cnvd - cnvd-2015-04574

cnvd-2015-04574

Vulnerability from cnvd

Title: Adobe Flash Player及AIR跨域信息泄露漏洞（CNVD-2015-04574）

Description:

Adobe Flash Player是一个集成的多媒体播放器。Adobe AIR是针对网络与桌面应用的结合所开发出来的技术，可以不必经由浏览器而对网络上的云端程式做控制。

Adobe Flash Player及AIR在实现上存在跨域信息泄露漏洞。攻击者利用这些漏洞可查看其他域或安全区域的内容，获取敏感信息。

Severity: 中

Patch Name: Adobe Flash Player及AIR跨域信息泄露漏洞（CNVD-2015-04574）的补丁

Patch Description:

Adobe Flash Player及AIR在实现上存在跨域信息泄露漏洞。攻击者利用这些漏洞可查看其他域或安全区域的内容，获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

Adobe已经为此发布了一个安全公告（apsb15-16）以及相应补丁: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Reference: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3115

Impacted products

Name
['Adobe AIR <18.0.0.180', 'Adobe AIR SDK <18.0.0.180', 'Adobe AIR SDK & Compiler <18.0.0.180', 'Adobe Flash Player(on Windows/OS X) <13.0.0.302', 'Adobe Flash Player(on Windows/OS X) 14.x-18.x(<18.0.0.203)', 'Adobe Flash Player(on Linux) <11.2.202.481']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "75594"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-3115"
    }
  },
  "description": "Adobe Flash Player\u662f\u4e00\u4e2a\u96c6\u6210\u7684\u591a\u5a92\u4f53\u64ad\u653e\u5668\u3002Adobe AIR\u662f\u9488\u5bf9\u7f51\u7edc\u4e0e\u684c\u9762\u5e94\u7528\u7684\u7ed3\u5408\u6240\u5f00\u53d1\u51fa\u6765\u7684\u6280\u672f\uff0c\u53ef\u4ee5\u4e0d\u5fc5\u7ecf\u7531\u6d4f\u89c8\u5668\u800c\u5bf9\u7f51\u7edc\u4e0a\u7684\u4e91\u7aef\u7a0b\u5f0f\u505a\u63a7\u5236\u3002\r\n\r\nAdobe Flash Player\u53caAIR\u5728\u5b9e\u73b0\u4e0a\u5b58\u5728\u8de8\u57df\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u53ef\u67e5\u770b\u5176\u4ed6\u57df\u6216\u5b89\u5168\u533a\u57df\u7684\u5185\u5bb9\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Malte Batram",
  "formalWay": "Adobe\u5df2\u7ecf\u4e3a\u6b64\u53d1\u5e03\u4e86\u4e00\u4e2a\u5b89\u5168\u516c\u544a\uff08apsb15-16\uff09\u4ee5\u53ca\u76f8\u5e94\u8865\u4e01:\r\nhttps://helpx.adobe.com/security/products/flash-player/apsb15-16.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-04574",
  "openTime": "2015-07-16",
  "patchDescription": "Adobe Flash Player\u662f\u4e00\u4e2a\u96c6\u6210\u7684\u591a\u5a92\u4f53\u64ad\u653e\u5668\u3002Adobe AIR\u662f\u9488\u5bf9\u7f51\u7edc\u4e0e\u684c\u9762\u5e94\u7528\u7684\u7ed3\u5408\u6240\u5f00\u53d1\u51fa\u6765\u7684\u6280\u672f\uff0c\u53ef\u4ee5\u4e0d\u5fc5\u7ecf\u7531\u6d4f\u89c8\u5668\u800c\u5bf9\u7f51\u7edc\u4e0a\u7684\u4e91\u7aef\u7a0b\u5f0f\u505a\u63a7\u5236\u3002\r\n\r\nAdobe Flash Player\u53caAIR\u5728\u5b9e\u73b0\u4e0a\u5b58\u5728\u8de8\u57df\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u53ef\u67e5\u770b\u5176\u4ed6\u57df\u6216\u5b89\u5168\u533a\u57df\u7684\u5185\u5bb9\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Adobe Flash Player\u53caAIR\u8de8\u57df\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2015-04574\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe AIR \u003c18.0.0.180",
      "Adobe AIR SDK \u003c18.0.0.180",
      "Adobe AIR SDK \u0026 Compiler  \u003c18.0.0.180",
      "Adobe Flash Player(on Windows/OS X) \u003c13.0.0.302",
      "Adobe Flash Player(on Windows/OS X) 14.x-18.x(\u003c18.0.0.203)",
      "Adobe Flash Player(on Linux) \u003c11.2.202.481"
    ]
  },
  "referenceLink": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3115",
  "serverity": "\u4e2d",
  "submitTime": "2015-07-14",
  "title": "Adobe Flash Player\u53caAIR\u8de8\u57df\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2015-04574\uff09"
}

CVE-2015-3115 (GCVE-0-2015-3115)

Vulnerability from cvelistv5

Published

2015-07-09 16:00

Modified

2024-08-06 05:39

Severity ?

CWE

Summary

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.

References

▼	URL	Tags
	http://www.securitytracker.com/id/1032810	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/75594	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2015-1214.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/201507-13	vendor-advisory, x_refsource_GENTOO
	https://helpx.adobe.com/security/products/flash-player/apsb15-16.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:39:31.101Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1032810",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032810"
          },
          {
            "name": "75594",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75594"
          },
          {
            "name": "SUSE-SU-2015:1211",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html"
          },
          {
            "name": "RHSA-2015:1214",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-1214.html"
          },
          {
            "name": "SUSE-SU-2015:1214",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html"
          },
          {
            "name": "GLSA-201507-13",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201507-13"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/flash-player/apsb15-16.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-07-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK \u0026 Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-21T09:57:01",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "name": "1032810",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1032810"
        },
        {
          "name": "75594",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75594"
        },
        {
          "name": "SUSE-SU-2015:1211",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html"
        },
        {
          "name": "RHSA-2015:1214",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1214.html"
        },
        {
          "name": "SUSE-SU-2015:1214",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html"
        },
        {
          "name": "GLSA-201507-13",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201507-13"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://helpx.adobe.com/security/products/flash-player/apsb15-16.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2015-3115",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK \u0026 Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1032810",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1032810"
            },
            {
              "name": "75594",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75594"
            },
            {
              "name": "SUSE-SU-2015:1211",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.html"
            },
            {
              "name": "RHSA-2015:1214",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-1214.html"
            },
            {
              "name": "SUSE-SU-2015:1214",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.html"
            },
            {
              "name": "GLSA-201507-13",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201507-13"
            },
            {
              "name": "https://helpx.adobe.com/security/products/flash-player/apsb15-16.html",
              "refsource": "CONFIRM",
              "url": "https://helpx.adobe.com/security/products/flash-player/apsb15-16.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2015-3115",
    "datePublished": "2015-07-09T16:00:00",
    "dateReserved": "2015-04-09T00:00:00",
    "dateUpdated": "2024-08-06T05:39:31.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted