CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 98.62% probability · 100th percentile
- Public exploits
- 1 in Exploit-DB · verified · first 8 July 2015
- CISA KEV
- Listed 3 March 2022 · due 24 March 2022
- Weakness
- CWE-416
- Affected
- adobe/flash player · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server from rhui · redhat/enterprise linux workstation · opensuse/evergreen · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise workstation extension
- Source
- psirt@adobe.com
EPSS 98.6% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2015-5119
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00016.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1214.htmlThird Party Advisory
- http://twitter.com/w3bd3vil/statuses/618168863708962816Broken Link
- http://www.kb.cert.org/vuls/id/561288Third Party Advisory, US Government Resource
- http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_hacking_team_uafThird Party Advisory
- http://www.securityfocus.com/bid/75568Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032809Broken Link, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/ncas/alerts/TA15-195AThird Party Advisory, US Government Resource
- https://helpx.adobe.com/security/products/flash-player/apsa15-03.htmlBroken Link, Patch, Vendor Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb15-16.htmlBroken Link, Patch, Vendor Advisory
- https://packetstormsecurity.com/files/132600/Adobe-Flash-Player-ByteArray-Use-After-Free.htmlExploit, Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201507-13Third Party Advisory
- http://blog.trendmicro.com/trendlabs-security-intelligence/unpatched-flash-player-flaws-more-pocs-found-in-hacking-team-leak/Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00016.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00017.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00018.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1214.htmlThird Party Advisory
- http://twitter.com/w3bd3vil/statuses/618168863708962816Broken Link
- http://www.kb.cert.org/vuls/id/561288Third Party Advisory, US Government Resource
- http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_hacking_team_uafThird Party Advisory
- http://www.securityfocus.com/bid/75568Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032809Broken Link, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/ncas/alerts/TA15-195AThird Party Advisory, US Government Resource
- https://helpx.adobe.com/security/products/flash-player/apsa15-03.htmlBroken Link, Patch, Vendor Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb15-16.htmlBroken Link, Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.