Vulnerability CVE-2015-0346

Vulnerability Name:

CVE-2015-0346 (CCN-102271)

Assigned:

2014-12-01

Published:

2015-04-14

Updated:

2018-10-30

Summary:

Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0359.

CWE-415: Double Free

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2015-0346

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2015:0718

Source: SUSE
Type: Third Party Advisory
SUSE-SU-2015:0722

Source: SUSE
Type: Third Party Advisory
SUSE-SU-2015:0723

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2015:0725

Source: REDHAT
Type: Third Party Advisory
RHSA-2015:0813

Source: BID
Type: UNKNOWN
74067

Source: CCN
Type: BID-74067
Adobe Flash Player APSB15-06 Multiple Remote Code Execution Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1032105

Source: XF
Type: UNKNOWN
adobe-flash-cve20150346-code-exec(102271)

Source: CCN
Type: Adobe Security Bulletin APSB15-06
Security updates available for Adobe Flash Player

Source: CONFIRM
Type: Patch, Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb15-06.html

Source: GENTOO
Type: UNKNOWN
GLSA-201504-07

Source: CCN
Type: Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-0346

Vulnerable Configuration:

Configuration 1:

cpe:/o:redhat:enterprise_linux_desktop_supplementary:5.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_server_supplementary:5.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_server_supplementary_eus:6.6.z:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux_workstation_extension:12.0:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version <= 13.0.0.264)

OR cpe:/a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version <= 11.2.202.451)

AND

cpe:/o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:rhel_extras:6:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_8:-:-:-:*:-:-:x32:*

OR cpe:/o:microsoft:windows_8:::~~~~x64~:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_rt:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:*

