# MA-515.082015: MyCERT Advisory - Adobe Releases Security Update for ColdFusion

**Date:** 31 Aug 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-515.082015  
**Advisory ID:** MA-515.082015

---

#### **1.0 Introduction**
Adobe has released a security hotfix for ColdFusion version 11 and 10 to address vulnerability. Users and administrators are encouraged to review the Adobe Security Bulletin APSB15-21 and apply the necessary update.
**2.0 Impact**
These updates address vulnerabilities that could potentially allow a remote attacker to read arbitrary files through the parsing of crafted XML external entities and to obtain sensitive information from an affected system.
**3.0 Affected Products**
The detail lists of the affected products are as below:
|  |
| --- | --- | --- | **Product** | **Affected Versions** | **Platform** | ColdFusion 11 | Update 5 and earlier versions | All | ColdFusion 10 | Update 16 and earlier versions | All |
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products:
4.1 ColdFusion 11 – Update 6
[http://helpx.adobe.com/coldfusion/kb/coldfusion-11-update-6.html](Product	Affected Versions	Platform ColdFusion 11	Update 5 and earlier versions	All ColdFusion 10	Update 16 and earlier versions	All)
4.2 ColdFusion 10 – Update 17
<http://helpx.adobe.com/coldfusion/kb/coldfusion-10-update-17.html>
4.3 Users should also apply the security configuration settings as outlined on theCold Fusion Security page:
<https://wikidocs.adobe.com/wiki/display/coldfusionen/AdministeringColdFusion+Security>
Please also review:
• ColdFusion 11 Lockdown Guide
<http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf>
• ColdFusion 10 Lockdown Guide.
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion-enterprise/pdf/cf10-lockdown-guide.pdf](http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf)
This hotfix resolves an issue associated with the parsing of crafted XML external entities in BlazeDS that could lead to information disclosure (CVE-2015-3269).
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#57342e3532256e6e6e17342e35322524323422253e232e793a2e) or [[email protected]](/cdn-cgi/l/email-protection#45283c2620373105283c262037316b2a37226b283c)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• Adobe Releases Security Update for ColdFusion: <https://www.us-cert.gov/ncas/current-activity/2015/08/28/Adobe-Releases-Security-Update-ColdFusion>
• Security Update: Hotfix Available for ColdFusion: <https://helpx.adobe.com/security/products/coldfusion/apsb15-21.html>
• Adobe Issues Hotfix Patch for ColdFusion Vulnerability: <http://www.zdnet.com/article/adobe-issues-hotfix-patch-for-coldfusion-vulnerability/>