Gravité: : Critique
  Identifiant(s) CVE: : CVE-2015-5122
  Date du conseil: 12 juillet 2015

  Description

This is the a zero-day vulnerability disclosed from the Hacking Team leak. It affects all versions of Flash Player for Windows, Mac, and Linux. The bug is a Use-After-Free vulnerability involving the methods TextBlock.createTextLine() and TextBlock.recreateTextLine(textLine). If exploited, it could result in a crash that would allow an attacker to take control of the vulnerable system.

As of this writing, only a proof-of-concept exists; we are continuously monitoring to see if this has been exploited in the wild.

  Information Exposure Rating:

Vulnerability protection in Trend Micro Deep Security protects user systems from threats that may leverage this vulnerability with the following DPI rule:

  • 1006858 – Adobe Flash ActionScript3 opaqueBackground Use After Free Vulnerability (CVE-2015-5122)

  Solutions

  Affected software and version:

  • Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh
  • Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome
  • Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh
  • Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux