Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.03873.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected
—

Configuration 1 [-]

AND
OR cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND
OR cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.134:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.169:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.188:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.190:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:17.0.0.191:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:18.0.0.160:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:18.0.0.194:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:18.0.0.203:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:18.0.0.209:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:18.0.0.232:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 5 Supplementary
flash-plugin-0:11.2.202.521-1.el5 cpe:/a:redhat:rhel_extras:5 RHSA-2015:1814 2015-09-22T00:00:00Z
Red Hat Enterprise Linux 6 Supplementary
flash-plugin-0:11.2.202.521-1.el6_7 cpe:/a:redhat:rhel_extras:6 RHSA-2015:1814 2015-09-22T00:00:00Z

No data.

Subscriptions

Vendors Products
Adobe Subscribe
Air Subscribe
Air Sdk Subscribe
Air Sdk \& Compiler Subscribe
Flash Player Subscribe
Apple Subscribe
Mac Os X Subscribe
Google Subscribe
Android Subscribe
Linux Subscribe
Linux Kernel Subscribe
Microsoft Subscribe
Windows Subscribe
Redhat Subscribe
Rhel Extras Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2015-5530 Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2015-1814.html cve-icon cve-icon
http://www.securityfocus.com/bid/76802 cve-icon cve-icon
http://www.securitytracker.com/id/1033629 cve-icon cve-icon
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04939841 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 cve-icon cve-icon
https://helpx.adobe.com/security/products/flash-player/apsb15-23.html cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2015-5576 cve-icon
https://security.gentoo.org/glsa/201509-07 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2015-5576 cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2024-08-06T06:50:02.918Z

Reserved: 2015-07-17T00:00:00.000Z

Link: CVE-2015-5576

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2015-09-22T10:59:08.967

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-5576

cve-icon Redhat

Severity : Moderate

Publid Date: 2015-09-21T00:00:00Z

Links: CVE-2015-5576 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses