CVE-2015-5123

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 18,8%

Kerentanan Use After Free pada redhat enterprise linux desktop, redhat enterprise linux server +7 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 13 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

Rincian

Terbit di NVD

14 Juli 2015

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

18,8% peluang dieksploitasi; lebih tinggi dari 97,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe Flash Player Use-After-Free Vulnerability

Masuk KEV

13 April 2022

Tenggat CISA

4 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://helpx.adobe.com/security/products/flash-player/apsa15-04.html broken link · advisory vendor
• https://helpx.adobe.com/security/products/flash-player/apsb15-18.html broken link · advisory vendor
• http://www.kb.cert.org/vuls/id/918568 advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/ncas/alerts/TA15-195A advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5123 pemerintah AS
• http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-f... broken link · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=144050155601375&w=2 mailing list · advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2015-1235.html advisory pihak ketiga
• http://www.securityfocus.com/bid/75710 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1032890 broken link · advisory pihak ketiga · vdb entry
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 broken link · advisory pihak ketiga
• https://security.gentoo.org/glsa/201508-01 advisory pihak ketiga
• https://github.com/cisagov/vulnrichment/issues/196 issue tracking