OR cpe:/o:microsoft:windows_8.1:::~~~~x64~:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:52002	P	Security update for haproxy (Critical)	2023-02-14
oval:org.opensuse.security:def:5302	P	Security update for postgresql12 (Important) (in QA)	2022-08-31
oval:org.opensuse.security:def:5335	P	Security update for postgresql10 (Important)	2022-08-26
oval:org.opensuse.security:def:5277	P	Security update for the Linux Kernel (Important)	2022-06-20
oval:org.opensuse.security:def:20150346	V	CVE-2015-0346	2022-05-20
oval:org.opensuse.security:def:6026	P	Security update for xen (Moderate)	2022-05-03
oval:org.opensuse.security:def:5366	P	Security update for flac (Moderate)	2022-03-14
oval:org.opensuse.security:def:5353	P	Security update for php72 (Moderate)	2022-02-25
oval:org.opensuse.security:def:5344	P	Security update for xen (Important)	2022-02-17
oval:org.opensuse.security:def:6004	P	Security update for MozillaFirefox (Important)	2022-01-18
oval:org.opensuse.security:def:10711	P	Security update for MozillaThunderbird (Important)	2022-01-12
oval:org.opensuse.security:def:46345	P	Security update for xorg-x11-server (Important)	2021-12-20
oval:org.opensuse.security:def:5168	P	Security update for mozilla-nss (Important)	2021-12-06
oval:org.opensuse.security:def:5121	P	Security update for the Linux Kernel (Important)	2021-09-23
oval:org.opensuse.security:def:10692	P	Security update for ffmpeg (Important)	2021-09-02
oval:org.opensuse.security:def:46929	P	dracut-044-87.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47170	P	unzip-6.00-32.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47013	P	libdcerpc-binding0-32bit-4.4.2-29.4 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47241	P	dnsmasq-2.76-17.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47075	P	libsnmp30-32bit-5.7.3-4.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47879	P	rsync-3.1.0-13.13.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47139	P	python-pywbem-0.7.0-4.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47933	P	yubikey-manager-0.6.0-1.27 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:5075	P	Security update for the Linux Kernel (Important)	2021-07-14
oval:org.opensuse.security:def:11513	P	cups-pk-helper-0.2.5-3.75 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11503	P	cifs-utils-6.4-6.4 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11320	P	gzip-1.6-7.392 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11534	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11535	P	freerdp-1.0.2-7.9 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46477	P	libevent-2_0-5-2.0.21-4.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:12141	P	gvim-7.4.326-16.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48718	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11339	P	libXfont1-1.4.7-2.9 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17049	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46568	P	radvd-1.9.7-2.12 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11481	P	xlockmore-5.43-5.33 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:12163	P	libIlmImf-Imf_2_1-21-2.1.0-4.5 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11414	P	libxcb-dri2-0-1.10-1.21 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46715	P	libapr1-1.5.1-2.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11490	P	MozillaFirefox-38.4.0esr-51.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:76830	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11305	P	gd-2.1.0-3.12 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11439	P	perl-Tk-804.031-3.82 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:5053	P	Security update for gstreamer-plugins-bad (Important)	2021-06-07
oval:org.opensuse.security:def:10677	P	Security update for MozillaThunderbird (Moderate)	2021-06-04
oval:org.opensuse.security:def:51896	P	Security update for djvulibre (Important)	2021-05-31
oval:org.opensuse.security:def:5045	P	Security update for postgresql10 (Moderate)	2021-05-27
oval:org.opensuse.security:def:11212	P	Security update for netdata (Moderate)	2021-05-15
oval:org.opensuse.security:def:38103	P	Security update for clamav (Important)	2021-04-14
oval:org.opensuse.security:def:5202	P	Security update for openssl-1_1 (Important)	2021-03-25
oval:org.opensuse.security:def:11190	P	Security update for privoxy (Moderate)	2021-03-22
oval:org.opensuse.security:def:11182	P	Security update for python-djangorestframework (Important)	2021-02-25
oval:org.opensuse.security:def:5183	P	Security update for ImageMagick (Moderate)	2021-02-19
oval:org.opensuse.security:def:51723	P	Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP3) (Important)	2021-02-10
oval:org.opensuse.security:def:51485	P	Security update for cyrus-sasl (Important)	2020-12-28
oval:org.opensuse.security:def:10584	P	Security update for MozillaThunderbird (Important)	2020-12-07
oval:org.opensuse.security:def:11258	P	python-requests-2.3.0-1.6 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:52646	P	Security update for openldap2 (Important)	2020-12-01
oval:org.opensuse.security:def:53303	P	Security update for memcached (Moderate)	2020-12-01
oval:org.opensuse.security:def:37356	P	xdg-utils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37688	P	sysvinit-tools on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38054	P	rrdtool on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24325	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:25048	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:52727	P	Security update for the Linux Kernel (Live Patch 9 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:54196	P	flash-player on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:53954	P	emacs on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:55423	P	yast2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:46019	P	Security update for openldap2 (Important)	2020-12-01
oval:org.opensuse.security:def:24605	P	Security update for lftp (Moderate)	2020-12-01
oval:org.opensuse.security:def:24947	P	Security update for libcroco (Moderate)	2020-12-01
oval:org.opensuse.security:def:38214	P	gv on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52453	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:52786	P	Security update for the Linux Kernel (Live Patch 19 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:53469	P	Security update for webkit2gtk3 (Important)	2020-12-01
oval:org.opensuse.security:def:37367	P	yast2-core on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37745	P	busybox on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10853	P	systemtap-sdt-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:46020	P	Security update for webkit2gtk3 (Important)	2020-12-01
oval:org.opensuse.security:def:51322	P	Security update for jasper (Low)	2020-12-01
oval:org.opensuse.security:def:25092	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:10630	P	Security update for xorg-x11-server (Important)	2020-12-01
oval:org.opensuse.security:def:10786	P	librsvg-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52765	P	Security update for the Linux Kernel (Live Patch 15 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:54028	P	libgssglue1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:55497	P	Security update for Adobe Flash Player (Important)	2020-12-01
oval:org.opensuse.security:def:24335	P	Security update for mgetty (Important)	2020-12-01
oval:org.opensuse.security:def:24661	P	Security update for krb5-appl (Important)	2020-12-01
oval:org.opensuse.security:def:38852	P	gnome-shell-calendar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51323	P	Security update for vim (Moderate)	2020-12-01
oval:org.opensuse.security:def:52561	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:10554	P	libtiff-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:53024	P	Security update for php7 (Important)	2020-12-01
oval:org.opensuse.security:def:53754	P	Security update for libreoffice (Moderate)	2020-12-01
oval:org.opensuse.security:def:37451	P	grub2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37835	P	krb5-appl-clients on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10862	P	xfig on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:46033	P	Security update for qemu (Moderate)	2020-12-01
oval:org.opensuse.security:def:25730	P	Security update for glibc (Important)	2020-12-01
oval:org.opensuse.security:def:52623	P	Security update for the Linux Kernel (Critical)	2020-12-01
oval:org.opensuse.security:def:10811	P	libxcb-composite0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52846	P	Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP1) (Important)	2020-12-01
oval:org.opensuse.security:def:54066	P	libsoup-2_4-1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24398	P	Security update for libqt5-qtbase (Moderate)	2020-12-01
oval:org.opensuse.security:def:24744	P	Security update for libsolv (Moderate)	2020-12-01
oval:org.opensuse.security:def:38142	P	bubblewrap on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38894	P	flash-player on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51345	P	Security update for freetype2 (Important)	2020-12-01
oval:org.opensuse.security:def:52624	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:53197	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:53862	P	Security update for openconnect (Moderate)	2020-12-01
oval:org.opensuse.security:def:37587	P	libspice-server1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37995	P	libz1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10875	P	aaa_base-malloccheck on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:46153	P	Security update for squid (Important)	2020-12-01
oval:org.opensuse.security:def:25034	P	Security update for libgcrypt (Moderate)	2020-12-01
oval:org.opensuse.security:def:25765	P	Security update for Adobe Flash Player (Important)	2020-12-01
oval:org.opensuse.security:def:10562	P	libwmf-0_2-7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52653	P	Security update for the Linux Kernel (Live Patch 2 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:54122	P	squashfs on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37355	P	xalan-j2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:54147	P	yast2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24524	P	Security update for openssl (Moderate)	2020-12-01
oval:org.opensuse.security:def:24894	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:38170	P	dovecot22 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52168	P	Security update for java-11-openjdk (Important)	2020-12-01
oval:com.redhat.rhsa:def:20150813	P	RHSA-2015:0813: flash-plugin security update (Critical)	2015-04-15
oval:org.opensuse.security:def:78131	P	Security update for Adobe Flash Player (Important)	2015-04-15
oval:com.ubuntu.precise:def:20150346000	V	CVE-2015-0346 on Ubuntu 12.04 LTS (precise) - medium.	2015-04-14
oval:com.ubuntu.trusty:def:20150346000	V	CVE-2015-0346 on Ubuntu 14.04 LTS (trusty) - medium.	2015-04-14

BACK