Adobe has released security updates for Adobe Flash Player and Adobe Reader. These updates address dozens of vulnerabilities that could potentially allow an attacker to take control of the affected system.
The details of the vulnerabilities and their CVE follow.
For Adobe Flash Player :
Memory corruption vulnerabilities that could lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090, CVE-2015-3093).
Heap overflow that could lead to code execution (CVE-2015-3088).
Time-of-check time-of-use (TOCTOU) race condition that could be exploited to bypass Protected Mode in Internet Explorer (CVE-2015-3081).
Validation bypass issues that could be exploited to write arbitrary data to the file system under user permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
An integer overflow vulnerability that could lead to code execution (CVE-2015-3087).
Type confusion that could lead to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
These updates resolve a use-after-free vulnerability that could lead to code execution (CVE-2015-3080).
Memory leaks that could be used to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
Security bypass that could lead to information disclosure (CVE-2015-3079), and provide additional hardening to protect against CVE-2015-3044.
For Adobe Reader :
Use-after-free vulnerabilities that could lead to code execution (CVE-2015-3053, CVE-2015-3054, CVE-2015-3055, CVE-2015-3059, CVE-2015-3075).
Heap-based buffer overflow that could lead to code execution (CVE-2014-9160).
Buffer overflow that could lead to code execution (CVE-2015-3048).
Memory corruptions that could lead to code execution (CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052,
CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, CVE-2015-3076).Memory leak (CVE-2015-3058).
Restriction bypass on Javascript API execution (CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064,
CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071,
CVE-2015-3072, CVE-2015-3073, CVE-2015-3074).Null-pointer dereference that could lead to a denial-of-service condition (CVE-2015-3047).
Additional hardening to protect against CVE-2014-8452, a vulnerability in the handling of XML external entities that could lead to information disclosure.
