NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2015-5119

Adobe Flash Player Use-After-Free Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-03. Federal due date: 2022-03-24.

The impacted product is end-of-life and should be disconnected if still in use.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

Affected products

VendorProductAffected versions
AdobeFlash Player
from 13.0.0.182 through 13.0.0296
from 14.0.0.125 through 18.0.0.194
through 11.2.202.468
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0
RedhatEnterprise Linux Eus
Version 6.6
RedhatEnterprise Linux Server
Versions 5.0, 6.0
RedhatEnterprise Linux Server Aus
Version 6.6
RedhatEnterprise Linux Server From Rhui
Versions 5.0, 6.0
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0
OpensuseEvergreen
Version 11.4
OpensuseOpensuse
Versions 13.1, 13.2
SuseLinux Enterprise Desktop
Versions 11, 12
SuseLinux Enterprise Workstation Extension
Version 12

Weakness classification

CWE-416

References