CVE-2015-3113: adobe flash player +14 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2015-3113

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,8%

Kerentanan Out-of-bounds Write pada adobe flash player, opensuse evergreen +13 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 13 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

Rincian

Terbit di NVD: 23 Juni 2015
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
CWE-122: Heap-based Buffer Overflow
EPSS (30 hari): 99,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Masuk KEV: 13 April 2022
Tenggat CISA: 4 Mei 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
adobe	flash player	Semua versi sebelum 13.0.0.296
adobe	flash player	Versi 14.0.0.125 hingga sebelum 18.0.0.194
adobe	flash player	Semua versi sebelum 11.2.202.468
opensuse	evergreen	Versi 11.4
opensuse	opensuse	Versi 13.1
opensuse	opensuse	Versi 13.2
suse	linux enterprise desktop	Versi 12
suse	linux enterprise workstation extension	Versi 12
hp	insight orchestration	Semua versi sebelum 7.5.0
hp	system management homepage	Semua versi sebelum 7.5.0
hp	systems insight manager	Semua versi sebelum 7.5
hp	version control agent	Semua versi sebelum 7.5.0
hp	version control repository manager	Semua versi sebelum 7.5.0
hp	version control repository manager	Versi 7.6
hp	virtual connect enterprise manager	Semua versi sebelum 7.5.0
redhat	enterprise linux desktop	Versi 6.0
redhat	enterprise linux eus	Versi 6.6
redhat	enterprise linux server	Versi 6.0
redhat	enterprise linux workstation	Versi 6.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://helpx.adobe.com/security/products/flash-player/apsb15-14.html broken link · patch · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3113 pemerintah AS
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html mailing list · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html mailing list · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html mailing list · advisory pihak ketiga
http://rhn.redhat.com/errata/RHSA-2015-1184.html advisory pihak ketiga
http://www.securityfocus.com/bid/75371 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id/1032696 broken link · advisory pihak ketiga · vdb entry
https://security.gentoo.org/glsa/201507-13 advisory pihak ketiga
https://www.suse.com/security/cve/CVE-2015-3113.html advisory pihak ketiga
http://marc.info/?l=bugtraq&m=144050155601375&w=2 mailing list
https://bugzilla.redhat.com/show_bug.cgi?id=1235036 issue tracking
https://bugzilla.suse.com/show_bug.cgi?id=935701 issue tracking
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467 broken link
https://github.com/cisagov/vulnrichment/issues/196 issue tracking

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.