7.8Alta KEV

CVE-2015-5122Adobe Flash Player Use-After-Free Vulnerability

adobe flash player; adobe flash player desktop runtime; redhat enterprise linux desktop; redhat enterprise linux server Publicada: 2015-07-14 13:00 (hace 11 años)

Explotación conocida — Adobe Flash Player Use-After-Free Vulnerability

CISA confirmó el 13.04.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 04.05.2022.

Acción requerida: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2015-5122

Descripción

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Debilidad (CWE): CWE-416

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
adobe	flash player	13.0 – ≤ 13.0.0.302
adobe	flash player desktop runtime	18.0 – ≤ 18.0.0.203
opensuse	evergreen	11.4
redhat	enterprise linux desktop	5.0
redhat	enterprise linux server	5.0
redhat	enterprise linux server eus	6.6
redhat	enterprise linux workstation	5.0
suse	linux enterprise desktop	11
suse	linux enterprise workstation extension	12

Referencias y parches

1032890 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
SUSE-SU-2015:1255 vendor-advisoryMailing ListThird Party Advisory
HPSBMU03409 vendor-advisoryMailing ListThird Party Advisory
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467 Third Party Advisory
https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html Broken LinkThird Party Advisory
TA15-195A third-party-advisoryThird Party AdvisoryUS Government Resource
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html Broken LinkVendor Advisory
SUSE-SU-2015:1258 vendor-advisoryMailing ListThird Party Advisory
GLSA-201508-01 vendor-advisoryThird Party Advisory
http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf Third Party Advisory
HPSBHF03509 vendor-advisoryBroken LinkThird Party Advisory
RHSA-2015:1235 vendor-advisoryThird Party Advisory
VU#338736 third-party-advisoryThird Party AdvisoryUS Government Resource
37599 exploitExploitThird Party AdvisoryVDB Entry
75712 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html ExploitThird Party AdvisoryVDB Entry
openSUSE-SU-2015:1267 vendor-advisoryMailing ListThird Party Advisory
https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/ Broken LinkThird Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html Broken LinkVendor Advisory
https://perception-point.io/new/breaking-cfi.php Broken LinkThird Party Advisory
https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122 US Government Resource

Coincidencias CPE (NVD) (19)

cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:* ≥ 13.0 ≤ 13.0.0.302
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:* ≥ 18.0 ≤ 18.0.0.204
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_10:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:* ≥ 18.0 ≤ 18.0.0.203
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* ≥ 11.0 ≤ 11.2.202.481
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:*:*:*:*:*:*:*

Puntuación CVSS

7.8Alta

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Local
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Requerida
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Todas las puntuaciones (4)

CISA-ADP	CVSS 3.1	7.8Alta
nvd	CVSS 3.1	9.8Crítica
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Alta
nvd	CVSS 2.0	10.0Alta

EPSS (probabilidad de explotación en 30 días)

87.03%

superior al 100 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: active
Automatizable: no
Impacto técnico: total

Cronología

ID reservado2015-06-26
Publicada2015-07-14 13:00
Llegó a IP-DB2026-10-24 23:33
Añadida a KEV2022-04-13
Última actualización2026-06-17 03:28

Asignada por (CNA): adobe
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Red Hat Enterprise Linux

4.4Media

CVE-2026-123876 ayer

Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Hardened Images

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper…

6.2Media

CVE-2026-120749 hace 2 días

Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…

6.7Media

CVE-2026-123037 hace 2 días

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

Red Hat Migration Toolkit for Applications 8; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Service Mesh 3; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their …

7.5Alta

CVE-2026-123151 hace 2 días

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitr…

8.1Alta

CVE-2026-121997 hace 2 días

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actua…

8.2Alta

CVE-2026-121996 hace 2 días

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…