CVE-2015-8656: adobe air Out-of-bounds Write
Vulnerability summary
CVE-2015-8656 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in adobe air. EPSS estimates a 7.15% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 04-03-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
CVSS metrics
4 scores · 2 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
7.15%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.15% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Adobe6 products
- air≤ 19.0.0.241
- air_desktop_runtime≤ 19.0.0.241
- air_sdk≤ 19.0.0.241
- air_sdk_\&_compiler≤ 19.0.0.241
- flash_player≤ 11.2.202.548 | ≤ 18.0.0.261 | ≤ 19.0.0.245
Ubuntu1 product
- flashplugin-nonfree< 11.2.202.569ubuntu0.14.04.1
2 vendors · 7 products
References
5 links- helpx.adobe.com/security/products/flash-player/apsb15-32.htmlX Refsource CONFIRMPatchVendor AdvisoryREPORT