Release date: July 8, 2015
Last updated: July 17, 2015
Vulnerability identifier: APSB15-16
Priority: See table below
CVE number: CVE-2014-0578, CVE-2015-3097, CVE-2015-3114, CVE-2015-3115, CVE-2015-3116, CVE-2015-3117, CVE-2015-3118, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-3123, CVE-2015-3124, CVE-2015-3125, CVE-2015-3126, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3130, CVE-2015-3131, CVE-2015-3132, CVE-2015-3133, CVE-2015-3134, CVE-2015-3135, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4429, CVE-2015-4430, CVE-2015-4431, CVE-2015-4432, CVE-2015-4433, CVE-2015-5116, CVE-2015-5117, CVE-2015-5118, CVE-2015-5119, CVE-2015-5124
Platform: All Platforms
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published.
|Adobe Flash Player Desktop Runtime||18.104.22.168 and earlier
||Windows and Macintosh
|Adobe Flash Player Extended Support Release||22.214.171.1246 and earlier||Windows and Macintosh
|Adobe Flash Player for Google Chrome||126.96.36.199 and earlier||Windows, Macintosh and Linux
|Adobe Flash Player for Internet Explorer 10 and Internet Explorer 11||188.8.131.52 and earlier||Windows 8.0 and 8.1|
|Adobe Flash Player||184.108.40.2068 and earlier||Linux|
|AIR Desktop Runtime||220.127.116.11 and earlier||Windows and Macintosh
|AIR SDK||18.104.22.168 and earlier||Windows, Macintosh, Android and iOS|
|AIR SDK & Compiler||22.214.171.124 and earlier||Windows, Macintosh, Android and iOS|
- To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system.
- To verify the version of Adobe AIR installed on your system, follow the instructions in the Adobe AIR TechNote.
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
|Flash Player Desktop Runtime
||126.96.36.199||Windows and Macintosh
||1||Flash Player Download Center Flash Player Distribution|
|Flash Player Extended Support Release||188.8.131.522||Windows and Macintosh
|Flash Player for Linux||184.108.40.2061||Linux||3||Flash Player Download Center|
|Flash Player for Google Chrome||220.127.116.11||Windows and Macintosh||1||Google Chrome Releases|
|Flash Player for Google Chrome||18.104.22.168||Linux||3||Google Chrome Releases|
|Flash Player for Internet Explorer 10 and Internet Explorer 11||22.214.171.124||Windows 8.0 and 8.1
||1||Microsoft Security Advisory|
|AIR Desktop Runtime||126.96.36.199||Windows and Macintosh||3||AIR Download Center|
|AIR SDK||188.8.131.52||Windows, Macintosh, Android and iOS||3||AIR SDK Download|
|AIR SDK & Compiler||184.108.40.206||Windows, Macintosh, Android and iOS||3||AIR SDK Download|
- Adobe recommends users of the Adobe Flash Player Desktop Runtime for Windows and Macintosh update to Adobe Flash Player 220.127.116.11 by visiting the Adobe Flash Player Download Center or via the update mechanism within the product when prompted .
- Adobe recommends users of the Adobe Flash Player Extended Support Release  update to version 18.104.22.1682 by visiting http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html.
- Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 22.214.171.1241 by visiting the Adobe Flash Player Download Center.
- Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 126.96.36.199 on Windows and Macintosh, and Flash Player 188.8.131.52 on Linux.
- Adobe Flash Player installed with Internet Explorer for Windows 8.x will be automatically updated to the latest version, which will include Adobe Flash Player 184.108.40.206.
- Please visit the Flash Player Help page for assistance in installing Flash Player.
- These updates improve memory address randomization of the Flash heap for the Window 7 64-bit platform (CVE-2015-3097).
- These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-3135, CVE-2015-4432, CVE-2015-5118).
- These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431, CVE-2015-5124).
- These updates resolve null pointer dereference issues (CVE-2015-3126, CVE-2015-4429).
- These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3114).
- These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433).
- These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119).
- These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116).
Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:
- Ben Hawkes of Google Project Zero (CVE-2015-4430)
- bilou, working with the Chromium Vulnerability Rewards Program (CVE-2015-3118, CVE-2015-3128)
- Chris Evans of Google Project Zero (CVE-2015-3097, CVE-2015-5118)
- Chris Evans, Ben Hawkes, Mateusz Jurczyk of Google Project Zero (CVE-2015-4432)
- David Kraftsow (dontsave) working with HP's Zero Day Initiative (CVE-2015-3125)
- instruder of Alibaba Security Threat Information (CVE-2015-3133)
- Kai Kang of Tencent's Xuanwu Lab (CVE-2015-4429, CVE-2015-5124)
- Kai Lu of Fortinet's FortiGuard Labs (CVE-2015-3117)
- Jihui Lu of KEEN Team (CVE-2015-3124)
- Malte Batram (CVE-2015-3115, CVE-2015-3116)
- Mateusz Jurczyk of Google Project Zero (CVE-2015-3123)
- Natalie Silvanovich of Google Project Zero (CVE-2015-3130, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433, CVE-2015-5117, CVE-2015-3127, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428)
- Soroush Dalili from NCC Group (CVE-2015-3114, CVE-2014-0578)
- willJ of Tencent PC Manager (CVE-2015-3126)
- Yuki Chen of Qihoo 360 Vulcan Team (CVE-2015-3134, CVE-2015-3135, CVE-2015-4431)
- Zręczny Gamoń (CVE-2015-5116)
- Google Project Zero and Morgan Marquis-Boire (CVE-2015-5119)