Release date: July 10, 2015
Last Updated: August 10, 2015
Vulnerability identifier: APSA15-04
CVE number: CVE-2015-5122, CVE-2015-5123
Platform: Windows, Macintosh and Linux
Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified in Adobe Flash Player 220.127.116.11 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.
Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly. Adobe expects to make updates available during the week of July 12, 2015.
UPDATE (July 14): Adobe recommends users update their product installations to the latest versions using the instructions provided in the "Solution" section in Security Bulletin APSB15-18.
- Adobe Flash Player 18.104.22.168 and earlier versions for Windows and Macintosh
- Adobe Flash Player 22.214.171.124 and earlier versions for Linux installed with Google Chrome
- Adobe Flash Player Extended Support Release version 126.96.36.1992 and earlier 13.x versions for Windows and Macintosh
- Adobe Flash Player Extended Support Release version 188.8.131.521 and earlier 11.x versions for Linux
To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system.
Adobe categorizes these issues as critical vulnerabilities
Adobe would like to thank the following individuals and organizations for reporting these issues and for working with Adobe to help protect our customers:
- Dhanesh Kizhakkinan of FireEye as well as Peter Pi of TrendMicro (CVE-2015-5122)
- Peter Pi of TrendMicro as well as slipstream/RoL (@TheWack0lian) (CVE-2015-5123)