CVE-2015-5123KEV · OVERDUE

Adobe Flash Player Use-After-Free Vulnerability

High · published July 14, 2015

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.3th percentile for exploit probability.

1633
days past CISA
deadline
CVSS v3.1
7.8
EPSS
19%
Percentile
97.3
In the wild
Confirmed
What it is

🚨 This Adobe Flash vulnerability is a ticking time bomb! A crafty bit of Flash content could exploit a use-after-free flaw, letting attackers run arbitrary code on your system. ⚡ Think of it like a waiter who forgets to clear a table before serving a new meal. If the dishes aren’t put away properly, a new order could spill everywhere, causing chaos! In this scenario, an attacker could gain complete control over the affected system, potentially leading to data loss or even a full system compromise. It's not just memory corruption; this could also result in a denial of service, making systems unusable. Absolutely devastating!

Put simply

Think of it like a waiter who forgets to clear a table before serving a new meal. If the dishes aren’t put away properly, a new order could spill everywhere, causing chaos! The use-after-free vulnerability in the BitmapData class allows an attacker to manipulate memory by overriding the valueOf function, which could lead to arbitrary code execution or destabilization of the application.

What to do

In this scenario, an attacker could gain complete control over the affected system, potentially leading to data loss or even a full system compromise. It's not just memory corruption; this could also result in a denial of service, making systems unusable. Absolutely devastating! To protect against this, update your Adobe Flash Player to the latest version immediately. Ensure you are running version 19.0.0.185 or later, and consider disabling Flash entirely if it's not absolutely necessary for your needs. Regularly audit your applications for any dependencies on outdated plugins. You've got this! By following these steps, you're actively fortifying your defenses! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.18830 · 97.3th percentile
Published
2015-07-14T10:00Z
KEV added
2022-04-13 · due 2022-05-04
EPSS history
Timeline
  • 13 APR 00:00Z
    Added to CISA KEV — remediate by May 4
    kev
  • 14 JUL 10:00Z
    Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS…
    cvelistv5