple Vulnerabilities in Adobe Flash Player


 

Published on: 29 December 2015

Last update on: 30 December 2015

  
  

Description:

Security updates are released for Adobe Flash Player to address multiple vulnerabilities caused by memory corruption, integer overflow, type confusion and use-after-free error. A remote attacker could entice a targeted user to open a specially crafted web page, Flash file, or document that supports embedded Flash content to exploit the vulnerabilities.

Reports indicate that one of the vulnerabilities is being exploited through targeted attacks.

Affected Systems:

  • Adobe Flash Player for Windows and Macintosh 18.0.0.268, 20.0.0.235 and earlier versions
  • Adobe Flash Player for Google Chrome, Microsoft Edge, Internet Explorer 10 & 11 20.0.0.228 and earlier versions
  • Adobe Flash Player for Linux 11.2.202.554 and earlier versions
  • AIR Desktop Runtime, SDK 20.0.0.204 and earlier versions
  • AIR SDK & Complier 20.0.0.204 and earlier versions
  • AIR for Android 20.0.0.204 and earlier versions

Impact:

A successful attack could lead to arbitrary code execution or potentially take control of the affected system.


Recommendation:

Upgrade Adobe Flash Player to the following versions to address the issues. The upgrade can be obtained by using the auto-update mechanism or by downloading at the following URLs:

  • Adobe Flash Player 18.0.0.324 & 20.0.0.267 for Windows and Macintosh
    http://www.adobe.com/go/getflash
    http://www.adobe.com/products/players/flash-player-distribution.html

  • Adobe Flash Player 20.0.0.267 for Google Chrome
    http://googlechromereleases.blogspot.com/

  • Adobe Flash Player 20.0.0.267 for Microsoft Edge and Internet Explorer 10 & 11
    https://support.microsoft.com/en-us/kb/3132372

  • Adobe Flash Player 11.2.202.559 for Linux
    http://www.adobe.com/go/getflash

  • AIR Desktop Runtime 20.0.0.233
    http://get.adobe.com/air/

  • AIR SDK, SDK & Complier 20.0.0.233
    http://www.adobe.com/devnet/air/air-sdk-download.html

  • AIR for Android 20.0.0.233
    https://play.google.com/store/apps/details?id=com.adobe.air

If you have multiple browsers, you are required to perform the Adobe Flash Player upgrade for each browser, the Flash Player version can be checked at http://www.adobe.com/software/flash/about/

 

More Information:

https://helpx.adobe.com/security/products/flash-player/apsb16-01.html
https://technet.microsoft.com/library/security/2755801
https://www.hkcert.org/my_url/en/alert/15122901
https://www.us-cert.gov/ncas/current-activity/2015/12/28/Adobe-Releases-Security-Updates-Flash-Player
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8459 (to CVE-2015-8060)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8634 (to CVE-2015-8636)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8638 (to CVE-2015-8651)



Tag: Adobe , Flash Player , AIR
Tags