CVE-2015-3090
EXPLOITEDAdobe Flash Player ShaderJob Buffer Overflow
Title source: metasploitExploitation Summary
CVE-2015-3090 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, Xattam1, Chris Evans, Unknown, juan vazquez, including a Metasploit module exploits/multi/browser/adobe_flash_shader_job_overflow.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in Adobe Flash Player's ShaderJob functionality (CVE-2015-3090) by manipulating Bitmap objects to achieve remote code execution. It delivers a malicious SWF file via a crafted HTML page targeting vulnerable Flash versions on Windows and Linux.
Description
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.
Exploits (3)
This Metasploit module exploits a buffer overflow in Adobe Flash Player's ShaderJob functionality (CVE-2015-3090) by manipulating Bitmap objects to achieve remote code execution. It delivers a malicious SWF file via a crafted HTML page targeting vulnerable Flash versions on Windows and Linux.
This repository contains a Python3 script that hosts a web server to exploit multiple Adobe Flash vulnerabilities (CVE-2015-3090, CVE-2015-3105, CVE-2015-5119, CVE-2015-5122) by delivering malicious SWF files and executing a base64-encoded payload. The exploit supports both direct HTML and XSS-based attack paths.
This Metasploit module exploits a buffer overflow in Adobe Flash Player's ShaderJob by manipulating the 'width' attribute after starting the job, allowing controlled buffer overflow conditions. It targets specific versions of Flash on Windows and Linux via a crafted SWF file delivered through an HTML page.