7.8Hoch KEV

CVE-2015-5122Adobe Flash Player Use-After-Free Vulnerability

adobe flash player; adobe flash player desktop runtime; redhat enterprise linux desktop; redhat enterprise linux server Veröffentlicht: 2015-07-14 13:00 (vor 11 Jahren)

Bekannt ausgenutzt — Adobe Flash Player Use-After-Free Vulnerability

CISA hat am 13.04.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 04.05.2022.

Erforderliche Maßnahme: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2015-5122

Beschreibung

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Schwachstellentyp (CWE): CWE-416

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
adobe	flash player	13.0 – ≤ 13.0.0.302
adobe	flash player desktop runtime	18.0 – ≤ 18.0.0.203
opensuse	evergreen	11.4
redhat	enterprise linux desktop	5.0
redhat	enterprise linux server	5.0
redhat	enterprise linux server eus	6.6
redhat	enterprise linux workstation	5.0
suse	linux enterprise desktop	11
suse	linux enterprise workstation extension	12

Referenzen und Patches

1032890 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
SUSE-SU-2015:1255 vendor-advisoryMailing ListThird Party Advisory
HPSBMU03409 vendor-advisoryMailing ListThird Party Advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467 Third Party Advisory
https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html Broken LinkThird Party Advisory
TA15-195A third-party-advisoryThird Party AdvisoryUS Government Resource
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html Broken LinkVendor Advisory
SUSE-SU-2015:1258 vendor-advisoryMailing ListThird Party Advisory
GLSA-201508-01 vendor-advisoryThird Party Advisory
http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf Third Party Advisory
HPSBHF03509 vendor-advisoryBroken LinkThird Party Advisory
RHSA-2015:1235 vendor-advisoryThird Party Advisory
VU#338736 third-party-advisoryThird Party AdvisoryUS Government Resource
37599 exploitExploitThird Party AdvisoryVDB Entry
75712 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html ExploitThird Party AdvisoryVDB Entry
openSUSE-SU-2015:1267 vendor-advisoryMailing ListThird Party Advisory
https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/ Broken LinkThird Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html Broken LinkVendor Advisory
https://perception-point.io/new/breaking-cfi.php Broken LinkThird Party Advisory
https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122 US Government Resource

CPE-Treffer (NVD) (19)

cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:* ≥ 13.0 ≤ 13.0.0.302
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* ≥ 18.0 ≤ 18.0.0.204
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_10:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* ≥ 11.0 ≤ 11.2.202.481
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*

CVSS-Score

7.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	7.8Hoch
nvd	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Hoch
nvd	CVSS 2.0	10.0Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

87.03%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2015-06-26
Veröffentlicht2015-07-14 13:00
Bei IP-DB eingegangen2026-10-24 23:33
In KEV aufgenommen2022-04-13
Zuletzt aktualisiert2026-06-17 03:28

Vergeben von (CNA): adobe
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

4.4Mittel

CVE-2026-123876 gestern

Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Hardened Images

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper…

6.2Mittel

CVE-2026-120749 gestern

Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…

6.7Mittel

CVE-2026-123037 gestern

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

Red Hat Migration Toolkit for Applications 8; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Service Mesh 3; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their …

7.5Hoch

CVE-2026-123151 vor 2 Tagen

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitr…

8.1Hoch

CVE-2026-121997 vor 2 Tagen

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actua…

8.2Hoch

CVE-2026-121996 vor 2 Tagen

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…