--- title: "CVE-2015-5571\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2015-5571?format=md keywords: index, follow --- # CVE-2015-5571 Publication date 22 September 2015 Last updated 24 July 2024 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | adobe-flashplugin | 15.04 vivid | Fixed 1:20150921.1-0vivid1 | | 14.04 LTS trusty | Fixed 1:20150921.1-0trusty1 | | 12.04 LTS precise | Fixed 1:20150921.1-0precise1 | | flashplugin-nonfree | 15.04 vivid | Fixed 11.2.202.521ubuntu0.15.04.1 | | 14.04 LTS trusty | Fixed 11.2.202.521ubuntu0.14.04.1 | | 12.04 LTS precise | Fixed 11.2.202.521ubuntu0.12.04.1 | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5571) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-5571) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2015-5571) * [Debian](https://security-tracker.debian.org/tracker/CVE-2015-5571) ### Other references * *