CVE-2015-3043: Adobe Flash Player Memory Corruption Vulnerability
First published: Tue Apr 14 2015(Updated: )
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | ||
| All of | ||
| Adobe Acrobat Reader | <11.2.202.457 | |
| Linux Kernel | ||
| All of | ||
| Any of | ||
| Adobe Acrobat Reader | <13.0.0.281 | |
| Adobe Acrobat Reader | >=14.0.0.125<17.0.0.169 | |
| Any of | ||
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| SUSE Linux Enterprise Desktop | =11.0-sp3 | |
| SUSE Linux Enterprise Desktop | =12.0 | |
| SUSE Linux Enterprise Workstation Extension | =12.0 | |
| openSUSE Evergreen | =11.4 | |
| openSUSE | =13.1 | |
| openSUSE | =13.2 | |
| redhat enterprise Linux desktop | =5.0 | |
| redhat enterprise Linux desktop | =6.0 | |
| redhat enterprise Linux eus | =6.6 | |
| redhat enterprise Linux server | =5.0 | |
| redhat enterprise Linux server | =6.0 | |
| redhat enterprise Linux server aus | =6.6 | |
| Red Hat Enterprise Linux Server Supplementary EUS | =5.0 | |
| Red Hat Enterprise Linux Server Supplementary EUS | =6.0 | |
| redhat enterprise Linux workstation | =5.0 | |
| redhat enterprise Linux workstation | =6.0 | |
| Adobe Acrobat Reader | <=11.2.202.451 | |
| Linux Kernel | ||
| Adobe Acrobat Reader | <=13.0.0.264 | |
| Adobe Acrobat Reader | =14.0.0.125 | |
| Adobe Acrobat Reader | =14.0.0.145 | |
| Adobe Acrobat Reader | =14.0.0.176 | |
| Adobe Acrobat Reader | =14.0.0.179 | |
| Adobe Acrobat Reader | =15.0.0.152 | |
| Adobe Acrobat Reader | =15.0.0.167 | |
| Adobe Acrobat Reader | =15.0.0.189 | |
| Adobe Acrobat Reader | =15.0.0.223 | |
| Adobe Acrobat Reader | =15.0.0.239 | |
| Adobe Acrobat Reader | =15.0.0.246 | |
| Adobe Acrobat Reader | =16.0.0.235 | |
| Adobe Acrobat Reader | =16.0.0.257 | |
| Adobe Acrobat Reader | =16.0.0.287 | |
| Adobe Acrobat Reader | =16.0.0.296 | |
| Adobe Acrobat Reader | =17.0.0.134 | |
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| redhat enterprise linux desktop supplementary | =5.0-client | |
| redhat enterprise linux desktop supplementary | =6.0 | |
| Red Hat Enterprise Linux Server Supplementary | =6.0 | |
| Red Hat Enterprise Linux Server Supplementary EUS | =6.6.z | |
| Red Hat Enterprise Linux Supplementary | =5.0-server | |
| Red Hat Enterprise Linux Workstation Supplementary | =6.0 | |
| All of | ||
| <11.2.202.457 | ||
| All of | ||
| Any of | ||
| <13.0.0.281 | ||
| >=14.0.0.125<17.0.0.169 | ||
| Any of | ||
| =11.0-sp3 | ||
| =12.0 | ||
| =12.0 | ||
| =11.4 | ||
| =13.1 | ||
| =13.2 | ||
| =5.0 | ||
| =6.0 | ||
| =6.6 | ||
| =5.0 | ||
| =6.0 | ||
| =6.6 | ||
| =5.0 | ||
| =6.0 | ||
| =5.0 | ||
| =6.0 |
Remedy
The impacted product is end-of-life and should be disconnected if still in use.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html
- http://rhn.redhat.com/errata/RHSA-2015-0813.html
- http://www.securityfocus.com/bid/74062
- http://www.securitytracker.com/id/1032105
- https://helpx.adobe.com/security/products/flash-player/apsb15-06.html
- https://security.gentoo.org/glsa/201504-07
- https://www.exploit-db.com/exploits/37536/
- https://nvd.nist.gov/vuln/detail/CVE-2015-3043
Frequently Asked Questions
What is the severity of CVE-2015-3043?
CVE-2015-3043 has a high severity rating as it allows attackers to execute arbitrary code or cause denial of service due to memory corruption.
How do I fix CVE-2015-3043?
To fix CVE-2015-3043, update Adobe Flash Player to version 17.0.0.169 or later.
Which versions of Adobe Flash Player are affected by CVE-2015-3043?
CVE-2015-3043 affects Adobe Flash Player versions prior to 13.0.0.281, 14.x through 17.x before 17.0.0.169, and 11.2.202.457 on Linux.
Can CVE-2015-3043 affect Linux systems running Adobe Flash Player?
Yes, CVE-2015-3043 affects Linux systems running Adobe Flash Player versions earlier than 11.2.202.457.
Is there a workaround for CVE-2015-3043 if I can't update Adobe Flash Player?
While the best approach is to update to the latest version, temporary mitigation includes disabling Flash Player in your browser or application until updated.
- agent/type
- agent/description
- agent/remedy
- agent/title
- agent/weakness
- agent/author
- agent/severity
- agent/first-publish-date
- agent/references
- agent/event
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- vendor/adobe
- canonical/adobe acrobat reader
- vendor/linux
- canonical/linux kernel
- version/adobe acrobat reader/14.0.0.125
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows
- vendor/novell
- canonical/suse linux enterprise desktop
- version/suse linux enterprise desktop/11.0-sp3
- version/suse linux enterprise desktop/12.0
- canonical/suse linux enterprise workstation extension
- version/suse linux enterprise workstation extension/12.0
- vendor/opensuse
- canonical/opensuse evergreen
- version/opensuse evergreen/11.4
- canonical/opensuse
- version/opensuse/13.1
- version/opensuse/13.2
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/5.0
- version/redhat enterprise linux desktop/6.0
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/6.6
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/5.0
- version/redhat enterprise linux server/6.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/6.6
- canonical/red hat enterprise linux server supplementary eus
- version/red hat enterprise linux server supplementary eus/5.0
- version/red hat enterprise linux server supplementary eus/6.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/5.0
- version/redhat enterprise linux workstation/6.0
- version/adobe acrobat reader/11.2.202.451
- version/adobe acrobat reader/13.0.0.264
- version/adobe acrobat reader/14.0.0.145
- version/adobe acrobat reader/14.0.0.176
- version/adobe acrobat reader/14.0.0.179
- version/adobe acrobat reader/15.0.0.152
- version/adobe acrobat reader/15.0.0.167
- version/adobe acrobat reader/15.0.0.189
- version/adobe acrobat reader/15.0.0.223
- version/adobe acrobat reader/15.0.0.239
- version/adobe acrobat reader/15.0.0.246
- version/adobe acrobat reader/16.0.0.235
- version/adobe acrobat reader/16.0.0.257
- version/adobe acrobat reader/16.0.0.287
- version/adobe acrobat reader/16.0.0.296
- version/adobe acrobat reader/17.0.0.134
- canonical/redhat enterprise linux desktop supplementary
- version/redhat enterprise linux desktop supplementary/5.0-client
- version/redhat enterprise linux desktop supplementary/6.0
- canonical/red hat enterprise linux server supplementary
- version/red hat enterprise linux server supplementary/6.0
- version/red hat enterprise linux server supplementary eus/6.6.z
- canonical/red hat enterprise linux supplementary
- version/red hat enterprise linux supplementary/5.0-server
- canonical/red hat enterprise linux workstation supplementary
- version/red hat enterprise linux workstation supplementary/6.0