What is the CVSS score of CVE-2015-8445?

CVE-2015-8445 has a CVSS 2.0 base score of 9.3 (Critical). CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 4.8%.

Is there a patch available for CVE-2015-8445?

Yes, a patch is available for CVE-2015-8445. Update the affected software to the latest version immediately.

Air Sdk CVE-2015-8445

CRITICAL

Numeric Errors (CWE-189)

2015-12-10 psirt@adobe.com

Adobe RCE Microsoft Air Sdk Air Sdk Compiler Flash Player Air

9.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 10, 2015 - 06:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Integer overflow in the Shader filter implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a large BitmapData source object.

AnalysisAI

Integer overflow in the Shader filter implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-189. Integer overflow in the Shader filter implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a large BitmapData source object. Affected products include: Adobe Air Sdk, Adobe Air Sdk \& Compiler, Adobe Flash Player, Adobe Air. Version information: before 18.0.0.268.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.