Adobe Flash Player Vulnerability (CVE-2015-5122)

Publish date: August 16, 2015
  Severity: CRITICAL
  CVE Identifier: CVE-2015-5122
  Advisory Date: JUL 12, 2015

  DESCRIPTION

This is the a zero-day vulnerability disclosed from the Hacking Team leak. It affects all versions of Flash Player for Windows, Mac, and Linux. The bug is a Use-After-Free vulnerability involving the methods TextBlock.createTextLine() and TextBlock.recreateTextLine(textLine). If exploited, it could result in a crash that would allow an attacker to take control of the vulnerable system.

As of this writing, only a proof-of-concept exists; we are continuously monitoring to see if this has been exploited in the wild.

  TREND MICRO PROTECTION INFORMATION

Vulnerability protection in Trend Micro Deep Security protects user systems from threats that may leverage this vulnerability with the following DPI rule:

  • 1006858 – Adobe Flash ActionScript3 opaqueBackground Use After Free Vulnerability (CVE-2015-5122)

  SOLUTION

  AFFECTED SOFTWARE AND VERSION

  • Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh
  • Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome
  • Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh
  • Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux

Featured Stories