Adobe Security Bulletin

Release date: July 8, 2015

Last updated: July 17, 2015

Vulnerability identifier: APSB15-16

Priority: See table below

CVE number: CVE-2014-0578, CVE-2015-3097, CVE-2015-3114, CVE-2015-3115, CVE-2015-3116, CVE-2015-3117, CVE-2015-3118, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-3123, CVE-2015-3124, CVE-2015-3125, CVE-2015-3126, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3130, CVE-2015-3131, CVE-2015-3132, CVE-2015-3133, CVE-2015-3134, CVE-2015-3135, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4429, CVE-2015-4430, CVE-2015-4431, CVE-2015-4432, CVE-2015-4433, CVE-2015-5116, CVE-2015-5117, CVE-2015-5118, CVE-2015-5119, CVE-2015-5124

Platform: All Platforms

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published. 

• To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system.  
• To verify the version of Adobe AIR installed on your system, follow the instructions in the Adobe AIR TechNote. 

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

• Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 18.0.0.203 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted [1].
• Adobe recommends users of the Adobe Flash Player Extended Support Release [2] update to version 13.0.0.302 by visiting http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html.
• Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.481 by visiting the Adobe Flash Player Download Center.
• Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 18.0.0.203 on Windows and Macintosh, and Flash Player 18.0.0.204 on Linux.
• Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 18.0.0.203.
• Please visit the Flash Player Help page for assistance in installing Flash Player.

• These updates improve memory address randomization of the Flash heap for the Window 7 64-bit platform (CVE-2015-3097).
• These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118).
• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431, CVE-2015-5124).
• These updates resolve null pointer dereference issues (CVE-2015-3126, CVE-2015-4429).
• These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3114).
• These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119).
• These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116).
  

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

• Ben Hawkes of Google Project Zero (CVE-2015-4430)
• bilou, working with the Chromium Vulnerability Rewards Program (CVE-2015-3118, CVE-2015-3128)
• Chris Evans of Google Project Zero (CVE-2015-3097, CVE-2015-5118)
• Chris Evans, Ben Hawkes, Mateusz Jurczyk of Google Project Zero (CVE-2015-4432)
• David Kraftsow (dontsave) working with HP's Zero Day Initiative (CVE-2015-3125)
• instruder of Alibaba Security Threat Information (CVE-2015-3133)
• Kai Kang of Tencent's Xuanwu Lab (CVE-2015-4429, CVE-2015-5124)
• Kai Lu of Fortinet's FortiGuard Labs (CVE-2015-3117)
• Jihui Lu of KEEN Team (CVE-2015-3124)
• Malte Batram (CVE-2015-3115, CVE-2015-3116)
• Mateusz Jurczyk of Google Project Zero (CVE-2015-3123)
• Natalie Silvanovich of Google Project Zero (CVE-2015-3130, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433, CVE-2015-5117, CVE-2015-3127, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428)
• Soroush Dalili from NCC Group (CVE-2015-3114, CVE-2014-0578)
• willJ of Tencent PC Manager (CVE-2015-3126)
• Yuki Chen of Qihoo 360 Vulcan Team (CVE-2015-3134, CVE-2015-3135, CVE-2015-4431)
• Zręczny Gamoń (CVE-2015-5116)
• Google Project Zero and Morgan Marquis-Boire (CVE-2015-5119)
  

July 17, 2015: Updated to include an additional CVE (CVE-2015-5124) resolved in these updates but inadvertently omitted from the bulletin.