CVE-2015-8651
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
Analysis
Adobe Flash Player contains an integer overflow vulnerability that allows remote code execution, exploited in the wild in December 2015, one of the last major Flash zero-days before the industry began phasing out the plugin.
Technical Context
The CWE-190 integer overflow occurs in Flash Player's internal memory allocation routines. By triggering an integer wraparound during buffer size calculation, the attacker causes a smaller-than-expected buffer to be allocated, which is subsequently overwritten with attacker-controlled data.
Affected Products
['Adobe Flash Player before 18.0.0.324 (Windows/OS X)', 'Adobe Flash Player 19.x/20.x before 20.0.0.267 (Windows/OS X)', 'Adobe Flash Player before 11.2.202.559 (Linux)', 'Adobe AIR before 20.0.0.233', 'Adobe AIR SDK before 20.0.0.233']
Remediation
Flash Player is end-of-life. Remove all Flash installations completely. No modern browser supports Flash content.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today