Adobe Flash ActionScript3 ByteArray Use After Free Vulnerability (CVE-2015-5119)

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: CRITICAL

  CVE Identifier: CVE-2015-5119

  Advisory Date: JUL 07, 2015

---

  DESCRIPTION

Adobe Flash Player contains a vulnerability in the ActionScript 3 ByteArray class, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Ref: http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  PATCH: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

  Trend Micro Deep Security DPI Rule Number: 1006824

Related Blog Entries

• OS X Zero-days on the Rise—A 2015 Midyear Review and Outlook on Advanced Attack Surfaces
• Hacking Team Flash Zero-Day Integrated Into Exploit Kits
• Unpatched Flash Player Flaw, More POCs Found in Hacking Team Leak
• Hacking Team Flash Zero-Day Tied To Attacks In Korea and Japan… on July 1
• A Look at the Open Type Font Manager Vulnerability from the Hacking Team Leak
• The Adobe Flash Conundrum: Old Habits Die Hard

Related Malware

• TROJ_FLASHUP.B
• TROJ_FLASHUP.A
• SWF_EXPLOYT.YYKI
• TROJ_NETISON.AB
• SWF_CVE20155119.GI