CVE-2015-0330
published 2015-02-06CVE-2015-0330: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute…
PriorityP352critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
8.12%
94.2th percentile
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0329.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | <= 13.0.0.264 | — |
| adobe | flash_player | <= 11.2.202.440 | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mpr3-3rvw-34fm: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-0321 [CRITICAL] GHSA-mpr3-3rvw-34fm: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
GHSA
GHSA-vc44-hgc6-fwjh: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-0318 [CRITICAL] GHSA-vc44-hgc6-fwjh: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
GHSA
GHSA-j95f-27mc-m626: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-0316 [CRITICAL] GHSA-j95f-27mc-m626: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
GHSA
GHSA-x6rp-xp9w-qxcr: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-0314 [CRITICAL] GHSA-x6rp-xp9w-qxcr: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
GHSA
GHSA-2m4h-74g6-655h: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-0329 [CRITICAL] GHSA-2m4h-74g6-655h: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0330.
GHSA
GHSA-27gx-7jvx-fj3g: Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-0330 [CRITICAL] GHSA-27gx-7jvx-fj3g: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0329.
OSV
CVE-2015-0314: Adobe Flash Player before 13
osv·2015-02-06·CVSS 10.0
CVE-2015-0314 [CRITICAL] CVE-2015-0314: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
OSV
CVE-2015-0318: Adobe Flash Player before 13
osv·2015-02-06·CVSS 10.0
CVE-2015-0318 [CRITICAL] CVE-2015-0318: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
OSV
CVE-2015-0329: Adobe Flash Player before 13
osv·2015-02-06·CVSS 10.0
CVE-2015-0329 [CRITICAL] CVE-2015-0329: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0330.
OSV
CVE-2015-0330: Adobe Flash Player before 13
osv·2015-02-06·CVSS 10.0
CVE-2015-0330 [CRITICAL] CVE-2015-0330: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0329.
OSV
CVE-2015-0321: Adobe Flash Player before 13
osv·2015-02-06·CVSS 10.0
CVE-2015-0321 [CRITICAL] CVE-2015-0321: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
OSV
CVE-2015-0316: Adobe Flash Player before 13
osv·2015-02-06·CVSS 10.0
CVE-2015-0316 [CRITICAL] CVE-2015-0316: Adobe Flash Player before 13
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Red Hat
flash-plugin: multiple code execution flaws (APSB15-04)
vendor_redhat·2015-02-04·CVSS 10.0
CVE-2015-0314 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Red Hat
flash-plugin: multiple code execution flaws (APSB15-04)
vendor_redhat·2015-02-04·CVSS 10.0
CVE-2015-0330 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0329.
Red Hat
flash-plugin: multiple code execution flaws (APSB15-04)
vendor_redhat·2015-02-04·CVSS 10.0
CVE-2015-0316 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Red Hat
flash-plugin: multiple code execution flaws (APSB15-04)
vendor_redhat·2015-02-04·CVSS 10.0
CVE-2015-0329 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0330.
Red Hat
flash-plugin: multiple code execution flaws (APSB15-04)
vendor_redhat·2015-02-04·CVSS 10.0
CVE-2015-0318 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Red Hat
flash-plugin: multiple code execution flaws (APSB15-04)
vendor_redhat·2015-02-04·CVSS 10.0
CVE-2015-0321 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
No detection rules found.
No public exploits indexed.
Bugzilla
mongodb: multiple flaws in bundled version of PCRE
bugzilla·2015-04-02·CVSS 5.0
CVE-2014-8964 [MEDIUM] mongodb: multiple flaws in bundled version of PCRE
mongodb: multiple flaws in bundled version of PCRE
MongoDB bundles PCRE version 8.30 that, among other issues, is vulnerable to CVE-2014-8964. A remote, authenticated attacker could use a specially crafted regular expression to crash a mongod server.
Upstream issue (with links to patches):
https://jira.mongodb.org/browse/SERVER-17252
Statement:
This issue did not affect the versions of MongoDB as shipped in any Red Hat product as they use the PCRE system library, not the bundled copy shipped with MongoDB. The CVE-2014-8964 PCRE flaw does not affect Red Hat Enterprise Linux 5 and 6, and has been fixed in Red Hat Enterprise Linux 7 via RHSA-2015:0330.
Discussion:
Vulnerabilities were in PCRE. Moving CVEs to the corresponding PCRE bugs.
HackerOne
Adobe Flash Player Out-of-Bound Access Vulnerability
hackerone·2015-03-25·CVSS 9.3
[CRITICAL] Adobe Flash Player Out-of-Bound Access Vulnerability
Adobe Flash Player Out-of-Bound Access Vulnerability
I. Summary
Adobe Flash Player is prone to a vulnerability which leads to Out-of-Bound memory access memory via carefully crafted regular expression. An attacker can exploit this issue to defeat ASLR protection or even execute arbitrary code in the context of affected application (Internet Explorer, EXCEL...).
II. Description
Adobe Flash is a multimedia and software platform used for authoring of vector graphics, animation, games and rich Internet applications (RIAs) that can be viewed, played and executed in Adobe Flash Player.
When constructing a RegExpObject, most part of memory was applied from the heap. While heap overflow may also happen as it is with CVE-2013-0634, CVE-2014-0559, the matching result is stored on the stack. A fixe
Bugzilla
flash-plugin: multiple code execution flaws (APSB15-04)
bugzilla·2015-02-06·CVSS 9.8
CVE-2015-0313 [CRITICAL] flash-plugin: multiple code execution flaws (APSB15-04)
flash-plugin: multiple code execution flaws (APSB15-04)
Adobe has released Flash Player 11.2.202.442 for Linux to correct the following flaws:
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330).
These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319).
These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327).
These updates resolve a buffer overflow vulnerability that could lead to cod
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0140.htmlhttp://secunia.com/advisories/62777http://secunia.com/advisories/62886http://secunia.com/advisories/62895http://security.gentoo.org/glsa/glsa-201502-02.xmlhttp://www.securityfocus.com/bid/72514http://www.securitytracker.com/id/1031706https://exchange.xforce.ibmcloud.com/vulnerabilities/100705https://helpx.adobe.com/security/products/flash-player/apsb15-04.htmlhttps://technet.microsoft.com/library/security/2755801http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0140.htmlhttp://secunia.com/advisories/62777http://secunia.com/advisories/62886http://secunia.com/advisories/62895http://security.gentoo.org/glsa/glsa-201502-02.xmlhttp://www.securityfocus.com/bid/72514http://www.securitytracker.com/id/1031706https://exchange.xforce.ibmcloud.com/vulnerabilities/100705https://helpx.adobe.com/security/products/flash-player/apsb15-04.htmlhttps://technet.microsoft.com/library/security/2755801
2015-02-06
Published