Headline

CVE-2015-5122: Adobe Security Bulletin

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

9 years ago

CVE

Open in Source

#vulnerability #mac #windows #google #linux #dos #chrome

Release date: July 10, 2015

Vulnerability identifier: APSA15-04

Priority: See table below

CVE number: CVE-2015-5122, CVE-2015-5123

Platform: Windows, Macintosh and Linux

Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified in Adobe Flash Player 18.0.0.204 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.

Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly. Adobe expects to make updates available during the week of July 12, 2015.

UPDATE (July 14): Adobe recommends users update their product installations to the latest versions using the instructions provided in the “Solution” section in Security Bulletin APSB15-18.

Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh
Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome
Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh
Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux

To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select “About Adobe (or Macromedia) Flash Player” from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system.

Adobe categorizes these issues as critical vulnerabilities

Adobe would like to thank the following individuals and organizations for reporting these issues and for working with Adobe to help protect our customers:

Dhanesh Kizhakkinan of FireEye as well as Peter Pi of TrendMicro (CVE-2015-5122)
Peter Pi of TrendMicro as well as slipstream/RoL (@TheWack0lian) (CVE-2015-5123)

July 11, 2015: added information on CVE-2015-5123

July 12, 2015: added acknowledgement on CVE-2015-5123

July 14, 2015: added reference to security bulletin APSB15-18.

August 10, 2015: added credit to TrendMicro for independently reporting CVE-2015-5122.

Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter.