Think you have a false positive on this rule?

Sid 1-37668

Message

FILE-FLASH Adobe Flash Player convolution filter use-after-free attempt

Summary

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0351, CVE-2015-0358, and CVE-2015-3039.

Impact

CVSS base score 10.0 CVSS impact score 10.0 CVSS exploitability score 10.0 confidentialityImpact COMPLETE integrityImpact COMPLETE availabilityImpact COMPLETE

CVE-2015-0349:

CVSS base score 10.0

CVSS impact score 10.0

CVSS exploitability score 10.0

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Detailed information

CVE-2015-0349: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0351, CVE-2015-0358, and CVE-2015-3039.

Affected systems

  • adobe flash_player 11.2.202.451
  • adobe flash_player 13.0.0.264
  • adobe flash_player 14.0.0.125
  • adobe flash_player 14.0.0.145
  • adobe flash_player 14.0.0.176
  • adobe flash_player 14.0.0.179
  • adobe flash_player 15.0.0.152
  • adobe flash_player 15.0.0.167
  • adobe flash_player 15.0.0.189
  • adobe flash_player 15.0.0.223
  • adobe flash_player 15.0.0.239
  • adobe flash_player 15.0.0.246
  • adobe flash_player 16.0.0.235
  • adobe flash_player 16.0.0.257
  • adobe flash_player 16.0.0.287
  • adobe flash_player 16.0.0.296
  • adobe flash_player 17.0.0.134
  • opensuse_project opensuse 13.1
  • opensuse_project opensuse 13.2
  • redhat enterpriselinuxdesktop_supplementary 5.0
  • redhat enterpriselinuxdesktop_supplementary 6.0
  • redhat enterpriselinuxserver_supplementary 5.0
  • redhat enterpriselinuxserver_supplementary 6.0
  • redhat enterpriselinuxserversupplementaryeus 6.6.z
  • redhat enterpriselinuxworkstation_supplementary 6.0
  • suse suselinuxenterprise_desktop 11.0
  • suse suselinuxenterprise_desktop 12.0
  • suse suselinuxworkstation_extension 12.0

Ease of attack

CVE-2015-0349:

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

False positives

None known

False negatives

None known

Corrective action

Upgrade to the latest non-affected version of the software.

Apply the appropriate vendor supplied patches.

Contributors

  • Talos research team.
  • This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
  • For more information see nvd.

Additional References

  • helpx.adobe.com/security/products/flash-player/apsb15-06.html