Vulnerability CVE-2015-3091

Vulnerability Name:

CVE-2015-3091 (CCN-103132)

Assigned:

2015-05-12

Published:

2015-05-12

Updated:

2017-01-03

Summary:

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3092.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-200

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2015-3091

Source: CCN
Type: Google Chrome Releases Web site
Dev Channel Update for Chrome OS

Source: SUSE
Type: UNKNOWN
SUSE-SU-2015:0878

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2015:0890

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2015:0914

Source: REDHAT
Type: UNKNOWN
RHSA-2015:1005

Source: BID
Type: UNKNOWN
74617

Source: CCN
Type: BID-74617
Adobe Flash Player and AIR Multiple Unspecified ASLR Security Bypass Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1032285

Source: XF
Type: UNKNOWN
adobe-flash-cve20153091-sec-bypass(103132)

Source: CCN
Type: Adobe Security Bulletin APSB15-09
Security updates available for Adobe Flash Player

Source: CONFIRM
Type: Patch, Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb15-09.html

Source: GENTOO
Type: UNKNOWN
GLSA-201505-02

Source: CCN
Type: Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-3091

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version <= 11.2.202.475)

AND

cpe:/o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version <= 13.0.0.264)

OR cpe:/a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:adobe:air:*:*:*:*:*:*:*:* (Version <= 17.0.0.144)

OR cpe:/a:adobe:air_sdk:*:*:*:*:*:*:*:* (Version <= 17.0.0.144)

OR cpe:/a:adobe:air_sdk_&_compiler:*:*:*:*:*:*:*:* (Version <= 17.0.0.144)

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:rhel_extras:6:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*

OR cpe:/a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_8:-:-:-:*:-:-:x32:*

OR cpe:/o:microsoft:windows_8:::~~~~x64~:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_rt:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:*

OR cpe:/o:microsoft:windows_8.1:::~~~~x64~:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:52002	P	Security update for haproxy (Critical)	2023-02-14
oval:org.opensuse.security:def:5302	P	Security update for postgresql12 (Important) (in QA)	2022-08-31
oval:org.opensuse.security:def:5335	P	Security update for postgresql10 (Important)	2022-08-26
oval:org.opensuse.security:def:5277	P	Security update for the Linux Kernel (Important)	2022-06-20
oval:org.opensuse.security:def:20153091	V	CVE-2015-3091	2022-05-20
oval:org.opensuse.security:def:6026	P	Security update for xen (Moderate)	2022-05-03
oval:org.opensuse.security:def:5366	P	Security update for flac (Moderate)	2022-03-14
oval:org.opensuse.security:def:5353	P	Security update for php72 (Moderate)	2022-02-25
oval:org.opensuse.security:def:5344	P	Security update for xen (Important)	2022-02-17
oval:org.opensuse.security:def:6004	P	Security update for MozillaFirefox (Important)	2022-01-18
oval:org.opensuse.security:def:10711	P	Security update for MozillaThunderbird (Important)	2022-01-12
oval:org.opensuse.security:def:5168	P	Security update for mozilla-nss (Important)	2021-12-06
oval:org.opensuse.security:def:5121	P	Security update for the Linux Kernel (Important)	2021-09-23
oval:org.opensuse.security:def:10692	P	Security update for ffmpeg (Important)	2021-09-02
oval:org.opensuse.security:def:46934	P	emacs-24.3-16.32 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47175	P	w3m-0.5.3-157.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47018	P	libfreebl3-3.21.1-46.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47246	P	e2fsprogs-1.42.11-15.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47080	P	libsrtp1-1.5.2-2.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47884	P	sane-backends-1.0.24-3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47144	P	res-signingkeys-3.0.18-26.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47938	P	ImageMagick-config-6-SUSE-6.8.8.1-71.126.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:5075	P	Security update for the Linux Kernel (Important)	2021-07-14
oval:org.opensuse.security:def:11513	P	cups-pk-helper-0.2.5-3.75 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11514	P	curl-7.37.0-15.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11331	P	lcms-1.19-17.31 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11534	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11535	P	freerdp-1.0.2-7.9 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46482	P	libgcrypt20-1.6.1-9.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:12152	P	java-1_8_0-openjdk-1.8.0.131-26.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48718	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11350	P	libXxf86vm1-1.1.3-3.54 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:17049	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46573	P	shim-0.7-14.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11492	P	accountsservice-0.6.35-3.10 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:12174	P	libXp6-1.0.2-3.58 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11269	P	bogofilter-1.2.4-3.56 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11425	P	ntp-4.2.6p5-24.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:46720	P	libdmx1-1.1.3-3.52 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11501	P	busybox-1.21.1-3.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:76830	P	flash-player-11.2.202.548-111.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11316	P	gpg2-2.0.24-1.5 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:11450	P	python-pywbem-0.7.0-4.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:5053	P	Security update for gstreamer-plugins-bad (Important)	2021-06-07
oval:org.opensuse.security:def:10677	P	Security update for MozillaThunderbird (Moderate)	2021-06-04
oval:org.opensuse.security:def:51896	P	Security update for djvulibre (Important)	2021-05-31
oval:org.opensuse.security:def:11223	P	Security update for singularity (Moderate)	2021-05-30
oval:org.opensuse.security:def:5045	P	Security update for postgresql10 (Moderate)	2021-05-27
oval:org.opensuse.security:def:11201	P	Security update for irssi (Moderate)	2021-04-23
oval:org.opensuse.security:def:38103	P	Security update for clamav (Important)	2021-04-14
oval:org.opensuse.security:def:5202	P	Security update for openssl-1_1 (Important)	2021-03-25
oval:org.opensuse.security:def:5183	P	Security update for ImageMagick (Moderate)	2021-02-19
oval:org.opensuse.security:def:51723	P	Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP3) (Important)	2021-02-10
oval:org.opensuse.security:def:11193	P	Security update for chromium (Important)	2021-01-11
oval:org.opensuse.security:def:46158	P	Security update for python (Moderate)	2021-01-05
oval:org.opensuse.security:def:51485	P	Security update for cyrus-sasl (Important)	2020-12-28
oval:org.opensuse.security:def:10584	P	Security update for MozillaThunderbird (Important)	2020-12-07
oval:org.opensuse.security:def:52657	P	Security update for the Linux Kernel (Live Patch 2 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:53314	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:37356	P	xdg-utils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37688	P	sysvinit-tools on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38054	P	rrdtool on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24330	P	Security update for smt, yast2-smt (Important)	2020-12-01
oval:org.opensuse.security:def:46350	P	Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)	2020-12-01
oval:org.opensuse.security:def:25053	P	Security update for libunwind (Moderate)	2020-12-01
oval:org.opensuse.security:def:52727	P	Security update for the Linux Kernel (Live Patch 9 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:54196	P	flash-player on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:53965	P	fuse on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:55434	P	Security update for flash-player (Moderate)	2020-12-01
oval:org.opensuse.security:def:46024	P	Security update for apache2 (Important)	2020-12-01
oval:org.opensuse.security:def:24610	P	Security update for ucode-intel (Moderate)	2020-12-01
oval:org.opensuse.security:def:24952	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:38214	P	gv on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52453	P	Security update for tiff (Moderate)	2020-12-01
oval:org.opensuse.security:def:52797	P	Security update for the Linux Kernel (Live Patch 16 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:53480	P	Security update for libvpx (Important)	2020-12-01
oval:org.opensuse.security:def:37367	P	yast2-core on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37745	P	busybox on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10853	P	systemtap-sdt-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:46025	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:51322	P	Security update for jasper (Low)	2020-12-01
oval:org.opensuse.security:def:25097	P	Security update for curl (Important)	2020-12-01
oval:org.opensuse.security:def:10630	P	Security update for xorg-x11-server (Important)	2020-12-01
oval:org.opensuse.security:def:10786	P	librsvg-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52765	P	Security update for the Linux Kernel (Live Patch 15 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:54039	P	libmms0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:55508	P	Security update for flash-player (Important)	2020-12-01
oval:org.opensuse.security:def:24340	P	Security update for soundtouch (Moderate)	2020-12-01
oval:org.opensuse.security:def:24666	P	Security update for ruby2.1 (Important)	2020-12-01
oval:org.opensuse.security:def:38852	P	gnome-shell-calendar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51323	P	Security update for vim (Moderate)	2020-12-01
oval:org.opensuse.security:def:52561	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:10554	P	libtiff-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:53035	P	Security update for libvpx (Moderate)	2020-12-01
oval:org.opensuse.security:def:53765	P	Security update for libwpd (Important)	2020-12-01
oval:org.opensuse.security:def:37451	P	grub2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37835	P	krb5-appl-clients on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10862	P	xfig on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:46038	P	Security update for tigervnc (Important)	2020-12-01
oval:org.opensuse.security:def:25735	P	Security update for exiv2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:52634	P	Security update for ntp (Moderate)	2020-12-01
oval:org.opensuse.security:def:10811	P	libxcb-composite0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52846	P	Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP1) (Important)	2020-12-01
oval:org.opensuse.security:def:54077	P	libxerces-c-3_1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24403	P	Security update for mailman (Important)	2020-12-01
oval:org.opensuse.security:def:24749	P	Security update for libmspack (Moderate)	2020-12-01
oval:org.opensuse.security:def:38142	P	bubblewrap on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38894	P	flash-player on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51345	P	Security update for freetype2 (Important)	2020-12-01
oval:org.opensuse.security:def:52635	P	Security update for openldap2 (Important)	2020-12-01
oval:org.opensuse.security:def:53208	P	Security update for bind (Important)	2020-12-01
oval:org.opensuse.security:def:53873	P	Security update for gimp (Low)	2020-12-01
oval:org.opensuse.security:def:37587	P	libspice-server1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37995	P	libz1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10875	P	aaa_base-malloccheck on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25039	P	Security update for binutils (Moderate)	2020-12-01
oval:org.opensuse.security:def:25770	P	Security update for flash-player (Important)	2020-12-01
oval:org.opensuse.security:def:10562	P	libwmf-0_2-7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52653	P	Security update for the Linux Kernel (Live Patch 2 for SLE 15) (Important)	2020-12-01
oval:org.opensuse.security:def:54122	P	squashfs on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37355	P	xalan-j2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:54158	P	avahi on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24529	P	Security update for expat (Moderate)	2020-12-01
oval:org.opensuse.security:def:24899	P	Security update for webkit2gtk3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:38170	P	dovecot22 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52168	P	Security update for java-11-openjdk (Important)	2020-12-01
oval:com.redhat.rhsa:def:20151005	P	RHSA-2015:1005: flash-plugin security update (Critical)	2015-05-13
oval:org.opensuse.security:def:78142	P	Security update for flash-player (Important)	2015-05-13
oval:com.ubuntu.precise:def:20153091000	V	CVE-2015-3091 on Ubuntu 12.04 LTS (precise) - medium.	2015-05-13
oval:com.ubuntu.trusty:def:20153091000	V	CVE-2015-3091 on Ubuntu 14.04 LTS (trusty) - medium.	2015-05-13

BACK