peter bassill · operator
$ cve CVE-2015-3113 JSON

CVE-2015-3113 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-04.

Description

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS99.94% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-787
On CISA KEVyes — remediate by 2022-05-04
Public exploityes
Published2015-06-23
Last modified2026-06-17

CISA KEV

NameAdobe Flash Player Heap-Based Buffer Overflow Vulnerability
Added2022-04-13
Due2022-05-04
Vendor / productAdobe / Flash Player
Ransomware usenone reported

Affected (18)

VendorProduct
adobeflash player
applemac os x
hpinsight orchestration
hpsystem management homepage
hpsystems insight manager
hpversion control agent
hpversion control repository manager
hpvirtual connect enterprise manager
linuxlinux kernel
microsoftwindows
opensuseevergreen
opensuseopensuse
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux workstation
suselinux enterprise desktop
suselinux enterprise workstation extension

Public exploits

SourceTitleDate
exploit-dbAdobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)2015-07-08

References

→ the Explorer  ·  watch your stack  ·  NVD