CVE-2015-8445 — Adobe AIR vulnerability

CWE-1895 documents5 sources
Severity
9.3CRITICALNVD
EPSS
4.8%
top 10.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Adobe AIRAdobe AIR SDKAdobe AIR SDK Compiler+1 more
Timeline
PublishedDec 10
Latest updateMay 17

Description

Integer overflow in the Shader filter implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a large BitmapData source object.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDadobe/flash_player11.2.202.548+5
▶NVDadobe/air_sdk_compiler19.0.0.241
▶NVDadobe/air19.0.0.241
▶NVDadobe/air_sdk19.0.0.241

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-42cr-vq33-8jrv: Integer overflow in the Shader filter implementation in Adobe Flash Player before 18↗2022-05-17
▶
CVEList
CVE-2015-8445: Integer overflow in the Shader filter implementation in Adobe Flash Player before 18↗2015-12-10
▶
OSV
CVE-2015-8445: Integer overflow in the Shader filter implementation in Adobe Flash Player before 18↗2015-12-10
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: multiple code execution issues fixed in APSB15-32↗2015-12-08
▶
CVE-2015-8445 — Adobe AIR vulnerability | cvebase