CVE-2015-3085

2015-05-1311:00:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2015-3085

adobe flash player

adobe air

filesystem write operations

remote attackers

security vulnerability

6.4 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.013 Low

EPSS

Percentile

85.9%

JSON

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3083.

CPENameOperatorVersion
adobe:air_sdkadobe air sdkle17.0.0.144
adobe:airadobe airle17.0.0.144
adobe:air_sdk_\&_compileradobe air sdk \& compilerle17.0.0.144
adobe:flash_playeradobe flash playerle13.0.0.264
adobe:flash_playeradobe flash playereq14.0.0.125
adobe:flash_playeradobe flash playereq14.0.0.145
adobe:flash_playeradobe flash playereq14.0.0.176
adobe:flash_playeradobe flash playereq14.0.0.179
adobe:flash_playeradobe flash playereq15.0.0.152
adobe:flash_playeradobe flash playereq15.0.0.167

CPE	Name	Operator	Version
adobe:air_sdk	adobe air sdk	le	17.0.0.144
adobe:air	adobe air	le	17.0.0.144
adobe:air_sdk_\&_compiler	adobe air sdk \& compiler	le	17.0.0.144
adobe:flash_player	adobe flash player	le	13.0.0.264
adobe:flash_player	adobe flash player	eq	14.0.0.125
adobe:flash_player	adobe flash player	eq	14.0.0.145
adobe:flash_player	adobe flash player	eq	14.0.0.176
adobe:flash_player	adobe flash player	eq	14.0.0.179
adobe:flash_player	adobe flash player	eq	15.0.0.152
adobe:flash_player	adobe flash player	eq	15.0.0.167