IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.8High KEV

CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

adobe flash player; opensuse evergreen; opensuse opensuse; suse linux enterprise desktop Published: (11 years ago)

Known exploited — Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

CISA confirmed this vulnerability is used in real attacks on 13.04.2022. Remediation deadline for US federal agencies: 04.05.2022.

Required action: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2015-3113

Description

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

Weakness (CWE): CWE-122CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
adobe flash player < 13.0.0.296
hp insight orchestration < 7.5.0
hp system management homepage < 7.5.0
hp systems insight manager < 7.5
hp version control agent < 7.5.0
hp version control repository manager < 7.5.0
hp virtual connect enterprise manager < 7.5.0
opensuse evergreen 11.4
opensuse opensuse 13.1
redhat enterprise linux desktop 6.0
redhat enterprise linux eus 6.6
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
suse linux enterprise desktop 12
suse linux enterprise workstation extension 12

References and patches

CPE matches (NVD) (19)
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* < 13.0.0.296
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* ≥ 14.0.0.125 < 18.0.0.194
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* < 11.2.202.468
  • cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*
  • cpe:2.3:a:hp:insight_orchestration:*:*:*:*:*:*:*:* < 7.5.0
  • cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* < 7.5.0
  • cpe:2.3:a:hp:systems_insight_manager:*:*:*:*:*:*:*:* < 7.5
  • cpe:2.3:a:hp:version_control_agent:*:*:*:*:*:*:*:* < 7.5.0
  • cpe:2.3:a:hp:version_control_repository_manager:*:*:*:*:*:*:*:* < 7.5.0
  • cpe:2.3:a:hp:version_control_repository_manager:7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:hp:virtual_connect_enterprise_manager:*:*:*:*:*:*:*:* < 7.5.0
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Recent CVEs in the same product — Red Hat Enterprise Linux

High
CVE-2026-123151

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitr…

8.1High
CVE-2026-121997

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actua…

8.2High
CVE-2026-121996

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…

7.5High
CVE-2026-121995

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale …

8.8High
CVE-2026-121994

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an allo…

6.5Medium
CVE-2026-121259

Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.