peter bassill · operator
$ cve CVE-2015-0313 JSON

CVE-2015-0313 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 95.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-04.

Description

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS95.27% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-416
On CISA KEVyes — remediate by 2022-05-04
Public exploityes
Published2015-02-02
Last modified2026-06-17

CISA KEV

NameAdobe Flash Player Use-After-Free Vulnerability
Added2022-04-13
Due2022-05-04
Vendor / productAdobe / Flash Player
Ransomware usenone reported

Affected (16)

VendorProduct
adobeflash player
applemac os x
linuxlinux kernel
microsoftedge
microsoftinternet explorer
microsoftwindows
microsoftwindows 10 1507
microsoftwindows 8
microsoftwindows 8.1
microsoftwindows rt
microsoftwindows rt 8.1
microsoftwindows server 2012
opensuseevergreen
opensuseopensuse
suselinux enterprise desktop
suselinux enterprise workstation extension

Public exploits

SourceTitleDate
exploit-dbAdobe Flash Player - ByteArray With Workers Use-After-Free (Metasploit)2015-03-31
exploit-dbAdobe Flash Player - Arbitrary Code Execution2015-03-25

References

→ the Explorer  ·  watch your stack  ·  NVD