{"id":"CVE-2015-5571","published":"2015-09-22T10:00:00Z","modified":"2024-08-06T06:50:02Z","title":"Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux…","vendor":null,"product":null,"tier":"tail","description":{"text":"Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.  NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03178,"percentile":0.88008,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-1814.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.securitytracker.com/id/1033629","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04939841","tags":["x_refsource_CONFIRM"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","tags":["x_refsource_CONFIRM"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-23.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://security.gentoo.org/glsa/201509-07","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.securityfocus.com/bid/76803","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":17.6}]},"euvd":{"id":"EUVD-2015-5525","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hapi-cve-2014-4671","parents":[{"from":"CVE-2014-4671","to":"CVE-2015-5571","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333.","from":"CVE.org","in":"CVE-2015-5571"}]},{"from":"CVE-2014-5333","to":"CVE-2015-5571","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333.","from":"CVE.org","in":"CVE-2015-5571"}]}]}}