Buffer overflow in Adobe Air
CVE-2015-8654
Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.063 (93.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 93.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.063 · newest: 0.063 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- helpx.adobe.com/security/products/flash-player/apsb15-32.html (Patch, Vendor Advisory)
- www.securityfocus.com/bid/84160 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.zerodayinitiative.com/advisories/ZDI-15-658 (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2015-8654?
- CVE-2015-8654 is a high-severity vulnerability in Adobe Air, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2016-03-04.
- How severe is CVE-2015-8654?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2015-8654 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.