cnvd - cnvd-2015-08511

cnvd-2015-08511

Vulnerability from cnvd

Title: 多款Adobe产品整数溢出漏洞（CNVD-2015-08511）

Description:

Adobe Flash Player、Adobe AIR SDK和Adobe AIR SDK & Compiler都是美国奥多比（Adobe）公司的产品。Adobe Flash Player是一款多媒体播放器产品；Adobe AIR SDK和Adobe AIR SDK & Compiler都是适用于Adobe AIR（一个跨操作系统的运行时环境）的标准开发工具包。

多款Adobe存在整数溢出漏洞。允许攻击者利用此漏洞通过未明向量执行任意代码。

Severity: 高

Patch Name: 多款Adobe产品整数溢出漏洞（CNVD-2015-08511）的补丁

Patch Description:

多款Adobe存在整数溢出漏洞。允许攻击者利用此漏洞通过未明向量执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://helpx.adobe.com/security/products/flash-player/apsb16-01.html

Reference: https://helpx.adobe.com/security/products/flash-player/apsb16-01.html

Impacted products

Name
['Adobe Flash Player(on Windows/OS X) \r\n19.x', 'Adobe Flash Player <18.0.0.324', 'Adobe Flash Player(on Windows/OS X) 20.x(<20.0.0.267)', 'Adobe AIR <20.0.0.233', 'Adobe AIR SDK & Compiler <20.0.0.233', 'Adobe AIR SDK <20.0.0.233']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-8651"
    }
  },
  "description": "Adobe Flash Player\u3001Adobe AIR SDK\u548cAdobe AIR SDK \u0026 Compiler\u90fd\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Adobe Flash Player\u662f\u4e00\u6b3e\u591a\u5a92\u4f53\u64ad\u653e\u5668\u4ea7\u54c1\uff1bAdobe AIR SDK\u548cAdobe AIR SDK \u0026 Compiler\u90fd\u662f\u9002\u7528\u4e8eAdobe AIR\uff08\u4e00\u4e2a\u8de8\u64cd\u4f5c\u7cfb\u7edf\u7684\u8fd0\u884c\u65f6\u73af\u5883\uff09\u7684\u6807\u51c6\u5f00\u53d1\u5de5\u5177\u5305\u3002\r\n\r\n\u591a\u6b3eAdobe\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u901a\u8fc7\u672a\u660e\u5411\u91cf\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Kai Wang and Hunter Gao of Huawei\u0027s IT Infrastructure \u0026 Security Dept, BPIT\u0026QM",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://helpx.adobe.com/security/products/flash-player/apsb16-01.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-08511",
  "openTime": "2015-12-30",
  "patchDescription": "Adobe Flash Player\u3001Adobe AIR SDK\u548cAdobe AIR SDK \u0026 Compiler\u90fd\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Adobe Flash Player\u662f\u4e00\u6b3e\u591a\u5a92\u4f53\u64ad\u653e\u5668\u4ea7\u54c1\uff1bAdobe AIR SDK\u548cAdobe AIR SDK \u0026 Compiler\u90fd\u662f\u9002\u7528\u4e8eAdobe AIR\uff08\u4e00\u4e2a\u8de8\u64cd\u4f5c\u7cfb\u7edf\u7684\u8fd0\u884c\u65f6\u73af\u5883\uff09\u7684\u6807\u51c6\u5f00\u53d1\u5de5\u5177\u5305\u3002\r\n\r\n\u591a\u6b3eAdobe\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u901a\u8fc7\u672a\u660e\u5411\u91cf\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eAdobe\u4ea7\u54c1\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2015-08511\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe Flash Player(on Windows/OS X) \r\n19.x",
      "Adobe Flash Player \u003c18.0.0.324",
      "Adobe Flash Player(on Windows/OS X) 20.x(\u003c20.0.0.267)",
      "Adobe AIR \u003c20.0.0.233",
      "Adobe AIR SDK \u0026 Compiler  \u003c20.0.0.233",
      "Adobe AIR SDK \u003c20.0.0.233"
    ]
  },
  "referenceLink": "https://helpx.adobe.com/security/products/flash-player/apsb16-01.html",
  "serverity": "\u9ad8",
  "submitTime": "2015-12-29",
  "title": "\u591a\u6b3eAdobe\u4ea7\u54c1\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2015-08511\uff09"
}

CVE-2015-8651 (GCVE-0-2015-8651)

Vulnerability from cvelistv5

Published

2015-12-28 23:00

Modified

2025-07-30 01:46

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

References

▼	URL	Tags
	http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00048.html	vendor-advisory, x_refsource_SUSE
	http://www.securitytracker.com/id/1034544	vdb-entry, x_refsource_SECTRACK
	http://rhn.redhat.com/errata/RHSA-2015-2697.html	vendor-advisory, x_refsource_REDHAT
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680	x_refsource_CONFIRM
	https://helpx.adobe.com/security/products/flash-player/apsb16-01.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/79705	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html	vendor-advisory, x_refsource_SUSE
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/201601-03	vendor-advisory, x_refsource_GENTOO
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2015:2403",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00048.html"
          },
          {
            "name": "1034544",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034544"
          },
          {
            "name": "RHSA-2015:2697",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-2697.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/flash-player/apsb16-01.html"
          },
          {
            "name": "79705",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/79705"
          },
          {
            "name": "SUSE-SU-2015:2401",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
          },
          {
            "name": "SUSE-SU-2015:2402",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html"
          },
          {
            "name": "openSUSE-SU-2015:2400",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html"
          },
          {
            "name": "GLSA-201601-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201601-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2015-8651",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T21:38:33.542604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-05-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-8651"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:46:41.373Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2022-05-25T00:00:00+00:00",
            "value": "CVE-2015-8651 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK \u0026 Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-16T10:57:01.000Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "name": "openSUSE-SU-2015:2403",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00048.html"
        },
        {
          "name": "1034544",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034544"
        },
        {
          "name": "RHSA-2015:2697",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-2697.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://helpx.adobe.com/security/products/flash-player/apsb16-01.html"
        },
        {
          "name": "79705",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/79705"
        },
        {
          "name": "SUSE-SU-2015:2401",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
        },
        {
          "name": "SUSE-SU-2015:2402",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html"
        },
        {
          "name": "openSUSE-SU-2015:2400",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html"
        },
        {
          "name": "GLSA-201601-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201601-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2015-8651",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK \u0026 Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2015:2403",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00048.html"
            },
            {
              "name": "1034544",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034544"
            },
            {
              "name": "RHSA-2015:2697",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-2697.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680"
            },
            {
              "name": "https://helpx.adobe.com/security/products/flash-player/apsb16-01.html",
              "refsource": "CONFIRM",
              "url": "https://helpx.adobe.com/security/products/flash-player/apsb16-01.html"
            },
            {
              "name": "79705",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/79705"
            },
            {
              "name": "SUSE-SU-2015:2401",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
            },
            {
              "name": "SUSE-SU-2015:2402",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html"
            },
            {
              "name": "openSUSE-SU-2015:2400",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html"
            },
            {
              "name": "GLSA-201601-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201601-03"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2015-8651",
    "datePublished": "2015-12-28T23:00:00.000Z",
    "dateReserved": "2015-12-23T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:46:41.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted