First published: Wed Nov 11 2015(Updated: )
Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation.
Credit: psirt@adobe.com
Affected Software | Affected Version | How to fix |
---|---|---|
Adobe Flash Player for Internet Explorer 11 | <=11.2.202.540 | |
Linux Kernel | ||
Adobe AIR | <=19.0.0.213 | |
macOS Yosemite | ||
Microsoft Windows | ||
Adobe Flash Player for Internet Explorer 11 | <=18.0.0.255 | |
Adobe Flash Player for Internet Explorer 11 | =19.0.0.185 | |
Adobe Flash Player for Internet Explorer 11 | =19.0.0.207 | |
Adobe Flash Player for Internet Explorer 11 | =19.0.0.226 | |
Adobe AIR | <=19.0.0.190 | |
Google Android | ||
Adobe AIR SDK and Compiler | <=19.0.0.213 | |
Adobe AIR SDK & Compiler | <=19.0.0.213 | |
Apple iPhone OS |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2015-7659 has a critical severity rating due to its potential to allow arbitrary code execution.
To mitigate CVE-2015-7659, update Adobe Flash Player to version 18.0.0.261 or later, or to version 19.0.0.245 or later.
CVE-2015-7659 affects Adobe Flash Player versions prior to 18.0.0.261, 19.x versions before 19.0.0.245, and Adobe AIR before 19.0.0.241.
CVE-2015-7659 impacts Adobe Flash Player, Adobe AIR, and Adobe AIR SDK on various platforms including Windows and macOS.
There is no known workaround for CVE-2015-7659, the recommended action is to update to a non-vulnerable version.