Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)

🗓️ 30 Jun 2015 14:33:56Reported by joukoType

Internet-based attacker can run Flash apps in local sandboxes using special URL schemes (PSIRT-3299, CVE-2015-3079). Flaw allows circumvention of Flash Player sandbox logic to promote local sandbox to "local trusted" for unlimited cross-domain access. Patches applied in May 201

Reporter	Title	Published	Views	Family All 110
FreeBSD	Adobe Flash Player -- critical vulnerabilities	14 Apr 201500:00	–	freebsd
FreeBSD	Adobe Flash Player -- critical vulnerabilities	12 May 201500:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt43	15 Apr 201500:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt44	15 May 201500:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt43	15 Apr 201500:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt44	15 May 201500:00	–	altlinux
Tenable Nessus	Google Chrome < 42.0.2311.152 Multiple Vulnerabilities	16 Jun 201500:00	–	nessus
Tenable Nessus	Flash Player < 13.0.0.289 / 17.0.0.188 Multiple Vulnerabilities (APSB15-09)	10 Jul 201500:00	–	nessus
Tenable Nessus	Adobe AIR < 17.0.0.172 Multiple Vulnerabilities (APSB15-09)	10 Jul 201500:00	–	nessus
Tenable Nessus	Flash Player < 17.0.0.189 (inferred) Multiple Vulnerabilities (APSB15-06 through 11)	24 Jul 201500:00	–	nessus

18 Oct 2019 13:00Current

5.9Medium risk

Vulners AI Score5.9

EPSS0.09395

$2000