Product:
Adobe Flash Player
Summary
Adobe Flash Player versions 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X, as well as 11.x through 11.2.202.535 on Linux, allow remote attackers to execute arbitrary code via a crafted SWF file. This vulnerability was actively exploited in the wild in October 2015.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2015-7645 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious SWF file and host it on a website or send it directly to a user. When the user interacts with the crafted file, it can trigger the execution of arbitrary code on the victim’s system, leading to potential unauthorized access or control.
Affected Products
- Adobe Flash Player 18.x (up to 18.0.0.252) on Windows and OS X
- Adobe Flash Player 19.x (up to 19.0.0.207) on Windows and OS X
- Adobe Flash Player 11.x (up to 11.2.202.535) on Linux
Mitigation
The impacted product is end-of-life and should be disconnected if still in use. Users are strongly advised to remove Adobe Flash Player from their systems to prevent potential exploitation.
References
- Trend Micro Blog
- OpenSUSE Security Announcement 1
- OpenSUSE Security Announcement 2
- OpenSUSE Security Announcement 3
- OpenSUSE Security Announcement 4
- Packet Storm Security
- Red Hat Errata 1
- Red Hat Errata 2
- SecurityFocus BID
- SecurityTracker ID
- Adobe Security Advisory
- Adobe Security Bulletin
- Gentoo GLSA
- Exploit Database
- CISA Known Exploited Vulnerabilities