peter bassill · operator
$ cve CVE-2015-5122 JSON

CVE-2015-5122 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 94% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-04.

Description

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS93.98% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-416
On CISA KEVyes — remediate by 2022-05-04
Public exploityes
Published2015-07-14
Last modified2026-06-17

CISA KEV

NameAdobe Flash Player Use-After-Free Vulnerability
Added2022-04-13
Due2022-05-04
Vendor / productAdobe / Flash Player
Ransomware usenone reported

Affected (14)

VendorProduct
adobeflash player
adobeflash player desktop runtime
applemacos
linuxlinux kernel
microsoftwindows
microsoftwindows 8
microsoftwindows 8.1
opensuseevergreen
redhatenterprise linux desktop
redhatenterprise linux server
redhatenterprise linux server eus
redhatenterprise linux workstation
suselinux enterprise desktop
suselinux enterprise workstation extension

Public exploits

SourceTitleDate
exploit-dbAdobe Flash - opaqueBackground Use-After-Free (Metasploit)2015-07-13

References

→ the Explorer  ·  watch your stack  ·  NVD