CVE-2015-5122

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 93,9%

Kerentanan Use After Free pada adobe flash player, adobe flash player desktop runtime +7 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 13 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Rincian

Terbit di NVD

14 Juli 2015

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

93,9% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe Flash Player Use-After-Free Vulnerability

Masuk KEV

13 April 2022

Tenggat CISA

4 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://helpx.adobe.com/security/products/flash-player/apsa15-04.html broken link · advisory vendor
• https://helpx.adobe.com/security/products/flash-player/apsb15-18.html broken link · advisory vendor
• http://www.kb.cert.org/vuls/id/338736 advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/ncas/alerts/TA15-195A advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=144050155601375&w=2 mailing list · advisory pihak ketiga
• http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html exploit · advisory pihak ketiga · vdb entry
• http://rhn.redhat.com/errata/RHSA-2015-1235.html advisory pihak ketiga
• http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf advisory pihak ketiga
• http://www.securityfocus.com/bid/75712 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1032890 broken link · advisory pihak ketiga · vdb entry
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 broken link · advisory pihak ketiga
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467 advisory pihak ketiga
• https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/ broken link · advisory pihak ketiga
• https://perception-point.io/new/breaking-cfi.php broken link · advisory pihak ketiga
• https://security.gentoo.org/glsa/201508-01 advisory pihak ketiga
• https://www.exploit-db.com/exploits/37599/ exploit · advisory pihak ketiga · vdb entry
• https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html broken link · advisory pihak ketiga
• https://github.com/cisagov/vulnrichment/issues/196 issue tracking